@classytic/mongokit 3.28.0 → 3.29.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 Classytic (Sadman Chowdhury)
+Copyright (c) 2024 Classytic LLC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -18,7 +18,10 @@ Requirements:
 
 - Node.js `>=22`
 - Mongoose `>=9.4.1`
-- `@classytic/repo-core >=0.7.0`
+- `@classytic/repo-core >=0.19.0`
+- `mongodb-memory-server >=10.4.3` — **optional**, needed only by the
+  `@classytic/mongokit/testkit` subpath (declared as an optional peer, so it is
+  never installed for consumers that don't use it)
 
 ## Quick Start
 
@@ -430,3 +433,10 @@ All accept `{ replset?, dbName?, uri? }`.
 ## License
 
 MIT
+
+
+## Trademark
+
+The code is MIT-licensed. **"Classytic", "arc", and the logos are trademarks of
+Classytic LLC** and are **not** licensed under MIT — see [TRADEMARK.md](TRADEMARK.md).
+Forks must be renamed; the license covers the code, not the brand.

package/TRADEMARK.md

@@ -0,0 +1,22 @@
+# Trademark Notice
+
+The **source code** in this package is licensed under the MIT License (see
+[LICENSE](LICENSE)). Trademarks are **not** part of that license.
+
+**"Classytic", "arc", the Classytic and arc logos**, and related names and marks
+are trademarks of **Classytic LLC** (Wyoming, USA). The MIT License covers the
+code only — it grants **no right** to use Classytic LLC's names, logos, or brand.
+
+## You may
+- use, fork, modify, and redistribute the **code** under the MIT License;
+- state truthfully that your product "uses" or "is built on" arc / Classytic
+  software, without implying endorsement.
+
+## You may not (without written permission from Classytic LLC)
+- use "Classytic", "arc", or confusingly similar names as the name of your own
+  product, package, company, or service;
+- use the Classytic / arc logos or brand styling;
+- imply sponsorship, affiliation, or endorsement by Classytic LLC.
+
+Forks or redistributions must be **renamed** so they are not confused with the
+official project. Permission / questions: **trademark@classytic.com**.

package/dist/{Repository-BFBTAMlA.mjs → Repository-DThvFCaV.mjs}

@@ -1,5 +1,5 @@
 import { i as isValidIdForType, t as getSchemaIdType } from "./id-resolution-BqDrk0S2.mjs";
-import { a as count, b as LookupBuilder, c as getByQuery, d as deleteById, f as deleteByQuery, h as createMany, l as getOrCreate, m as create, n as update, o as exists, r as updateByQuery, s as getById, t as findOneAndUpdate, x as compileFilterToMongo, y as distinct } from "./update-1Lq9OMD2.mjs";
+import { a as count, b as LookupBuilder, c as getByQuery, d as deleteById, f as deleteByQuery, h as createMany, l as getOrCreate, m as create, n as update, o as exists, r as updateByQuery, s as getById, t as findOneAndUpdate, x as compileFilterToMongo, y as distinct } from "./update-CI2NdAW6.mjs";
 import { n as warn } from "./logger-K7dPmu2U.mjs";
 import { n as isDuplicateKeyError, r as parseDuplicateKeyError, t as createError } from "./error-BuByZwKU.mjs";
 import { t as PaginationEngine } from "./PaginationEngine-CczbvCAq.mjs";
@@ -317,6 +317,122 @@ function applyExecutionHints(aggregation, hints) {
 	if (hints.indexHint !== void 0) aggregation.option({ hint: hints.indexHint });
 }
 //#endregion
+//#region src/filter/cast-schema.ts
+/** Operators whose operand is a single scalar to cast. */
+const SCALAR_OPS = /* @__PURE__ */ new Set([
+	"$eq",
+	"$ne",
+	"$gt",
+	"$gte",
+	"$lt",
+	"$lte"
+]);
+/** Operators whose operand is an array of scalars to cast element-wise. */
+const ARRAY_OPS = /* @__PURE__ */ new Set(["$in", "$nin"]);
+/** Logical operators whose operand is an ARRAY of sub-filters. */
+const LOGICAL_ARRAY_OPS = /* @__PURE__ */ new Set([
+	"$and",
+	"$or",
+	"$nor"
+]);
+/** Logical operators whose operand is a SINGLE nested sub-filter. */
+const LOGICAL_OBJECT_OPS = /* @__PURE__ */ new Set(["$not"]);
+function isPlainObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+/**
+* Cast one value through a schema path. Returns the original value when the
+* path is unknown, the value is nullish, or the cast throws — never raises.
+*/
+function castValue(schema, field, value) {
+	if (value === null || value === void 0) return value;
+	if (typeof value === "object" && !(value instanceof Date)) return value;
+	let schemaType;
+	try {
+		schemaType = schema.path(field);
+	} catch {
+		return value;
+	}
+	if (!schemaType || typeof schemaType.cast !== "function") return value;
+	try {
+		return schemaType.cast(value);
+	} catch {
+		return value;
+	}
+}
+/**
+* Cast the operand(s) of a field-level operator object, leaving operators we
+* don't understand (`$regex`, `$exists`, `$size`, `$elemMatch`, …) alone.
+*/
+function castOperatorObject(schema, field, ops) {
+	let changed = false;
+	const out = {};
+	for (const [op, operand] of Object.entries(ops)) if (SCALAR_OPS.has(op)) {
+		const next = castValue(schema, field, operand);
+		out[op] = next;
+		if (next !== operand) changed = true;
+	} else if (ARRAY_OPS.has(op) && Array.isArray(operand)) {
+		const arr = operand.map((entry) => castValue(schema, field, entry));
+		out[op] = arr;
+		if (arr.some((v, i) => v !== operand[i])) changed = true;
+	} else out[op] = operand;
+	return changed ? out : ops;
+}
+/**
+* Cast a record-shape Mongo filter against a Mongoose schema so it is safe to
+* hand to a `$match` stage. Recurses `$and` / `$or` / `$nor` / `$not`, since a
+* policy/tenant scope conjoined with a caller filter nests one level down.
+*
+* Filter IR nodes and non-objects pass through untouched — IR values are built
+* in code (already correctly typed) and carry no schema paths to resolve.
+*
+* @example
+* ```ts
+* // organizationId is an ObjectId column; arc supplies the scope id as a string
+* castFilterToSchema({ organizationId: '6a6a…' }, Order.schema)
+* // → { organizationId: ObjectId('6a6a…') }
+* ```
+*/
+function castFilterToSchema(filter, schema) {
+	if (!isPlainObject(filter)) return filter;
+	if (typeof filter.op === "string") return filter;
+	let changed = false;
+	const out = {};
+	for (const [key, value] of Object.entries(filter)) {
+		if (LOGICAL_ARRAY_OPS.has(key) && Array.isArray(value)) {
+			const arr = value.map((entry) => castFilterToSchema(entry, schema));
+			out[key] = arr;
+			if (arr.some((v, i) => v !== value[i])) changed = true;
+			continue;
+		}
+		if (LOGICAL_OBJECT_OPS.has(key) && isPlainObject(value)) {
+			const nested = castFilterToSchema(value, schema);
+			out[key] = nested;
+			if (nested !== value) changed = true;
+			continue;
+		}
+		if (key.startsWith("$")) {
+			out[key] = value;
+			continue;
+		}
+		if (isPlainObject(value)) {
+			const keys = Object.keys(value);
+			if (keys.length > 0 && keys.every((k) => k.startsWith("$"))) {
+				const nextOps = castOperatorObject(schema, key, value);
+				out[key] = nextOps;
+				if (nextOps !== value) changed = true;
+				continue;
+			}
+			out[key] = value;
+			continue;
+		}
+		const next = castValue(schema, key, value);
+		out[key] = next;
+		if (next !== value) changed = true;
+	}
+	return changed ? out : filter;
+}
+//#endregion
 //#region src/actions/aggregate-ir/normalize.ts
 /**
 * AggRequest → input normalization (mongokit binding).
@@ -580,14 +696,14 @@ function compileMeasure(measure) {
 }
 //#endregion
 //#region src/actions/aggregate-ir/pipeline.ts
-function buildAggPipeline(req) {
+function buildAggPipeline(req, schema) {
 	validateMeasures$1(req.measures);
 	const groupCols = normalizeGroupBy(req.groupBy);
 	const bucketAliases = req.dateBuckets ? Object.keys(req.dateBuckets) : [];
 	validateBucketAliases(bucketAliases, groupCols, req.measures);
 	const stages = [];
 	const aliasSet = new Set((req.lookups ?? []).map((l) => l.as ?? l.from));
-	const { base: baseFilter, joined: joinedFilter } = splitFilterByAlias(req.filter, aliasSet);
+	const { base: baseFilter, joined: joinedFilter } = splitFilterByAlias(schema !== void 0 && req.filter !== void 0 ? castFilterToSchema(req.filter, schema) : req.filter, aliasSet);
 	if (baseFilter !== void 0) {
 		const match = compileFilterToMongo(baseFilter);
 		if (Object.keys(match).length > 0) stages.push({ $match: match });
@@ -869,7 +985,7 @@ async function countAggGroups(Model, req, options = {}) {
 	const hasDottedGroupBy = groupCols.some((f) => f.includes("."));
 	const hasDateBuckets = !!req.dateBuckets && Object.keys(req.dateBuckets).length > 0;
 	if (req.having !== void 0 || req.lookups !== void 0 && req.lookups.length > 0 || hasDottedGroupBy || hasDateBuckets) {
-		const { pipeline, prePaginationIndex } = buildAggPipeline(req);
+		const { pipeline, prePaginationIndex } = buildAggPipeline(req, Model.schema);
 		const finalPipeline = [...pipeline.slice(0, prePaginationIndex), { $count: "n" }];
 		const aggregation = Model.aggregate(finalPipeline);
 		if (session) aggregation.session(session);
@@ -877,7 +993,7 @@ async function countAggGroups(Model, req, options = {}) {
 		const [row] = await aggregation.exec();
 		return row?.n ?? 0;
 	}
-	const match = req.filter ? compileFilterToMongo(req.filter) : {};
+	const match = req.filter ? compileFilterToMongo(castFilterToSchema(req.filter, Model.schema)) : {};
 	if (groupCols.length === 0) {
 		const pipeline = [];
 		if (Object.keys(match).length > 0) pipeline.push({ $match: match });
@@ -906,7 +1022,7 @@ async function countAggGroups(Model, req, options = {}) {
 //#region src/actions/aggregate-ir/execute.ts
 async function executeAgg(Model, req, options = {}) {
 	const session = options.session;
-	const { pipeline } = buildAggPipeline(req);
+	const { pipeline } = buildAggPipeline(req, Model.schema);
 	const aggregation = Model.aggregate(pipeline);
 	if (session) aggregation.session(session);
 	applyExecutionHints(aggregation, req.executionHints);
@@ -3746,7 +3862,7 @@ var Repository = class extends RepositoryBase {
 			if (!finalReq.sort || Object.keys(finalReq.sort).length === 0) throw new Error("mongokit/aggregatePaginate: keyset pagination requires `sort` — the cursor anchors on the sort-key tuple");
 			const cursor = finalReq.after ? decodeAggCursor$1(finalReq.after) : void 0;
 			const keysetMatch = cursor ? buildKeysetPredicate(finalReq.sort, cursor) : void 0;
-			const { pipeline, prePaginationIndex } = buildAggPipeline(finalReq);
+			const { pipeline, prePaginationIndex } = buildAggPipeline(finalReq, this.Model.schema);
 			const headStages = pipeline.slice(0, prePaginationIndex);
 			const tailStages = [];
 			if (keysetMatch) tailStages.push(keysetMatch);

