@classytic/mongokit 3.32.0 → 3.33.0

package/dist/{PaginationEngine-CSh-P8Nh.mjs → PaginationEngine-GdyX29tE.mjs}

@@ -35,18 +35,20 @@ function buildKeysetFilter(baseFilters, sort, cursorValue, cursorId, cursorValue
 		const primaryField = sortFields[0] || "_id";
 		const direction = sort[primaryField];
 		const operator = direction === 1 ? "$gt" : "$lt";
-		if (cursorValue === null || cursorValue === void 0) if (direction === 1) return {
-			...baseFilters,
-			$or: [{
+		if (cursorValue === null || cursorValue === void 0) {
+			if (direction === 1) return {
+				...baseFilters,
+				$or: [{
+					[primaryField]: null,
+					_id: { $gt: cursorId }
+				}, { [primaryField]: { $ne: null } }]
+			};
+			else return {
+				...baseFilters,
 				[primaryField]: null,
-				_id: { $gt: cursorId }
-			}, { [primaryField]: { $ne: null } }]
-		};
-		else return {
-			...baseFilters,
-			[primaryField]: null,
-			_id: { $lt: cursorId }
-		};
+				_id: { $lt: cursorId }
+			};
+		}
 		return {
 			...baseFilters,
 			$or: [{ [primaryField]: { [operator]: cursorValue } }, {

