@classytic/mongokit 3.36.0 → 3.39.0

package/dist/{Repository-BdSkQ8vc.d.mts → Repository-IxI983_m.d.mts}

@@ -1,8 +1,7 @@
-import { _ as UpdateOptions, a as CreateOptions, b as LookupOptions, c as FindOneAndUpdateOptions, d as LookupPopulateResult, g as UpdateManyResult, h as SessionOptions, m as ReadOptions, o as DeleteManyResult, p as OperationOptions, r as CacheableOptions, s as DeleteResult, t as AggregateOptions, u as LookupPopulateOptions, v as WithTransactionOptions, y as LookupBuilder } from "./operations-DZodvjC-.mjs";
-import { a as PopulateSpec, i as ObjectId, l as SortSpec$1, o as ReadPreferenceType, s as SelectSpec } from "./core-62oo3N1C.mjs";
-import { c as PaginationConfig, r as CollationOptions, t as AggregatePaginationOptions } from "./pagination-jSUdrACK.mjs";
-import { _ as RepositoryOptions, d as PluginType, f as PrioritizedHook, o as Middleware, p as RepositoryContext } from "./repository-H_ffGgpE.mjs";
-import { t as PaginationEngine } from "./PaginationEngine-CBS1XGzp.mjs";
+import { _ as UpdateOptions, a as CreateOptions, b as LookupOptions, c as FindOneAndUpdateOptions, d as LookupPopulateResult, g as UpdateManyResult, h as SessionOptions, m as ReadOptions, o as DeleteManyResult, p as OperationOptions, r as CacheableOptions, s as DeleteResult, t as AggregateOptions, u as LookupPopulateOptions, v as WithTransactionOptions, y as LookupBuilder } from "./operations-CrRIoc8Z.mjs";
+import { _ as PopulateSpec, g as ObjectId, i as CountStrategy, r as CollationOptions, t as AggregatePaginationOptions, u as PaginationConfig, v as ReadPreferenceType, x as SortSpec$1, y as SelectSpec } from "./pagination-BpIv2bdS.mjs";
+import { _ as RepositoryOptions, d as PluginType, f as PrioritizedHook, o as Middleware, p as RepositoryContext } from "./repository-ZbLtL7Nk.mjs";
+import { t as PaginationEngine } from "./PaginationEngine-D-P19Y9m.mjs";
 import { AggPaginationRequest, AggRequest, AggResult, ArchiveOptions, ArchiveResult, ArchiveSink, ChangeEvent, FilterInput, KeysetAggPaginationResult, QueryOptions, RepoCapabilities, RepositoryBase, TenantPurgeOptions, TenantPurgeResult, TenantPurgeStrategy, WatchOptions } from "@classytic/repo-core/repository";
 import { ClientSession, Expression, Model, PipelineStage, PopulateOptions } from "mongoose";
 import { Filter } from "@classytic/repo-core/filter";
@@ -580,6 +579,18 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * the `Middleware<TDoc>` type for the protocol.
    */
   private readonly _middlewares;
+  /**
+   * Shard-key guard built once from `options.distribution`; `undefined`
+   * when not configured so the per-op check is a single falsy test.
+   */
+  private readonly _checkDistribution;
+  /**
+   * Whether id-addressed verbs are guarded too — true unless the
+   * distribution key IS the id field, where an `_id` match is genuinely
+   * routed and guarding would flag every by-id call. See
+   * {@link ID_ADDRESSED_OPERATIONS}.
+   */
+  private readonly _guardIdAddressed;
   constructor(Model: Model<TDoc, any, any, any>, plugins?: PluginType[], paginationConfig?: PaginationConfig, options?: RepositoryOptions);
   /**
    * Live read-through view of the hook engine's listener registry.
@@ -860,8 +871,12 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    *     repo without a filter to observe deletes.
    *   - `options.signal` ends the iterator (closes the stream). A
    *     pre-aborted signal rejects at the op boundary like every other op.
-   *   - `options.resumeAfter` forwards a previously captured Mongo
-   *     resume token for at-least-once consumption across restarts.
+   *   - Every yielded event carries `resumeToken` (the change document's
+   *     `_id`). Persist the last one you finished processing and pass it