package/dist/actions/index.mjs

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
-import { g as create_exports, i as update_exports, p as delete_exports, u as read_exports, v as aggregate_exports } from "../update-1Lq9OMD2.mjs";
+import { g as create_exports, i as update_exports, p as delete_exports, u as read_exports, v as aggregate_exports } from "../update-CI2NdAW6.mjs";
 //#region src/actions/index.ts
 var actions_exports = /* @__PURE__ */ __exportAll({
 	aggregate: () => aggregate_exports,

package/dist/better-auth/index.mjs

@@ -1,4 +1,4 @@
-import { n as Repository } from "../Repository-BFBTAMlA.mjs";
+import { n as Repository } from "../Repository-DThvFCaV.mjs";
 import { n as createMongooseAdapter } from "../adapter-CLvUHiTW.mjs";
 import { pluralizeBetterAuthCollection, resolveBetterAuthCollections } from "@classytic/repo-core/better-auth";
 //#region src/better-auth/index.ts

package/dist/{create-repository-2DMwkYVz.mjs → create-repository-uhKt_oUT.mjs}

@@ -1,5 +1,5 @@
-import { n as Repository } from "./Repository-BFBTAMlA.mjs";
-import { a as methodRegistryPlugin, d as cachePlugin, f as batchOperationsPlugin, g as auditLogPlugin, i as multiTenantPlugin, m as auditTrailPlugin, n as softDeletePlugin, o as customIdPlugin, t as timestampPlugin } from "./timestamp.plugin-ennbatTW.mjs";
+import { n as Repository } from "./Repository-DThvFCaV.mjs";
+import { a as methodRegistryPlugin, d as cachePlugin, f as batchOperationsPlugin, g as auditLogPlugin, i as multiTenantPlugin, m as auditTrailPlugin, n as softDeletePlugin, o as customIdPlugin, t as timestampPlugin } from "./timestamp.plugin-CFL6LlYZ.mjs";
 //#region src/create-repository.ts
 function isLoggerAudit(value) {
 	const v = value;

package/dist/index.d.mts

@@ -8,7 +8,7 @@ import { A as ensureAuditTrailReady, C as AuditTrailMethods, D as AuditTrailQuer
 import { t as PaginationEngine } from "./PaginationEngine-CBS1XGzp.mjs";
 import { a as Repository, i as HOOK_PRIORITY, n as CreateRepositoryConfig, o as TransitionMachine, r as createRepository, s as AggregationBuilder, t as AuditConfig } from "./create-repository-D4ZU94b3.mjs";
 import { a as SoftDeleteFilterMode, c as ValidationChainOptions, i as Logger, l as ValidatorDefinition, n as CascadeRelation, o as SoftDeleteOptions, r as FieldPreset, s as SoftDeleteRepository, t as CascadeOptions } from "./plugin-options-vFufQZMZ.mjs";
-import { A as ImmutableStatesPluginOptions, B as AppendOnlyPluginOptions, C as LeasePluginOptions, D as IdempotencyStorePluginOptions, E as IdempotencyStoreMethods, F as cascadePlugin, H as AggregateHelpersMethods, I as BatchOperationsMethods, L as BulkWriteResult, M as fieldFilterPlugin, N as ElasticSearchOptions, O as idempotencyStorePlugin, P as elasticSearchPlugin, R as batchOperationsPlugin, S as LeaseMethods, T as IdempotencyClaim, U as aggregateHelpersPlugin, V as appendOnlyPlugin, _ as observabilityPlugin, a as uniqueField, c as TenantContext, d as SubdocumentMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, j as immutableStatesPlugin, k as ImmutableClaimView, l as TenantStore, m as softDeletePlugin, n as blockIf, o as validationChainPlugin, p as SoftDeleteMethods, r as immutableField, s as timestampPlugin, t as autoInject, u as createTenantContext, v as MongoOperationsMethods, w as leasePlugin, x as methodRegistryPlugin, y as mongoOperationsPlugin, z as auditLogPlugin } from "./validation-chain.plugin-Cm0Ttnd8.mjs";
+import { A as IdempotencyStorePluginOptions, B as AppendOnlyPluginOptions, C as LeasePluginOptions, D as immutableStatesPlugin, E as ImmutableStatesPluginOptions, F as cascadePlugin, H as AggregateHelpersMethods, I as BatchOperationsMethods, L as BulkWriteResult, M as fieldFilterPlugin, N as ElasticSearchOptions, O as IdempotencyClaim, P as elasticSearchPlugin, R as batchOperationsPlugin, S as LeaseMethods, T as ImmutableClaimView, U as aggregateHelpersPlugin, V as appendOnlyPlugin, _ as observabilityPlugin, a as uniqueField, c as TenantContext, d as SubdocumentMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, j as idempotencyStorePlugin, k as IdempotencyStoreMethods, l as TenantStore, m as softDeletePlugin, n as blockIf, o as validationChainPlugin, p as SoftDeleteMethods, r as immutableField, s as timestampPlugin, t as autoInject, u as createTenantContext, v as MongoOperationsMethods, w as leasePlugin, x as methodRegistryPlugin, y as mongoOperationsPlugin, z as auditLogPlugin } from "./validation-chain.plugin-BLecaKa0.mjs";
 import { n as SchemaPathsLike, t as FieldType$1 } from "./coercion-BjdPX3YF.mjs";
 import { n as SchemaIndexes } from "./indexes-DIjMpYES.mjs";
 import { _ as isDuplicateKeyError, a as configureLogger, c as idVariants, f as createFieldPreset, g as createError, h as getMongooseProjection, i as createMemoryCache, m as getFieldsForUser, n as buildCrudSchemasFromModel, p as filterResponseData, r as buildCrudSchemasFromMongooseSchema, t as toPlain, v as parseDuplicateKeyError } from "./to-plain-DkF5px0R.mjs";