package/dist/{Repository-B_1y9cCf.mjs → Repository-BArvU32x.mjs}

@@ -1,12 +1,14 @@
 import { i as isValidIdForType, t as getSchemaIdType } from "./id-resolution-BqDrk0S2.mjs";
-import { a as count, b as LookupBuilder, c as getByQuery, d as deleteById, f as deleteByQuery, h as createMany, l as getOrCreate, m as create, n as update, o as exists, r as updateByQuery, s as getById, t as findOneAndUpdate, x as compileFilterToMongo, y as distinct } from "./update-w5i-pa_c.mjs";
+import { a as narrowToIds, i as keysetFilter, o as selectKeysetChunk } from "./id-chunks-BmAwsqNk.mjs";
+import { a as count, b as LookupBuilder, c as getByQuery, d as deleteById, f as deleteByQuery, h as createMany, l as getOrCreate, m as create, n as update, o as exists, r as updateByQuery, s as getById, t as findOneAndUpdate, x as compileFilterToMongo, y as distinct } from "./update-jSXp3nu3.mjs";
 import { n as warn } from "./logger-K7dPmu2U.mjs";
 import { n as isDuplicateKeyError, r as parseDuplicateKeyError, t as createError } from "./error-BuByZwKU.mjs";
-import { r as calculateTotalPages, t as PaginationEngine } from "./PaginationEngine-CSh-P8Nh.mjs";
+import { r as calculateTotalPages, t as PaginationEngine } from "./PaginationEngine-GdyX29tE.mjs";
 import { hasNearOperator, rewriteNearForCount } from "./query/primitives/geo.mjs";
 import { RepositoryBase, runChunkedArchive, runChunkedPurge, throwIfAborted, validatePluginOrder, withRetry } from "@classytic/repo-core/repository";
 import mongoose from "mongoose";
 import { isFilter } from "@classytic/repo-core/filter";
+import { VersionConflictError, conservativeMongoIsTransientConflict } from "@classytic/repo-core/errors";
 import { HOOK_PRIORITY } from "@classytic/repo-core/hooks";
 import { compileUpdateSpecToMongo, isUpdateSpec } from "@classytic/repo-core/update";
 import { decodeAggCursor, encodeAggCursor, isKeysetMode, normalizeGroupBy, validateMeasures } from "@classytic/repo-core/aggregate";
@@ -48,10 +50,7 @@ function createKeysetPurgePort(repo, baseFilter, session) {
 		bypassTenant: true
 	};
 	let cursor = null;
-	const selectFilter = () => cursor == null ? baseFilter : {
-		...baseFilter,
-		_id: { $gt: cursor }
-	};
+	const selectFilter = () => keysetFilter(baseFilter, cursor);
 	return { async purgeChunk(strategy, limit) {
 		if (strategy.type === "anonymize") {
 			if (Object.values(strategy.fields).some((v) => typeof v === "function")) {
@@ -60,13 +59,13 @@ function createKeysetPurgePort(repo, baseFilter, session) {
 				return processed;
 			}
 		}
-		const idDocs = await repo.Model.find(selectFilter(), { _id: 1 }).sort({ _id: 1 }).limit(limit).session(session ?? null).lean().exec();
+		const idDocs = await selectKeysetChunk(repo.Model, selectFilter(), limit, {
+			session,
+			projection: { _id: 1 }
+		});
 		if (idDocs.length === 0) return 0;
 		const ids = idDocs.map((d) => d._id);
-		const chunkFilter = {
-			...baseFilter,
-			_id: { $in: ids }
-		};
+		const chunkFilter = narrowToIds(baseFilter, ids);
 		switch (strategy.type) {
 			case "hard":
 				await repo.deleteMany(chunkFilter, {
@@ -101,7 +100,7 @@ function createKeysetPurgePort(repo, baseFilter, session) {
 * is the same write), this matches the at-least-once contract.
 */
 async function purgeAnonymizeFunctional(repo, selectFilter, fields, limit, session) {
-	const docs = await repo.Model.find(selectFilter).sort({ _id: 1 }).limit(limit).session(session ?? null).lean().exec();
+	const docs = await selectKeysetChunk(repo.Model, selectFilter, limit, { session });
 	if (docs.length === 0) return {
 		processed: 0,
 		lastId: null
@@ -138,10 +137,11 @@ function transactionResolutionOf(caps) {
 /**
 * What MongoDB supports through mongokit's surface, DECLARED (not observed).
 *
-* Deployment-dependent flags (`transactions`, `nestedTransactions`,
-* `changeStreams` — all three need a replica set or mongos) are `true` here
-* because they describe the product, not the server you happen to be pointed
-* at. **Do not read this constant to decide whether a live connection can run
+* Deployment-dependent flags (`transactions`, `changeStreams` — both need a
+* replica set or mongos) are `true` here because they describe the product,
+* not the server you happen to be pointed at. `nestedTransactions` is NOT one
+* of them: it is `false` unconditionally, because the refusal comes from
+* mongokit's own tx-bound proxy rather than from the deployment. **Do not read this constant to decide whether a live connection can run
 * a transaction** — that is {@link resolveMongoCapabilities}, which is what
 * `Repository#capabilities` returns. This one is for the cross-kit conformance
 * harness (which overrides environment-specific limits where it is
@@ -150,9 +150,11 @@ function transactionResolutionOf(caps) {
 const MONGOKIT_CAPABILITIES = Object.freeze({
 	transactionsResolution: "declared",
 	transactions: true,
-	nestedTransactions: true,
+	nestedTransactions: false,
+	transactionRetry: "managed",
 	upsert: true,
 	duplicateKeyError: true,
+	optimisticConcurrency: true,
 	distinct: true,
 	aggregate: true,
 	aggregateOps: Object.freeze({
@@ -251,7 +253,7 @@ function deriveCapabilities(support) {
 		...MONGOKIT_CAPABILITIES,
 		transactionsResolution: support === "unknown" ? "unknown" : "observed",
 		transactions: available,
-		nestedTransactions: available,
+		nestedTransactions: false,
 		changeStreams: available
 	});
 }
@@ -830,7 +832,8 @@ function compile(filter) {
 		} };
 		case "regex": return { $regexMatch: {
