@classytic/mongokit 3.39.0 → 3.40.1

package/dist/{pagination-BpIv2bdS.d.mts → pagination-D6psses0.d.mts}

@@ -1,4 +1,4 @@
-import { Document, Model, PipelineStage, PopulateOptions, Types } from "mongoose";
+import { Connection, Document, Model, PipelineStage, PopulateOptions, Types } from "mongoose";
 //#region src/types/core.d.ts
 /**
  * Core query/document primitives shared across every mongokit module —
@@ -47,6 +47,79 @@ type SelectSpec = string | readonly string[] | Record<string, 0 | 1>;
 /** Filter query type for MongoDB queries (compatible with Mongoose 8 & 9) */
 type FilterQuery<_T = unknown> = Record<string, unknown>;
 //#endregion
+//#region src/repository/query-defaults.d.ts
+type ReadConcernLevel = 'local' | 'available' | 'majority' | 'linearizable' | 'snapshot';
+interface WriteConcernSpec {
+  w?: number | 'majority';
+  j?: boolean;
+  wtimeoutMS?: number;
+}
+/** Defaults for every repository command. */
+interface QueryDefaults {
+  maxTimeMS?: number;
+  readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  writeConcern?: WriteConcernSpec;
+  /** Profiler / log tag. */
+  comment?: string;
+}
+/** Defaults for aggregations only; consulted before {@link QueryDefaults}. */
+interface AggregateDefaults {
+  maxTimeMs?: number;
+  allowDiskUse?: boolean;
+}
+/** What one call may pass. Every field beats every default. */
+interface PerCallQueryOptions {
+  maxTimeMS?: number;
+  readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  writeConcern?: WriteConcernSpec;
+  comment?: string;
+  hint?: string | Record<string, 1 | -1>;
+  allowDiskUse?: boolean;
+  session?: unknown;
+}
+/** The options a command is executed with, after resolution. */
+interface ResolvedQueryOptions {
+  maxTimeMS?: number;
+  readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  writeConcern?: WriteConcernSpec;
+  comment?: string;
+  hint?: string | Record<string, 1 | -1>;
+  allowDiskUse?: boolean;
+}
+type CommandKind = 'read' | 'aggregate' | 'write' | 'findAndModify';
+/** Set the deployment's query defaults. Merges; an explicit `undefined` changes nothing. */
+declare function configureQueryDefaults(defaults: QueryDefaults): void;
+/** Set the deployment's aggregation defaults. Merges; an explicit `undefined` changes nothing. */
+declare function configureAggregateDefaults(defaults: AggregateDefaults): void;
+/** A copy of the deployment defaults. */
+declare function getQueryDefaults(): {
+  query: QueryDefaults;
+  aggregate: AggregateDefaults;
+};
+/** Back to no deployment defaults. For tests. */
+declare function resetQueryDefaults(): void;
+/**
+ * Boot check (M7): throws unless the deployment sets a query `maxTimeMS`, and — when a connection
+ * is passed — unless its client carries a CSOT `timeoutMS`. Returns what it verified.
+ */
+declare function assertQueryDefaultsConfigured(connection?: Connection): {
+  maxTimeMS: number;
+  timeoutMS?: number;
+};
+declare const QUERY_DEFAULTS_ERROR_CODES: {
+  readonly NOT_CONFIGURED: "mongokit.query_defaults.not_configured";
+  /** A per-call bound inside a transaction that carries its own CSOT budget (the driver forbids both). */
+  readonly TIMEOUT_IN_TRANSACTION: "mongokit.query_defaults.timeout_in_transaction";
+};
+/** Resolve the options one command runs with. `repo` is the repository's own defaults. */
+declare function resolveQueryOptions(kind: CommandKind, perCall: PerCallQueryOptions, repo?: {
+  query?: QueryDefaults;
+  aggregate?: AggregateDefaults;
+}): ResolvedQueryOptions;
+//#endregion
 //#region src/pagination/utils/cursor-signing.d.ts
 /**
  * HMAC signing for pagination cursors.
@@ -108,7 +181,11 @@ type CursorSecret = string | readonly string[];
  * Declared ONCE and referenced everywhere — this union was hand-copied to eight
  * declarations, which is how the aggregate variant silently lost a member.
  */
-type CountStrategy = 'exact' | 'estimated' | 'capped' | 'none';
+/**
+ * `cached`: the capped count memoised per (collection, filter, collation, hint) for
+ * `countCacheTtlMs`; never inside a transaction (it would publish uncommitted rows).
+ */
+type CountStrategy = 'exact' | 'estimated' | 'capped' | 'none' | 'cached';
 /**
  * What mongokit adds to repo-core's offset envelope, via its reserved `TExtra`
  * slot: `OffsetPaginationResult<TDoc, MongokitPageExtras>`.
