@classytic/mongokit 3.32.0 → 3.34.0

package/dist/{PaginationEngine-CSh-P8Nh.mjs → PaginationEngine-GdyX29tE.mjs}

@@ -35,18 +35,20 @@ function buildKeysetFilter(baseFilters, sort, cursorValue, cursorId, cursorValue
 		const primaryField = sortFields[0] || "_id";
 		const direction = sort[primaryField];
 		const operator = direction === 1 ? "$gt" : "$lt";
-		if (cursorValue === null || cursorValue === void 0) if (direction === 1) return {
-			...baseFilters,
-			$or: [{
+		if (cursorValue === null || cursorValue === void 0) {
+			if (direction === 1) return {
+				...baseFilters,
+				$or: [{
+					[primaryField]: null,
+					_id: { $gt: cursorId }
+				}, { [primaryField]: { $ne: null } }]
+			};
+			else return {
+				...baseFilters,
 				[primaryField]: null,
-				_id: { $gt: cursorId }
-			}, { [primaryField]: { $ne: null } }]
-		};
-		else return {
-			...baseFilters,
-			[primaryField]: null,
-			_id: { $lt: cursorId }
-		};
+				_id: { $lt: cursorId }
+			};
+		}
 		return {
 			...baseFilters,
 			$or: [{ [primaryField]: { [operator]: cursorValue } }, {

package/dist/{Repository-B_1y9cCf.mjs → Repository-BArvU32x.mjs}

@@ -1,12 +1,14 @@
 import { i as isValidIdForType, t as getSchemaIdType } from "./id-resolution-BqDrk0S2.mjs";
-import { a as count, b as LookupBuilder, c as getByQuery, d as deleteById, f as deleteByQuery, h as createMany, l as getOrCreate, m as create, n as update, o as exists, r as updateByQuery, s as getById, t as findOneAndUpdate, x as compileFilterToMongo, y as distinct } from "./update-w5i-pa_c.mjs";
+import { a as narrowToIds, i as keysetFilter, o as selectKeysetChunk } from "./id-chunks-BmAwsqNk.mjs";
+import { a as count, b as LookupBuilder, c as getByQuery, d as deleteById, f as deleteByQuery, h as createMany, l as getOrCreate, m as create, n as update, o as exists, r as updateByQuery, s as getById, t as findOneAndUpdate, x as compileFilterToMongo, y as distinct } from "./update-jSXp3nu3.mjs";
 import { n as warn } from "./logger-K7dPmu2U.mjs";
 import { n as isDuplicateKeyError, r as parseDuplicateKeyError, t as createError } from "./error-BuByZwKU.mjs";
-import { r as calculateTotalPages, t as PaginationEngine } from "./PaginationEngine-CSh-P8Nh.mjs";
+import { r as calculateTotalPages, t as PaginationEngine } from "./PaginationEngine-GdyX29tE.mjs";
 import { hasNearOperator, rewriteNearForCount } from "./query/primitives/geo.mjs";
 import { RepositoryBase, runChunkedArchive, runChunkedPurge, throwIfAborted, validatePluginOrder, withRetry } from "@classytic/repo-core/repository";
 import mongoose from "mongoose";
 import { isFilter } from "@classytic/repo-core/filter";
+import { VersionConflictError, conservativeMongoIsTransientConflict } from "@classytic/repo-core/errors";
 import { HOOK_PRIORITY } from "@classytic/repo-core/hooks";
 import { compileUpdateSpecToMongo, isUpdateSpec } from "@classytic/repo-core/update";
 import { decodeAggCursor, encodeAggCursor, isKeysetMode, normalizeGroupBy, validateMeasures } from "@classytic/repo-core/aggregate";
@@ -48,10 +50,7 @@ function createKeysetPurgePort(repo, baseFilter, session) {
 		bypassTenant: true
 	};
 	let cursor = null;
-	const selectFilter = () => cursor == null ? baseFilter : {
-		...baseFilter,
-		_id: { $gt: cursor }
-	};
+	const selectFilter = () => keysetFilter(baseFilter, cursor);
 	return { async purgeChunk(strategy, limit) {
 		if (strategy.type === "anonymize") {
 			if (Object.values(strategy.fields).some((v) => typeof v === "function")) {
@@ -60,13 +59,13 @@ function createKeysetPurgePort(repo, baseFilter, session) {
 				return processed;
 			}
 		}
-		const idDocs = await repo.Model.find(selectFilter(), { _id: 1 }).sort({ _id: 1 }).limit(limit).session(session ?? null).lean().exec();
+		const idDocs = await selectKeysetChunk(repo.Model, selectFilter(), limit, {
+			session,
+			projection: { _id: 1 }
+		});
 		if (idDocs.length === 0) return 0;
 		const ids = idDocs.map((d) => d._id);
-		const chunkFilter = {
-			...baseFilter,
-			_id: { $in: ids }
-		};
+		const chunkFilter = narrowToIds(baseFilter, ids);
 		switch (strategy.type) {
 			case "hard":
 				await repo.deleteMany(chunkFilter, {
@@ -101,7 +100,7 @@ function createKeysetPurgePort(repo, baseFilter, session) {
 * is the same write), this matches the at-least-once contract.
