@classytic/mongokit 3.38.1 → 3.40.0

package/dist/pagination-BpIv2bdS.d.mts

@@ -0,0 +1,364 @@
+import { Document, Model, PipelineStage, PopulateOptions, Types } from "mongoose";
+//#region src/types/core.d.ts
+/**
+ * Core query/document primitives shared across every mongokit module —
+ * sort/select/populate/filter specs and the mongoose-facing aliases.
+ *
+ * Also the home of the `softRequired` Mongoose declaration merge (this file
+ * is loaded by every module, so the augmentation is always in the program).
+ */
+/**
+ * Global declaration merge: adds `softRequired` to Mongoose's SchemaTypeOptions
+ * so consumers can annotate paths type-safely without importing anything.
+ *
+ * A path with `softRequired: true` keeps its DB-level `required: true`
+ * invariant but is excluded from the auto-generated CRUD body `required[]`
+ * array (see buildCrudSchemasFromModel).
+ */
+declare module 'mongoose' {
+  interface SchemaTypeOptions<T, EnforcedDocType = any, THydratedDocumentType = HydratedDocument<EnforcedDocType>> {
+    /** mongokit: omit from auto-generated CRUD body `required` array. */
+    softRequired?: boolean;
+  }
+}
+/** Read Preference Type for replica sets */
+type ReadPreferenceType = 'primary' | 'primaryPreferred' | 'secondary' | 'secondaryPreferred' | 'nearest' | (string & {});
+/** Re-export mongoose ObjectId */
+type ObjectId = Types.ObjectId;
+/** Generic document type */
+type AnyDocument = Document & Record<string, unknown>;
+/** Generic model type */
+type AnyModel = Model<AnyDocument>;
+/** Sort direction */
+type SortDirection = 1 | -1;
+/** Sort specification for MongoDB queries */
+type SortSpec = Record<string, SortDirection>;
+/** Populate specification */
+type PopulateSpec = string | string[] | PopulateOptions | PopulateOptions[];
+/**
+ * Select specification. `readonly string[]` widens the legacy `string[]`
+ * form to also accept the immutable variant repo-core's contract uses
+ * (`LookupPopulateOptions.select: readonly string[] | Record<string, 0
+ * | 1>`), so `Repository<TDoc>` assigns to `StandardRepo<TDoc>` without
+ * TS2322 on the `select` field. Any existing mutable-array caller stays
+ * compatible — `string[]` is assignable to `readonly string[]`.
+ */
+type SelectSpec = string | readonly string[] | Record<string, 0 | 1>;
+/** Filter query type for MongoDB queries (compatible with Mongoose 8 & 9) */
+type FilterQuery<_T = unknown> = Record<string, unknown>;
+//#endregion
+//#region src/pagination/utils/cursor-signing.d.ts
+/**
+ * HMAC signing for pagination cursors.
+ *
+ * ## What this protects, and what it does not
+ *
+ * A cursor is a POSITION, and the server's own filters decide what a caller may
+ * read — so a stolen or shared cursor cannot reach another tenant's rows, and
+ * signing is not a substitute for scoping. What an unsigned cursor gives away
+ * is the ability to MOVE the position: edit the encoded sort value, re-submit,
+ * and the response says whether any row sorts past it. Repeat, and that is a
+ * binary search over a column the caller can never read directly — "where do
+ * salaries above X start", against a list that only ever showed them names.
+ *
+ * Signing closes that. It does NOT hide the cursor's contents: the payload is
+ * still base64url JSON and still readable by anyone holding the token, field
+ * names included. **Signing is integrity, not confidentiality.** A deployment
+ * that must not reveal which column it sorts by needs encryption, which this is
+ * not.
+ *
+ * ## The rules that make it worth having
+ *
+ * - **A configured secret makes a signature REQUIRED.** Accepting an unsigned
+ *   token "for compatibility" means an attacker strips the signature and the
+ *   protection evaporates while still looking enabled — the exact shape of a
+ *   specific instruction defeated by a general default.
+ * - **An unusable secret THROWS.** `cursorSecret: ''` (an unset env var read
+ *   without a check) would otherwise mean "signing on, key guessable", and
+ *   nothing would say so.