package/dist/index.mjs

@@ -1,14 +1,14 @@
 import { n as idVariants } from "./id-resolution-BqDrk0S2.mjs";
-import { a as supportsTransactions, c as ALL_OPERATIONS, d as READ_OPERATIONS, f as operationsByPolicyKey, i as isTransactionUnsupported, l as MUTATING_OPERATIONS, m as createMongoPurgePort, n as Repository, o as withTransaction, p as MONGOKIT_CAPABILITIES, r as batchTransaction, s as AggregationBuilder, t as HOOK_PRIORITY, u as OP_REGISTRY } from "./Repository-BFBTAMlA.mjs";
-import { b as LookupBuilder, x as compileFilterToMongo } from "./update-1Lq9OMD2.mjs";
+import { a as supportsTransactions, c as ALL_OPERATIONS, d as READ_OPERATIONS, f as operationsByPolicyKey, i as isTransactionUnsupported, l as MUTATING_OPERATIONS, m as createMongoPurgePort, n as Repository, o as withTransaction, p as MONGOKIT_CAPABILITIES, r as batchTransaction, s as AggregationBuilder, t as HOOK_PRIORITY, u as OP_REGISTRY } from "./Repository-DThvFCaV.mjs";
+import { b as LookupBuilder, x as compileFilterToMongo } from "./update-CI2NdAW6.mjs";
 import { n as warn, t as configureLogger } from "./logger-K7dPmu2U.mjs";
 import { n as isDuplicateKeyError, r as parseDuplicateKeyError, t as createError } from "./error-BuByZwKU.mjs";
 import { t as actions_exports } from "./actions/index.mjs";
-import { a as methodRegistryPlugin, c as getNextSequence, d as cachePlugin, f as batchOperationsPlugin, g as auditLogPlugin, h as ensureAuditTrailReady, i as multiTenantPlugin, l as prefixedId, m as auditTrailPlugin, n as softDeletePlugin, o as customIdPlugin, p as AuditTrailQuery, r as adminBypass, s as dateSequentialId, t as timestampPlugin, u as sequentialId } from "./timestamp.plugin-ennbatTW.mjs";
+import { a as methodRegistryPlugin, c as getNextSequence, d as cachePlugin, f as batchOperationsPlugin, g as auditLogPlugin, h as ensureAuditTrailReady, i as multiTenantPlugin, l as prefixedId, m as auditTrailPlugin, n as softDeletePlugin, o as customIdPlugin, p as AuditTrailQuery, r as adminBypass, s as dateSequentialId, t as timestampPlugin, u as sequentialId } from "./timestamp.plugin-CFL6LlYZ.mjs";
 import { t as PaginationEngine } from "./PaginationEngine-CczbvCAq.mjs";
 import { isGeoOperator, parseGeoFilter } from "./query/primitives/geo.mjs";
-import { t as createRepository } from "./create-repository-2DMwkYVz.mjs";
-import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as immutableStatesPlugin, n as blockIf, o as validationChainPlugin, p as idempotencyStorePlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "./validation-chain.plugin-k9joH2qw.mjs";
+import { t as createRepository } from "./create-repository-uhKt_oUT.mjs";
+import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "./validation-chain.plugin-CwOcUJC1.mjs";
 import { i as getMongooseProjection, n as filterResponseData, r as getFieldsForUser, t as createFieldPreset } from "./field-selection-FSQFLpsU.mjs";
 import { buildFieldTypeMap, coerceFieldValue, coerceHeuristic } from "./query/primitives/coercion.mjs";
 import { extractSchemaIndexes } from "./query/primitives/indexes.mjs";

package/dist/plugins/index.d.mts

@@ -1,6 +1,6 @@
 import { S as RepositoryPluginName, b as MONGOKIT_PLUGIN_NAMES, l as Plugin, x as MongoKitPluginName } from "../repository-DCHRWRXw.mjs";
 import { A as ensureAuditTrailReady, C as AuditTrailMethods, D as AuditTrailQueryOptions, E as AuditTrailQuery, O as EnsureAuditTrailReadyOptions, S as AuditQueryResult, T as AuditTrailOptions, _ as RepositoryCachePluginOptions, a as DateSequentialIdOptions, b as AuditOperation, c as SequentialIdOptions, d as getNextSequence, f as prefixedId, g as RepositoryCacheHandle, h as CacheOptions, i as CustomIdOptions, k as auditTrailPlugin, l as customIdPlugin, m as CacheAdapter, o as IdGenerator, p as sequentialId, r as multiTenantPlugin, s as PrefixedIdOptions, t as MultiTenantOptions, u as dateSequentialId, v as cachePlugin, w as AuditTrailMode, x as AuditQueryOptions, y as AuditEntry } from "../multi-tenant.plugin-DVyVGREb.mjs";
-import { A as ImmutableStatesPluginOptions, B as AppendOnlyPluginOptions, C as LeasePluginOptions, D as IdempotencyStorePluginOptions, E as IdempotencyStoreMethods, F as cascadePlugin, H as AggregateHelpersMethods, I as BatchOperationsMethods, M as fieldFilterPlugin, N as ElasticSearchOptions, O as idempotencyStorePlugin, P as elasticSearchPlugin, R as batchOperationsPlugin, S as LeaseMethods, T as IdempotencyClaim, U as aggregateHelpersPlugin, V as appendOnlyPlugin, _ as observabilityPlugin, a as uniqueField, b as MethodRegistryRepository, c as TenantContext, d as SubdocumentMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, j as immutableStatesPlugin, k as ImmutableClaimView, l as TenantStore, m as softDeletePlugin, n as blockIf, o as validationChainPlugin, p as SoftDeleteMethods, r as immutableField, s as timestampPlugin, t as autoInject, u as createTenantContext, v as MongoOperationsMethods, w as leasePlugin, x as methodRegistryPlugin, y as mongoOperationsPlugin, z as auditLogPlugin } from "../validation-chain.plugin-Cm0Ttnd8.mjs";
+import { A as IdempotencyStorePluginOptions, B as AppendOnlyPluginOptions, C as LeasePluginOptions, D as immutableStatesPlugin, E as ImmutableStatesPluginOptions, F as cascadePlugin, H as AggregateHelpersMethods, I as BatchOperationsMethods, M as fieldFilterPlugin, N as ElasticSearchOptions, O as IdempotencyClaim, P as elasticSearchPlugin, R as batchOperationsPlugin, S as LeaseMethods, T as ImmutableClaimView, U as aggregateHelpersPlugin, V as appendOnlyPlugin, _ as observabilityPlugin, a as uniqueField, b as MethodRegistryRepository, c as TenantContext, d as SubdocumentMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, j as idempotencyStorePlugin, k as IdempotencyStoreMethods, l as TenantStore, m as softDeletePlugin, n as blockIf, o as validationChainPlugin, p as SoftDeleteMethods, r as immutableField, s as timestampPlugin, t as autoInject, u as createTenantContext, v as MongoOperationsMethods, w as leasePlugin, x as methodRegistryPlugin, y as mongoOperationsPlugin, z as auditLogPlugin } from "../validation-chain.plugin-BLecaKa0.mjs";
 import { ChangeLogStore } from "@classytic/repo-core/sync";
 //#region src/plugins/change-log.plugin.d.ts
 interface ChangeLogPluginOptions {