 			input: `$${filter.field}`,
-			regex: filter.pattern
+			regex: filter.pattern,
+			...filter.flags ? { options: filter.flags } : {}
 		} };
 		case "and": {
 			if (filter.children.length === 0) return true;
@@ -1347,14 +1350,11 @@ function buildKeysetPredicate(sort, cursor) {
 function createMongoArchivePort(repo, filter, session) {
 	return {
 		async readChunk(limit) {
-			return await repo.Model.find(filter).sort({ _id: 1 }).limit(limit).session(session ?? null).lean().exec();
+			return selectKeysetChunk(repo.Model, filter, limit, { session });
 		},
 		async deleteChunk(docs) {
 			const ids = docs.map((doc) => doc._id);
-			return (await repo.deleteMany({
-				...filter,
-				_id: { $in: ids }
-			}, {
+			return (await repo.deleteMany(narrowToIds(filter, ids), {
 				session,
 				bypassTenant: true,
 				mode: "hard"
@@ -2204,6 +2204,33 @@ function assertNoMixedPatchShape(opName, patch) {
 	const flatKeys = patchKeys.filter((k) => !k.startsWith("$"));
 	throw createError(400, `[${opName}] assertNoMixedPatchShape: patch mixes Mongo operators (${operatorKeys.join(", ")}) with raw field keys (${flatKeys.join(", ")}). Mongo would silently DROP the flat keys — that's a write-loss bug we refuse to forward. Either wrap the flat keys in $set explicitly, or remove the operator keys.`);
 }
+/**
+* Under `ifVersion`, the CAS owns the version field EXCLUSIVELY.
+*
+* The write merges `$inc: { [versionField]: 1 }` into the caller's payload, so
+* a payload that also touches the version field produces one of two silent
+* wrongs: Mongo rejects the whole update with a path-conflict error that names
+* an internal field the caller never wrote (`$set: { __v }`, `$unset`,
+* `$rename`), or the merge quietly overrides the caller's intent (`$inc: { __v: 5 }`
+* becomes `1`). Neither is a failure a caller can act on, so the payload is
+* refused up front and the reason is named.
+*
+* `$inc: { [versionField]: 1 }` is permitted: it is exactly what the CAS does
+* anyway, so a caller declaring it redundantly is stating the truth.
+*/
+function assertCasOwnsVersionField(opName, patch, versionField) {
+	for (const [op, value] of Object.entries(patch)) {
+		if (!op.startsWith("$")) {
+			if (op === versionField) throw createError(400, `[${opName}] payload sets '${versionField}' directly, but the optimistic-concurrency CAS owns that field — it increments it as part of the same write. Remove it; the expected value belongs in \`options.ifVersion\`, not the payload.`);
+			continue;
+		}
+		if (typeof value !== "object" || value === null) continue;
+		const fields = value;
+		if (!(versionField in fields)) continue;
+		if (op === "$inc" && fields[versionField] === 1) continue;
+		throw createError(400, `[${opName}] payload's ${op} targets '${versionField}', but the optimistic-concurrency CAS owns that field — it increments it as part of the same write. ` + (op === "$inc" ? `Only \`$inc: { ${versionField}: 1 }\` is accepted (it matches what the CAS does); any other increment would be silently overridden. ` : `A conflicting ${op} would either fail the update with a Mongo path conflict or be silently overridden. `) + `Remove it; the expected version belongs in \`options.ifVersion\`.`);
+	}
+}
 /** Mongo `operationType` → portable `ChangeEvent.operation`. */
 const CHANGE_OPERATION_MAP = {
 	insert: "create",
@@ -2280,6 +2307,8 @@ var Repository = class extends RepositoryBase {
 	model;
 	_pagination;
 	idField;
+	/** Version field for `ifVersion` CAS writes. Default '__v'. */
+	versionField;
 	searchMode;
 	searchFields;
 	_hasTextIndex = null;
@@ -2307,6 +2336,7 @@ var Repository = class extends RepositoryBase {
 		this.model = Model.modelName;
 		this._pagination = new PaginationEngine(Model, paginationConfig);
 		this.idField = options.idField ?? "_id";
+		this.versionField = options.versionField ?? "__v";
 		this.searchMode = options.searchMode ?? "text";
 		this.searchFields = options.searchFields;
 		this._wireStrictQueryStripDiagnostic(options.warnOnStrictQueryStrip === true);
@@ -3218,7 +3248,78 @@ var Repository = class extends RepositoryBase {
 					}
 				}
 				let result;
-				if (effectiveIdField !== "_id") result = await this._withResilience(context, () => updateByQuery(this.Model, {
+				if (options.ifVersion !== void 0) {
+					/**
+					* Optimistic CAS: the version predicate joins the match filter, so
+					* the check and the write are ONE round-trip — no read-then-write
+					* window. The `$inc` rides the same operation; a versioned write
+					* that did not bump the version would let the NEXT writer pass the
+					* same CAS and silently clobber this one.
+					*/
+					const vf = this.versionField;
+					const payload = context.data || data;
+					assertNoMixedPatchShape("update(ifVersion)", payload);
+					assertCasOwnsVersionField("update(ifVersion)", payload, vf);
+					const casUpdate = Object.keys(payload).some((k) => k.startsWith("$")) ? {
+						...payload,
+						$inc: {
+							...payload.$inc ?? {},
+							[vf]: 1
+						}
+					} : {
+						$set: payload,
+						$inc: { [vf]: 1 }
+					};
+					/**
+					* `throwOnNotFound` MUST NOT ride into the CAS write. `updateByQuery`
+					* throws its own 404 on ANY filter miss when the flag is set — and a CAS
+					* miss is usually not "not found", it is "found at another version". The
+					* disambiguation below is the contract's authority on which of the two
+					* happened; letting the inner 404 fire first made it unreachable, so a
