@classytic/mongokit 3.24.0 → 3.25.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. package/README.md +11 -2
  2. package/dist/{PaginationEngine-BnZ24ehC.d.mts → PaginationEngine-CBS1XGzp.d.mts} +2 -1
  3. package/dist/{Repository-ClOraFjT.mjs → Repository-KKR8jxfD.mjs} +70 -41
  4. package/dist/actions/index.d.mts +1 -1
  5. package/dist/adapter/index.d.mts +1 -1
  6. package/dist/adapter/index.mjs +1 -1
  7. package/dist/{adapter-BWgJ_Jdc.mjs → adapter-CLvUHiTW.mjs} +1 -1
  8. package/dist/ai/index.d.mts +1 -1
  9. package/dist/better-auth/index.mjs +2 -2
  10. package/dist/core-62oo3N1C.d.mts +50 -0
  11. package/dist/{create-repository-CVupgeRG.mjs → create-repository-DA5VJh-3.mjs} +2 -2
  12. package/dist/{create-repository-Cn1LkvL7.d.mts → create-repository-HjMD9h9_.d.mts} +18 -5
  13. package/dist/{id-resolution-P2OzcyRl.mjs → id-resolution-BqDrk0S2.mjs} +12 -1
  14. package/dist/{index-DLQ6pjal.d.mts → index-DceInCTX.d.mts} +3 -1
  15. package/dist/index.d.mts +53 -213
  16. package/dist/index.mjs +1071 -922
  17. package/dist/{mongooseToJsonSchema-CVnrKFDq.mjs → mongooseToJsonSchema-CByt1VhQ.mjs} +1 -1
  18. package/dist/{multi-tenant.plugin-BjXXuc_g.d.mts → multi-tenant.plugin-DVyVGREb.d.mts} +117 -18
  19. package/dist/operations-C8IcCHF9.d.mts +463 -0
  20. package/dist/pagination/PaginationEngine.d.mts +1 -1
  21. package/dist/pagination-jSUdrACK.d.mts +158 -0
  22. package/dist/plugin-options-vFufQZMZ.d.mts +125 -0
  23. package/dist/plugins/index.d.mts +4 -4
  24. package/dist/plugins/index.mjs +3 -3
  25. package/dist/query/primitives/coercion.mjs +1 -1
  26. package/dist/query/primitives/geo.d.mts +1 -1
  27. package/dist/repository-DCHRWRXw.d.mts +511 -0
  28. package/dist/testkit/index.d.mts +1 -1
  29. package/dist/testkit/index.mjs +1 -1
  30. package/dist/{timestamp.plugin-BhSX0Lu_.mjs → timestamp.plugin-B8252GuQ.mjs} +192 -46
  31. package/dist/{to-plain-g8-gsVxZ.d.mts → to-plain-DkF5px0R.d.mts} +12 -16
  32. package/dist/type-utils-CLzRFtIA.d.mts +163 -0
  33. package/dist/utils/index.d.mts +2 -2
  34. package/dist/utils/index.mjs +3 -3
  35. package/dist/{validation-chain.plugin-Dtt4tO7R.mjs → validation-chain.plugin-C3Vwp-Rk.mjs} +1 -1
  36. package/dist/{validation-chain.plugin-CFJbr964.d.mts → validation-chain.plugin-DxD15h-2.d.mts} +3 -1
  37. package/package.json +5 -3
  38. package/dist/types-BtMuhoX5.d.mts +0 -1830
package/dist/index.d.mts CHANGED
@@ -1,12 +1,17 @@
1
- import { $ as RepositoryEvent, A as KeysetPaginationOptions, At as LookupOptions, B as ObjectId, C as FieldPreset, Ct as IControllerResponse, D as InferDocument, Dt as MongoKitPluginName, E as HookMode, Et as MONGOKIT_PLUGIN_NAMES, F as MiddlewareContext, G as Plugin, H as OperationOptions, I as MinMaxResult, J as PopulateSpec, K as PluginFunction, L as MinimalRepoView, M as LookupPopulateOptions, N as LookupPopulateResult, O as InferRawDoc, Ot as RepositoryPluginName, P as Middleware, Q as RepositoryContext, R as MongoOperatorUpdate, S as EventPhase, St as IController, T as GroupResult, Tt as IResponseFormatter, U as PaginationConfig, V as OffsetPaginationOptions, W as PartialBy, X as ReadOptions, Y as PrioritizedHook, Z as ReadPreferenceType, _t as ValidationChainOptions, a as AnyModel, at as SessionOptions, b as EventHandlers, bt as WithPlugins, c as CacheableOptions, ct as SoftDeleteRepository, d as CollationOptions, dt as Strict, et as RepositoryInstance, f as CreateInput, ft as UpdateManyResult, g as DeepPartial, gt as UserContext, h as DecodedCursor, ht as UpdateWithValidationResult, i as AnyDocument, it as SelectSpec, j as Logger, k as KeysOfType, kt as LookupBuilder, l as CascadeOptions, lt as SortDirection, m as CursorPayload, mt as UpdatePatch, n as AggregatePaginationOptions, nt as RepositoryOptions, o as BasePaginationOptions, ot as SoftDeleteFilterMode, p as CreateOptions, pt as UpdateOptions, q as PluginType, r as AllPluginMethods, rt as RequiredBy, s as CacheOperationOptions, st as SoftDeleteOptions, t as AggregateOptions, tt as RepositoryOperation, u as CascadeRelation, ut as SortSpec, v as DeleteResult, vt as ValidatorDefinition, w as FindOneAndUpdateOptions, wt as IRequestContext, x as EventPayload, xt as WithTransactionOptions, y as DocField, yt as ValueType, z as NonNullableFields } from "./types-BtMuhoX5.mjs";