 */
 async function purgeAnonymizeFunctional(repo, selectFilter, fields, limit, session) {
-	const docs = await repo.Model.find(selectFilter).sort({ _id: 1 }).limit(limit).session(session ?? null).lean().exec();
+	const docs = await selectKeysetChunk(repo.Model, selectFilter, limit, { session });
 	if (docs.length === 0) return {
 		processed: 0,
 		lastId: null
@@ -138,10 +137,11 @@ function transactionResolutionOf(caps) {
 /**
 * What MongoDB supports through mongokit's surface, DECLARED (not observed).
 *
-* Deployment-dependent flags (`transactions`, `nestedTransactions`,
-* `changeStreams` — all three need a replica set or mongos) are `true` here
-* because they describe the product, not the server you happen to be pointed
-* at. **Do not read this constant to decide whether a live connection can run
+* Deployment-dependent flags (`transactions`, `changeStreams` — both need a
+* replica set or mongos) are `true` here because they describe the product,
+* not the server you happen to be pointed at. `nestedTransactions` is NOT one
+* of them: it is `false` unconditionally, because the refusal comes from
+* mongokit's own tx-bound proxy rather than from the deployment. **Do not read this constant to decide whether a live connection can run
 * a transaction** — that is {@link resolveMongoCapabilities}, which is what
 * `Repository#capabilities` returns. This one is for the cross-kit conformance
 * harness (which overrides environment-specific limits where it is
@@ -150,9 +150,11 @@ function transactionResolutionOf(caps) {
 const MONGOKIT_CAPABILITIES = Object.freeze({
 	transactionsResolution: "declared",
 	transactions: true,
-	nestedTransactions: true,
+	nestedTransactions: false,
+	transactionRetry: "managed",
 	upsert: true,
 	duplicateKeyError: true,
+	optimisticConcurrency: true,
 	distinct: true,
 	aggregate: true,
 	aggregateOps: Object.freeze({
@@ -251,7 +253,7 @@ function deriveCapabilities(support) {
 		...MONGOKIT_CAPABILITIES,
 		transactionsResolution: support === "unknown" ? "unknown" : "observed",
 		transactions: available,
-		nestedTransactions: available,
+		nestedTransactions: false,
 		changeStreams: available
 	});
 }
@@ -830,7 +832,8 @@ function compile(filter) {
 		} };
 		case "regex": return { $regexMatch: {
 			input: `$${filter.field}`,
-			regex: filter.pattern
+			regex: filter.pattern,
+			...filter.flags ? { options: filter.flags } : {}
 		} };
 		case "and": {
 			if (filter.children.length === 0) return true;
@@ -1347,14 +1350,11 @@ function buildKeysetPredicate(sort, cursor) {
 function createMongoArchivePort(repo, filter, session) {
 	return {
 		async readChunk(limit) {
-			return await repo.Model.find(filter).sort({ _id: 1 }).limit(limit).session(session ?? null).lean().exec();
+			return selectKeysetChunk(repo.Model, filter, limit, { session });
 		},
 		async deleteChunk(docs) {
 			const ids = docs.map((doc) => doc._id);
-			return (await repo.deleteMany({
-				...filter,
-				_id: { $in: ids }
-			}, {
+			return (await repo.deleteMany(narrowToIds(filter, ids), {
 				session,
 				bypassTenant: true,
 				mode: "hard"
@@ -2204,6 +2204,33 @@ function assertNoMixedPatchShape(opName, patch) {
 	const flatKeys = patchKeys.filter((k) => !k.startsWith("$"));
 	throw createError(400, `[${opName}] assertNoMixedPatchShape: patch mixes Mongo operators (${operatorKeys.join(", ")}) with raw field keys (${flatKeys.join(", ")}). Mongo would silently DROP the flat keys — that's a write-loss bug we refuse to forward. Either wrap the flat keys in $set explicitly, or remove the operator keys.`);
 }
+/**
+* Under `ifVersion`, the CAS owns the version field EXCLUSIVELY.