package/dist/plugins/index.mjs

@@ -1,5 +1,5 @@
-import { a as methodRegistryPlugin, c as getNextSequence, d as cachePlugin, f as batchOperationsPlugin, g as auditLogPlugin, h as ensureAuditTrailReady, i as multiTenantPlugin, l as prefixedId, m as auditTrailPlugin, n as softDeletePlugin, o as customIdPlugin, p as AuditTrailQuery, s as dateSequentialId, t as timestampPlugin, u as sequentialId } from "../timestamp.plugin-ennbatTW.mjs";
-import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as immutableStatesPlugin, n as blockIf, o as validationChainPlugin, p as idempotencyStorePlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-k9joH2qw.mjs";
+import { a as methodRegistryPlugin, c as getNextSequence, d as cachePlugin, f as batchOperationsPlugin, g as auditLogPlugin, h as ensureAuditTrailReady, i as multiTenantPlugin, l as prefixedId, m as auditTrailPlugin, n as softDeletePlugin, o as customIdPlugin, p as AuditTrailQuery, s as dateSequentialId, t as timestampPlugin, u as sequentialId } from "../timestamp.plugin-CFL6LlYZ.mjs";
+import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-CwOcUJC1.mjs";
 //#region src/plugins/change-log.plugin.ts
 const PLUGIN_NAME = "changeLog";
 function isSkipped(context) {

package/dist/testkit/index.mjs

@@ -1,4 +1,4 @@
-import { t as createRepository } from "../create-repository-2DMwkYVz.mjs";
+import { t as createRepository } from "../create-repository-uhKt_oUT.mjs";
 import { createConnection } from "mongoose";
 //#region src/testkit/index.ts
 function idempotentStop(server) {

package/dist/{timestamp.plugin-ennbatTW.mjs → timestamp.plugin-CFL6LlYZ.mjs}

@@ -1,4 +1,4 @@
-import { c as ALL_OPERATIONS, t as HOOK_PRIORITY, u as OP_REGISTRY } from "./Repository-BFBTAMlA.mjs";
+import { c as ALL_OPERATIONS, t as HOOK_PRIORITY, u as OP_REGISTRY } from "./Repository-DThvFCaV.mjs";
 import { n as warn } from "./logger-K7dPmu2U.mjs";
 import { t as createError } from "./error-BuByZwKU.mjs";
 import { throwIfAborted, withRetry } from "@classytic/repo-core/repository";

package/dist/{update-1Lq9OMD2.mjs → update-CI2NdAW6.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { n as warn } from "./logger-K7dPmu2U.mjs";
 import { t as createError } from "./error-BuByZwKU.mjs";
-import { isFilter } from "@classytic/repo-core/filter";
+import { coerceFilterDates, isFilter } from "@classytic/repo-core/filter";
 //#region src/filter/compile.ts
 /**
 * Compile a Filter IR node to a MongoDB query object. Returns `{}`
@@ -34,47 +34,41 @@ const SHORTHAND_OPS = /* @__PURE__ */ new Set([
 	"regex",
 	"mod"
 ]);
-/** Range operators whose string values should be coerced to Date. */
-const RANGE_OPS = /* @__PURE__ */ new Set([
-	"gt",
-	"gte",
-	"lt",
-	"lte"
+/** Logical operators whose operand is an array of sub-queries to recurse into. */
+const LOGICAL_ARRAY_OPS = /* @__PURE__ */ new Set([
+	"$and",
+	"$or",
+	"$nor"
 ]);
-/** ISO-8601 date-only or datetime string pattern. */
-const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}/;
-/**
-* Coerce a string value to a Date when it looks like an ISO-8601 date.
-* Needed because MongoDB won't match a BSON Date field against a string
-* value even when using range operators — BSON type comparison treats
-* Date (type 9) and String (type 2) as distinct, so `{ createdAt: {
-* $gte: "2026-05-01" } }` never matches a Date-typed field.
-*/
-function tryCoerceDate(value) {
-	if (typeof value === "string" && ISO_DATE_RE.test(value)) {
-		const d = new Date(value);
-		return Number.isNaN(d.getTime()) ? value : d;
-	}
-	return value;
-}
 /**
-* Expand operator shorthand values in a plain Mongo-style query object.
+* Expand operator shorthand values in a plain Mongo-style query object —
+* `$`-prefixing is the ONE Mongo-dialect concern this function owns. Date
+* coercion is delegated to `coerceFilterDates` (repo-core) so the ISO
+* pattern has a single source of truth shared with the URL-parsing boundary.
+*
 * Only expands nested objects whose keys are ALL in `SHORTHAND_OPS` — so
 * real nested documents (e.g. `address: { city: 'Dhaka' }`) pass through
 * unchanged, while `createdAt: { gte: '2026-04-01', lte: '2026-05-01' }`
-* becomes `createdAt: { $gte: Date(2026-04-01), $lte: Date(2026-05-01) }`.
-* String values on range operators are coerced to Date when they match the
-* ISO-8601 pattern, so BSON Date fields in MongoDB are compared correctly.
+* becomes `createdAt: { $gte: '2026-04-01', $lte: '2026-05-01' }` for the
+* coercion pass to type.
+*
+* Recurses `$and` / `$or` / `$nor` because a policy-scope merge conjoins the
+* caller filter under `$and`, and un-prefixed shorthand nested there would
+* otherwise reach `$match` as a literal field named `gte`.
 */
 function expandShorthands(obj) {
 	const out = {};
 	for (const [key, value] of Object.entries(obj)) {
+		if (LOGICAL_ARRAY_OPS.has(key) && Array.isArray(value)) {
+			out[key] = value.map((entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry) ? expandShorthands(entry) : entry);
+			continue;
+		}
 		if (value !== null && typeof value === "object" && !Array.isArray(value)) {
 			const nested = value;
 			const keys = Object.keys(nested);
 			if (keys.length > 0 && keys.every((k) => !k.startsWith("$") && SHORTHAND_OPS.has(k))) {
 				const expanded = {};
-				for (const [op, opVal] of Object.entries(nested)) expanded[`$${op}`] = RANGE_OPS.has(op) ? tryCoerceDate(opVal) : opVal;
+				for (const [op, opVal] of Object.entries(nested)) expanded[`$${op}`] = opVal;
 				out[key] = expanded;
 				continue;
 			}
@@ -85,7 +79,7 @@ function expandShorthands(obj) {
 }
 function compileFilterToMongo(input) {
 	if (!input) return {};
-	if (!isFilter(input)) return expandShorthands(input);
+	if (!isFilter(input)) return coerceFilterDates(expandShorthands(input));
 	return compile(input);
 }
 function compile(filter) {

package/dist/{validation-chain.plugin-Cm0Ttnd8.d.mts → validation-chain.plugin-BLecaKa0.d.mts}