2
- import { t as index_d_exports } from "./index-DLQ6pjal.mjs";
3
- import { C as AuditTrailMethods, E as auditTrailPlugin, S as AuditQueryResult, T as AuditTrailQuery, _ as RepositoryCachePluginOptions, a as DateSequentialIdOptions, b as AuditOperation, c as SequentialIdOptions, d as getNextSequence, f as prefixedId, g as RepositoryCacheHandle, h as CacheOptions, i as CustomIdOptions, l as customIdPlugin, m as CacheAdapter, n as adminBypass, o as IdGenerator, p as sequentialId, r as multiTenantPlugin, s as PrefixedIdOptions, t as MultiTenantOptions, u as dateSequentialId, v as cachePlugin, w as AuditTrailOptions, x as AuditQueryOptions, y as AuditEntry } from "./multi-tenant.plugin-BjXXuc_g.mjs";
4
- import { t as PaginationEngine } from "./PaginationEngine-BnZ24ehC.mjs";
5
- import { a as Repository, i as HOOK_PRIORITY, n as CreateRepositoryConfig, o as TransitionMachine, r as createRepository, s as AggregationBuilder, t as AuditConfig } from "./create-repository-Cn1LkvL7.mjs";
6
- import { A as elasticSearchPlugin, C as LeasePluginOptions, D as immutableStatesPlugin, E as ImmutableStatesPluginOptions, F as auditLogPlugin, I as AppendOnlyPluginOptions, L as appendOnlyPlugin, M as BatchOperationsMethods, N as BulkWriteResult, O as fieldFilterPlugin, P as batchOperationsPlugin, R as AggregateHelpersMethods, S as LeaseMethods, T as ImmutableClaimView, _ as observabilityPlugin, a as uniqueField, c as TenantContext, d as SubdocumentMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, j as cascadePlugin, k as ElasticSearchOptions, l as TenantStore, m as softDeletePlugin, n as blockIf, o as validationChainPlugin, p as SoftDeleteMethods, r as immutableField, s as timestampPlugin, t as autoInject, u as createTenantContext, v as MongoOperationsMethods, w as leasePlugin, x as methodRegistryPlugin, y as mongoOperationsPlugin, z as aggregateHelpersPlugin } from "./validation-chain.plugin-CFJbr964.mjs";
1
+ import { _ as WithTransactionOptions, c as GroupResult, d as MinMaxResult, f as OperationOptions, g as UpdateOptions, h as UpdateManyResult, i as CreateOptions, l as LookupPopulateOptions, m as SessionOptions, n as CacheOperationOptions, o as DeleteResult, p as ReadOptions, r as CacheableOptions, s as FindOneAndUpdateOptions, t as AggregateOptions, u as LookupPopulateResult, v as LookupBuilder, y as LookupOptions } from "./operations-C8IcCHF9.mjs";
2
+ import { a as PopulateSpec, c as SortDirection, i as ObjectId, l as SortSpec, n as AnyModel, o as ReadPreferenceType, s as SelectSpec, t as AnyDocument } from "./core-62oo3N1C.mjs";
3
+ import { a as DecodedCursor, c as PaginationConfig, i as CursorPayload, l as ValueType, n as BasePaginationOptions, o as KeysetPaginationOptions, r as CollationOptions, s as OffsetPaginationOptions, t as AggregatePaginationOptions } from "./pagination-jSUdrACK.mjs";
4
+ import { t as index_d_exports } from "./index-DceInCTX.mjs";
5
+ import { a as InferRawDoc, c as NonNullableFields, d as Strict, f as UpdatePatch, i as InferDocument, l as PartialBy, n as DeepPartial, o as KeysOfType, p as UpdateWithValidationResult, r as DocField, s as MongoOperatorUpdate, t as CreateInput, u as RequiredBy } from "./type-utils-CLzRFtIA.mjs";
6
+ import { S as RepositoryPluginName, _ as RepositoryOptions, a as HookMode, b as MONGOKIT_PLUGIN_NAMES, c as MinimalRepoView, d as PluginType, f as PrioritizedHook, g as RepositoryOperation, h as RepositoryInstance, i as EventPhase, l as Plugin, m as RepositoryEvent, n as EventHandlers, o as Middleware, p as RepositoryContext, r as EventPayload, s as MiddlewareContext, t as AllPluginMethods, u as PluginFunction, v as UserContext, x as MongoKitPluginName, y as WithPlugins } from "./repository-DCHRWRXw.mjs";
7