+   *     back as `options.resumeAfter` — or `options.startAfter` to also
+   *     step past an invalidate event — for at-least-once consumption
+   *     across restarts. Setting both is rejected up front (Mongo forbids
+   *     the combination; the driver error is far less legible).
    *
    * Context keys for policy plugins (`organizationId`, `bypassTenant`,
    * `includeDeleted`, ...) ride the options bag at runtime — same as every
@@ -906,6 +921,8 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
     sort?: SortSpec$1 | string;
     cursor?: string;
     after?: string;
+    /** Cursor for the PREVIOUS page. Mutually exclusive with `after`/`cursor`. */
+    before?: string;
     page?: number;
     pagination?: {
       page?: number;
@@ -916,7 +933,9 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
     mode?: 'offset' | 'keyset';
     hint?: string | Record<string, 1 | -1>;
     maxTimeMS?: number;
-    countStrategy?: 'exact' | 'estimated' | 'none';
+    countStrategy?: CountStrategy;
+    /** Ceiling for `countStrategy: 'capped'`. */
+    countLimit?: number;
     readPreference?: ReadPreferenceType;
     /** Advanced populate options (from QueryParser or Arc's BaseController) */
     populateOptions?: PopulateOptions[];
@@ -1782,6 +1801,16 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * 4. DEFAULT (500) — user-registered hooks
    */
   _buildContext(operation: string, options: Record<string, unknown> | object): Promise<RepositoryContext>;
+  /**
+   * Feed the resolved filter of a guarded verb to the distribution guard.
+   * The slot follows `OP_REGISTRY[op].policyKey` (`query` vs `filters`);
+   * the portable aggregate verbs ALSO carry the caller's filter on
+   * `aggRequest.filter` (merged into the pipeline later by
+   * `_injectPolicyScopeIntoAgg`), and the kit-native pipeline verbs may
+   * carry it as leading `$match` stages — both are folded in so a key the
+   * caller did supply is never reported missing.
+   */
+  private _guardDistribution;
   /**
    * Walk the well-known filter-carrying keys (`query`, `filters`,
    * `having`) and route any Filter IR through `compileFilterToMongo`.
@@ -1796,6 +1825,9 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
   private _resolveSort;
   /**
    * Detect whether to use keyset (cursor) or offset (page) pagination.
+   * Precedence: explicit `mode` → `page` (offset) → `after` (keyset) →
+   * `PaginationConfig.defaultMode` → the sort heuristic (a non-default
+   * sort with no page means the caller wants a cursor).
    */
   private _detectPaginationMode;
   /**
@@ -1866,7 +1898,22 @@ declare class Repository<TDoc = unknown> extends RepositoryBase {
    * `errorLabels` exactly as we received it. The caller still sees a
    * thrown error — only the wrapping layer is skipped.
    */
+  /**
+   * Translate a driver error into the repository's error contract, WITHOUT
+   * losing structured diagnostics an action attached to it.
+   *
+   * The translation replaces the object — an E11000 becomes a 409 — so any
+   * property a caller was meant to read went with it. `createMany` attaches a
+   * `partial` report naming which documents landed, and it arrived nowhere:
+   * the report existed, the test for it failed, and the only evidence was the
+   * absence.
+   *
+   * Carried explicitly rather than by copying every own-property, because the
+   * wrap is deliberate: the point is to hide driver internals, and a blanket
+   * copy would put them back.
+   */
   _handleError(error: Error): HttpError;
+  private _translateError;
 }
 //#endregion
 export { AggregationPlan as a, SortOrder as c, AggregationBuilder as i, SortSpec as l, Repository as n, GroupSpec as o, TransitionMachine as r, ProjectionSpec as s, HOOK_PRIORITY as t, VectorSearchOptions as u };