+ * - **Comparison is timing-safe.** `===` on a signature leaks it byte by byte
+ *   to anyone willing to time the responses.
+ * - **Rotation takes a list.** Sign with the first, accept any — otherwise
+ *   changing the key invalidates every cursor a client is holding.
+ */
+/** One key, or several during a rotation (the FIRST signs; all verify). */
+type CursorSecret = string | readonly string[];
+//#endregion
+//#region src/types/pagination.d.ts
+/**
+ * How an offset page learns how many rows sit behind it.
+ *
+ * | | cost | `total` reports |
+ * |---|---|---|
+ * | `exact` | O(matching index keys) — the whole range, every page | the truth |
+ * | `estimated` | O(1) collection metadata, but IGNORES filters, so it falls back to `exact` whenever any filter is present | the truth, or the collection size |
+ * | `capped` | O(countLimit) — the scan stops at the ceiling | the truth below the ceiling, else the ceiling, with `totalIsLowerBound: true` |
+ * | `none` | free — `limit + 1` is fetched instead | `0` |
+ *
+ * `exact` is the default and is right until a filter matches enough rows for
+ * the count to outgrow the find it runs beside. Past that it is the dominant
+ * cost of a page the user reads fifteen rows of, and it is paid again on every
+ * page.
+ *
+ * `capped` is what a product ships instead: the row count a list header shows
+ * is only actionable while it is small, so bound the work and say `10,000+`
+ * above the bound. Elasticsearch (`track_total_hits`), Odoo (`search_count`'s
+ * limit) and GitHub's `1000+` are all this strategy.
+ *
+ * Declared ONCE and referenced everywhere — this union was hand-copied to eight
+ * declarations, which is how the aggregate variant silently lost a member.
+ */
+type CountStrategy = 'exact' | 'estimated' | 'capped' | 'none';
+/**
+ * What mongokit adds to repo-core's offset envelope, via its reserved `TExtra`
+ * slot: `OffsetPaginationResult<TDoc, MongokitPageExtras>`.
+ *
+ * Both members are optional and absent on an ordinary page, so every existing
+ * consumer of `OffsetPaginationResult<TDoc>` stays assignable.
+ *
+ * A `type` and not an `interface`: repo-core constrains `TExtra` to
+ * `Record<string, unknown>`, and an interface has no implicit index signature.
+ */
+type MongokitPageExtras = {
+  /** Deep-page or clamped-limit advice. Human-readable; never branch on it. */
+  warning?: string;
+  /**
+   * `total` is a FLOOR, not a count — the scan stopped at `countLimit`. Render
+   * it as `10,000+`, and never compute a percentage or a last-page number from
+   * a total carrying this flag.
+   *
+   * A separate boolean rather than a sentinel `total` (`-1`, `null`): a total
+   * that lies in a field typed `number` is read as a number by every consumer
+   * that has not been taught otherwise, which is the failure this flag exists
+   * to make impossible to miss.
+   */
+  totalIsLowerBound?: boolean;
+};
+/** Pagination configuration */
+interface PaginationConfig {
+  /** Default number of documents per page (default: 10) */
+  defaultLimit?: number;
+  /** Maximum allowed limit (default: 100) */
+  maxLimit?: number;
+  /** Maximum allowed page number (default: 10000) */
+  maxPage?: number;
+  /** Page number that triggers performance warning (default: 100) */
+  deepPageThreshold?: number;
+  /** Cursor version for forward compatibility (default: 1) */
+  cursorVersion?: number;
+  /**
+   * Minimum cursor version accepted. Bump alongside `cursorVersion` when a
+   * breaking format change ships so stale client cursors are rejected with a
+   * clear error instead of silently paginating from the wrong position.
+   * Default: 1 (accept any cursor <= cursorVersion).
+   */
+  minCursorVersion?: number;
+  /**
+   * Allowlist of primary sort fields for keyset pagination. When set, any
+   * `getAll({ sort })` whose primary (non-_id) field is not in this list
+   * throws at validation time.
+   *
+   * Use this to lock down keyset pagination to fields that are structurally
+   * guaranteed non-null in your schema — keyset sort across null/non-null
+   * boundaries is lossy (MongoDB's `$lt/$gt` semantics leave a gap at the
+   * type boundary, so not every doc is reachable).