+ import { A as ensureAuditTrailReady, C as AuditTrailMethods, D as AuditTrailQueryOptions, E as AuditTrailQuery, O as EnsureAuditTrailReadyOptions, S as AuditQueryResult, T as AuditTrailOptions, _ as RepositoryCachePluginOptions, a as DateSequentialIdOptions, b as AuditOperation, c as SequentialIdOptions, d as getNextSequence, f as prefixedId, g as RepositoryCacheHandle, h as CacheOptions, i as CustomIdOptions, k as auditTrailPlugin, l as customIdPlugin, m as CacheAdapter, n as adminBypass, o as IdGenerator, p as sequentialId, r as multiTenantPlugin, s as PrefixedIdOptions, t as MultiTenantOptions, u as dateSequentialId, v as cachePlugin, w as AuditTrailMode, x as AuditQueryOptions, y as AuditEntry } from "./multi-tenant.plugin-DVyVGREb.mjs";
8
+ import { t as PaginationEngine } from "./PaginationEngine-CBS1XGzp.mjs";
9
+ import { a as Repository, i as HOOK_PRIORITY, n as CreateRepositoryConfig, o as TransitionMachine, r as createRepository, s as AggregationBuilder, t as AuditConfig } from "./create-repository-HjMD9h9_.mjs";
10
+ import { a as SoftDeleteFilterMode, c as ValidationChainOptions, i as Logger, l as ValidatorDefinition, n as CascadeRelation, o as SoftDeleteOptions, r as FieldPreset, s as SoftDeleteRepository, t as CascadeOptions } from "./plugin-options-vFufQZMZ.mjs";
11
+ import { A as elasticSearchPlugin, C as LeasePluginOptions, D as immutableStatesPlugin, E as ImmutableStatesPluginOptions, F as auditLogPlugin, I as AppendOnlyPluginOptions, L as appendOnlyPlugin, M as BatchOperationsMethods, N as BulkWriteResult, O as fieldFilterPlugin, P as batchOperationsPlugin, R as AggregateHelpersMethods, S as LeaseMethods, T as ImmutableClaimView, _ as observabilityPlugin, a as uniqueField, c as TenantContext, d as SubdocumentMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, j as cascadePlugin, k as ElasticSearchOptions, l as TenantStore, m as softDeletePlugin, n as blockIf, o as validationChainPlugin, p as SoftDeleteMethods, r as immutableField, s as timestampPlugin, t as autoInject, u as createTenantContext, v as MongoOperationsMethods, w as leasePlugin, x as methodRegistryPlugin, y as mongoOperationsPlugin, z as aggregateHelpersPlugin } from "./validation-chain.plugin-DxD15h-2.mjs";
7
12
  import { n as SchemaPathsLike, t as FieldType$1 } from "./coercion-BjdPX3YF.mjs";
8
13
  import { n as SchemaIndexes } from "./indexes-DIjMpYES.mjs";
9
- import { _ as parseDuplicateKeyError, a as configureLogger, c as idVariants, d as createFieldPreset, f as filterResponseData, g as isDuplicateKeyError, h as createError, i as createMemoryCache, m as getMongooseProjection, n as buildCrudSchemasFromModel, p as getFieldsForUser, r as buildCrudSchemasFromMongooseSchema, t as toPlain } from "./to-plain-g8-gsVxZ.mjs";
14
+ import { _ as isDuplicateKeyError, a as configureLogger, c as idVariants, f as createFieldPreset, g as createError, h as getMongooseProjection, i as createMemoryCache, m as getFieldsForUser, n as buildCrudSchemasFromModel, p as filterResponseData, r as buildCrudSchemasFromMongooseSchema, t as toPlain, v as parseDuplicateKeyError } from "./to-plain-DkF5px0R.mjs";
10
15
  import { RepoCapabilities } from "@classytic/repo-core/repository";
11
16
  import { ClientSession, PipelineStage } from "mongoose";
12
17
  //#region src/actions/cascade-references.d.ts
@@ -149,7 +154,7 @@ declare const READ_OPERATIONS: readonly RepositoryOperation[];
149
154
  /** Filter ops by their policy injection key. */
150
155
  declare function operationsByPolicyKey(key: PolicyKey): RepositoryOperation[];
151
156
  //#endregion
152
- //#region src/query/QueryParser.d.ts
157
+ //#region src/query/parser/types.d.ts
153
158
  type SortSpec$1 = Record<string, 1 | -1>;
154
159
  type FilterQuery = Record<string, unknown>;
155
160
  /**
@@ -211,21 +216,36 @@ interface ParsedQuery {
211
216
  type SearchMode = 'text' | 'regex';
212
217
  /**
213
218
  * Normalized field type used for schema-aware value coercion. Re-exported
214
- * from `primitives/coercion` so the public QueryParser API stays unchanged
215
- * while the actual logic lives in a single, unit-tested primitive module.