+*
+* The write merges `$inc: { [versionField]: 1 }` into the caller's payload, so
+* a payload that also touches the version field produces one of two silent
+* wrongs: Mongo rejects the whole update with a path-conflict error that names
+* an internal field the caller never wrote (`$set: { __v }`, `$unset`,
+* `$rename`), or the merge quietly overrides the caller's intent (`$inc: { __v: 5 }`
+* becomes `1`). Neither is a failure a caller can act on, so the payload is
+* refused up front and the reason is named.
+*
+* `$inc: { [versionField]: 1 }` is permitted: it is exactly what the CAS does
+* anyway, so a caller declaring it redundantly is stating the truth.
+*/
+function assertCasOwnsVersionField(opName, patch, versionField) {
+	for (const [op, value] of Object.entries(patch)) {
+		if (!op.startsWith("$")) {
+			if (op === versionField) throw createError(400, `[${opName}] payload sets '${versionField}' directly, but the optimistic-concurrency CAS owns that field — it increments it as part of the same write. Remove it; the expected value belongs in \`options.ifVersion\`, not the payload.`);
+			continue;
+		}
+		if (typeof value !== "object" || value === null) continue;
+		const fields = value;
+		if (!(versionField in fields)) continue;
+		if (op === "$inc" && fields[versionField] === 1) continue;
+		throw createError(400, `[${opName}] payload's ${op} targets '${versionField}', but the optimistic-concurrency CAS owns that field — it increments it as part of the same write. ` + (op === "$inc" ? `Only \`$inc: { ${versionField}: 1 }\` is accepted (it matches what the CAS does); any other increment would be silently overridden. ` : `A conflicting ${op} would either fail the update with a Mongo path conflict or be silently overridden. `) + `Remove it; the expected version belongs in \`options.ifVersion\`.`);
+	}
+}
 /** Mongo `operationType` → portable `ChangeEvent.operation`. */
 const CHANGE_OPERATION_MAP = {
 	insert: "create",
@@ -2280,6 +2307,8 @@ var Repository = class extends RepositoryBase {
 	model;
 	_pagination;
 	idField;
+	/** Version field for `ifVersion` CAS writes. Default '__v'. */
+	versionField;
 	searchMode;
 	searchFields;
 	_hasTextIndex = null;
@@ -2307,6 +2336,7 @@ var Repository = class extends RepositoryBase {
 		this.model = Model.modelName;
 		this._pagination = new PaginationEngine(Model, paginationConfig);
 		this.idField = options.idField ?? "_id";
+		this.versionField = options.versionField ?? "__v";
 		this.searchMode = options.searchMode ?? "text";
 		this.searchFields = options.searchFields;
 		this._wireStrictQueryStripDiagnostic(options.warnOnStrictQueryStrip === true);
@@ -3218,7 +3248,78 @@ var Repository = class extends RepositoryBase {
 					}
 				}
 				let result;
-				if (effectiveIdField !== "_id") result = await this._withResilience(context, () => updateByQuery(this.Model, {
+				if (options.ifVersion !== void 0) {
+					/**
+					* Optimistic CAS: the version predicate joins the match filter, so
+					* the check and the write are ONE round-trip — no read-then-write
+					* window. The `$inc` rides the same operation; a versioned write
+					* that did not bump the version would let the NEXT writer pass the
+					* same CAS and silently clobber this one.