@@ -123,16 +200,13 @@ type MongokitPageExtras = {
   /** Deep-page or clamped-limit advice. Human-readable; never branch on it. */
   warning?: string;
   /**
-   * `total` is a FLOOR, not a count — the scan stopped at `countLimit`. Render
-   * it as `10,000+`, and never compute a percentage or a last-page number from
-   * a total carrying this flag.
-   *
-   * A separate boolean rather than a sentinel `total` (`-1`, `null`): a total
-   * that lies in a field typed `number` is read as a number by every consumer
-   * that has not been taught otherwise, which is the failure this flag exists
-   * to make impossible to miss.
+   * `total` is not an exact count of the rows matching right now: a capped count at its
+   * ceiling (a floor — render `10,000+`), an estimate, a memoised (`cached`) count, or no count
+   * (`none`). Never derive a last-page number or a percentage from a total carrying it.
    */
-  totalIsLowerBound?: boolean;
+  totalIsEstimate: boolean;
+  /** When `total` was counted; `null` when nothing was counted (`none`). */
+  countedAt: Date | null;
 };
 /** Pagination configuration */
 interface PaginationConfig {
@@ -142,6 +216,13 @@ interface PaginationConfig {
   maxLimit?: number;
   /** Maximum allowed page number (default: 10000) */
   maxPage?: number;
+  /**
+   * Deepest `skip` an offset page may ask for (default 100,000). Past it the call is refused
+   * with `mongokit.pagination.offset_too_deep` (400): walk with keyset (`after`) instead.
+   */
+  maxOffset?: number;
+  /** Freshness window of `countStrategy: 'cached'` (default 30,000 ms). */
+  countCacheTtlMs?: number;
   /** Page number that triggers performance warning (default: 100) */
   deepPageThreshold?: number;
   /** Cursor version for forward compatibility (default: 1) */
@@ -249,6 +330,13 @@ interface BasePaginationOptions {
   maxTimeMS?: number;
   /** Read preference for replica sets (e.g. 'secondaryPreferred') */
   readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  comment?: string;
+  /**
+   * Already-resolved time bound and concerns (the Repository passes these, defaults folded in).
+   * When absent the engine resolves the per-call fields above against the deployment defaults.
+   */
+  queryOptions?: ResolvedQueryOptions;
   /** Collation for locale-aware string comparison and case-insensitive sorting */
   collation?: CollationOptions;
 }
@@ -325,9 +413,20 @@ interface AggregatePaginationOptions {
   mode?: 'offset';
   /** Read preference for replica sets (e.g. 'secondaryPreferred') */
   readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  comment?: string;
+  /** Collections the caller asserts are company-wide (see `join-scope.ts`). */
+  unscopedJoins?: readonly string[];
+  /**
+   * The caller states the pipeline's last `$sort` is a TOTAL order (unique per output row), so the
+   * not-provably-total warning is silenced. Only for a sort total by domain knowledge.
+   */
+  sortIsTotal?: boolean;
+  /** Already-resolved options; see {@link BasePaginationOptions.queryOptions}. */
+  queryOptions?: ResolvedQueryOptions;
 }
 /** Value type identifier for cursor serialization */
-type ValueType = 'date' | 'objectid' | 'boolean' | 'number' | 'string' | 'null' | 'unknown';
+type ValueType = 'date' | 'objectid' | 'decimal' | 'boolean' | 'number' | 'string' | 'null' | 'unknown';
 /** Cursor payload */
 interface CursorPayload {
   /** Primary sort field value (legacy single-field) */
@@ -346,6 +445,8 @@ interface CursorPayload {
   vals?: Record<string, string | number | boolean | null>;
   /** Compound sort value types */
   types?: Record<string, ValueType>;
+  /** Scope fingerprint: collection + post-policy filter + collation (see `utils/guards.ts`). */
+  fp: string;
 }
 /** Decoded cursor */
 interface DecodedCursor {
@@ -359,6 +460,8 @@ interface DecodedCursor {
   version: number;
   /** All sort field values (rehydrated) — for compound sort */