+   *
+   * `_id` is always allowed regardless of this list.
+   * Undefined (default) = no allowlist, any sort field accepted.
+   */
+  strictKeysetSortFields?: string[];
+  /** Use estimatedDocumentCount for faster counts on large collections */
+  useEstimatedCount?: boolean;
+  /**
+   * Repo-wide `countStrategy` for `getAll` / `lookupPopulate` /
+   * `aggregatePaginate` calls that don't set their own (default: 'exact' —
+   * a `countDocuments` round-trip per page). `'none'` suits list endpoints
+   * that only need `hasNext`: one query per page, `total` / `pages` report
+   * 0. A per-call `countStrategy` always wins.
+   */
+  defaultCountStrategy?: CountStrategy;
+  /**
+   * Ceiling for `countStrategy: 'capped'` when a call names none. Default 10000.
+   * See {@link OffsetPaginationOptions.countLimit}.
+   */
+  defaultCountLimit?: number;
+  /**
+   * HMAC key for cursor tokens. Absent (default) = cursors are unsigned, as
+   * before. A list rotates keys: the FIRST signs, all of them verify.
+   *
+   * Signing stops a caller EDITING a cursor to move the position — re-submit a
+   * tampered sort value and the response says whether any row sorts past it,
+   * which is a binary search over a column the caller may never read. It does
+   * NOT hide the token's contents: the payload stays readable base64url JSON.
+   * Integrity, not confidentiality.
+   *
+   * **Switching it on is a cutover.** Cursors already in flight carry no
+   * signature and will be refused — the client restarts from page one. That is
+   * deliberate: a "tolerate unsigned during rollout" flag is a permanent
+   * downgrade switch, and stripping the signature is the first thing an
+   * attacker tries.
+   *
+   * A key under 16 characters throws rather than being accepted, because an
+   * unset environment variable reads as `''` and would otherwise mean "signing
+   * on, key guessable" with nothing to say so.
+   */
+  cursorSecret?: CursorSecret;
+  /**
+   * Repo-wide pagination mode for a `getAll` call that carries no explicit
+   * `mode`, no `page` and no cursor (`after`) — the plain
+   * `getAll({ filters })` case, which otherwise picks offset (or keyset
+   * only when a non-default sort is given). `'keyset'` makes those calls
+   * cursor-paginated: no `skip`, O(1) deep pages. Explicit per-call
+   * signals still win — `page` → offset, `after` → keyset, `mode` → as
+   * given. Default: undefined (the sort-based auto-detection above).
+   */
+  defaultMode?: 'offset' | 'keyset';
+}
+/** MongoDB collation options for locale-aware string comparison */
+interface CollationOptions {
+  locale: string;
+  caseLevel?: boolean;
+  caseFirst?: 'upper' | 'lower' | 'off';
+  strength?: 1 | 2 | 3 | 4 | 5;
+  numericOrdering?: boolean;
+  alternate?: 'non-ignorable' | 'shifted';
+  maxVariable?: 'punct' | 'space';
+  backwards?: boolean;
+}
+/** Base pagination options */
+interface BasePaginationOptions {
+  /** Pagination mode (explicit override) */
+  mode?: 'offset' | 'keyset';
+  /** MongoDB query filters */
+  filters?: FilterQuery<AnyDocument>;
+  /** Sort specification */
+  sort?: SortSpec;
+  /** Number of documents per page */
+  limit?: number;
+  /** Fields to select */
+  select?: SelectSpec;
+  /** Fields to populate */
+  populate?: PopulateSpec;
+  /** Return plain JavaScript objects */
+  lean?: boolean;
+  /** MongoDB session for transactions */
+  session?: unknown;
+  /** Query hint (index name or document) */
+  hint?: string | Record<string, 1 | -1>;
+  /** Maximum execution time in milliseconds */
+  maxTimeMS?: number;
+  /** Read preference for replica sets (e.g. 'secondaryPreferred') */
+  readPreference?: ReadPreferenceType;
+  /** Collation for locale-aware string comparison and case-insensitive sorting */
+  collation?: CollationOptions;
+}
+/** Offset pagination options */
+interface OffsetPaginationOptions extends BasePaginationOptions {
+  /** Page number (1-indexed) */
+  page?: number;
+  /** Count strategy for filtered queries (default: 'exact'). See {@link CountStrategy}. */
+  countStrategy?: CountStrategy;
+  /**
+   * Ceiling for `countStrategy: 'capped'` (default: the repository's
+   * `defaultCountLimit`, else 10000). Ignored by every other strategy.