+					* caller passing `throwOnNotFound: true` got "Document not found" for a
+					* document that exists — a false statement, and one that invites the
+					* blind retry the CAS exists to prevent. The genuinely-gone case still
+					* honours the flag via the shared `!result && wantsThrow` throw below.
+					*/
+					result = await this._withResilience(context, () => updateByQuery(
+						this.Model,
+						/**
+						* Injected scope FIRST, caller authority LAST. `context.query`
+						* is hook-supplied (tenant scoping, soft-delete filters) and
+						* must only ever NARROW the match — spread last it could
+						* REPLACE `_id` (retargeting the write) or `__v` (defeating the
+						* CAS that is the entire point of this branch).
+						*/
+						{
+							...context.query || {},
+							[effectiveIdField]: id,
+							[vf]: options.ifVersion
+						},
+						casUpdate,
+						{
+							...context,
+							throwOnNotFound: false
+						}
+					));
+					if (!result) {
+						/**
+						* Disambiguate the miss — the contract's teeth. Filter-matched-
+						* nothing is TWO different facts: record gone (stays null, the
+						* MinimalRepo miss contract) or record moved past the expected
+						* version (MUST throw — null would read as not-found and invite
+						* a blind retry that overwrites the concurrent write).
+						*/
+						const current = await this.Model.findOne({
+							...context.query || {},
+							[effectiveIdField]: id
+						}).session(context.session ?? null).lean().exec();
+						if (current) throw new VersionConflictError({
+							expectedVersion: options.ifVersion,
+							...typeof current[vf] === "number" ? { actualVersion: current[vf] } : {},
+							id: String(id)
+						});
+					}
+				} else if (effectiveIdField !== "_id") result = await this._withResilience(context, () => updateByQuery(this.Model, {
 					[effectiveIdField]: id,
 					...context.query || {}
 				}, context.data || data, context));
@@ -3471,14 +3572,15 @@ var Repository = class extends RepositoryBase {
 			} };
 		} else {
 			const callerSet = patch.$set ?? {};
-			if (isStateNoop) if (Object.keys(callerSet).length === 0) {
-				const { $set, ...rest } = patch;
-				update = rest;
+			if (isStateNoop) {
+				if (Object.keys(callerSet).length === 0) {
+					const { $set, ...rest } = patch;
+					update = rest;
+				} else update = {
+					...patch,
+					$set: { ...callerSet }
+				};
 			} else update = {
-				...patch,
-				$set: { ...callerSet }
-			};
-			else update = {
 				...patch,
 				$set: {
 					...callerSet,
@@ -4310,9 +4412,9 @@ var Repository = class extends RepositoryBase {
 				const appendLookupStages$2 = (pipeline) => appendLookupStages(pipeline, lookups, projection, isKeyset && sort ? this._parseSort(sort) : void 0);
 				if (isKeyset && sort) {
 					const parsedSort = this._parseSort(sort);
-					const { validateKeysetSort } = await import("./PaginationEngine-CSh-P8Nh.mjs").then((n) => n.n);
-					const { encodeCursor, resolveCursorFilter } = await import("./PaginationEngine-CSh-P8Nh.mjs").then((n) => n.i);
-					const { getPrimaryField } = await import("./PaginationEngine-CSh-P8Nh.mjs").then((n) => n.n);
+					const { validateKeysetSort } = await import("./PaginationEngine-GdyX29tE.mjs").then((n) => n.n);
+					const { encodeCursor, resolveCursorFilter } = await import("./PaginationEngine-GdyX29tE.mjs").then((n) => n.i);
+					const { getPrimaryField } = await import("./PaginationEngine-GdyX29tE.mjs").then((n) => n.n);
 					const normalizedSort = validateKeysetSort(parsedSort, this._pagination.config.strictKeysetSortFields);
 					const cursorVersion = this._pagination.config.cursorVersion ?? 1;
 					const minCursorVersion = this._pagination.config.minCursorVersion ?? 1;
@@ -4511,7 +4613,7 @@ var Repository = class extends RepositoryBase {
 	*/
 	async withTransaction(callback, options = {}) {
 		return withTransaction(this.Model.db, async (session) => {
-			return callback(createTxBoundRepo(this, session));
+			return callback(createTxBoundRepo(this, session), { session });
 		}, options);
 	}
 	/**
@@ -4684,6 +4786,16 @@ var Repository = class extends RepositoryBase {
 		return isDuplicateKeyError(err);
 	}
 	/**
+	* Classify a transactional-write failure as a TRANSIENT concurrency
+	* conflict — one MongoDB designed callers to recover from by re-running
+	* the transaction (`TransientTransactionError` label / WriteConflict 112).
+	* Consumed by repo-core's `retryingTransaction`; conservative on purpose —
+	* never classifies from message text.
+	*/
+	isTransientConflictError(err) {
+		return conservativeMongoIsTransientConflict(err);
+	}
+	/**
 	* Handle errors with proper HTTP status codes.
 	*
 	* **Transactional retry signal preservation.** MongoDB driver errors
@@ -4703,6 +4815,7 @@ var Repository = class extends RepositoryBase {
 		const labels = error.errorLabels;
 		const hasLabel = error.hasErrorLabel;
 		if (Array.isArray(labels) && (labels.includes("TransientTransactionError") || labels.includes("UnknownTransactionCommitResult")) || typeof hasLabel === "function" && (hasLabel.call(error, "TransientTransactionError") || hasLabel.call(error, "UnknownTransactionCommitResult"))) return error;
+		if (error instanceof mongoose.mongo.MongoOperationTimeoutError) return error;
 		if (error instanceof mongoose.Error.ValidationError) {
 			const messages = Object.values(error.errors).map((err) => err.message);
 			return createError(400, `Validation Error: ${messages.join(", ")}`);