   values?: Record<string, unknown>;
+  /** Scope fingerprint the cursor was minted under. */
+  scope: string;
 }
 //#endregion
-export { PopulateSpec as _, CursorPayload as a, SortDirection as b, MongokitPageExtras as c, ValueType as d, CursorSecret as f, ObjectId as g, FilterQuery as h, CountStrategy as i, OffsetPaginationOptions as l, AnyModel as m, BasePaginationOptions as n, DecodedCursor as o, AnyDocument as p, CollationOptions as r, KeysetPaginationOptions as s, AggregatePaginationOptions as t, PaginationConfig as u, ReadPreferenceType as v, SortSpec as x, SelectSpec as y };
+export { ObjectId as A, configureQueryDefaults as C, AnyDocument as D, resolveQueryOptions as E, SortSpec as F, ReadPreferenceType as M, SelectSpec as N, AnyModel as O, SortDirection as P, configureAggregateDefaults as S, resetQueryDefaults as T, QueryDefaults as _, CursorPayload as a, WriteConcernSpec as b, MongokitPageExtras as c, ValueType as d, CursorSecret as f, QUERY_DEFAULTS_ERROR_CODES as g, PerCallQueryOptions as h, CountStrategy as i, PopulateSpec as j, FilterQuery as k, OffsetPaginationOptions as l, CommandKind as m, BasePaginationOptions as n, DecodedCursor as o, AggregateDefaults as p, CollationOptions as r, KeysetPaginationOptions as s, AggregatePaginationOptions as t, PaginationConfig as u, ReadConcernLevel as v, getQueryDefaults as w, assertQueryDefaultsConfigured as x, ResolvedQueryOptions as y };

package/dist/{plugin-options-BuvtOSZf.d.mts → plugin-options-CRhIvSzx.d.mts}

@@ -1,5 +1,5 @@
-import { _ as PopulateSpec, g as ObjectId, x as SortSpec, y as SelectSpec } from "./pagination-BpIv2bdS.mjs";
-import { h as RepositoryInstance, p as RepositoryContext } from "./repository-ZbLtL7Nk.mjs";
+import { A as ObjectId, F as SortSpec, N as SelectSpec, j as PopulateSpec } from "./pagination-D6psses0.mjs";
+import { h as RepositoryInstance, p as RepositoryContext } from "./repository-DNHfjAZX.mjs";
 import { OffsetPaginationResult } from "@classytic/repo-core/pagination";
 //#region src/types/plugin-options.d.ts
 /** Field preset configuration (field-filter plugin) */
@@ -69,6 +69,9 @@ interface SoftDeleteRepository<TDoc = unknown> {
    */
   restore(id: string | ObjectId, options?: {
     session?: unknown;
+    organizationId?: unknown;
+    bypassTenant?: boolean;
+    [key: string]: unknown;
   }): Promise<TDoc>;
   /**
    * Get all soft-deleted documents
@@ -109,6 +112,17 @@ interface CascadeRelation {
   model?: string;
   /** Foreign key field in the related model that references the deleted document */
   foreignKey: string;
+  /**
+   * WHICH parent field `foreignKey` stores. Default: the parent repository's
+   * `idField` (`_id` unless the repository declares another).
+   *
+   * Set it when the two differ. An order repository addressed by `orderNumber`
+   * whose children store the order's `_id` declares `parentKey: '_id'`;
+   * without it, `delete('ORD-2026-0001')` cascaded with the order NUMBER and
+   * every child delete failed on the ObjectId cast. The cascade reads the
+   * parent's value for this field before the delete, under the same session.
+   */
+  parentKey?: string;
   /** Whether to use soft delete if available (default: follows parent behavior) */
   softDelete?: boolean;
   /**

package/dist/plugins/index.d.mts

@@ -1,6 +1,6 @@
-import { S as RepositoryPluginName, b as MONGOKIT_PLUGIN_NAMES, l as Plugin, x as MongoKitPluginName } from "../repository-ZbLtL7Nk.mjs";
-import { A as ensureAuditTrailReady, C as AuditTrailMethods, D as AuditTrailQueryOptions, E as AuditTrailQuery, O as EnsureAuditTrailReadyOptions, S as AuditQueryResult, T as AuditTrailOptions, _ as RepositoryCachePluginOptions, a as DateSequentialIdOptions, b as AuditOperation, c as SequentialIdOptions, d as getNextSequence, f as prefixedId, g as RepositoryCacheHandle, h as CacheOptions, i as CustomIdOptions, k as auditTrailPlugin, l as customIdPlugin, m as CacheAdapter, o as IdGenerator, p as sequentialId, r as multiTenantPlugin, s as PrefixedIdOptions, t as MultiTenantOptions, u as dateSequentialId, v as cachePlugin, w as AuditTrailMode, x as AuditQueryOptions, y as AuditEntry } from "../multi-tenant.plugin-B-tzNeYL.mjs";