+   *
+   * A `total` that comes back EQUAL to this is a lower bound, not a count —
+   * `totalIsLowerBound` on the result says so, because `total === countLimit`
+   * is also what an exactly-full collection legitimately returns and the two
+   * are otherwise indistinguishable.
+   */
+  countLimit?: number;
+  /**
+   * Optional alternate filter used for the count query only. The primary
+   * `filters` is still used for `.find()`. Lets callers (Repository) run a
+   * sort-only query like `$near` for results while counting with a
+   * count-compatible rewrite (e.g. `$geoWithin: $centerSphere`) that
+   * returns the same document set but works with `countDocuments`.
+   */
+  countFilters?: FilterQuery<AnyDocument>;
+}
+/** Keyset (cursor) pagination options */
+interface KeysetPaginationOptions extends BasePaginationOptions {
+  /** Cursor token for next page */
+  after?: string;
+  /**
+   * Cursor token for the PREVIOUS page — the page ending just before this
+   * position. Mutually exclusive with `after`; passing both throws.
+   *
+   * Feed back the `prev` from a result. Rows come back in the sort order you
+   * asked for, not reversed: the query runs inverted internally and the page
+   * is turned back around before it is returned.
+   */
+  before?: string;
+  /** Sort is required for keyset pagination */
+  sort: SortSpec;
+}
+/** Aggregate pagination options */
+interface AggregatePaginationOptions {
+  /** Aggregation pipeline stages */
+  pipeline?: PipelineStage[];
+  /** Page number (1-indexed) */
+  page?: number;
+  /** Number of documents per page */
+  limit?: number;
+  /** MongoDB session for transactions */
+  session?: unknown;
+  /** Query hint (index name or document) for aggregation */
+  hint?: string | Record<string, 1 | -1>;
+  /** Maximum execution time in milliseconds */
+  maxTimeMS?: number;
+  /** Count strategy (default: 'exact' via $facet).
+   * 'estimated' is accepted but treated as 'exact' in aggregation context
+   * since estimatedDocumentCount is not available inside pipelines.
+   * 'capped' bounds the count facet with a `$limit` — see {@link CountStrategy}. */
+  countStrategy?: CountStrategy;
+  /** Ceiling for `countStrategy: 'capped'`. See {@link OffsetPaginationOptions.countLimit}. */
+  countLimit?: number;
+  /**
+   * Let `$sort` / `$group` spill to disk past the server's 100MB per-stage
+   * memory limit. Off by default — spilling hides a missing index behind a
+   * slow success, and on MongoDB >= 6.0 the server's own
+   * `allowDiskUseByDefault` already decides this when a caller says nothing.