package/dist/actions/index.d.mts

@@ -1,2 +1,2 @@
-import { a as create_d_exports, i as delete_d_exports, n as update_d_exports, o as aggregate_d_exports, r as read_d_exports } from "../index-DKEql4cL.mjs";
+import { c as create_d_exports, i as delete_d_exports, n as update_d_exports, r as read_d_exports, u as aggregate_d_exports } from "../index-CmjNyulu.mjs";
 export { aggregate_d_exports as aggregate, create_d_exports as create, delete_d_exports as deleteActions, read_d_exports as read, update_d_exports as update };

package/dist/actions/index.mjs

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
-import { g as create_exports, i as update_exports, p as delete_exports, u as read_exports, v as aggregate_exports } from "../update-jSXp3nu3.mjs";
+import { b as create_exports, i as update_exports, m as aggregate_exports, p as delete_exports, u as read_exports } from "../update-c_01A0if.mjs";
 //#region src/actions/index.ts
 var actions_exports = /* @__PURE__ */ __exportAll({
 	aggregate: () => aggregate_exports,

package/dist/adapter/index.d.mts

@@ -129,6 +129,27 @@ declare class MongooseAdapter<TDoc = unknown, TModelDoc = unknown> implements Da
    * `matchesRecordFilter` — one shared contract/IR across every kit; its
    * evaluator is id-coercion aware so a Mongo `ObjectId` `_id` matches its
    * string form. Arrow field: keeps its binding when passed by reference.
+   *
+   * The document is flattened to a plain record FIRST, and that step is the
+   * whole reason this is not a one-liner. The evaluator resolves field paths
+   * with `Object.hasOwn`, own-properties-only and deliberately so: it must not
+   * walk a prototype chain, or a crafted `{ 'constructor.x': … }` policy filter
+   * could match an inherited member. A HYDRATED Mongoose document keeps its
+   * values in `_doc` and exposes them through prototype getters, so it has no
+   * own `status`, no own `organizationId` — every path resolves to absent and
+   * the filter matches NOTHING. Fail-closed, so it does not leak; it denies.
+   *
+   * That turned any policy at all into a blanket 404 on every non-compound
+   * fetch (`getBySlug`, cache revalidation, the realtime feed) while the same
+   * policy worked perfectly on list/get, which filter at the DB. The asymmetry
+   * is what made it so hard to see: a resource reads fine until the day someone
+   * gives it a row-level policy, and then one route starts lying.
+   *
+   * Knowing that a Mongoose document is not a plain record is the MONGO kit's
+   * job, not the dialect-agnostic evaluator's, so the normalisation lives here.
+   * `toObject` rather than `toJSON`: it preserves `ObjectId` and `Date` values,
+   * which the evaluator compares by type. A `.lean()` result is already plain
+   * and passes through untouched.
    */
   readonly matchesFilter: (item: unknown, filters: Record<string, unknown>) => boolean;
   /**

package/dist/adapter/index.mjs

@@ -1,2 +1,2 @@
-import { n as createMongooseAdapter, r as isMongooseModel, t as MongooseAdapter } from "../adapter-Bfqz8yHE.mjs";
+import { n as createMongooseAdapter, r as isMongooseModel, t as MongooseAdapter } from "../adapter-BrVfPFSW.mjs";
 export { MongooseAdapter, createMongooseAdapter, isMongooseModel };