-import { A as IdempotencyStoreMethods, B as auditLogPlugin, C as LeaseMethods, D as ImmutableStatesPluginOptions, E as ImmutableClaimView, F as elasticSearchPlugin, H as appendOnlyPlugin, I as cascadePlugin, L as BatchOperationsMethods, M as idempotencyStorePlugin, N as fieldFilterPlugin, O as immutableStatesPlugin, P as ElasticSearchOptions, S as methodRegistryPlugin, T as leasePlugin, U as AggregateHelpersMethods, V as AppendOnlyPluginOptions, W as aggregateHelpersPlugin, _ as OperationMetric, a as requireField, b as mongoOperationsPlugin, c as timestampPlugin, d as createTenantContext, f as SubdocumentMethods, g as ObservabilityOptions, h as softDeletePlugin, i as immutableField, j as IdempotencyStorePluginOptions, k as IdempotencyClaim, l as TenantContext, m as SoftDeleteMethods, n as autoInject, o as uniqueField, p as subdocumentPlugin, r as blockIf, s as validationChainPlugin, t as OperationType, u as TenantStore, v as observabilityPlugin, w as LeasePluginOptions, x as MethodRegistryRepository, y as MongoOperationsMethods, z as batchOperationsPlugin } from "../validation-chain.plugin-DvrLJIbJ.mjs";
+import { S as RepositoryPluginName, b as MONGOKIT_PLUGIN_NAMES, l as Plugin, x as MongoKitPluginName } from "../repository-DNHfjAZX.mjs";
+import { A as EnsureAuditTrailReadyOptions, C as AuditQueryOptions, D as AuditTrailOptions, E as AuditTrailMode, M as ensureAuditTrailReady, O as AuditTrailQuery, S as AuditOperation, T as AuditTrailMethods, _ as CacheOptions, a as DateSequentialIdOptions, b as cachePlugin, c as SequentialIdOptions, f as getNextSequence, g as CacheAdapter, h as sequentialId, i as CustomIdOptions, j as auditTrailPlugin, k as AuditTrailQueryOptions, l as customIdPlugin, o as IdGenerator, p as prefixedId, r as multiTenantPlugin, s as PrefixedIdOptions, t as MultiTenantOptions, u as dateSequentialId, v as RepositoryCacheHandle, w as AuditQueryResult, x as AuditEntry, y as RepositoryCachePluginOptions } from "../multi-tenant.plugin-a3UhQARj.mjs";
+import { A as IdempotencyStoreMethods, B as batchOperationsPlugin, C as LeaseMethods, D as ImmutableStatesPluginOptions, E as ImmutableClaimView, F as elasticSearchPlugin, G as aggregateHelpersPlugin, H as AppendOnlyPluginOptions, I as cascadePlugin, L as BatchOperationsMethods, M as idempotencyStorePlugin, N as fieldFilterPlugin, O as immutableStatesPlugin, P as ElasticSearchOptions, S as methodRegistryPlugin, T as leasePlugin, U as appendOnlyPlugin, V as auditLogPlugin, W as AggregateHelpersMethods, _ as OperationMetric, a as requireField, b as mongoOperationsPlugin, c as timestampPlugin, d as createTenantContext, f as SubdocumentMethods, g as ObservabilityOptions, h as softDeletePlugin, i as immutableField, j as IdempotencyStorePluginOptions, k as IdempotencyClaim, l as TenantContext, m as SoftDeleteMethods, n as autoInject, o as uniqueField, p as subdocumentPlugin, r as blockIf, s as validationChainPlugin, t as OperationType, u as TenantStore, v as observabilityPlugin, w as LeasePluginOptions, x as MethodRegistryRepository, y as MongoOperationsMethods } from "../validation-chain.plugin-CTcNJCmV.mjs";
 import { ChangeLogStore } from "@classytic/repo-core/sync";
 //#region src/plugins/change-log.plugin.d.ts
 interface ChangeLogPluginOptions {
@@ -12,6 +12,11 @@ interface ChangeLogPluginOptions {
   tenantField?: string;
   /** Monotonic per-doc version field. Default `version` (kernel convention). */
   versionField?: string;
+  /**
+   * The document as a subscriber may see it — fields picked, secrets (a cost price) dropped. Tenant
+   * and version are still read from the whole document. Default: the whole document.