+   */
+  allowDiskUse?: boolean;
+  /** Pagination mode (reserved for API consistency) */
+  mode?: 'offset';
+  /** Read preference for replica sets (e.g. 'secondaryPreferred') */
+  readPreference?: ReadPreferenceType;
+}
+/** Value type identifier for cursor serialization */
+type ValueType = 'date' | 'objectid' | 'boolean' | 'number' | 'string' | 'null' | 'unknown';
+/** Cursor payload */
+interface CursorPayload {
+  /** Primary sort field value (legacy single-field) */
+  v: string | number | boolean | null;
+  /** Value type identifier (legacy single-field) */
+  t: ValueType;
+  /** Document ID */
+  id: string;
+  /** ID type identifier */
+  idType: ValueType;
+  /** Sort specification */
+  sort: SortSpec;
+  /** Cursor version */
+  ver: number;
+  /** Compound sort field values (multi-field keyset) */
+  vals?: Record<string, string | number | boolean | null>;
+  /** Compound sort value types */
+  types?: Record<string, ValueType>;
+}
+/** Decoded cursor */
+interface DecodedCursor {
+  /** Primary sort field value (rehydrated) — legacy compat */
+  value: unknown;
+  /** Document ID (rehydrated) */
+  id: ObjectId | string;
+  /** Sort specification */
+  sort: SortSpec;
+  /** Cursor version */
+  version: number;
+  /** All sort field values (rehydrated) — for compound sort */
+  values?: Record<string, unknown>;
+}
+//#endregion
+export { PopulateSpec as _, CursorPayload as a, SortDirection as b, MongokitPageExtras as c, ValueType as d, CursorSecret as f, ObjectId as g, FilterQuery as h, CountStrategy as i, OffsetPaginationOptions as l, AnyModel as m, BasePaginationOptions as n, DecodedCursor as o, AnyDocument as p, CollationOptions as r, KeysetPaginationOptions as s, AggregatePaginationOptions as t, PaginationConfig as u, ReadPreferenceType as v, SortSpec as x, SelectSpec as y };

package/dist/{plugin-options-DXnlKM3B.d.mts → plugin-options-Zk46lD6F.d.mts}

@@ -1,5 +1,5 @@
-import { a as PopulateSpec, i as ObjectId, l as SortSpec, s as SelectSpec } from "./core-62oo3N1C.mjs";
-import { h as RepositoryInstance, p as RepositoryContext } from "./repository-H_ffGgpE.mjs";
+import { _ as PopulateSpec, g as ObjectId, x as SortSpec, y as SelectSpec } from "./pagination-BpIv2bdS.mjs";
+import { h as RepositoryInstance, p as RepositoryContext } from "./repository-odl03582.mjs";
 import { OffsetPaginationResult } from "@classytic/repo-core/pagination";
 //#region src/types/plugin-options.d.ts
 /** Field preset configuration (field-filter plugin) */
@@ -69,6 +69,9 @@ interface SoftDeleteRepository<TDoc = unknown> {
    */
   restore(id: string | ObjectId, options?: {
     session?: unknown;
+    organizationId?: unknown;
+    bypassTenant?: boolean;
+    [key: string]: unknown;
   }): Promise<TDoc>;
   /**
    * Get all soft-deleted documents
@@ -109,6 +112,17 @@ interface CascadeRelation {
   model?: string;
   /** Foreign key field in the related model that references the deleted document */
   foreignKey: string;
+  /**
+   * WHICH parent field `foreignKey` stores. Default: the parent repository's
+   * `idField` (`_id` unless the repository declares another).
+   *
+   * Set it when the two differ. An order repository addressed by `orderNumber`
+   * whose children store the order's `_id` declares `parentKey: '_id'`;
+   * without it, `delete('ORD-2026-0001')` cascaded with the order NUMBER and
+   * every child delete failed on the ObjectId cast. The cascade reads the
+   * parent's value for this field before the delete, under the same session.
+   */
+  parentKey?: string;
   /** Whether to use soft delete if available (default: follows parent behavior) */
   softDelete?: boolean;
   /**

package/dist/plugins/index.d.mts

@@ -1,6 +1,6 @@
-import { S as RepositoryPluginName, b as MONGOKIT_PLUGIN_NAMES, l as Plugin, x as MongoKitPluginName } from "../repository-H_ffGgpE.mjs";