+					*/
+					const vf = this.versionField;
+					const payload = context.data || data;
+					assertNoMixedPatchShape("update(ifVersion)", payload);
+					assertCasOwnsVersionField("update(ifVersion)", payload, vf);
+					const casUpdate = Object.keys(payload).some((k) => k.startsWith("$")) ? {
+						...payload,
+						$inc: {
+							...payload.$inc ?? {},
+							[vf]: 1
+						}
+					} : {
+						$set: payload,
+						$inc: { [vf]: 1 }
+					};
+					/**
+					* `throwOnNotFound` MUST NOT ride into the CAS write. `updateByQuery`
+					* throws its own 404 on ANY filter miss when the flag is set — and a CAS
+					* miss is usually not "not found", it is "found at another version". The
+					* disambiguation below is the contract's authority on which of the two
+					* happened; letting the inner 404 fire first made it unreachable, so a
+					* caller passing `throwOnNotFound: true` got "Document not found" for a
+					* document that exists — a false statement, and one that invites the
+					* blind retry the CAS exists to prevent. The genuinely-gone case still
+					* honours the flag via the shared `!result && wantsThrow` throw below.
+					*/
+					result = await this._withResilience(context, () => updateByQuery(
+						this.Model,
+						/**
+						* Injected scope FIRST, caller authority LAST. `context.query`
+						* is hook-supplied (tenant scoping, soft-delete filters) and
+						* must only ever NARROW the match — spread last it could
+						* REPLACE `_id` (retargeting the write) or `__v` (defeating the
+						* CAS that is the entire point of this branch).
+						*/
+						{
+							...context.query || {},
+							[effectiveIdField]: id,
+							[vf]: options.ifVersion
+						},
+						casUpdate,
+						{
+							...context,
+							throwOnNotFound: false
+						}
+					));
+					if (!result) {
+						/**
+						* Disambiguate the miss — the contract's teeth. Filter-matched-
+						* nothing is TWO different facts: record gone (stays null, the
+						* MinimalRepo miss contract) or record moved past the expected
+						* version (MUST throw — null would read as not-found and invite
+						* a blind retry that overwrites the concurrent write).
+						*/
+						const current = await this.Model.findOne({
+							...context.query || {},
+							[effectiveIdField]: id
+						}).session(context.session ?? null).lean().exec();
+						if (current) throw new VersionConflictError({
+							expectedVersion: options.ifVersion,
+							...typeof current[vf] === "number" ? { actualVersion: current[vf] } : {},
+							id: String(id)
+						});
+					}
+				} else if (effectiveIdField !== "_id") result = await this._withResilience(context, () => updateByQuery(this.Model, {
 					[effectiveIdField]: id,
 					...context.query || {}
 				}, context.data || data, context));
@@ -3471,14 +3572,15 @@ var Repository = class extends RepositoryBase {
 			} };
 		} else {
 			const callerSet = patch.$set ?? {};
-			if (isStateNoop) if (Object.keys(callerSet).length === 0) {
-				const { $set, ...rest } = patch;
-				update = rest;
+			if (isStateNoop) {
+				if (Object.keys(callerSet).length === 0) {
+					const { $set, ...rest } = patch;
+					update = rest;
+				} else update = {
+					...patch,
+					$set: { ...callerSet }
+				};
 			} else update = {
-				...patch,
-				$set: { ...callerSet }
-			};
-			else update = {
 				...patch,
 				$set: {
 					...callerSet,
@@ -4310,9 +4412,9 @@ var Repository = class extends RepositoryBase {
 				const appendLookupStages$2 = (pipeline) => appendLookupStages(pipeline, lookups, projection, isKeyset && sort ? this._parseSort(sort) : void 0);