+   */
+  project?: (doc: Record<string, unknown>) => Record<string, unknown>;
 }
 declare function changeLogPlugin(options: ChangeLogPluginOptions): Plugin;
 //#endregion

package/dist/plugins/index.mjs

@@ -1,14 +1,18 @@
-import { a as customIdPlugin, c as prefixedId, d as AuditTrailQuery, f as auditTrailPlugin, i as multiTenantPlugin, l as sequentialId, m as auditLogPlugin, n as softDeletePlugin, o as dateSequentialId, p as ensureAuditTrailReady, s as getNextSequence, t as timestampPlugin, u as cachePlugin } from "../timestamp.plugin-B5eiaItQ.mjs";
+import { _ as AuditTrailQuery, b as auditLogPlugin, f as getNextSequence, g as cachePlugin, h as sequentialId, i as multiTenantPlugin, l as customIdPlugin, n as softDeletePlugin, p as prefixedId, t as timestampPlugin, u as dateSequentialId, v as auditTrailPlugin, y as ensureAuditTrailReady } from "../timestamp.plugin-zfdLYZiO.mjs";
 import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-C63pGn1d.mjs";
-import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-Bju1D1Sn.mjs";
+import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-CHUHWMtk.mjs";
 //#region src/plugins/change-log.plugin.ts
 const PLUGIN_NAME = "changeLog";
+/** Marks a repository already captured: the store and scope it writes to. */
+const CAPTURED = Symbol.for("mongokit.changeLog.capture");
+/** Where `before:updateMany` / `before:deleteMany` leave the ids they matched for the after hook. */
+const MATCHED_IDS = Symbol("changeLog.matchedIds");
 function isSkipped(context) {
 	const list = context.skipPlugins;
 	return Array.isArray(list) && list.includes(PLUGIN_NAME);
 }
 function changeLogPlugin(options) {
-	const { store, scope, tenantField = "organizationId", versionField = "version" } = options;
+	const { store, scope, tenantField = "organizationId", versionField = "version", project } = options;
 	const toRecord = (doc) => {
 		if (!doc || typeof doc !== "object") return null;
 		const d = doc;
@@ -21,51 +25,120 @@ function changeLogPlugin(options) {
 		return updatedAt instanceof Date ? updatedAt.getTime() : 0;
 	};
 	const tenantOf = (doc, context) => {
-		const raw = doc[tenantField] ?? context.organizationId;
+		const raw = doc?.[tenantField] ?? context.organizationId;
 		return raw === void 0 || raw === null ? void 0 : String(raw);
 	};
-	const capture = async (op, doc, context) => {
+	const appendOptions = (context) => context.session !== void 0 ? { session: context.session } : void 0;
+	const upsert = async (doc, context) => {
 		const record = toRecord(doc);
 		if (!record || record._id === void 0) return;
 		const tenantId = tenantOf(record, context);
 		await store.append({
 			scope,
 			docId: String(record._id),
-			op,
+			op: "upsert",
 			version: versionOf(record),
-			...op === "upsert" ? { doc: record } : {},
+			doc: project ? project(record) : record,
 			...tenantId !== void 0 ? { tenantId } : {}
-		}, context.session !== void 0 ? { session: context.session } : void 0);
+		}, appendOptions(context));
+	};
+	const tombstone = async (docId, context) => {
+		if (docId === void 0 || docId === null) return;
+		const tenantId = tenantOf(null, context);
+		await store.append({
+			scope,
+			docId: String(docId),
+			op: "delete",
+			version: 0,
+			...tenantId !== void 0 ? { tenantId } : {}
+		}, appendOptions(context));
 	};
 	return {
 		name: PLUGIN_NAME,
 		apply(repo) {
+			const marked = repo;
+			const existing = marked[CAPTURED];
+			if (existing) {
+				if (existing.store === store && existing.scope === scope) return;
+				throw new Error(`[mongokit] changeLogPlugin is already capturing this repository as "${existing.scope}"`);
+			}
+			marked[CAPTURED] = {
+				store,
+				scope
+			};
+			/** The whole document as committed in this session — never a projection. */
+			const reread = async (id, context) => {
+				const query = repo.Model.findById(id).lean();
+				if (context.session !== void 0) query.session(context.session);
+				return query.exec();
+			};
+			const matchingIds = async (context, filter) => {
+				const query = repo.Model.find(filter ?? {}).select({ _id: 1 }).lean();
+				if (context.session !== void 0) query.session(context.session);
+				return (await query.exec()).map((d) => d._id);
+			};
 			repo.on("after:create", async ({ context, result }) => {
-				if (isSkipped(context) || !result) return;
-				await capture("upsert", result, context);
+				if (!isSkipped(context) && result) await upsert(result, context);
 			});