@@ -185,47 +185,6 @@ declare function elasticSearchPlugin(options: ElasticSearchOptions): Plugin;
  */
 declare function fieldFilterPlugin(fieldPreset: FieldPreset): Plugin;
 //#endregion
-//#region src/plugins/immutable-states.plugin.d.ts
-/** The slice of a `before:claim` context `allowClaim` predicates see. */
-interface ImmutableClaimView {
-  id: unknown;
-  transition: {
-    from?: unknown | readonly unknown[];
-    to?: unknown;
-    field?: string;
-    where?: Record<string, unknown>;
-  };
-  /** Operator-form patch (`{ $set: {...}, ... }`). */
-  data: Record<string, unknown> | undefined;
-}
-interface ImmutableStatesPluginOptions {
-  /** States in which the document is frozen (e.g. `['posted']`). */
-  states: readonly string[];
-  /** State field on the doc — dotted paths supported. Default `'state'`. */
-  field?: string | undefined;
-  /**
-   * Context flag the OWNING ENGINE's verbs set to pass the guard
-   * (private handshake — see module doc). Default `'_immutableInternal'`.
-   */
-  internalFlag?: string | undefined;
-  /** Tenant field used to scope state lookups (mirrors the repo's scope). */
-  tenantField?: string | undefined;
-  /**
-   * Exempt specific claim shapes that legitimately touch frozen rows
-   * (audit-trail stamps like ledger's reverse-mark). Return `true` to
-   * allow. Runs only after the claim was determined to reach a frozen
-   * state — keep the predicate a strict fingerprint.
-   */
-  allowClaim?: ((view: ImmutableClaimView) => boolean) | undefined;
-  /** Domain error to throw. Default: 403 `IMMUTABLE_STATE_VIOLATION`. */
-  errorFactory?: ((ctx: {
-    id: unknown;
-    operation: string;
-    state?: string | undefined;
-  }) => Error) | undefined;
-}
-declare function immutableStatesPlugin(options: ImmutableStatesPluginOptions): Plugin;
-//#endregion
 //#region src/plugins/idempotency-store.plugin.d.ts
 interface IdempotencyStorePluginOptions {
   /** Field carrying the deterministic operation key. @default `'key'` */
@@ -362,6 +321,47 @@ interface IdempotencyStoreMethods<TProgress = Record<string, unknown>, TResult =
 }
 declare function idempotencyStorePlugin(options?: IdempotencyStorePluginOptions): Plugin;
 //#endregion
+//#region src/plugins/immutable-states.plugin.d.ts
+/** The slice of a `before:claim` context `allowClaim` predicates see. */
+interface ImmutableClaimView {
+  id: unknown;
+  transition: {
+    from?: unknown | readonly unknown[];
+    to?: unknown;
+    field?: string;
+    where?: Record<string, unknown>;
+  };
+  /** Operator-form patch (`{ $set: {...}, ... }`). */
+  data: Record<string, unknown> | undefined;
+}
+interface ImmutableStatesPluginOptions {
+  /** States in which the document is frozen (e.g. `['posted']`). */
+  states: readonly string[];
+  /** State field on the doc — dotted paths supported. Default `'state'`. */
+  field?: string | undefined;
+  /**
+   * Context flag the OWNING ENGINE's verbs set to pass the guard
+   * (private handshake — see module doc). Default `'_immutableInternal'`.
+   */
+  internalFlag?: string | undefined;
+  /** Tenant field used to scope state lookups (mirrors the repo's scope). */
+  tenantField?: string | undefined;
+  /**
+   * Exempt specific claim shapes that legitimately touch frozen rows
+   * (audit-trail stamps like ledger's reverse-mark). Return `true` to
+   * allow. Runs only after the claim was determined to reach a frozen
+   * state — keep the predicate a strict fingerprint.
+   */
+  allowClaim?: ((view: ImmutableClaimView) => boolean) | undefined;
+  /** Domain error to throw. Default: 403 `IMMUTABLE_STATE_VIOLATION`. */
+  errorFactory?: ((ctx: {
+    id: unknown;
+    operation: string;
+    state?: string | undefined;
+  }) => Error) | undefined;
+}
+declare function immutableStatesPlugin(options: ImmutableStatesPluginOptions): Plugin;
+//#endregion
 //#region src/plugins/lease.plugin.d.ts
 interface LeasePluginOptions {
   /** Field carrying the row's status. @default `'status'` */
@@ -958,4 +958,4 @@ declare function immutableField(field: string): ValidatorDefinition;
  */
 declare function uniqueField(field: string, errorMessage?: string): ValidatorDefinition;
 //#endregion
-export { ImmutableStatesPluginOptions as A, AppendOnlyPluginOptions as B, LeasePluginOptions as C, IdempotencyStorePluginOptions as D, IdempotencyStoreMethods as E, cascadePlugin as F, AggregateHelpersMethods as H, BatchOperationsMethods as I, BulkWriteResult as L, fieldFilterPlugin as M, ElasticSearchOptions as N, idempotencyStorePlugin as O, elasticSearchPlugin as P, batchOperationsPlugin as R, LeaseMethods as S, IdempotencyClaim as T, aggregateHelpersPlugin as U, appendOnlyPlugin as V, observabilityPlugin as _, uniqueField as a, MethodRegistryRepository as b, TenantContext as c, SubdocumentMethods as d, subdocumentPlugin as f, OperationMetric as g, ObservabilityOptions as h, requireField as i, immutableStatesPlugin as j, ImmutableClaimView as k, TenantStore as l, softDeletePlugin as m, blockIf as n, validationChainPlugin as o, SoftDeleteMethods as p, immutableField as r, timestampPlugin as s, autoInject as t, createTenantContext as u, MongoOperationsMethods as v, leasePlugin as w, methodRegistryPlugin as x, mongoOperationsPlugin as y, auditLogPlugin as z };
+export { IdempotencyStorePluginOptions as A, AppendOnlyPluginOptions as B, LeasePluginOptions as C, immutableStatesPlugin as D, ImmutableStatesPluginOptions as E, cascadePlugin as F, AggregateHelpersMethods as H, BatchOperationsMethods as I, BulkWriteResult as L, fieldFilterPlugin as M, ElasticSearchOptions as N, IdempotencyClaim as O, elasticSearchPlugin as P, batchOperationsPlugin as R, LeaseMethods as S, ImmutableClaimView as T, aggregateHelpersPlugin as U, appendOnlyPlugin as V, observabilityPlugin as _, uniqueField as a, MethodRegistryRepository as b, TenantContext as c, SubdocumentMethods as d, subdocumentPlugin as f, OperationMetric as g, ObservabilityOptions as h, requireField as i, idempotencyStorePlugin as j, IdempotencyStoreMethods as k, TenantStore as l, softDeletePlugin as m, blockIf as n, validationChainPlugin as o, SoftDeleteMethods as p, immutableField as r, timestampPlugin as s, autoInject as t, createTenantContext as u, MongoOperationsMethods as v, leasePlugin as w, methodRegistryPlugin as x, mongoOperationsPlugin as y, auditLogPlugin as z };

package/dist/{validation-chain.plugin-k9joH2qw.mjs → validation-chain.plugin-CwOcUJC1.mjs}