-import { A as ensureAuditTrailReady, C as AuditTrailMethods, D as AuditTrailQueryOptions, E as AuditTrailQuery, O as EnsureAuditTrailReadyOptions, S as AuditQueryResult, T as AuditTrailOptions, _ as RepositoryCachePluginOptions, a as DateSequentialIdOptions, b as AuditOperation, c as SequentialIdOptions, d as getNextSequence, f as prefixedId, g as RepositoryCacheHandle, h as CacheOptions, i as CustomIdOptions, k as auditTrailPlugin, l as customIdPlugin, m as CacheAdapter, o as IdGenerator, p as sequentialId, r as multiTenantPlugin, s as PrefixedIdOptions, t as MultiTenantOptions, u as dateSequentialId, v as cachePlugin, w as AuditTrailMode, x as AuditQueryOptions, y as AuditEntry } from "../multi-tenant.plugin-BwSvTirB.mjs";
-import { A as IdempotencyStoreMethods, B as auditLogPlugin, C as LeaseMethods, D as ImmutableStatesPluginOptions, E as ImmutableClaimView, F as elasticSearchPlugin, H as appendOnlyPlugin, I as cascadePlugin, L as BatchOperationsMethods, M as idempotencyStorePlugin, N as fieldFilterPlugin, O as immutableStatesPlugin, P as ElasticSearchOptions, S as methodRegistryPlugin, T as leasePlugin, U as AggregateHelpersMethods, V as AppendOnlyPluginOptions, W as aggregateHelpersPlugin, _ as OperationMetric, a as requireField, b as mongoOperationsPlugin, c as timestampPlugin, d as createTenantContext, f as SubdocumentMethods, g as ObservabilityOptions, h as softDeletePlugin, i as immutableField, j as IdempotencyStorePluginOptions, k as IdempotencyClaim, l as TenantContext, m as SoftDeleteMethods, n as autoInject, o as uniqueField, p as subdocumentPlugin, r as blockIf, s as validationChainPlugin, t as OperationType, u as TenantStore, v as observabilityPlugin, w as LeasePluginOptions, x as MethodRegistryRepository, y as MongoOperationsMethods, z as batchOperationsPlugin } from "../validation-chain.plugin-yQRob3Av.mjs";
+import { S as RepositoryPluginName, b as MONGOKIT_PLUGIN_NAMES, l as Plugin, x as MongoKitPluginName } from "../repository-odl03582.mjs";
+import { A as EnsureAuditTrailReadyOptions, C as AuditQueryOptions, D as AuditTrailOptions, E as AuditTrailMode, M as ensureAuditTrailReady, O as AuditTrailQuery, S as AuditOperation, T as AuditTrailMethods, _ as CacheOptions, a as DateSequentialIdOptions, b as cachePlugin, c as SequentialIdOptions, f as getNextSequence, g as CacheAdapter, h as sequentialId, i as CustomIdOptions, j as auditTrailPlugin, k as AuditTrailQueryOptions, l as customIdPlugin, o as IdGenerator, p as prefixedId, r as multiTenantPlugin, s as PrefixedIdOptions, t as MultiTenantOptions, u as dateSequentialId, v as RepositoryCacheHandle, w as AuditQueryResult, x as AuditEntry, y as RepositoryCachePluginOptions } from "../multi-tenant.plugin-CBgCo9im.mjs";
+import { A as IdempotencyStoreMethods, B as batchOperationsPlugin, C as LeaseMethods, D as ImmutableStatesPluginOptions, E as ImmutableClaimView, F as elasticSearchPlugin, G as aggregateHelpersPlugin, H as AppendOnlyPluginOptions, I as cascadePlugin, L as BatchOperationsMethods, M as idempotencyStorePlugin, N as fieldFilterPlugin, O as immutableStatesPlugin, P as ElasticSearchOptions, S as methodRegistryPlugin, T as leasePlugin, U as appendOnlyPlugin, V as auditLogPlugin, W as AggregateHelpersMethods, _ as OperationMetric, a as requireField, b as mongoOperationsPlugin, c as timestampPlugin, d as createTenantContext, f as SubdocumentMethods, g as ObservabilityOptions, h as softDeletePlugin, i as immutableField, j as IdempotencyStorePluginOptions, k as IdempotencyClaim, l as TenantContext, m as SoftDeleteMethods, n as autoInject, o as uniqueField, p as subdocumentPlugin, r as blockIf, s as validationChainPlugin, t as OperationType, u as TenantStore, v as observabilityPlugin, w as LeasePluginOptions, x as MethodRegistryRepository, y as MongoOperationsMethods } from "../validation-chain.plugin-DYp9E7K2.mjs";
 import { ChangeLogStore } from "@classytic/repo-core/sync";
 //#region src/plugins/change-log.plugin.d.ts
 interface ChangeLogPluginOptions {
@@ -12,6 +12,11 @@ interface ChangeLogPluginOptions {
   tenantField?: string;
   /** Monotonic per-doc version field. Default `version` (kernel convention). */
   versionField?: string;
+  /**
+   * The document as a subscriber may see it — fields picked, secrets (a cost price) dropped. Tenant
+   * and version are still read from the whole document. Default: the whole document.