 			repo.on("after:createMany", async ({ context, result }) => {
 				if (isSkipped(context) || !Array.isArray(result)) return;
-				for (const doc of result) await capture("upsert", doc, context);
+				for (const doc of result) await upsert(doc, context);
 			});
 			repo.on("after:update", async ({ context, result }) => {
-				if (isSkipped(context) || !result) return;
-				await capture("upsert", result, context);
+				if (!isSkipped(context) && result) await upsert(result, context);
+			});
+			for (const op of [
+				"claim",
+				"claimVersion",
+				"findOneAndUpdate",
+				"getOrCreate",
+				"restore"
+			]) repo.on(`after:${op}`, async ({ context, result }) => {
+				if (isSkipped(context)) return;
+				const id = toRecord(result)?._id;
+				if (id === void 0) return;
+				const doc = await reread(id, context);
+				if (doc) await upsert(doc, context);
+				else await tombstone(id, context);
+			});
+			for (const op of ["updateMany", "deleteMany"]) repo.on(`before:${op}`, async (context) => {
+				if (!isSkipped(context)) context[MATCHED_IDS] = await matchingIds(context, context.query);
+			});
+			/** Each re-read document as an upsert, or a tombstone where it is gone. */
+			const capture = async (ids, context) => {
+				for (const id of ids) {
+					const doc = await reread(id, context);
+					if (doc) await upsert(doc, context);
+					else await tombstone(id, context);
+				}
+			};
+			repo.on("after:updateMany", async ({ context }) => {
+				if (!isSkipped(context)) await capture(context[MATCHED_IDS] ?? [], context);
+			});
+			repo.on("after:anonymize", async ({ context, result }) => {
+				if (!isSkipped(context)) await capture(result.ids, context);
+			});
+			repo.on("after:deleteMany", async ({ context }) => {
+				if (!isSkipped(context)) await capture(context[MATCHED_IDS] ?? [], context);
 			});
 			repo.on("after:delete", async ({ context, result }) => {
 				if (isSkipped(context) || !result) return;
-				const summary = result;
-				const ctxId = context.id;
-				const docId = summary.id ?? ctxId;
-				if (docId === void 0 || docId === null) return;
-				const tenantRaw = context.organizationId;
-				await store.append({
-					scope,
-					docId: String(docId),
-					op: "delete",
-					version: 0,
-					...tenantRaw !== void 0 && tenantRaw !== null ? { tenantId: String(tenantRaw) } : {}
-				}, context.session !== void 0 ? { session: context.session } : void 0);
+				await tombstone(result.id ?? context.id, context);
+			});
+			repo.on("before:bulkWrite", async (context) => {
+				if (isSkipped(context)) return;
+				const ids = [];
+				for (const op of context.operations ?? []) {
+					const [kind, spec] = Object.entries(op)[0] ?? [];
+					if (!kind || !spec) continue;
+					if (kind === "insertOne") ids.push(spec.document?._id);
+					else ids.push(...await matchingIds(context, spec.filter));
+				}
+				context[MATCHED_IDS] = ids.filter((id) => id !== void 0);
+			});
+			repo.on("after:bulkWrite", async ({ context, result }) => {
+				if (isSkipped(context)) return;
+				await capture([...context[MATCHED_IDS] ?? [], ...Object.values(result?.upsertedIds ?? {})], context);
 			});
 		}
 	};

package/dist/query-defaults-BxUcSOoF.mjs

@@ -0,0 +1,208 @@
+import { t as createError } from "./error-BuByZwKU.mjs";
+import mongoose from "mongoose";
+//#region src/repository/query-defaults.ts
+/**
+* Query defaults — the time bound and read/write concerns every repository command carries.
+*
+* Resolution, per option: per call → repository (`RepositoryOptions.queryDefaults` /
+* `aggregateDefaults`) → deployment (`configureQueryDefaults` / `configureAggregateDefaults`).
+* An explicit value always wins (FL1). For an aggregation the aggregate chain is consulted before
+* the generic query chain, because it is the more specific instruction.
+*
+* The bound travels as per-op CSOT `timeoutMS` (the driver derives the wire `maxTimeMS` from
+* it, and a client-level `timeoutMS` cannot override it). It and `comment` go to the commands Mongoose itself bounds with its global `maxTimeMS`
+* (find, findOne, countDocuments, distinct, findOneAndUpdate, aggregate:
+* lib/query.js:2465,2812,2905,3074,3610; lib/aggregate.js:1106). Writes get `writeConcern`. The
+* connection's CSOT `timeoutMS` bounds everything else; {@link assertQueryDefaultsConfigured}
+* checks both at boot. Inside a transaction a DEFAULT read/write concern or read preference is
+* dropped (the transaction owns them); a per-call one is passed and the driver judges it.