package/dist/{adapter-Bfqz8yHE.mjs → adapter-BrVfPFSW.mjs}

@@ -19,6 +19,29 @@ const REQUIRED_REPO_METHODS = [
 	"update",
 	"delete"
 ];
+/**
+* A Mongoose document as a plain record, for anything that reads fields directly.
+*
+* Hydrated documents hold their values in `_doc` and surface them through prototype getters, so
+* `Object.hasOwn(doc, 'status')` is FALSE even though `doc.status` reads fine. Any consumer that
+* refuses to walk the prototype chain — as a prototype-pollution-safe field resolver must — sees
+* an empty document. See `matchesFilter` for what that cost us.
+*
+* `toObject` over `toJSON`: it keeps `ObjectId` and `Date` as values rather than stringifying
+* them, and callers here compare by type. Anything already plain (a `.lean()` result, a POJO) is
+* returned untouched, and a `toObject` that throws degrades to the original rather than taking
+* the caller down.
+*/
+function toPlainRecord(item) {
+	if (item === null || typeof item !== "object") return item;
+	const maybe = item;
+	if (typeof maybe.toObject !== "function") return item;
+	try {
+		return maybe.toObject();
+	} catch {
+		return item;
+	}
+}
 function describeValue(value) {
 	if (value === null) return "null";
 	if (value === void 0) return "undefined";
@@ -215,8 +238,29 @@ var MongooseAdapter = class {
 	* `matchesRecordFilter` — one shared contract/IR across every kit; its
 	* evaluator is id-coercion aware so a Mongo `ObjectId` `_id` matches its
 	* string form. Arrow field: keeps its binding when passed by reference.
+	*
+	* The document is flattened to a plain record FIRST, and that step is the
+	* whole reason this is not a one-liner. The evaluator resolves field paths
+	* with `Object.hasOwn`, own-properties-only and deliberately so: it must not
+	* walk a prototype chain, or a crafted `{ 'constructor.x': … }` policy filter
+	* could match an inherited member. A HYDRATED Mongoose document keeps its
+	* values in `_doc` and exposes them through prototype getters, so it has no
+	* own `status`, no own `organizationId` — every path resolves to absent and
+	* the filter matches NOTHING. Fail-closed, so it does not leak; it denies.
+	*
+	* That turned any policy at all into a blanket 404 on every non-compound
+	* fetch (`getBySlug`, cache revalidation, the realtime feed) while the same
+	* policy worked perfectly on list/get, which filter at the DB. The asymmetry
+	* is what made it so hard to see: a resource reads fine until the day someone
+	* gives it a row-level policy, and then one route starts lying.
+	*
+	* Knowing that a Mongoose document is not a plain record is the MONGO kit's
+	* job, not the dialect-agnostic evaluator's, so the normalisation lives here.
+	* `toObject` rather than `toJSON`: it preserves `ObjectId` and `Date` values,
+	* which the evaluator compares by type. A `.lean()` result is already plain
+	* and passes through untouched.
 	*/
-	matchesFilter = (item, filters) => matchesRecordFilter(item, filters);
+	matchesFilter = (item, filters) => matchesRecordFilter(toPlainRecord(item), filters);
 	/**
 	* No-op — mongokit's per-call resources (`watch()` change streams,
 	* `cursor()` iterators) are released by their own `AbortSignal` /

package/dist/ai/index.d.mts

@@ -1,4 +1,4 @@
-import { l as Plugin } from "../repository-H_ffGgpE.mjs";
+import { l as Plugin } from "../repository-ZbLtL7Nk.mjs";
 import { PipelineStage } from "mongoose";
 //#region src/ai/types.d.ts
 /** Supported similarity metrics for vector search */