 				if (isKeyset && sort) {
 					const parsedSort = this._parseSort(sort);
-					const { validateKeysetSort } = await import("./PaginationEngine-CSh-P8Nh.mjs").then((n) => n.n);
-					const { encodeCursor, resolveCursorFilter } = await import("./PaginationEngine-CSh-P8Nh.mjs").then((n) => n.i);
-					const { getPrimaryField } = await import("./PaginationEngine-CSh-P8Nh.mjs").then((n) => n.n);
+					const { validateKeysetSort } = await import("./PaginationEngine-GdyX29tE.mjs").then((n) => n.n);
+					const { encodeCursor, resolveCursorFilter } = await import("./PaginationEngine-GdyX29tE.mjs").then((n) => n.i);
+					const { getPrimaryField } = await import("./PaginationEngine-GdyX29tE.mjs").then((n) => n.n);
 					const normalizedSort = validateKeysetSort(parsedSort, this._pagination.config.strictKeysetSortFields);
 					const cursorVersion = this._pagination.config.cursorVersion ?? 1;
 					const minCursorVersion = this._pagination.config.minCursorVersion ?? 1;
@@ -4511,7 +4613,7 @@ var Repository = class extends RepositoryBase {
 	*/
 	async withTransaction(callback, options = {}) {
 		return withTransaction(this.Model.db, async (session) => {
-			return callback(createTxBoundRepo(this, session));
+			return callback(createTxBoundRepo(this, session), { session });
 		}, options);
 	}
 	/**
@@ -4684,6 +4786,16 @@ var Repository = class extends RepositoryBase {
 		return isDuplicateKeyError(err);
 	}
 	/**
+	* Classify a transactional-write failure as a TRANSIENT concurrency
+	* conflict — one MongoDB designed callers to recover from by re-running
+	* the transaction (`TransientTransactionError` label / WriteConflict 112).
+	* Consumed by repo-core's `retryingTransaction`; conservative on purpose —
+	* never classifies from message text.
+	*/
+	isTransientConflictError(err) {
+		return conservativeMongoIsTransientConflict(err);
+	}
+	/**
 	* Handle errors with proper HTTP status codes.
 	*
 	* **Transactional retry signal preservation.** MongoDB driver errors
@@ -4703,6 +4815,7 @@ var Repository = class extends RepositoryBase {
 		const labels = error.errorLabels;
 		const hasLabel = error.hasErrorLabel;
 		if (Array.isArray(labels) && (labels.includes("TransientTransactionError") || labels.includes("UnknownTransactionCommitResult")) || typeof hasLabel === "function" && (hasLabel.call(error, "TransientTransactionError") || hasLabel.call(error, "UnknownTransactionCommitResult"))) return error;
+		if (error instanceof mongoose.mongo.MongoOperationTimeoutError) return error;
 		if (error instanceof mongoose.Error.ValidationError) {
 			const messages = Object.values(error.errors).map((err) => err.message);
 			return createError(400, `Validation Error: ${messages.join(", ")}`);

package/dist/{Repository-BAzymuOz.d.mts → Repository-BdSkQ8vc.d.mts}

@@ -1,13 +1,14 @@
-import { _ as WithTransactionOptions, a as DeleteManyResult, f as OperationOptions, g as UpdateOptions, h as UpdateManyResult, i as CreateOptions, l as LookupPopulateOptions, m as SessionOptions, o as DeleteResult, p as ReadOptions, r as CacheableOptions, s as FindOneAndUpdateOptions, t as AggregateOptions, u as LookupPopulateResult, v as LookupBuilder, y as LookupOptions } from "./operations-CuzX9m2Z.mjs";
+import { _ as UpdateOptions, a as CreateOptions, b as LookupOptions, c as FindOneAndUpdateOptions, d as LookupPopulateResult, g as UpdateManyResult, h as SessionOptions, m as ReadOptions, o as DeleteManyResult, p as OperationOptions, r as CacheableOptions, s as DeleteResult, t as AggregateOptions, u as LookupPopulateOptions, v as WithTransactionOptions, y as LookupBuilder } from "./operations-DZodvjC-.mjs";