219
+ * from `primitives/coercion` — the canonical definition lives there.
216
220
  */
217
221
  type FieldType = FieldType$1;
218
222
  /**
219
223
  * Minimal structural type for a Mongoose schema. We only read `.paths` and
220
224
  * (optionally) `.indexes()`, so the parser stays decoupled from a specific
221
- * Mongoose major version and is easy to mock in tests. Re-exported from the
222
- * primitives module — the canonical definition lives there.
225
+ * Mongoose major version and is easy to mock in tests.
223
226
  */
224
227
  interface SchemaLike extends SchemaPathsLike {
225
228
  /** Optional — when present, schema indexes are introspected for geo/text fields */
226
229
  indexes?: () => Array<[Record<string, unknown>, Record<string, unknown>?]>;
227
230
  }
228
231
  interface QueryParserOptions {
232
+ /**
233
+ * How the parser treats invalid or disallowed query input (default: 'throw').
234
+ *
235
+ * - `'throw'` (default — fail-closed): raise an HTTP 400 error
236
+ * (`createError(400, …, { code: 'INVALID_QUERY_INPUT' })`) at the first
237
+ * invalid fragment — blocked operators, disallowed filter/sort fields,
238
+ * over-deep filters, malformed operator values, blocked lookup
239
+ * collections/stages, dangerous populate paths, over-long or
240
+ * pathological regex/search input.
241
+ * - `'drop'`: warn and remove the offending fragment, then keep parsing.
242
+ * Still safe against dangerous Mongo operators, but NOT fail-closed:
243
+ * when the only supplied filter is dropped, the resulting query matches
244
+ * every record in scope — a malformed filter silently *broadens* the
245
+ * result set instead of failing the request. Opt in only for trusted
246
+ * migration/compatibility tooling that must accept sloppy input.
247
+ */
248
+ invalidInput?: 'throw' | 'drop';
229
249
  /** Maximum allowed regex pattern length (default: 500) */
230
250
  maxRegexLength?: number;
231
251
  /** Maximum allowed text search query length (default: 200) */
@@ -259,9 +279,9 @@ interface QueryParserOptions {
259
279
  * @example ['departments', 'categories', 'users']
260
280
  */
261
281
  allowedLookupCollections?: string[];
262
- /** Allowed fields for filtering. If set, ignores unknown fields. */
282
+ /** Allowed fields for filtering. If set, unknown fields are rejected per `invalidInput`. */
263
283
  allowedFilterFields?: string[];
264
- /** Allowed fields for sorting. If set, ignores unknown fields. */
284
+ /** Allowed fields for sorting. If set, unknown fields are rejected per `invalidInput`. */
265
285
  allowedSortFields?: string[];
266
286
  /**
267
287
  * Whitelist of allowed filter operators.
@@ -292,70 +312,38 @@ interface QueryParserOptions {
292
312
  */
293
313
  fieldTypes?: Record<string, FieldType>;
294
314
  }
315
+ //#endregion
316
+ //#region src/query/parser/schema-docs.d.ts
317
+ interface QuerySchema {
318
+ type: 'object';
319
+ properties: Record<string, unknown>;
320
+ required?: string[];
321
+ }
322
+ //#endregion
323
+ //#region src/query/QueryParser.d.ts
295
324
  /**
296
325
  * Modern Query Parser
297
326
  * Converts URL parameters to MongoDB queries with $lookup support
298
327
  */
299
328
  declare class QueryParser {
300
- private readonly options;
301
- private readonly operators;
302
- private readonly dangerousOperators;
303
329
  /**
304
- * Normalized dot-notation field-type map. Built once at construction from
305
- * `options.schema` (Mongoose) and `options.fieldTypes` (override map), with
306
- * `fieldTypes` taking precedence. An empty map means schema-aware coercion
307
- * is disabled and the heuristic in `_convertValue` runs unchanged — this
308
- * preserves backwards compatibility for callers that don't opt in.