package/dist/better-auth/index.d.mts

@@ -259,6 +259,83 @@ declare function ensureBetterAuthSessionTtl(connection: {
   collection?: string;
   indexName?: string;
 }): Promise<boolean>;
+/**
+ * One declared index on a Better Auth collection.
+ *
+ * `unique` is a REQUEST, not a guarantee: {@link ensureBetterAuthIndexes}
+ * downgrades to a non-unique index when existing rows already violate it,
+ * because failing a boot over historical duplicates is worse than running with
+ * a plain lookup index and reporting the degradation.
+ */
+interface BetterAuthIndexSpec {
+  /** Canonical collection name (`'user'`, `'session'`, ...). */
+  collection: string;
+  keys: Record<string, 1 | -1>;
+  name: string;
+  unique?: boolean;
+  /** Present on self-expiring rows; always paired with `expireAfterSeconds: 0`. */
+  ttl?: boolean;
+}
+/**
+ * The indexes Better Auth's own queries need, which its mongo adapter does NOT
+ * create. Grouped by the plugin that owns the collection so a host only pays
+ * for what it enabled.
+ *
+ * Every entry below backs a query BA runs on a hot path:
+ *   - `session.token`   — read on EVERY authenticated request
+ *   - `user.email`      — read on every sign-in / sign-up, and must be unique
+ *   - `account.(providerId|issuer, accountId)` — the credential lookup at sign-in
+ *   - `member.(organizationId, userId)` — the membership check on org-scoped requests
+ * Without them each of those is a collection scan, and `email` / `slug` /
+ * `token` have no uniqueness guarantee at all.
+ *
+ * TTL entries (`expiresAt`) additionally keep the collection BOUNDED — see
+ * {@link ensureBetterAuthSessionTtl} for the measurements that motivated it.
+ */
+declare const BA_INDEXES_BY_PLUGIN: Record<string, readonly BetterAuthIndexSpec[]>;
+/** Outcome of one declared index. */
+interface BetterAuthIndexResult {
+  collection: string;
+  name: string;
+  status: 'created' | 'degraded' | 'failed';
+  /** Set on `degraded` (unique dropped) and `failed`. */
+  reason?: string;
+}
+interface EnsureBetterAuthIndexesOptions {
+  /** Plugin sets to include beyond `core` (always implied). */
+  plugins?: BetterAuthPluginKey$1[];
+  /** Mirror BA's `usePlural` — appends `s` to every collection name. */
+  usePlural?: boolean;
+  /** Per-collection name override (mirrors BA's `user.modelName`). */
+  modelOverrides?: Partial<Record<string, string>>;
+  /** Canonical collection names to skip entirely. */
+  exclude?: string[];
+}
+interface IndexCreator {
+  collection(name: string): {
+    createIndex(keys: Record<string, 1 | -1>, opts: Record<string, unknown>): Promise<unknown>;
+  };
+}
+/**
+ * Create every index Better Auth's queries need. Idempotent, never throws.
+ *
+ * BA's mongo adapter creates NO indexes — not even on `session.token`, which is
+ * read on every authenticated request, nor a unique one on `user.email`. On a
+ * small database nobody notices; the cost arrives as a full collection scan per
+ * login once the tables grow, and until then nothing stops a duplicate email.
+ *
+ * This lives in the kit rather than a host for the same reason
+ * {@link ensureBetterAuthSessionTtl} does: the kit is what knows BA's collection
+ * names, so fixing it here protects every consumer instead of one host.
+ *
+ * **Uniqueness degrades rather than fails.** A `unique: true` spec is retried
+ * without uniqueness when the collection already holds violating rows, and
+ * reported as `degraded` — a boot must not die because historical data has a
+ * duplicate. Inspect the returned report to find those.
+ *
+ * Call once at boot, after the connection is live. Safe to call again.
+ */
+declare function ensureBetterAuthIndexes(connection: IndexCreator, options?: EnsureBetterAuthIndexesOptions): Promise<BetterAuthIndexResult[]>;
 interface SessionUpdaterLike {
   updateMany(filter: Record<string, unknown>, update: Record<string, unknown>): Promise<{
     modifiedCount?: number;
@@ -293,4 +370,4 @@ declare function clearActiveOrganizationFromSessions(sessions: SessionUpdaterLik
   userId?: unknown;
 }): Promise<number>;
 //#endregion
-export { BetterAuthIdType, BetterAuthInstance, BetterAuthOverlayOptions, type BetterAuthPluginKey, MongooseLike, RegisterBetterAuthStubsOptions, SessionUpdaterLike, clearActiveOrganizationFromSessions, createBetterAuthOverlay, ensureBetterAuthSessionTtl, registerBetterAuthStubs };
+export { BA_INDEXES_BY_PLUGIN, BetterAuthIdType, BetterAuthIndexResult, BetterAuthIndexSpec, BetterAuthInstance, BetterAuthOverlayOptions, type BetterAuthPluginKey, EnsureBetterAuthIndexesOptions, IndexCreator, MongooseLike, RegisterBetterAuthStubsOptions, SessionUpdaterLike, clearActiveOrganizationFromSessions, createBetterAuthOverlay, ensureBetterAuthIndexes, ensureBetterAuthSessionTtl, registerBetterAuthStubs };