package/dist/{Repository-BAzymuOz.d.mts → Repository-BdSkQ8vc.d.mts}

@@ -1,13 +1,14 @@
-import { _ as WithTransactionOptions, a as DeleteManyResult, f as OperationOptions, g as UpdateOptions, h as UpdateManyResult, i as CreateOptions, l as LookupPopulateOptions, m as SessionOptions, o as DeleteResult, p as ReadOptions, r as CacheableOptions, s as FindOneAndUpdateOptions, t as AggregateOptions, u as LookupPopulateResult, v as LookupBuilder, y as LookupOptions } from "./operations-CuzX9m2Z.mjs";
+import { _ as UpdateOptions, a as CreateOptions, b as LookupOptions, c as FindOneAndUpdateOptions, d as LookupPopulateResult, g as UpdateManyResult, h as SessionOptions, m as ReadOptions, o as DeleteManyResult, p as OperationOptions, r as CacheableOptions, s as DeleteResult, t as AggregateOptions, u as LookupPopulateOptions, v as WithTransactionOptions, y as LookupBuilder } from "./operations-DZodvjC-.mjs";
 import { a as PopulateSpec, i as ObjectId, l as SortSpec$1, o as ReadPreferenceType, s as SelectSpec } from "./core-62oo3N1C.mjs";
 import { c as PaginationConfig, r as CollationOptions, t as AggregatePaginationOptions } from "./pagination-jSUdrACK.mjs";
-import { _ as RepositoryOptions, d as PluginType, f as PrioritizedHook, o as Middleware, p as RepositoryContext } from "./repository-Q16ErTu8.mjs";
+import { _ as RepositoryOptions, d as PluginType, f as PrioritizedHook, o as Middleware, p as RepositoryContext } from "./repository-H_ffGgpE.mjs";
 import { t as PaginationEngine } from "./PaginationEngine-CBS1XGzp.mjs";
 import { AggPaginationRequest, AggRequest, AggResult, ArchiveOptions, ArchiveResult, ArchiveSink, ChangeEvent, FilterInput, KeysetAggPaginationResult, QueryOptions, RepoCapabilities, RepositoryBase, TenantPurgeOptions, TenantPurgeResult, TenantPurgeStrategy, WatchOptions } from "@classytic/repo-core/repository";
 import { ClientSession, Expression, Model, PipelineStage, PopulateOptions } from "mongoose";
 import { Filter } from "@classytic/repo-core/filter";
-import { UpdateInput } from "@classytic/repo-core/update";
+import { RepositoryCacheHandle } from "@classytic/repo-core/cache";
 import { HttpError } from "@classytic/repo-core/errors";
+import { UpdateInput } from "@classytic/repo-core/update";
 import { AggregatePaginationResult, KeysetPaginationResult, OffsetPaginationResult, OffsetPaginationResultCore } from "@classytic/repo-core/pagination";
 //#region src/query/AggregationBuilder.d.ts
 /** Options for $vectorSearch stage (Atlas only) */
@@ -520,6 +521,16 @@ interface TransitionMachine {
   assertTransition(entityId: string, from: string, to: string): void;
 }
 declare class Repository<TDoc = unknown> extends RepositoryBase {
+  /**
+   * Cache handle ATTACHED BY the unified cache plugin at wiring time —
+   * `undefined` when no cache is configured. Declared (optional) so
+   * consumers and this class's own methods read `this.cache` typed instead
+   * of probing through `as unknown as { cache?: … }` — mongokit itself
+   * carried that erasure in `invalidateAggregateCache`, and every host that
+   * wanted the handle copied it. The plugin's `Object.assign` keeps working
+   * unchanged; nothing here constructs the handle.
+   */
+  cache?: RepositoryCacheHandle;
   /**
    * Runtime capability descriptor required by `StandardRepo<TDoc>`
    * (repo-core 0.6.0). Hosts feature-detect once at boot instead of
@@ -556,6 +567,8 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
   readonly model: string;
   readonly _pagination: PaginationEngine<TDoc>;
   readonly idField: string;
+  /** Version field for `ifVersion` CAS writes. Default '__v'. */
+  readonly versionField: string;
   readonly searchMode: 'text' | 'regex' | 'auto';
   readonly searchFields: string[] | undefined;
   [key: string]: unknown;
@@ -1747,7 +1760,9 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * });
    * ```
    */
-  withTransaction<T>(callback: (txRepo: this) => Promise<T>, options?: WithTransactionOptions): Promise<T>;
+  withTransaction<T>(callback: (txRepo: this, uow?: {
+    session?: ClientSession;
+  }) => Promise<T>, options?: WithTransactionOptions): Promise<T>;
   /**
    * Execute custom query with event emission
    */
@@ -1827,6 +1842,14 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * }
    */
   isDuplicateKeyError(err: unknown): boolean;
+  /**
+   * Classify a transactional-write failure as a TRANSIENT concurrency
+   * conflict — one MongoDB designed callers to recover from by re-running
+   * the transaction (`TransientTransactionError` label / WriteConflict 112).
+   * Consumed by repo-core's `retryingTransaction`; conservative on purpose —
+   * never classifies from message text.
+   */
+  isTransientConflictError(err: unknown): boolean;
   /**
    * Handle errors with proper HTTP status codes.
    *