330
+ * Shared runtime handed to every parser module. `schema` and `fieldTypes`
331
+ * are consumed once at construction to build the coercion map and are not
332
+ * retained — the parser never holds a reference to the user's Mongoose
333
+ * schema.
309
334
  */
310
- private readonly _fieldTypes;
335
+ private readonly rt;
311
336
  /**
312
337
  * Structured schema-index info (geo / text / other), built once from
313
- * `options.schema?.indexes()`. Used by the operator router to validate
314
- * geo operators against actual geo-indexed fields, and exposed publicly
315
- * via `parser.schemaIndexes` for downstream tools (Arc MCP, query planners).
338
+ * `options.schema?.indexes()`. Exposed via `parser.schemaIndexes` for
339
+ * downstream tools (Arc MCP, query planners).
316
340
  */
317
341
  private readonly _schemaIndexes;
318
- /**
319
- * Regex patterns that can cause catastrophic backtracking (ReDoS attacks).
320
- * Detects common footguns:
321
- * - Quantifiers: {n,m}
322
- * - Possessive quantifiers: *+, ++, ?+
323
- * - Nested quantifiers: (a+)+, (a*)*
324
- * - Backreferences: \1, \2, etc.
325
- * - Complex character classes: [...]...[...]
326
- *
327
- * This pattern detector is FAIL-SAFE (on match, the input is escaped), but
328
- * it is not exhaustive. {@link _regexComplexityExceedsBudget} complements
329
- * it with a deterministic static complexity budget so patterns that happen
330
- * to evade the detector still fail over when their unbounded-quantifier
331
- * density is pathological.
332
- */
333
- private readonly dangerousRegexPatterns;
334
- /**
335
- * Static complexity budget for user-supplied regex patterns.
336
- * Returns `true` if the pattern crosses a budget that empirically correlates
337
- * with ReDoS risk — independent of the heuristic regex detector.
338
- *
339
- * Budget components (any single threshold crossed → over budget):
340
- * - unbounded quantifiers (`*`, `+`, `?`) — hard cap 20
341
- * - nested groups `(` — hard cap 8
342
- * - alternations `|` — hard cap 10
343
- * - combined: (quantifiers * groups) — hard cap 40
344
- *
345
- * These thresholds are intentionally permissive for legitimate queries and
346
- * tight enough to refuse known-pathological patterns like `(a+)+b` with
347
- * heavy repetition.
348
- */
349
- private _regexComplexityExceedsBudget;
350
342
  constructor(options?: QueryParserOptions);
351
343
  /**
352
344
  * Structured view of the configured schema's indexes — geo fields, text
353
345
  * fields, and other compound indexes. Empty arrays when no schema was
354
- * provided. Stable across the parser's lifetime; mutating the returned
355
- * object does not affect parser behavior.
356
- *
357
- * Useful for downstream tooling (Arc MCP, query planners, doc generators)
358
- * that needs to know which fields support which query types.
346
+ * provided. Stable across the parser's lifetime.
359
347
  */
360
348
  get schemaIndexes(): SchemaIndexes;
361
349
  /**
@@ -391,18 +379,8 @@ declare class QueryParser {
391
379
  * Generate OpenAPI-compatible JSON Schema for query parameters.
392
380
  * Arc's defineResource() auto-detects this method and uses it
393
381
  * to document list endpoint query parameters in OpenAPI/Swagger.
394
- *
395
- * The schema respects parser configuration:
396
- * - `allowedOperators`: only documents allowed operators
397
- * - `allowedFilterFields`: generates explicit field[op] entries
398
- * - `enableLookups` / `enableAggregations`: includes/excludes lookup/aggregate params
399
- * - `maxLimit` / `maxSearchLength`: reflected in schema constraints
400
382
  */
401
- getQuerySchema(): {
402
- type: 'object';
403
- properties: Record<string, unknown>;
404
- required?: string[];
405
- };
383
+ getQuerySchema(): QuerySchema;
406
384
  /**
407
385
  * Get the query schema with OpenAPI extensions (x-internal metadata).