@@ -1,5 +1,5 @@
-import { c as ALL_OPERATIONS, u as OP_REGISTRY } from "./Repository-BFBTAMlA.mjs";
-import { _ as upsert } from "./update-1Lq9OMD2.mjs";
+import { c as ALL_OPERATIONS, u as OP_REGISTRY } from "./Repository-DThvFCaV.mjs";
+import { _ as upsert } from "./update-CI2NdAW6.mjs";
 import { n as warn } from "./logger-K7dPmu2U.mjs";
 import { t as createError } from "./error-BuByZwKU.mjs";
 import { r as getFieldsForUser } from "./field-selection-FSQFLpsU.mjs";
@@ -476,140 +476,6 @@ function fieldFilterPlugin(fieldPreset) {
 	};
 }
 //#endregion
-//#region src/plugins/immutable-states.plugin.ts
-/** Ops this plugin has an explicit strategy for (see module doc). */
-const STRATEGY_OPS = /* @__PURE__ */ new Set([
-	"create",
-	"createMany",
-	"update",
-	"delete",
-	"claimVersion",
-	"restore",
-	"findOneAndUpdate",
-	"updateMany",
-	"deleteMany",
-	"bulkWrite",
-	"claim"
-]);
-function immutableStatesPlugin(options) {
-	const field = options.field ?? "state";
-	const internalFlag = options.internalFlag ?? "_immutableInternal";
-	const frozen = new Set(options.states);
-	const throwViolation = (ctx) => {
-		if (options.errorFactory) throw options.errorFactory(ctx);
-		throw createError(403, `Document ${String(ctx.id)} is in immutable state${ctx.state !== void 0 ? ` '${ctx.state}'` : ""} — '${ctx.operation}' is not permitted. Frozen rows change only through the owning engine's transition verbs.`, {
-			code: "IMMUTABLE_STATE_VIOLATION",
-			meta: { ...ctx }
-		});
-	};
-	return {
-		name: "immutableStates",
-		apply(repo) {
-			const unhandled = Object.entries(OP_REGISTRY).filter(([op, meta]) => meta.mutates && !STRATEGY_OPS.has(op)).map(([op]) => op);
-			if (unhandled.length > 0) throw createError(500, `immutableStatesPlugin has no strategy for mutating op(s): ${unhandled.join(", ")}. Mongokit added write ops this plugin predates — extend the plugin before using it.`, {
-				code: "IMMUTABLE_STATES_UNHANDLED_OPS",
-				meta: { unhandled }
-			});
-			const Model = repo.Model;
-			const getState = (doc) => field.split(".").reduce((acc, key) => acc?.[key], doc);
-			const scoped = (base, ctx) => {
-				const q = { ...base };
-				if (options.tenantField && ctx.query && options.tenantField in ctx.query) q[options.tenantField] = ctx.query[options.tenantField];
-				return q;
-			};
-			/** Raw-Model read — never re-enters the repo hook pipeline. */
-			const readStateById = async (ctx) => {
-				if (ctx.id === void 0 || ctx.id === null) return void 0;
-				const doc = await Model.findOne(scoped({ _id: ctx.id }, ctx)).select({ [field]: 1 }).lean();
-				return doc ? getState(doc) : void 0;
-			};
-			const guardById = (op) => async (ctx) => {
-				if (ctx[internalFlag]) return;
-				const state = await readStateById(ctx);
-				if (state !== void 0 && frozen.has(state)) throwViolation({
-					id: ctx.id,
-					operation: op,
-					state
-				});
-			};
-			for (const op of [
-				"update",
-				"delete",
-				"claimVersion",
-				"restore"
-			]) repo.on(`before:${op}`, guardById(op));
-			repo.on("before:findOneAndUpdate", async (ctx) => {
-				if (ctx[internalFlag]) return;
-				const filter = ctx.query ?? {};
-				const doc = await Model.findOne(filter).select({
-					[field]: 1,
-					_id: 1
-				}).lean();
-				if (!doc) return;
-				const state = getState(doc);
-				if (state !== void 0 && frozen.has(state)) throwViolation({
-					id: doc._id,
-					operation: "findOneAndUpdate",
-					state
-				});
-			});
-			const guardMany = (op) => async (ctx) => {
-				if (ctx[internalFlag]) return;
-				const filter = ctx.query ?? {};
-				const hit = await Model.exists({ $and: [filter, { [field]: { $in: [...frozen] } }] });
-				if (hit) throwViolation({
-					id: hit._id,
-					operation: op,
-					state: void 0
-				});
-			};
-			repo.on("before:updateMany", guardMany("updateMany"));
-			repo.on("before:deleteMany", guardMany("deleteMany"));
-			repo.on("before:bulkWrite", (ctx) => {
-				if (ctx[internalFlag]) return;
-				throwViolation({
-					id: void 0,
-					operation: "bulkWrite",
-					state: void 0
-				});
-			});
-			repo.on("before:claim", async (rawCtx) => {
-				const ctx = rawCtx;
-				if (ctx[internalFlag]) return;
-				const t = ctx.transition;
-				if (!t) return;
-				if ((t.field ?? "status") === field) {
-					const fromSpec = t.from;
-					if (!(Array.isArray(fromSpec) ? fromSpec.some((f) => frozen.has(String(f))) : frozen.has(String(fromSpec)))) return;
-					if (options.allowClaim?.({
-						id: ctx.id,
-						transition: t,
-						data: ctx.data
-					})) return;
-					throwViolation({
-						id: ctx.id,
-						operation: "claim",
-						state: void 0
-					});
-				}
-				const state = await readStateById(ctx);
-				if (state !== void 0 && frozen.has(state)) {
-					if (options.allowClaim?.({
-						id: ctx.id,
-						transition: t,
-						data: ctx.data
-					})) return;
-					throwViolation({
-						id: ctx.id,
-						operation: "claim",
-						state
-					});
-				}
-			});
-		}
-	};
-}
-//#endregion
 //#region src/plugins/idempotency-store.plugin.ts
 function randomToken() {
 	const bytes = /* @__PURE__ */ new Uint8Array(16);
@@ -757,6 +623,140 @@ function idempotencyStorePlugin(options = {}) {
 	};
 }
 //#endregion
+//#region src/plugins/immutable-states.plugin.ts
+/** Ops this plugin has an explicit strategy for (see module doc). */
+const STRATEGY_OPS = /* @__PURE__ */ new Set([
+	"create",
+	"createMany",
+	"update",
+	"delete",
+	"claimVersion",
+	"restore",
+	"findOneAndUpdate",
+	"updateMany",
+	"deleteMany",
+	"bulkWrite",
+	"claim"
+]);
+function immutableStatesPlugin(options) {
+	const field = options.field ?? "state";
+	const internalFlag = options.internalFlag ?? "_immutableInternal";
+	const frozen = new Set(options.states);
+	const throwViolation = (ctx) => {
+		if (options.errorFactory) throw options.errorFactory(ctx);
+		throw createError(403, `Document ${String(ctx.id)} is in immutable state${ctx.state !== void 0 ? ` '${ctx.state}'` : ""} — '${ctx.operation}' is not permitted. Frozen rows change only through the owning engine's transition verbs.`, {
+			code: "IMMUTABLE_STATE_VIOLATION",
+			meta: { ...ctx }
+		});
+	};
+	return {
+		name: "immutableStates",
+		apply(repo) {
+			const unhandled = Object.entries(OP_REGISTRY).filter(([op, meta]) => meta.mutates && !STRATEGY_OPS.has(op)).map(([op]) => op);
+			if (unhandled.length > 0) throw createError(500, `immutableStatesPlugin has no strategy for mutating op(s): ${unhandled.join(", ")}. Mongokit added write ops this plugin predates — extend the plugin before using it.`, {
+				code: "IMMUTABLE_STATES_UNHANDLED_OPS",
+				meta: { unhandled }
+			});
+			const Model = repo.Model;
+			const getState = (doc) => field.split(".").reduce((acc, key) => acc?.[key], doc);
+			const scoped = (base, ctx) => {
+				const q = { ...base };
+				if (options.tenantField && ctx.query && options.tenantField in ctx.query) q[options.tenantField] = ctx.query[options.tenantField];
+				return q;
+			};
+			/** Raw-Model read — never re-enters the repo hook pipeline. */
+			const readStateById = async (ctx) => {
+				if (ctx.id === void 0 || ctx.id === null) return void 0;
+				const doc = await Model.findOne(scoped({ _id: ctx.id }, ctx)).select({ [field]: 1 }).lean();
+				return doc ? getState(doc) : void 0;
+			};
+			const guardById = (op) => async (ctx) => {
+				if (ctx[internalFlag]) return;
+				const state = await readStateById(ctx);
+				if (state !== void 0 && frozen.has(state)) throwViolation({
+					id: ctx.id,
+					operation: op,
+					state
+				});
+			};
+			for (const op of [
+				"update",
+				"delete",
+				"claimVersion",
+				"restore"
+			]) repo.on(`before:${op}`, guardById(op));
+			repo.on("before:findOneAndUpdate", async (ctx) => {
+				if (ctx[internalFlag]) return;
+				const filter = ctx.query ?? {};
+				const doc = await Model.findOne(filter).select({
+					[field]: 1,
+					_id: 1
+				}).lean();
+				if (!doc) return;
+				const state = getState(doc);
+				if (state !== void 0 && frozen.has(state)) throwViolation({
+					id: doc._id,
+					operation: "findOneAndUpdate",
+					state
+				});
+			});
+			const guardMany = (op) => async (ctx) => {
+				if (ctx[internalFlag]) return;
+				const filter = ctx.query ?? {};
+				const hit = await Model.exists({ $and: [filter, { [field]: { $in: [...frozen] } }] });
+				if (hit) throwViolation({
+					id: hit._id,
+					operation: op,
+					state: void 0
+				});
+			};
+			repo.on("before:updateMany", guardMany("updateMany"));
+			repo.on("before:deleteMany", guardMany("deleteMany"));
+			repo.on("before:bulkWrite", (ctx) => {
+				if (ctx[internalFlag]) return;
+				throwViolation({
+					id: void 0,
+					operation: "bulkWrite",
+					state: void 0
+				});
+			});
+			repo.on("before:claim", async (rawCtx) => {
+				const ctx = rawCtx;
+				if (ctx[internalFlag]) return;
+				const t = ctx.transition;
+				if (!t) return;
+				if ((t.field ?? "status") === field) {
+					const fromSpec = t.from;
+					if (!(Array.isArray(fromSpec) ? fromSpec.some((f) => frozen.has(String(f))) : frozen.has(String(fromSpec)))) return;
+					if (options.allowClaim?.({
+						id: ctx.id,
+						transition: t,
+						data: ctx.data
+					})) return;
+					throwViolation({
+						id: ctx.id,
+						operation: "claim",
+						state: void 0
+					});
+				}
+				const state = await readStateById(ctx);
+				if (state !== void 0 && frozen.has(state)) {
+					if (options.allowClaim?.({
+						id: ctx.id,
+						transition: t,
+						data: ctx.data
+					})) return;
+					throwViolation({
+						id: ctx.id,
+						operation: "claim",
+						state
+					});
+				}
+			});
+		}
+	};
+}
+//#endregion
 //#region src/plugins/lease.plugin.ts
 function leasePlugin(options = {}) {
 	const statusField = options.statusField ?? "status";
@@ -1451,4 +1451,4 @@ function uniqueField(field, errorMessage) {
 	};
 }
 //#endregion
-export { cascadePlugin as _, uniqueField as a, subdocumentPlugin as c, mongoOperationsPlugin as d, leasePlugin as f, elasticSearchPlugin as g, fieldFilterPlugin as h, requireField as i, observabilityPlugin as l, immutableStatesPlugin as m, blockIf as n, validationChainPlugin as o, idempotencyStorePlugin as p, immutableField as r, createTenantContext as s, autoInject as t, MONGOKIT_PLUGIN_NAMES as u, appendOnlyPlugin as v, aggregateHelpersPlugin as y };
+export { cascadePlugin as _, uniqueField as a, subdocumentPlugin as c, mongoOperationsPlugin as d, leasePlugin as f, elasticSearchPlugin as g, fieldFilterPlugin as h, requireField as i, observabilityPlugin as l, idempotencyStorePlugin as m, blockIf as n, validationChainPlugin as o, immutableStatesPlugin as p, immutableField as r, createTenantContext as s, autoInject as t, MONGOKIT_PLUGIN_NAMES as u, appendOnlyPlugin as v, aggregateHelpersPlugin as y };