package/dist/better-auth/index.mjs

@@ -1,5 +1,5 @@
-import { n as Repository } from "../Repository-BArvU32x.mjs";
-import { n as createMongooseAdapter } from "../adapter-Bfqz8yHE.mjs";
+import { n as Repository } from "../Repository-D7fDpyFx.mjs";
+import { n as createMongooseAdapter } from "../adapter-BrVfPFSW.mjs";
 import { asReadOnlyRepo } from "@classytic/repo-core/repository";
 import { pluralizeBetterAuthCollection, resolveBetterAuthCollections } from "@classytic/repo-core/better-auth";
 //#region src/better-auth/index.ts
@@ -203,6 +203,236 @@ async function ensureBetterAuthSessionTtl(connection, options = {}) {
 	}
 }
 /**
+* The indexes Better Auth's own queries need, which its mongo adapter does NOT
+* create. Grouped by the plugin that owns the collection so a host only pays
+* for what it enabled.
+*
+* Every entry below backs a query BA runs on a hot path:
+*   - `session.token`   — read on EVERY authenticated request
+*   - `user.email`      — read on every sign-in / sign-up, and must be unique
+*   - `account.(providerId|issuer, accountId)` — the credential lookup at sign-in
+*   - `member.(organizationId, userId)` — the membership check on org-scoped requests
+* Without them each of those is a collection scan, and `email` / `slug` /
+* `token` have no uniqueness guarantee at all.
+*
+* TTL entries (`expiresAt`) additionally keep the collection BOUNDED — see
+* {@link ensureBetterAuthSessionTtl} for the measurements that motivated it.
+*/
+const BA_INDEXES_BY_PLUGIN = {
+	core: [
+		{
+			collection: "user",
+			keys: { email: 1 },
+			name: "ba_user_email",
+			unique: true
+		},
+		{
+			collection: "session",
+			keys: { token: 1 },
+			name: "ba_session_token",
+			unique: true
+		},
+		{
+			collection: "session",
+			keys: { userId: 1 },
+			name: "ba_session_userId"
+		},
+		{
+			collection: "session",
+			keys: { expiresAt: 1 },
+			name: "ttl_session_expiresAt",
+			ttl: true
+		},
+		{
+			collection: "account",
+			keys: { userId: 1 },
+			name: "ba_account_userId"
+		},
+		{
+			collection: "account",
+			keys: {
+				providerId: 1,
+				accountId: 1
+			},
+			name: "ba_account_provider_accountId"
+		},
+		{
+			collection: "account",
+			keys: {
+				issuer: 1,
+				accountId: 1
+			},
+			name: "ba_account_issuer_accountId"
+		},
+		{
+			collection: "verification",
+			keys: { identifier: 1 },
+			name: "ba_verification_identifier"
+		},
+		{
+			collection: "verification",
+			keys: { expiresAt: 1 },
+			name: "ttl_verification_expiresAt",
+			ttl: true
+		}
+	],
+	organization: [
+		{
+			collection: "organization",
+			keys: { slug: 1 },
+			name: "ba_organization_slug",
+			unique: true
+		},
+		{
+			collection: "member",
+			keys: {
+				organizationId: 1,
+				userId: 1
+			},
+			name: "ba_member_org_user",
+			unique: true
+		},
+		{
+			collection: "member",
+			keys: { userId: 1 },
+			name: "ba_member_userId"
+		},
+		{
+			collection: "invitation",
+			keys: { organizationId: 1 },
+			name: "ba_invitation_org"
+		},
+		{
+			collection: "invitation",
+			keys: { email: 1 },
+			name: "ba_invitation_email"
+		},
+		{
+			collection: "invitation",
+			keys: { expiresAt: 1 },
+			name: "ttl_invitation_expiresAt",
+			ttl: true
+		}
+	],
+	"organization-teams": [{
+		collection: "team",
+		keys: { organizationId: 1 },
+		name: "ba_team_org"
+	}, {
+		collection: "teamMember",
+		keys: {
+			teamId: 1,
+			userId: 1
+		},
+		name: "ba_teamMember_team_user"
+	}],
+	twoFactor: [{
+		collection: "twoFactor",
+		keys: { userId: 1 },
+		name: "ba_twoFactor_userId"
+	}],
+	deviceAuthorization: [
+		{
+			collection: "deviceCode",
+			keys: { deviceCode: 1 },
+			name: "ba_deviceCode_code"
+		},
+		{