408
386
  * Use this when generating OpenAPI/Swagger docs — it includes a documentary
@@ -413,144 +391,6 @@ declare class QueryParser {
413
391
  type: 'object';
414
392
  properties: Record<string, unknown>;
415
393
  };
416
- /**
417
- * Get the JSON Schema type for a filter operator
418
- */
419
- private _getOperatorSchemaType;
420
- /**
421
- * Get a human-readable description for a filter operator
422
- */
423
- private _getOperatorDescription;
424
- /**
425
- * Build a summary description of all available filter operators
426
- */
427
- private _buildOperatorDescription;
428
- /**
429
- * Parse lookup configurations from URL parameters
430
- *
431
- * Supported formats:
432
- * 1. Simple: ?lookup[department]=slug
433
- * → Join with 'departments' collection on slug field
434
- *
435
- * 2. Detailed: ?lookup[department][localField]=deptSlug&lookup[department][foreignField]=slug
436
- * → Full control over join configuration
437
- *
438
- * 3. Multiple: ?lookup[department]=slug&lookup[category]=categorySlug
439
- * → Multiple lookups
440
- *
441
- * @example
442
- * ```typescript
443
- * // URL: ?lookup[department][localField]=deptSlug&lookup[department][foreignField]=slug&lookup[department][single]=true
444
- * const lookups = parser._parseLookups({
445
- * department: { localField: 'deptSlug', foreignField: 'slug', single: 'true' }
446
- * });
447
- * // Returns: [{ from: 'departments', localField: 'deptSlug', foreignField: 'slug', single: true }]
448
- * ```
449
- */
450
- private _parseLookups;
451
- /**
452
- * Parse a single lookup configuration
453
- */
454
- private _parseSingleLookup;
455
- /**
456
- * Parse aggregation pipeline from URL (advanced feature)
457
- *
458
- * @example
459
- * ```typescript
460
- * // URL: ?aggregate[group][_id]=$status&aggregate[group][count]=$sum:1
461
- * const pipeline = parser._parseAggregation({
462
- * group: { _id: '$status', count: '$sum:1' }
463
- * });
464
- * ```
465
- */
466
- private _parseAggregation;
467
- /**
468
- * Parse select/project fields
469
- *
470
- * @example
471
- * ```typescript
472
- * // URL: ?select=name,email,-password
473
- * // Returns: { name: 1, email: 1, password: 0 }
474
- * ```
475
- */
476
- private _parseSelect;
477
- /**
478
- * Parse populate parameter - handles both simple string and advanced object format
479
- *
480
- * @example
481
- * ```typescript
482
- * // Simple: ?populate=author,category
483
- * // Returns: { simplePopulate: 'author,category', populateOptions: undefined }
484
- *
485
- * // Advanced: ?populate[author][select]=name,email
486
- * // Returns: { simplePopulate: undefined, populateOptions: [{ path: 'author', select: 'name email' }] }
487
- * ```
488
- */
489
- private _parsePopulate;
490
- /**
491
- * Parse a single populate configuration
492
- */
493
- private _parseSinglePopulate;
494
- /**
495
- * Convert populate match values (handles boolean strings, etc.)
496
- */
497
- private _convertPopulateMatch;
498
- /**
499
- * Parse filter parameters
500
- */
501
- private _parseFilters;
502
- /**
503
- * Handle operator syntax: field[operator]=value
504
- */
505
- private _handleOperatorSyntax;
506
- /**
507
- * Handle bracket syntax with object value
508
- */
509
- private _handleBracketSyntax;
510
- private _parseSort;
511
- private _toMongoOperator;
512
- private _createSafeRegex;
513
- private _escapeRegex;
514
- /**
515
- * Sanitize $match configuration to prevent dangerous operators
516
- * Recursively filters out operators like $where, $function, $accumulator
517
- */
518
- private _sanitizeMatchConfig;
519
- /**
520
- * Sanitize pipeline stages for use in $lookup.
521
- * Blocks dangerous stages ($out, $merge, etc.) and recursively sanitizes
522
- * operator expressions within $match, $addFields, and $set stages.
523
- */
524
- private _sanitizePipeline;
525
- /**
526
- * Recursively sanitize expression objects, blocking dangerous operators
527
- * like $where, $function, $accumulator inside $addFields/$set stages.
528
- *
529
- * Depth-guarded — same protection `_sanitizeMatchConfig` ships, since
530
- * a hostile `$cond`/`$switch` chain can recurse arbitrarily deep and
531
- * exhaust JS stack. Without the guard, this is a one-liner DoS against
532
- * any host that exposes pipeline parsing to untrusted callers.