package/package.json

@@ -1,180 +1,187 @@
 {
-  "name": "@classytic/mongokit",
-  "version": "3.28.0",
-  "description": "Production-grade MongoDB repositories - smart pagination, events, and plugins. Built on @classytic/repo-core.",
-  "type": "module",
-  "sideEffects": false,
-  "main": "./dist/index.mjs",
-  "module": "./dist/index.mjs",
-  "types": "./dist/index.d.mts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.mts",
-      "default": "./dist/index.mjs"
-    },
-    "./pagination": {
-      "types": "./dist/pagination/PaginationEngine.d.mts",
-      "default": "./dist/pagination/PaginationEngine.mjs"
-    },
-    "./plugins": {
-      "types": "./dist/plugins/index.d.mts",
-      "default": "./dist/plugins/index.mjs"
-    },
-    "./utils": {
-      "types": "./dist/utils/index.d.mts",
-      "default": "./dist/utils/index.mjs"
-    },
-    "./actions": {
-      "types": "./dist/actions/index.d.mts",
-      "default": "./dist/actions/index.mjs"
-    },
-    "./ai": {
-      "types": "./dist/ai/index.d.mts",
-      "default": "./dist/ai/index.mjs"
-    },
-    "./adapter": {
-      "types": "./dist/adapter/index.d.mts",
-      "default": "./dist/adapter/index.mjs"
-    },
-    "./better-auth": {
-      "types": "./dist/better-auth/index.d.mts",
-      "default": "./dist/better-auth/index.mjs"
-    },
-    "./lock": {
-      "types": "./dist/lock/index.d.mts",
-      "default": "./dist/lock/index.mjs"
-    },
-    "./usage": {
-      "types": "./dist/usage/index.d.mts",
-      "default": "./dist/usage/index.mjs"
-    },
-    "./query/primitives/geo": {
-      "types": "./dist/query/primitives/geo.d.mts",
-      "default": "./dist/query/primitives/geo.mjs"
-    },
-    "./query/primitives/coercion": {
-      "types": "./dist/query/primitives/coercion.d.mts",
-      "default": "./dist/query/primitives/coercion.mjs"
-    },
-    "./query/primitives/indexes": {
-      "types": "./dist/query/primitives/indexes.d.mts",
-      "default": "./dist/query/primitives/indexes.mjs"
-    },
-    "./testkit": {
-      "types": "./dist/testkit/index.d.mts",
-      "default": "./dist/testkit/index.mjs"
-    }
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE"
-  ],
-  "keywords": [
-    "mongodb",
-    "mongoose",
-    "repository",
-    "repository-pattern",
-    "data-access",
-    "pagination",
-    "cursor-pagination",
-    "infinite-scroll",
-    "offset-pagination",
-    "keyset-pagination",
-    "caching",
-    "redis",
-    "cache",
-    "multi-tenant",
-    "multi-tenancy",
-    "vector-search",
-    "embeddings",
-    "atlas-search",
-    "observability",
-    "event-driven",
-    "plugin-based",
-    "zero-dependencies",
-    "express",
-    "fastify",
-    "nestjs",
-    "nextjs",
-    "typescript"
-  ],
-  "author": "Classytic <classytic.dev@gmail.com> (https://github.com/classytic)",
-  "contributors": [
-    "Sadman Chowdhury (https://github.com/siam923)"
-  ],
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/classytic/mongokit.git"
-  },
-  "bugs": {
-    "url": "https://github.com/classytic/mongokit/issues"
-  },
-  "homepage": "https://github.com/classytic/mongokit#readme",
-  "peerDependencies": {
-    "@classytic/repo-core": ">=0.17.0",
-    "mongoose": ">=9.4.1"
-  },
-  "engines": {
-    "node": ">=22"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "build": "tsdown",
-    "dev": "tsdown --watch",
-    "test": "vitest run --project unit --project integration",
-    "test:unit": "vitest run --project unit",
-    "test:integration": "vitest run --project integration",
-    "test:e2e": "vitest run --project e2e",
-    "test:all": "vitest run --project unit --project integration --project e2e",
-    "test:watch": "vitest --project unit --project integration",
-    "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc --noEmit",
-    "typecheck:tests": "tsc --noEmit -p tsconfig.tests.json",
-    "lint": "biome check src/",
-    "lint:fix": "biome check src/ --write",
-    "lint:package": "publint && attw --pack . --profile esm-only",
-    "format": "biome format src/ --write",
-    "check": "biome ci src/ --diagnostic-level=error",
-    "check:dead-code": "knip",
-    "ci": "npm run check && npm run typecheck && npm run typecheck:tests && npm run build && npm run lint:package && npm run check:dead-code && npm test",
-    "push": "classytic-push",
-    "prepublishOnly": "npm run ci",
-    "publish:dry": "npm publish --dry-run --access public",
-    "publish:npm": "npm publish --access public",
-    "release:tag": "node -e \"require('child_process').execSync('npm run push -- v'+require('./package.json').version,{stdio:'inherit'})\"",
-    "release": "npm run push -- main && npm run release:tag && npm publish --access public",
-    "release:patch": "npm version patch && npm run release",
-    "release:minor": "npm version minor && npm run release",
-    "release:major": "npm version major && npm run release"
-  },
-  "devDependencies": {
-    "@arethetypeswrong/cli": "^0.18.2",
-    "@better-auth/api-key": "^1.6.22",
-    "@better-auth/mongo-adapter": "^1.6.22",
-    "@biomejs/biome": "^2.4.10",
-    "@classytic/dev-tools": "^0.2.0",
-    "@classytic/repo-core": "^0.17.0",
-    "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^4.1.4",
-    "ajv": "^8.18.0",
-    "ajv-formats": "^3.0.1",
-    "better-auth": "^1.6.23",
-    "dotenv": "^17.4.2",
-    "knip": "^6.3.0",
-    "mongodb": "7.2.0",
-    "mongodb-memory-server": "^10.4.3",
-    "mongoose": "^9.4.1",
-    "publint": "^0.3.18",
-    "tsdown": "^0.22.5",
-    "typescript": "~5.9.0",