+   */
+  project?: (doc: Record<string, unknown>) => Record<string, unknown>;
 }
 declare function changeLogPlugin(options: ChangeLogPluginOptions): Plugin;
 //#endregion

package/dist/plugins/index.mjs

@@ -1,14 +1,18 @@
-import { a as customIdPlugin, c as prefixedId, d as AuditTrailQuery, f as auditTrailPlugin, i as multiTenantPlugin, l as sequentialId, m as auditLogPlugin, n as softDeletePlugin, o as dateSequentialId, p as ensureAuditTrailReady, s as getNextSequence, t as timestampPlugin, u as cachePlugin } from "../timestamp.plugin-CBQukQzV.mjs";
-import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-DblM7V6j.mjs";
-import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-DhNyxNCw.mjs";
+import { _ as AuditTrailQuery, b as auditLogPlugin, f as getNextSequence, g as cachePlugin, h as sequentialId, i as multiTenantPlugin, l as customIdPlugin, n as softDeletePlugin, p as prefixedId, t as timestampPlugin, u as dateSequentialId, v as auditTrailPlugin, y as ensureAuditTrailReady } from "../timestamp.plugin-DF0gJB6p.mjs";
+import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-C63pGn1d.mjs";
+import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-BLY2gLEk.mjs";
 //#region src/plugins/change-log.plugin.ts
 const PLUGIN_NAME = "changeLog";
+/** Marks a repository already captured: the store and scope it writes to. */
+const CAPTURED = Symbol.for("mongokit.changeLog.capture");
+/** Where `before:updateMany` / `before:deleteMany` leave the ids they matched for the after hook. */
+const MATCHED_IDS = Symbol("changeLog.matchedIds");
 function isSkipped(context) {
 	const list = context.skipPlugins;
 	return Array.isArray(list) && list.includes(PLUGIN_NAME);
 }
 function changeLogPlugin(options) {
-	const { store, scope, tenantField = "organizationId", versionField = "version" } = options;
+	const { store, scope, tenantField = "organizationId", versionField = "version", project } = options;
 	const toRecord = (doc) => {
 		if (!doc || typeof doc !== "object") return null;
 		const d = doc;
@@ -21,51 +25,120 @@ function changeLogPlugin(options) {
 		return updatedAt instanceof Date ? updatedAt.getTime() : 0;
 	};
 	const tenantOf = (doc, context) => {
-		const raw = doc[tenantField] ?? context.organizationId;
+		const raw = doc?.[tenantField] ?? context.organizationId;
 		return raw === void 0 || raw === null ? void 0 : String(raw);
 	};
-	const capture = async (op, doc, context) => {
+	const appendOptions = (context) => context.session !== void 0 ? { session: context.session } : void 0;
+	const upsert = async (doc, context) => {
 		const record = toRecord(doc);
 		if (!record || record._id === void 0) return;
 		const tenantId = tenantOf(record, context);
 		await store.append({
 			scope,
 			docId: String(record._id),
-			op,
+			op: "upsert",
 			version: versionOf(record),
-			...op === "upsert" ? { doc: record } : {},
+			doc: project ? project(record) : record,
 			...tenantId !== void 0 ? { tenantId } : {}
-		}, context.session !== void 0 ? { session: context.session } : void 0);
+		}, appendOptions(context));
+	};
+	const tombstone = async (docId, context) => {
+		if (docId === void 0 || docId === null) return;
+		const tenantId = tenantOf(null, context);
+		await store.append({
+			scope,
+			docId: String(docId),
+			op: "delete",
+			version: 0,
+			...tenantId !== void 0 ? { tenantId } : {}
+		}, appendOptions(context));
 	};
 	return {
 		name: PLUGIN_NAME,
 		apply(repo) {
+			const marked = repo;
+			const existing = marked[CAPTURED];
+			if (existing) {
+				if (existing.store === store && existing.scope === scope) return;
+				throw new Error(`[mongokit] changeLogPlugin is already capturing this repository as "${existing.scope}"`);
+			}
+			marked[CAPTURED] = {
+				store,
+				scope
+			};
+			/** The whole document as committed in this session — never a projection. */