533
- */
534
- private _sanitizeExpressions;
535
- private _sanitizeSearch;
536
- /**
537
- * Build regex-based multi-field search filters
538
- * Creates an $or query with case-insensitive regex across all searchFields
539
- *
540
- * @example
541
- * // searchFields: ['name', 'description', 'sku']
542
- * // search: 'azure'
543
- * // Returns: [
544
- * // { name: { $regex: /azure/i } },
545
- * // { description: { $regex: /azure/i } },
546
- * // { sku: { $regex: /azure/i } }
547
- * // ]
548
- */
549
- private _buildRegexSearch;
550
- private _parseOr;
551
- private _enhanceWithBetween;
552
- private _pluralize;
553
- private _capitalize;
554
394
  }
555
395
  //#endregion
556
396
  //#region src/transaction.d.ts
@@ -852,4 +692,4 @@ declare function createOptionsExtractor<TCtx extends Record<string, unknown>>(fi
852
692
  */
853
693
  declare function systemContext(extra?: SessionOptions): SessionOptions;
854
694
  //#endregion
855
- export { ALL_OPERATIONS, type AggregateHelpersMethods, type AggregateOptions, type AggregatePaginationOptions, AggregationBuilder, type AllPluginMethods, type AnyDocument, type AnyModel, type AppendOnlyPluginOptions, type AuditConfig, type AuditEntry, type AuditOperation, type AuditQueryOptions, type AuditQueryResult, type AuditTrailMethods, type AuditTrailOptions, AuditTrailQuery, type BasePaginationOptions, type BatchOperationsMethods, type BulkWriteResult, type CacheAdapter, type CacheOperationOptions, type CacheOptions, type CacheableOptions, type CascadeOptions, type CascadePurgeReferencesOptions, type CascadeRelation, type CollationOptions, type CollectionRWLike, type CreateInput, type CreateOptions, type CreateRepositoryConfig, type CursorPayload, type CustomIdOptions, type DateSequentialIdOptions, type DecodedCursor, type DeepPartial, type DeleteResult, type DocField, type ElasticSearchOptions, type EventHandlers, type EventPayload, type EventPhase, type FieldPreset, type FieldType, type FilterQuery, type FindOneAndUpdateOptions, type GroupResult, HOOK_PRIORITY, type HookMode, type IController, type IControllerResponse, type IRequestContext, type IResponseFormatter, type IdGenerator, type ImmutableClaimView, type ImmutableStatesPluginOptions, type InferDocument, type InferRawDoc, type KeysOfType, type KeysetPaginationOptions, type LeaseMethods, type LeasePluginOptions, type Logger, LookupBuilder, type LookupOptions, type LookupPopulateOptions, type LookupPopulateResult, MONGOKIT_CAPABILITIES, MONGOKIT_PLUGIN_NAMES, MUTATING_OPERATIONS, type Middleware, type MiddlewareContext, type MinMaxResult, type MinimalRepoView, type MongoKitPluginName, type MongoOperationsMethods, type MongoOperatorUpdate, type MultiTenantOptions, type NonNullableFields, OP_REGISTRY, type ObjectId, type ObservabilityOptions, type OffsetPaginationOptions, type OperationDescriptor, type OperationMetric, type OperationOptions, type PaginationConfig, PaginationEngine, type ParsedQuery, type PartialBy, type Plugin, type PluginFunction, type PluginType, type PolicyKey, type PopulateOption, type PopulateSpec, type PrefixedIdOptions, type PrioritizedHook, type PurgeMode, type PurgeableRepoLike, QueryParser, type QueryParserOptions, READ_OPERATIONS, type ReadOptions, type ReadPreferenceType, type ReferencePurgeResult, type ReferenceRelation, Repository, Repository as default, type RepositoryCacheHandle, type RepositoryCachePluginOptions, type RepositoryContext, type RepositoryEvent, type RepositoryInstance, type RepositoryOperation, type RepositoryOptions, type RepositoryPluginName, type RequiredBy, type SchemaLike, type SearchMode, type SelectSpec, type SequentialIdOptions, type SessionOptions, type SoftDeleteFilterMode, type SoftDeleteMethods, type SoftDeleteOptions, type SoftDeleteRepository, type SortDirection, type SortSpec, type Strict, type SubdocumentMethods, type TenantContext, type TenantStore, type TransitionMachine, type UpdateManyResult, type UpdateOptions, type UpdatePatch, type UpdateWithValidationResult, type UserContext, type ValidationChainOptions, type ValidatorDefinition, type ValueType, type WithPlugins, type WithTransactionOptions, index_d_exports as actions, adminBypass, aggregateHelpersPlugin, appendOnlyPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, batchTransaction, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, cascadePlugin, cascadePurgeReferences, compileFilterToMongo, configureLogger, createError, createFieldPreset, createMemoryCache, createOptionsExtractor, createRepository, createTenantContext, customIdPlugin, dateSequentialId, elasticSearchPlugin, fieldFilterPlugin, filterResponseData, getFieldsForUser, getMongooseProjection, getNextSequence, idVariants, immutableField, immutableStatesPlugin, isDuplicateKeyError, isTransactionUnsupported, leasePlugin, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, operationsByPolicyKey, parseDuplicateKeyError, prefixedId, repoOptionsFromCtx, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, systemContext, timestampPlugin, toPlain, uniqueField, validationChainPlugin, withTransaction };