package/dist/actions/index.d.mts

@@ -1,2 +1,2 @@
-import { a as create_d_exports, i as delete_d_exports, n as update_d_exports, o as aggregate_d_exports, r as read_d_exports } from "../index-Beyr1r4d.mjs";
+import { a as create_d_exports, i as delete_d_exports, n as update_d_exports, o as aggregate_d_exports, r as read_d_exports } from "../index-DKEql4cL.mjs";
 export { aggregate_d_exports as aggregate, create_d_exports as create, delete_d_exports as deleteActions, read_d_exports as read, update_d_exports as update };

package/dist/actions/index.mjs

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
-import { g as create_exports, i as update_exports, p as delete_exports, u as read_exports, v as aggregate_exports } from "../update-w5i-pa_c.mjs";
+import { g as create_exports, i as update_exports, p as delete_exports, u as read_exports, v as aggregate_exports } from "../update-jSXp3nu3.mjs";
 //#region src/actions/index.ts
 var actions_exports = /* @__PURE__ */ __exportAll({
 	aggregate: () => aggregate_exports,

package/dist/ai/index.d.mts

@@ -1,4 +1,4 @@
-import { l as Plugin } from "../repository-Q16ErTu8.mjs";
+import { l as Plugin } from "../repository-H_ffGgpE.mjs";
 import { PipelineStage } from "mongoose";
 //#region src/ai/types.d.ts
 /** Supported similarity metrics for vector search */

package/dist/better-auth/index.d.mts

@@ -156,6 +156,25 @@ interface BetterAuthOverlayOptions<TDoc = Record<string, unknown>> {
    * `@classytic/mongokit` to wire OpenAPI auto-gen.
    */
   schemaGenerator?: any;
+  /**
+   * Return a WRITABLE repository. Default `false` — the overlay is a
+   * read-side projection, and its repository is sealed
+   * (`asReadOnlyRepo`): writes throw, and `capabilities.readOnly` lets a
+   * host refuse write ROUTES at boot.
+   *
+   * Better Auth owns writes to these collections and enforces invariants
+   * the documents cannot: password hashing, session revocation, org
+   * membership cascades, and every plugin hook (passkey, SSO, ...). A
+   * generic `POST /users` through this repository bypasses all of it and
+   * writes a row Better Auth never saw. That is one route-config line away
+   * whenever the repository is writable, so the seal is the default rather
+   * than a docstring.
+   *
+   * Set `true` ONLY for administrative repair paths where you have
+   * accepted that responsibility. Normal identity mutations go through
+   * `auth.api`.
+   */
+  unsafeWritable?: boolean;
 }
 /**
  * Create a `DataAdapter<TDoc>` over a Better Auth collection.