 import { a as PopulateSpec, i as ObjectId, l as SortSpec$1, o as ReadPreferenceType, s as SelectSpec } from "./core-62oo3N1C.mjs";
 import { c as PaginationConfig, r as CollationOptions, t as AggregatePaginationOptions } from "./pagination-jSUdrACK.mjs";
-import { _ as RepositoryOptions, d as PluginType, f as PrioritizedHook, o as Middleware, p as RepositoryContext } from "./repository-Q16ErTu8.mjs";
+import { _ as RepositoryOptions, d as PluginType, f as PrioritizedHook, o as Middleware, p as RepositoryContext } from "./repository-H_ffGgpE.mjs";
 import { t as PaginationEngine } from "./PaginationEngine-CBS1XGzp.mjs";
 import { AggPaginationRequest, AggRequest, AggResult, ArchiveOptions, ArchiveResult, ArchiveSink, ChangeEvent, FilterInput, KeysetAggPaginationResult, QueryOptions, RepoCapabilities, RepositoryBase, TenantPurgeOptions, TenantPurgeResult, TenantPurgeStrategy, WatchOptions } from "@classytic/repo-core/repository";
 import { ClientSession, Expression, Model, PipelineStage, PopulateOptions } from "mongoose";
 import { Filter } from "@classytic/repo-core/filter";
-import { UpdateInput } from "@classytic/repo-core/update";
+import { RepositoryCacheHandle } from "@classytic/repo-core/cache";
 import { HttpError } from "@classytic/repo-core/errors";
+import { UpdateInput } from "@classytic/repo-core/update";
 import { AggregatePaginationResult, KeysetPaginationResult, OffsetPaginationResult, OffsetPaginationResultCore } from "@classytic/repo-core/pagination";
 //#region src/query/AggregationBuilder.d.ts
 /** Options for $vectorSearch stage (Atlas only) */
@@ -520,6 +521,16 @@ interface TransitionMachine {
   assertTransition(entityId: string, from: string, to: string): void;
 }
 declare class Repository<TDoc = unknown> extends RepositoryBase {
+  /**
+   * Cache handle ATTACHED BY the unified cache plugin at wiring time —
+   * `undefined` when no cache is configured. Declared (optional) so
+   * consumers and this class's own methods read `this.cache` typed instead
+   * of probing through `as unknown as { cache?: … }` — mongokit itself
+   * carried that erasure in `invalidateAggregateCache`, and every host that
+   * wanted the handle copied it. The plugin's `Object.assign` keeps working
+   * unchanged; nothing here constructs the handle.
+   */
+  cache?: RepositoryCacheHandle;
   /**
    * Runtime capability descriptor required by `StandardRepo<TDoc>`
    * (repo-core 0.6.0). Hosts feature-detect once at boot instead of
@@ -556,6 +567,8 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
   readonly model: string;
   readonly _pagination: PaginationEngine<TDoc>;
   readonly idField: string;
+  /** Version field for `ifVersion` CAS writes. Default '__v'. */
+  readonly versionField: string;
   readonly searchMode: 'text' | 'regex' | 'auto';
   readonly searchFields: string[] | undefined;
   [key: string]: unknown;
@@ -1747,7 +1760,9 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * });
    * ```
    */
-  withTransaction<T>(callback: (txRepo: this) => Promise<T>, options?: WithTransactionOptions): Promise<T>;
+  withTransaction<T>(callback: (txRepo: this, uow?: {
+    session?: ClientSession;
+  }) => Promise<T>, options?: WithTransactionOptions): Promise<T>;
   /**
    * Execute custom query with event emission
    */
@@ -1827,6 +1842,14 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * }
    */
   isDuplicateKeyError(err: unknown): boolean;
+  /**
+   * Classify a transactional-write failure as a TRANSIENT concurrency
+   * conflict — one MongoDB designed callers to recover from by re-running
+   * the transaction (`TransientTransactionError` label / WriteConflict 112).