695
+ export { ALL_OPERATIONS, type AggregateHelpersMethods, type AggregateOptions, type AggregatePaginationOptions, AggregationBuilder, type AllPluginMethods, type AnyDocument, type AnyModel, type AppendOnlyPluginOptions, type AuditConfig, type AuditEntry, type AuditOperation, type AuditQueryOptions, type AuditQueryResult, type AuditTrailMethods, type AuditTrailMode, type AuditTrailOptions, AuditTrailQuery, type AuditTrailQueryOptions, type BasePaginationOptions, type BatchOperationsMethods, type BulkWriteResult, type CacheAdapter, type CacheOperationOptions, type CacheOptions, type CacheableOptions, type CascadeOptions, type CascadePurgeReferencesOptions, type CascadeRelation, type CollationOptions, type CollectionRWLike, type CreateInput, type CreateOptions, type CreateRepositoryConfig, type CursorPayload, type CustomIdOptions, type DateSequentialIdOptions, type DecodedCursor, type DeepPartial, type DeleteResult, type DocField, type ElasticSearchOptions, type EnsureAuditTrailReadyOptions, type EventHandlers, type EventPayload, type EventPhase, type FieldPreset, type FieldType, type FilterQuery, type FindOneAndUpdateOptions, type GroupResult, HOOK_PRIORITY, type HookMode, type IdGenerator, type ImmutableClaimView, type ImmutableStatesPluginOptions, type InferDocument, type InferRawDoc, type KeysOfType, type KeysetPaginationOptions, type LeaseMethods, type LeasePluginOptions, type Logger, LookupBuilder, type LookupOptions, type LookupPopulateOptions, type LookupPopulateResult, MONGOKIT_CAPABILITIES, MONGOKIT_PLUGIN_NAMES, MUTATING_OPERATIONS, type Middleware, type MiddlewareContext, type MinMaxResult, type MinimalRepoView, type MongoKitPluginName, type MongoOperationsMethods, type MongoOperatorUpdate, type MultiTenantOptions, type NonNullableFields, OP_REGISTRY, type ObjectId, type ObservabilityOptions, type OffsetPaginationOptions, type OperationDescriptor, type OperationMetric, type OperationOptions, type PaginationConfig, PaginationEngine, type ParsedQuery, type PartialBy, type Plugin, type PluginFunction, type PluginType, type PolicyKey, type PopulateOption, type PopulateSpec, type PrefixedIdOptions, type PrioritizedHook, type PurgeMode, type PurgeableRepoLike, QueryParser, type QueryParserOptions, READ_OPERATIONS, type ReadOptions, type ReadPreferenceType, type ReferencePurgeResult, type ReferenceRelation, Repository, Repository as default, type RepositoryCacheHandle, type RepositoryCachePluginOptions, type RepositoryContext, type RepositoryEvent, type RepositoryInstance, type RepositoryOperation, type RepositoryOptions, type RepositoryPluginName, type RequiredBy, type SchemaLike, type SearchMode, type SelectSpec, type SequentialIdOptions, type SessionOptions, type SoftDeleteFilterMode, type SoftDeleteMethods, type SoftDeleteOptions, type SoftDeleteRepository, type SortDirection, type SortSpec, type Strict, type SubdocumentMethods, type TenantContext, type TenantStore, type TransitionMachine, type UpdateManyResult, type UpdateOptions, type UpdatePatch, type UpdateWithValidationResult, type UserContext, type ValidationChainOptions, type ValidatorDefinition, type ValueType, type WithPlugins, type WithTransactionOptions, index_d_exports as actions, adminBypass, aggregateHelpersPlugin, appendOnlyPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, batchTransaction, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, cascadePlugin, cascadePurgeReferences, compileFilterToMongo, configureLogger, createError, createFieldPreset, createMemoryCache, createOptionsExtractor, createRepository, createTenantContext, customIdPlugin, dateSequentialId, elasticSearchPlugin, ensureAuditTrailReady, fieldFilterPlugin, filterResponseData, getFieldsForUser, getMongooseProjection, getNextSequence, idVariants, immutableField, immutableStatesPlugin, isDuplicateKeyError, isTransactionUnsupported, leasePlugin, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, operationsByPolicyKey, parseDuplicateKeyError, prefixedId, repoOptionsFromCtx, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, systemContext, timestampPlugin, toPlain, uniqueField, validationChainPlugin, withTransaction };