+*/
+/** On `globalThis`, for the reason `pagination/defaults.ts` gives: a duplicated install must share it. */
+const POLICY_SLOT = Symbol.for("classytic.mongokit.queryDefaults");
+function policy() {
+	const holder = globalThis;
+	holder[POLICY_SLOT] ??= {
+		query: {},
+		aggregate: {}
+	};
+	return holder[POLICY_SLOT];
+}
+function defined(input) {
+	return Object.fromEntries(Object.entries(input).filter(([, v]) => v !== void 0));
+}
+function assertPositive(name, value) {
+	if (value !== void 0 && !(Number.isFinite(value) && value > 0)) throw new TypeError(`[mongokit] ${name} must be a positive number of milliseconds, got ${value}`);
+}
+/** Set the deployment's query defaults. Merges; an explicit `undefined` changes nothing. */
+function configureQueryDefaults(defaults) {
+	assertPositive("queryDefaults.maxTimeMS", defaults.maxTimeMS);
+	Object.assign(policy().query, defined(defaults));
+}
+/** Set the deployment's aggregation defaults. Merges; an explicit `undefined` changes nothing. */
+function configureAggregateDefaults(defaults) {
+	assertPositive("aggregateDefaults.maxTimeMs", defaults.maxTimeMs);
+	Object.assign(policy().aggregate, defined(defaults));
+}
+/** A copy of the deployment defaults. */
+function getQueryDefaults() {
+	const p = policy();
+	return {
+		query: { ...p.query },
+		aggregate: { ...p.aggregate }
+	};
+}
+/** Back to no deployment defaults. For tests. */
+function resetQueryDefaults() {
+	const holder = globalThis;
+	holder[POLICY_SLOT] = {
+		query: {},
+		aggregate: {}
+	};
+}
+/**
+* Boot check (M7): throws unless the deployment sets a query `maxTimeMS`, and — when a connection
+* is passed — unless its client carries a CSOT `timeoutMS`. Returns what it verified.
+*/
+function assertQueryDefaultsConfigured(connection) {
+	const maxTimeMS = policy().query.maxTimeMS;
+	if (maxTimeMS === void 0) throw createError(500, "[mongokit] no deployment query time bound: call configureQueryDefaults({ maxTimeMS }) at boot", {
+		code: QUERY_DEFAULTS_ERROR_CODES.NOT_CONFIGURED,
+		meta: { missing: "maxTimeMS" }
+	});
+	if (!connection) return { maxTimeMS };
+	const timeoutMS = connection.getClient().options.timeoutMS;
+	if (!(typeof timeoutMS === "number" && timeoutMS > 0)) throw createError(500, "[mongokit] the connection has no CSOT timeoutMS: pass { timeoutMS } to mongoose.connect()", {
+		code: QUERY_DEFAULTS_ERROR_CODES.NOT_CONFIGURED,
+		meta: { missing: "timeoutMS" }
+	});
+	return {
+		maxTimeMS,
+		timeoutMS
+	};
+}
+const QUERY_DEFAULTS_ERROR_CODES = {
+	NOT_CONFIGURED: "mongokit.query_defaults.not_configured",
+	/** A per-call bound inside a transaction that carries its own CSOT budget (the driver forbids both). */
+	TIMEOUT_IN_TRANSACTION: "mongokit.query_defaults.timeout_in_transaction"
+};
+const TX_DEADLINE = Symbol.for("@classytic/mongokit/transaction-deadline");
+/**
+* Set (or clear) the transaction budget's deadline (`performance.now()` ms) on a session.
+* `runTransaction` sets it for each attempt; every mongokit op on the session is then bounded
+* by what remains of it, so a transaction budget is ONE budget, as with the driver's own.
+*/
+function setTransactionDeadline(session, deadline) {
+	Object.defineProperty(session, TX_DEADLINE, {
+		value: deadline,
+		writable: true,
+		configurable: true,
+		enumerable: false
+	});
+}
+function transactionRemaining(session) {
+	if (!session || typeof session !== "object") return void 0;
+	const deadline = session[TX_DEADLINE];
+	return deadline === void 0 ? void 0 : Math.floor(deadline - performance.now());
+}
+function inTransaction(session) {
+	const s = session;
+	return typeof s?.inTransaction === "function" && s.inTransaction();
+}
+/**
+* A `withTransaction` running under a CSOT budget: the driver refuses any per-op `timeoutMS`
+* there (mongodb lib/utils.js:451, `session.explicit && session.timeoutContext != null`).