package/dist/better-auth/index.mjs

@@ -1,5 +1,6 @@
-import { n as Repository } from "../Repository-B_1y9cCf.mjs";
+import { n as Repository } from "../Repository-BArvU32x.mjs";
 import { n as createMongooseAdapter } from "../adapter-BitHg-CN.mjs";
+import { asReadOnlyRepo } from "@classytic/repo-core/repository";
 import { pluralizeBetterAuthCollection, resolveBetterAuthCollections } from "@classytic/repo-core/better-auth";
 //#region src/better-auth/index.ts
 /**
@@ -95,7 +96,7 @@ function registerBetterAuthStubs(mongoose, options = {}) {
 *         would silently drop this call's `additionalFields` / `indexes`).
 */
 async function createBetterAuthOverlay(options) {
-	const { auth, mongoose, collection, additionalFields = {}, indexes = [], usePlural = false, RepositoryClass, schemaGenerator } = options;
+	const { auth, mongoose, collection, additionalFields = {}, indexes = [], usePlural = false, RepositoryClass, schemaGenerator, unsafeWritable = false } = options;
 	const ctx = await auth.$context;
 	const tableConfig = ctx.tables[collection];
 	if (!tableConfig) throw new Error(`[mongokit:better-auth] Better Auth has no table named '${collection}'. Available: ${Object.keys(ctx.tables).join(", ")}. Did you enable the right plugin in your betterAuth() config?`);
@@ -142,7 +143,8 @@ async function createBetterAuthOverlay(options) {
 		for (const idx of indexes) schema.index(idx.fields, idx.options);
 		Model = mongoose.model(finalName, schema);
 	}
-	const repository = new (RepositoryClass ?? Repository)(Model);
+	const built = new (RepositoryClass ?? Repository)(Model);
+	const repository = unsafeWritable ? built : asReadOnlyRepo(built, { reason: `Better Auth owns writes to '${finalName}' (hashing, session revocation, org cascades, plugin hooks) — mutate via auth.api, not generic CRUD. Pass \`unsafeWritable: true\` to this overlay if raw administrative writes are required` });
 	return createMongooseAdapter({
 		model: Model,
 		repository,

package/dist/{create-repository-mEdfH9sz.d.mts → create-repository-BU4x9Kb0.d.mts}

@@ -1,8 +1,8 @@
 import { c as PaginationConfig } from "./pagination-jSUdrACK.mjs";
-import { _ as RepositoryOptions, d as PluginType } from "./repository-Q16ErTu8.mjs";
-import { T as AuditTrailOptions, _ as RepositoryCachePluginOptions, i as CustomIdOptions, t as MultiTenantOptions } from "./multi-tenant.plugin-2VtSSm1Y.mjs";
-import { n as Repository } from "./Repository-BAzymuOz.mjs";
-import { i as Logger, o as SoftDeleteOptions } from "./plugin-options-BsFH0sTi.mjs";
+import { _ as RepositoryOptions, d as PluginType } from "./repository-H_ffGgpE.mjs";
+import { T as AuditTrailOptions, _ as RepositoryCachePluginOptions, i as CustomIdOptions, t as MultiTenantOptions } from "./multi-tenant.plugin-BwSvTirB.mjs";
+import { n as Repository } from "./Repository-BdSkQ8vc.mjs";
+import { i as Logger, o as SoftDeleteOptions } from "./plugin-options-DXnlKM3B.mjs";
 import { Model } from "mongoose";
 //#region src/create-repository.d.ts
 /**

package/dist/{create-repository-a3DQ5tzt.mjs → create-repository-CPNbktFG.mjs}

@@ -1,5 +1,5 @@
-import { n as Repository } from "./Repository-B_1y9cCf.mjs";
-import { a as customIdPlugin, f as auditTrailPlugin, i as multiTenantPlugin, m as auditLogPlugin, n as softDeletePlugin, t as timestampPlugin, u as cachePlugin } from "./timestamp.plugin-CAXzHs9y.mjs";
+import { n as Repository } from "./Repository-BArvU32x.mjs";
+import { a as customIdPlugin, f as auditTrailPlugin, i as multiTenantPlugin, m as auditLogPlugin, n as softDeletePlugin, t as timestampPlugin, u as cachePlugin } from "./timestamp.plugin-BEc6TANm.mjs";
 import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "./method-registry.plugin-DblM7V6j.mjs";
 //#region src/create-repository.ts
 function isLoggerAudit(value) {