+			const reread = async (id, context) => {
+				const query = repo.Model.findById(id).lean();
+				if (context.session !== void 0) query.session(context.session);
+				return query.exec();
+			};
+			const matchingIds = async (context, filter) => {
+				const query = repo.Model.find(filter ?? {}).select({ _id: 1 }).lean();
+				if (context.session !== void 0) query.session(context.session);
+				return (await query.exec()).map((d) => d._id);
+			};
 			repo.on("after:create", async ({ context, result }) => {
-				if (isSkipped(context) || !result) return;
-				await capture("upsert", result, context);
+				if (!isSkipped(context) && result) await upsert(result, context);
 			});
 			repo.on("after:createMany", async ({ context, result }) => {
 				if (isSkipped(context) || !Array.isArray(result)) return;
-				for (const doc of result) await capture("upsert", doc, context);
+				for (const doc of result) await upsert(doc, context);
 			});
 			repo.on("after:update", async ({ context, result }) => {
-				if (isSkipped(context) || !result) return;
-				await capture("upsert", result, context);
+				if (!isSkipped(context) && result) await upsert(result, context);
+			});
+			for (const op of [
+				"claim",
+				"claimVersion",
+				"findOneAndUpdate",
+				"getOrCreate",
+				"restore"
+			]) repo.on(`after:${op}`, async ({ context, result }) => {
+				if (isSkipped(context)) return;
+				const id = toRecord(result)?._id;
+				if (id === void 0) return;
+				const doc = await reread(id, context);
+				if (doc) await upsert(doc, context);
+				else await tombstone(id, context);
+			});
+			for (const op of ["updateMany", "deleteMany"]) repo.on(`before:${op}`, async (context) => {
+				if (!isSkipped(context)) context[MATCHED_IDS] = await matchingIds(context, context.query);
+			});
+			/** Each re-read document as an upsert, or a tombstone where it is gone. */
+			const capture = async (ids, context) => {
+				for (const id of ids) {
+					const doc = await reread(id, context);
+					if (doc) await upsert(doc, context);
+					else await tombstone(id, context);
+				}
+			};
+			repo.on("after:updateMany", async ({ context }) => {
+				if (!isSkipped(context)) await capture(context[MATCHED_IDS] ?? [], context);
+			});
+			repo.on("after:anonymize", async ({ context, result }) => {
+				if (!isSkipped(context)) await capture(result.ids, context);
+			});
+			repo.on("after:deleteMany", async ({ context }) => {
+				if (!isSkipped(context)) await capture(context[MATCHED_IDS] ?? [], context);
 			});
 			repo.on("after:delete", async ({ context, result }) => {
 				if (isSkipped(context) || !result) return;
-				const summary = result;
-				const ctxId = context.id;
-				const docId = summary.id ?? ctxId;
-				if (docId === void 0 || docId === null) return;
-				const tenantRaw = context.organizationId;
-				await store.append({
-					scope,
-					docId: String(docId),
-					op: "delete",
-					version: 0,
-					...tenantRaw !== void 0 && tenantRaw !== null ? { tenantId: String(tenantRaw) } : {}
-				}, context.session !== void 0 ? { session: context.session } : void 0);
+				await tombstone(result.id ?? context.id, context);
+			});
+			repo.on("before:bulkWrite", async (context) => {
+				if (isSkipped(context)) return;
+				const ids = [];
+				for (const op of context.operations ?? []) {
+					const [kind, spec] = Object.entries(op)[0] ?? [];
+					if (!kind || !spec) continue;
+					if (kind === "insertOne") ids.push(spec.document?._id);
+					else ids.push(...await matchingIds(context, spec.filter));
+				}
+				context[MATCHED_IDS] = ids.filter((id) => id !== void 0);
+			});
+			repo.on("after:bulkWrite", async ({ context, result }) => {
+				if (isSkipped(context)) return;
+				await capture([...context[MATCHED_IDS] ?? [], ...Object.values(result?.upsertedIds ?? {})], context);
 			});
 		}
 	};