+			collection: "deviceCode",
+			keys: { userCode: 1 },
+			name: "ba_deviceCode_userCode"
+		},
+		{
+			collection: "deviceCode",
+			keys: { expiresAt: 1 },
+			name: "ttl_deviceCode_expiresAt",
+			ttl: true
+		}
+	]
+};
+/**
+* Create every index Better Auth's queries need. Idempotent, never throws.
+*
+* BA's mongo adapter creates NO indexes — not even on `session.token`, which is
+* read on every authenticated request, nor a unique one on `user.email`. On a
+* small database nobody notices; the cost arrives as a full collection scan per
+* login once the tables grow, and until then nothing stops a duplicate email.
+*
+* This lives in the kit rather than a host for the same reason
+* {@link ensureBetterAuthSessionTtl} does: the kit is what knows BA's collection
+* names, so fixing it here protects every consumer instead of one host.
+*
+* **Uniqueness degrades rather than fails.** A `unique: true` spec is retried
+* without uniqueness when the collection already holds violating rows, and
+* reported as `degraded` — a boot must not die because historical data has a
+* duplicate. Inspect the returned report to find those.
+*
+* Call once at boot, after the connection is live. Safe to call again.
+*/
+async function ensureBetterAuthIndexes(connection, options = {}) {
+	const plugins = options.plugins ?? [];
+	const excluded = new Set(options.exclude ?? []);
+	const keys = ["core", ...plugins];
+	const resolveName = (canonical) => {
+		const overridden = options.modelOverrides?.[canonical] ?? canonical;
+		return options.usePlural ? pluralizeBetterAuthCollection(overridden) : overridden;
+	};
+	const specs = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const key of keys) for (const spec of BA_INDEXES_BY_PLUGIN[key] ?? []) {
+		if (excluded.has(spec.collection)) continue;
+		const id = `${spec.collection}.${spec.name}`;
+		if (seen.has(id)) continue;
+		seen.add(id);
+		specs.push(spec);
+	}
+	const results = [];
+	for (const spec of specs) {
+		const target = resolveName(spec.collection);
+		const base = { name: spec.name };
+		if (spec.ttl) base.expireAfterSeconds = 0;
+		try {
+			await connection.collection(target).createIndex(spec.keys, {
+				...base,
+				...spec.unique ? { unique: true } : {}
+			});
+			results.push({
+				collection: target,
+				name: spec.name,
+				status: "created"
+			});
+		} catch (err) {
+			const reason = err instanceof Error ? err.message : String(err);
+			if (!spec.unique) {
+				results.push({
+					collection: target,
+					name: spec.name,
+					status: "failed",
+					reason
+				});
+				continue;
+			}
+			try {
+				await connection.collection(target).createIndex(spec.keys, base);
+				results.push({
+					collection: target,
+					name: spec.name,
+					status: "degraded",
+					reason
+				});
+			} catch (err2) {
+				results.push({
+					collection: target,
+					name: spec.name,
+					status: "failed",
+					reason: err2 instanceof Error ? err2.message : String(err2)
+				});
+			}
+		}
+	}
+	return results;
+}
+/**
 * Clear a dangling `activeOrganizationId` from Better Auth `session` rows.
 *
 * WHY THIS EXISTS: Better Auth purges its `member` / `invitation` rows when an
@@ -233,4 +463,4 @@ async function clearActiveOrganizationFromSessions(sessions, organizationId, opt
 	return (await sessions.updateMany(filter, { $set: { activeOrganizationId: null } })).modifiedCount ?? 0;
 }
 //#endregion
-export { clearActiveOrganizationFromSessions, createBetterAuthOverlay, ensureBetterAuthSessionTtl, registerBetterAuthStubs };
+export { BA_INDEXES_BY_PLUGIN, clearActiveOrganizationFromSessions, createBetterAuthOverlay, ensureBetterAuthIndexes, ensureBetterAuthSessionTtl, registerBetterAuthStubs };