-    "vitest": "^4.1.4"
-  },
-  "overrides": {
-    "mongodb": "7.2.0",
-    "bson": "7.2.0"
-  }
+	"name": "@classytic/mongokit",
+	"version": "3.29.0",
+	"description": "Production-grade MongoDB repositories - smart pagination, events, and plugins. Built on @classytic/repo-core.",
+	"type": "module",
+	"sideEffects": false,
+	"main": "./dist/index.mjs",
+	"module": "./dist/index.mjs",
+	"types": "./dist/index.d.mts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.mts",
+			"default": "./dist/index.mjs"
+		},
+		"./pagination": {
+			"types": "./dist/pagination/PaginationEngine.d.mts",
+			"default": "./dist/pagination/PaginationEngine.mjs"
+		},
+		"./plugins": {
+			"types": "./dist/plugins/index.d.mts",
+			"default": "./dist/plugins/index.mjs"
+		},
+		"./utils": {
+			"types": "./dist/utils/index.d.mts",
+			"default": "./dist/utils/index.mjs"
+		},
+		"./actions": {
+			"types": "./dist/actions/index.d.mts",
+			"default": "./dist/actions/index.mjs"
+		},
+		"./ai": {
+			"types": "./dist/ai/index.d.mts",
+			"default": "./dist/ai/index.mjs"
+		},
+		"./adapter": {
+			"types": "./dist/adapter/index.d.mts",
+			"default": "./dist/adapter/index.mjs"
+		},
+		"./better-auth": {
+			"types": "./dist/better-auth/index.d.mts",
+			"default": "./dist/better-auth/index.mjs"
+		},
+		"./lock": {
+			"types": "./dist/lock/index.d.mts",
+			"default": "./dist/lock/index.mjs"
+		},
+		"./usage": {
+			"types": "./dist/usage/index.d.mts",
+			"default": "./dist/usage/index.mjs"
+		},
+		"./query/primitives/geo": {
+			"types": "./dist/query/primitives/geo.d.mts",
+			"default": "./dist/query/primitives/geo.mjs"
+		},
+		"./query/primitives/coercion": {
+			"types": "./dist/query/primitives/coercion.d.mts",
+			"default": "./dist/query/primitives/coercion.mjs"
+		},
+		"./query/primitives/indexes": {
+			"types": "./dist/query/primitives/indexes.d.mts",
+			"default": "./dist/query/primitives/indexes.mjs"
+		},
+		"./testkit": {
+			"types": "./dist/testkit/index.d.mts",
+			"default": "./dist/testkit/index.mjs"
+		}
+	},
+	"files": [
+		"dist",
+		"README.md",
+		"LICENSE",
+		"TRADEMARK.md"
+	],
+	"keywords": [
+		"mongodb",
+		"mongoose",
+		"repository",
+		"repository-pattern",
+		"data-access",
+		"pagination",
+		"cursor-pagination",
+		"infinite-scroll",
+		"offset-pagination",
+		"keyset-pagination",
+		"caching",
+		"redis",
+		"cache",
+		"multi-tenant",
+		"multi-tenancy",
+		"vector-search",
+		"embeddings",
+		"atlas-search",
+		"observability",
+		"event-driven",
+		"plugin-based",
+		"zero-dependencies",
+		"express",
+		"fastify",
+		"nestjs",
+		"nextjs",
+		"typescript"
+	],
+	"author": "Classytic <classytic.dev@gmail.com> (https://github.com/classytic)",
+	"contributors": [
+		"Sadman Chowdhury (https://github.com/siam923)"
+	],
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/classytic/mongokit.git"
+	},
+	"bugs": {
+		"url": "https://github.com/classytic/mongokit/issues"
+	},
+	"homepage": "https://github.com/classytic/mongokit#readme",
+	"peerDependencies": {
+		"@classytic/repo-core": ">=0.19.0",
+		"mongodb-memory-server": ">=10.4.3",
+		"mongoose": ">=9.4.1"
+	},
+	"peerDependenciesMeta": {
+		"mongodb-memory-server": {
+			"optional": true
+		}
+	},
+	"engines": {
+		"node": ">=22"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"build": "tsdown",
+		"dev": "tsdown --watch",
+		"test": "vitest run --project unit --project integration",
+		"test:unit": "vitest run --project unit",
+		"test:integration": "vitest run --project integration",
+		"test:e2e": "vitest run --project e2e",
+		"test:all": "vitest run --project unit --project integration --project e2e",
+		"test:watch": "vitest --project unit --project integration",
+		"test:coverage": "vitest run --coverage",
+		"typecheck": "tsc --noEmit",
+		"typecheck:tests": "tsc --noEmit -p tsconfig.tests.json",
+		"lint": "biome check src/",
+		"lint:fix": "biome check src/ --write",
+		"lint:package": "publint && attw --pack . --profile esm-only",
+		"format": "biome format src/ --write",
+		"check": "biome ci src/ --diagnostic-level=error",
+		"check:dead-code": "knip",
+		"ci": "npm run check && npm run typecheck && npm run typecheck:tests && npm run build && npm run lint:package && npm run check:dead-code && npm test",
+		"push": "classytic-push",
+		"prepublishOnly": "npm run ci",
+		"publish:dry": "npm publish --dry-run --access public",
+		"publish:npm": "npm publish --access public",
+		"release:tag": "node -e \"require('child_process').execSync('npm run push -- v'+require('./package.json').version,{stdio:'inherit'})\"",
+		"release": "npm run push -- main && npm run release:tag && npm publish --access public",
+		"release:patch": "npm version patch && npm run release",
+		"release:minor": "npm version minor && npm run release",
+		"release:major": "npm version major && npm run release"
+	},
+	"devDependencies": {
+		"@arethetypeswrong/cli": "^0.18.2",
+		"@better-auth/api-key": "^1.6.22",
+		"@better-auth/mongo-adapter": "^1.6.22",
+		"@biomejs/biome": "^2.4.10",
+		"@classytic/dev-tools": "^0.2.0",
+		"@classytic/repo-core": "^0.19.0",
+		"@types/node": "^22.0.0",
+		"@vitest/coverage-v8": "^4.1.4",
+		"ajv": "^8.18.0",
+		"ajv-formats": "^3.0.1",
+		"better-auth": "^1.6.23",
+		"dotenv": "^17.4.2",
+		"knip": "^6.3.0",
+		"mongodb": "7.2.0",
+		"mongodb-memory-server": "^10.4.3",
+		"mongoose": "^9.4.1",
+		"publint": "^0.3.18",
+		"tsdown": "^0.22.5",
+		"typescript": "~5.9.0",
+		"vitest": "^4.1.4"
+	},
+	"overrides": {
+		"mongodb": "7.2.0",
+		"bson": "7.2.0"
+	}
 }