+*/
+function csotTransaction(session) {
+	const s = session;
+	return inTransaction(session) && s?.explicit === true && s.timeoutContext != null;
+}
+/** Resolve the options one command runs with. `repo` is the repository's own defaults. */
+function resolveQueryOptions(kind, perCall, repo = {}) {
+	const deployment = policy();
+	const q = {
+		...deployment.query,
+		...defined(repo.query ?? {})
+	};
+	const agg = {
+		...deployment.aggregate,
+		...defined(repo.aggregate ?? {})
+	};
+	const tx = inTransaction(perCall.session);
+	const out = {};
+	const budget = tx ? transactionRemaining(perCall.session) : void 0;
+	if (budget !== void 0 && budget <= 0) throw new mongoose.mongo.MongoOperationTimeoutError("Transaction budget exhausted before this operation");
+	if (kind !== "write") {
+		if (csotTransaction(perCall.session) && perCall.maxTimeMS !== void 0) throw createError(400, "[mongokit] a per-call maxTimeMS cannot be honoured inside a transaction with its own timeoutMS budget; bound the transaction instead", { code: QUERY_DEFAULTS_ERROR_CODES.TIMEOUT_IN_TRANSACTION });
+		const bound = tx ? perCall.maxTimeMS : perCall.maxTimeMS ?? (kind === "aggregate" ? repo.aggregate?.maxTimeMs ?? deployment.aggregate.maxTimeMs : void 0) ?? q.maxTimeMS;
+		const capped = budget === void 0 ? bound : Math.min(bound ?? Number.POSITIVE_INFINITY, budget);
+		if (capped !== void 0) out.maxTimeMS = capped;
+		const comment = perCall.comment ?? q.comment;
+		if (comment !== void 0) out.comment = comment;
+		if (perCall.hint !== void 0) out.hint = perCall.hint;
+	}
+	if (kind === "read" || kind === "aggregate") {
+		const pref = perCall.readPreference ?? (tx ? void 0 : q.readPreference);
+		if (pref !== void 0) out.readPreference = pref;
+		const concern = perCall.readConcern ?? (tx ? void 0 : q.readConcern);
+		if (concern !== void 0) out.readConcern = concern;
+	}
+	if (kind === "aggregate") {
+		const disk = perCall.allowDiskUse ?? agg.allowDiskUse;
+		if (disk !== void 0) out.allowDiskUse = disk;
+	}
+	if (kind === "write" && budget !== void 0) out.maxTimeMS = budget;
+	if (kind === "write" || kind === "findAndModify") {
+		const wc = perCall.writeConcern ?? (tx ? void 0 : q.writeConcern);
+		if (wc !== void 0) out.writeConcern = wc;
+	}
+	return out;
+}
+const READ_PREFERENCE_MODES = [
+	"primary",
+	"primaryPreferred",
+	"secondary",
+	"secondaryPreferred",
+	"nearest"
+];
+function isReadPreferenceMode(value) {
+	return READ_PREFERENCE_MODES.includes(value);
+}
+/** A read preference outside the driver's modes is refused, never passed through (FL2). */
+function readPreferenceMode(value) {
+	if (isReadPreferenceMode(value)) return value;
+	throw new TypeError(`[mongokit] unknown readPreference '${value}'; expected one of ${READ_PREFERENCE_MODES.join(", ")}`);
+}
+/** Apply resolved options to a mongoose Query. */
+function applyToQuery(query, o) {
+	if (o.maxTimeMS !== void 0) {
+		const csot = { timeoutMS: o.maxTimeMS };
+		query.setOptions(csot);
+	}
+	if (o.comment !== void 0) query.setOptions({ comment: o.comment });
+	if (o.readPreference !== void 0) query.read(readPreferenceMode(o.readPreference));
+	if (o.readConcern !== void 0) query.readConcern(o.readConcern);
+	if (o.writeConcern !== void 0) query.setOptions({ writeConcern: o.writeConcern });
+	if (o.hint !== void 0) query.hint(o.hint);
+}
+/**
+* Make a find cursor's bound apply PER BATCH (CSOT `timeoutMode: 'iteration'`). Only when some
+* `timeoutMS` exists (this op's, or the client's): the driver refuses a timeoutMode without one
+* (mongodb lib/cursor/abstract_cursor.js:114). In iteration mode the driver enforces the budget
+* client-side per batch and sends no wire maxTimeMS.
+*/
+function applyCursorTimeoutMode(query, o, connection) {
+	const clientTimeout = connection.getClient().options.timeoutMS;
+	if (o.maxTimeMS === void 0 && clientTimeout === void 0) return;
+	query.setOptions({ timeoutMode: "iteration" });
+}
+/** Apply resolved options to a mongoose Aggregate. */
+function applyToAggregate(aggregation, o) {
+	if (o.maxTimeMS !== void 0) aggregation.option({ timeoutMS: o.maxTimeMS });
+	if (o.comment !== void 0) aggregation.option({ comment: o.comment });
+	if (o.readPreference !== void 0) aggregation.read(readPreferenceMode(o.readPreference));
+	if (o.readConcern !== void 0) aggregation.readConcern(o.readConcern);
+	if (o.allowDiskUse !== void 0) aggregation.allowDiskUse(o.allowDiskUse);
+	if (o.hint !== void 0) aggregation.hint(o.hint);
+}
+//#endregion
+export { assertQueryDefaultsConfigured as a, getQueryDefaults as c, setTransactionDeadline as d, applyToQuery as i, resetQueryDefaults as l, applyCursorTimeoutMode as n, configureAggregateDefaults as o, applyToAggregate as r, configureQueryDefaults as s, QUERY_DEFAULTS_ERROR_CODES as t, resolveQueryOptions as u };