package/dist/{create-repository-BU4x9Kb0.d.mts → create-repository-CRXjDa3N.d.mts}

@@ -1,8 +1,8 @@
-import { c as PaginationConfig } from "./pagination-jSUdrACK.mjs";
-import { _ as RepositoryOptions, d as PluginType } from "./repository-H_ffGgpE.mjs";
-import { T as AuditTrailOptions, _ as RepositoryCachePluginOptions, i as CustomIdOptions, t as MultiTenantOptions } from "./multi-tenant.plugin-BwSvTirB.mjs";
-import { n as Repository } from "./Repository-BdSkQ8vc.mjs";
-import { i as Logger, o as SoftDeleteOptions } from "./plugin-options-DXnlKM3B.mjs";
+import { u as PaginationConfig } from "./pagination-BpIv2bdS.mjs";
+import { _ as RepositoryOptions, d as PluginType } from "./repository-ZbLtL7Nk.mjs";
+import { T as AuditTrailOptions, _ as RepositoryCachePluginOptions, i as CustomIdOptions, t as MultiTenantOptions } from "./multi-tenant.plugin-B-tzNeYL.mjs";
+import { n as Repository } from "./Repository-IxI983_m.mjs";
+import { i as Logger, o as SoftDeleteOptions } from "./plugin-options-BuvtOSZf.mjs";
 import { Model } from "mongoose";
 //#region src/create-repository.d.ts
 /**

package/dist/{create-repository-CPNbktFG.mjs → create-repository-DOe9E_5F.mjs}

@@ -1,6 +1,6 @@
-import { n as Repository } from "./Repository-BArvU32x.mjs";
-import { a as customIdPlugin, f as auditTrailPlugin, i as multiTenantPlugin, m as auditLogPlugin, n as softDeletePlugin, t as timestampPlugin, u as cachePlugin } from "./timestamp.plugin-BEc6TANm.mjs";
-import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "./method-registry.plugin-DblM7V6j.mjs";
+import { n as Repository } from "./Repository-D7fDpyFx.mjs";
+import { a as customIdPlugin, f as auditTrailPlugin, i as multiTenantPlugin, m as auditLogPlugin, n as softDeletePlugin, t as timestampPlugin, u as cachePlugin } from "./timestamp.plugin-B5eiaItQ.mjs";
+import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "./method-registry.plugin-C63pGn1d.mjs";
 //#region src/create-repository.ts
 function isLoggerAudit(value) {
 	const v = value;