+   * Consumed by repo-core's `retryingTransaction`; conservative on purpose —
+   * never classifies from message text.
+   */
+  isTransientConflictError(err: unknown): boolean;
   /**
    * Handle errors with proper HTTP status codes.
    *

package/dist/actions/index.d.mts

@@ -1,2 +1,2 @@
-import { a as create_d_exports, i as delete_d_exports, n as update_d_exports, o as aggregate_d_exports, r as read_d_exports } from "../index-Beyr1r4d.mjs";
+import { a as create_d_exports, i as delete_d_exports, n as update_d_exports, o as aggregate_d_exports, r as read_d_exports } from "../index-DKEql4cL.mjs";
 export { aggregate_d_exports as aggregate, create_d_exports as create, delete_d_exports as deleteActions, read_d_exports as read, update_d_exports as update };

package/dist/actions/index.mjs

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
-import { g as create_exports, i as update_exports, p as delete_exports, u as read_exports, v as aggregate_exports } from "../update-w5i-pa_c.mjs";
+import { g as create_exports, i as update_exports, p as delete_exports, u as read_exports, v as aggregate_exports } from "../update-jSXp3nu3.mjs";
 //#region src/actions/index.ts
 var actions_exports = /* @__PURE__ */ __exportAll({
 	aggregate: () => aggregate_exports,

package/dist/ai/index.d.mts

@@ -1,4 +1,4 @@
-import { l as Plugin } from "../repository-Q16ErTu8.mjs";
+import { l as Plugin } from "../repository-H_ffGgpE.mjs";
 import { PipelineStage } from "mongoose";
 //#region src/ai/types.d.ts
 /** Supported similarity metrics for vector search */

package/dist/better-auth/index.d.mts

@@ -49,9 +49,32 @@ interface BAFieldAttribute {
   };
   defaultValue?: unknown;
 }
+/**
+ * How Better Auth's `_id` values are stored, so mongoose casts queries the same way.
+ *
+ * - `'objectid'` (DEFAULT) — BA's mongo adapter generating its own ids writes
+ *   real ObjectIds. Mongoose's default `_id` SchemaType casts a hex string to
+ *   ObjectId, which is what makes `findById`, `_id` filters and `populate`
+ *   resolve.
+ * - `'string'` — the host overrode `advanced.database.generateId` (commonly to
+ *   `randomBytes(12).toString('hex')`, which AVOIDS a cross-driver ObjectId
+ *   `instanceof` failure). BA then stores those ids as STRINGS.
+ *
+ * Getting this wrong fails in the quiet direction, in BOTH directions: an
+ * ObjectId-typed schema over string ids casts every lookup to an ObjectId that
+ * matches nothing, so `getById` 404s and `populate` yields null — no error, no
+ * log. Measured on a real deployment: `GET /me`, `GET /users/:id` and
+ * `GET /branches/code/:code` all 404'd for rows that existed.
+ *
+ * There is no safe default that covers both, which is why this is an explicit
+ * option rather than a guess: read `typeof doc._id` from a live row.
+ */
+type BetterAuthIdType = 'objectid' | 'string';
 interface RegisterBetterAuthStubsOptions {
   /** Plugin sets to include. `core` is always implied. */
   plugins?: BetterAuthPluginKey$1[];
+  /** How BA stores `_id` — see {@link BetterAuthIdType}. Default `'objectid'`. */
+  idType?: BetterAuthIdType;
   /** Additional collection names beyond the plugin set. */
   extraCollections?: string[];
   /** Mirror BA's `usePlural` flag — appends `s` to every collection name. */
@@ -115,6 +138,8 @@ interface BetterAuthOverlayOptions<TDoc = Record<string, unknown>> {
    * Mongoose-side concerns (validators, indexes, defaults).
    */
   additionalFields?: Record<string, unknown>;
+  /** How BA stores `_id` — see {@link BetterAuthIdType}. Default `'objectid'`. */
+  idType?: BetterAuthIdType;
   /**
    * Mongoose schema indexes to attach to the overlay model.