package/dist/id-chunks-BmAwsqNk.mjs

@@ -0,0 +1,67 @@
+//#region src/utils/id-chunks.ts
+/**
+* Default slice for `$in` fan-out. Larger than `runChunkedPurge`'s 1000 on purpose:
+* a purge chunk bounds the WRITE LOCK SCOPE of each progressive strategy step, while a
+* snapshot slice bounds only the query-document size and the per-call working set —
+* 10k ObjectIds is ~120 KB of `$in`, far under every limit, at 10× fewer round trips.
+*/
+const DEFAULT_ID_CHUNK = 1e4;
+/**
+* Collect the bare id values matching `filter`, streaming via a driver cursor so the
+* only O(n) allocation is the returned array itself (a `find().lean()` materializes an
+* intermediate array of `{_id}` documents first — roughly double the peak for large n).
+*/
+async function collectIds(model, filter, options = {}) {
+	const idField = options.idField ?? "_id";
+	const ids = [];
+	const cursor = model.find(filter, { [idField]: 1 }).session(options.session ?? null).lean().cursor();
+	for await (const doc of cursor) ids.push(doc[idField]);
+	return ids;
+}
+/**
+* Yield `ids` in consecutive slices of at most `size`. Yields nothing for an empty
+* array. `size` must be a positive integer — sliced `$in` correctness depends on it,
+* so a nonsense size throws instead of silently degrading to one giant slice.
+*/
+function* idChunks(ids, size) {
+	if (!Number.isInteger(size) || size < 1) throw new Error(`idChunks: size must be a positive integer, got ${String(size)}`);
+	for (let i = 0; i < ids.length; i += size) yield ids.slice(i, i + size);
+}
+/**
+* Compose the keyset-progressed select filter: the base predicate, narrowed to rows past
+* the last committed `_id`. `cursor == null` means "from the start". Selection paired
+* with this must sort `_id`-ascending ({@link selectKeysetChunk} does), so `$gt: cursor`
+* never revisits a processed row and never skips an unprocessed one. Never mutates
+* `baseFilter`.
+*/
+function keysetFilter(baseFilter, cursor) {
+	return cursor == null ? baseFilter : {
+		...baseFilter,
+		_id: { $gt: cursor }
+	};
+}
+/**
+* The `_id`-ascending bounded chunk select both action ports share:
+* `find(filter).sort({_id: 1}).limit(limit).lean()`. Lean on purpose — chunk consumers
+* want plain objects, not hydrated documents. Pass `projection: {_id: 1}` when only ids
+* are needed (the purge port's common path); omit it for full docs (archive's readChunk,
+* anonymize-functional).
+*/
+async function selectKeysetChunk(model, filter, limit, options = {}) {
+	return await model.find(filter, options.projection).sort({ _id: 1 }).limit(limit).session(options.session ?? null).lean().exec();
+}
+/**
+* Re-assert the base predicate on an id-narrowed WRITE: `{...base, _id: {$in: ids}}`.
+* The `$in` alone would be enough to address the chunk, but carrying the base predicate
+* defends against a row whose scope fields changed between the chunk select and the
+* write — such a row is silently skipped instead of written outside its cohort. Both
+* action ports use this shape; use it for any select-then-write over a chunk.
+*/
+function narrowToIds(baseFilter, ids) {
+	return {
+		...baseFilter,
+		_id: { $in: ids }
+	};
+}
+//#endregion
+export { narrowToIds as a, keysetFilter as i, collectIds as n, selectKeysetChunk as o, idChunks as r, DEFAULT_ID_CHUNK as t };

package/dist/{index-Beyr1r4d.d.mts → index-DKEql4cL.d.mts}

@@ -1,4 +1,4 @@
-import { c as GroupResult, d as MinMaxResult, f as OperationOptions, g as UpdateOptions, h as UpdateManyResult, i as CreateOptions, o as DeleteResult, s as FindOneAndUpdateOptions, y as LookupOptions } from "./operations-CuzX9m2Z.mjs";
+import { _ as UpdateOptions, a as CreateOptions, b as LookupOptions, c as FindOneAndUpdateOptions, f as MinMaxResult, g as UpdateManyResult, l as GroupResult, p as OperationOptions, s as DeleteResult } from "./operations-DZodvjC-.mjs";
 import { a as PopulateSpec, i as ObjectId, l as SortSpec, o as ReadPreferenceType, s as SelectSpec, t as AnyDocument } from "./core-62oo3N1C.mjs";
 import { p as UpdateWithValidationResult } from "./type-utils-CLzRFtIA.mjs";
 import { Model, PipelineStage } from "mongoose";