    *
@@ -156,6 +181,25 @@ interface BetterAuthOverlayOptions<TDoc = Record<string, unknown>> {
    * `@classytic/mongokit` to wire OpenAPI auto-gen.
    */
   schemaGenerator?: any;
+  /**
+   * Return a WRITABLE repository. Default `false` — the overlay is a
+   * read-side projection, and its repository is sealed
+   * (`asReadOnlyRepo`): writes throw, and `capabilities.readOnly` lets a
+   * host refuse write ROUTES at boot.
+   *
+   * Better Auth owns writes to these collections and enforces invariants
+   * the documents cannot: password hashing, session revocation, org
+   * membership cascades, and every plugin hook (passkey, SSO, ...). A
+   * generic `POST /users` through this repository bypasses all of it and
+   * writes a row Better Auth never saw. That is one route-config line away
+   * whenever the repository is writable, so the seal is the default rather
+   * than a docstring.
+   *
+   * Set `true` ONLY for administrative repair paths where you have
+   * accepted that responsibility. Normal identity mutations go through
+   * `auth.api`.
+   */
+  unsafeWritable?: boolean;
 }
 /**
  * Create a `DataAdapter<TDoc>` over a Better Auth collection.
@@ -181,6 +225,40 @@ declare function createBetterAuthOverlay<TDoc = Record<string, unknown>>(options
  * `Model` — so the host passes whichever it has, and mongokit keeps mongoose +
  * the mongodb driver as peer deps with zero runtime import.
  */
+/**
+ * Ensure the TTL index that reaps expired Better Auth sessions.
+ *
+ * BA stamps `expiresAt` on every session (tunable via `session.expiresIn`,
+ * default 7 days) but its mongo adapter creates NO index for it, and nothing
+ * else sweeps the collection — so `session` grows without bound on the hottest
+ * auth table. Measured on two live deployments before this existed: 568 rows
+ * (233 expired) and 909 rows of which EVERY ONE was expired, the oldest five
+ * months old.
+ *
+ * It lives here rather than in a host or a spine module because this kit is
+ * what knows Better Auth's collection names — a host-side fix only protects
+ * that host, and every other consumer keeps leaking.
+ *
+ * `expireAfterSeconds: 0` means "delete once `expiresAt` has passed", so
+ * mongo's background task keeps the collection bounded with no application
+ * code. Idempotent — re-creating an existing index is a no-op.
+ *
+ * NOT called automatically by {@link registerBetterAuthStubs}: that function is
+ * synchronous and writes nothing to the database, and silently issuing DDL from
+ * a model-registration helper would be a surprise. Call this once at boot.
+ *
+ * @returns `true` when an index was created or already present, `false` when
+ *          the attempt failed (logged by the caller, never thrown — a missing
+ *          TTL degrades storage, and refusing to boot over it is worse).
+ */
+declare function ensureBetterAuthSessionTtl(connection: {
+  collection(name: string): {
+    createIndex(keys: Record<string, 1>, opts: Record<string, unknown>): Promise<unknown>;
+  };
+}, options?: {
+  collection?: string;
+  indexName?: string;
+}): Promise<boolean>;
 interface SessionUpdaterLike {
   updateMany(filter: Record<string, unknown>, update: Record<string, unknown>): Promise<{
     modifiedCount?: number;
@@ -215,4 +293,4 @@ declare function clearActiveOrganizationFromSessions(sessions: SessionUpdaterLik
   userId?: unknown;
 }): Promise<number>;
 //#endregion
-export { BetterAuthInstance, BetterAuthOverlayOptions, type BetterAuthPluginKey, MongooseLike, RegisterBetterAuthStubsOptions, SessionUpdaterLike, clearActiveOrganizationFromSessions, createBetterAuthOverlay, registerBetterAuthStubs };
+export { BetterAuthIdType, BetterAuthInstance, BetterAuthOverlayOptions, type BetterAuthPluginKey, MongooseLike, RegisterBetterAuthStubsOptions, SessionUpdaterLike, clearActiveOrganizationFromSessions, createBetterAuthOverlay, ensureBetterAuthSessionTtl, registerBetterAuthStubs };