@classytic/mongokit 3.40.0 → 3.40.1

package/dist/index.mjs

@@ -1,23 +1,26 @@
 import { n as idVariants } from "./id-resolution-BqDrk0S2.mjs";
-import { a as MUTATING_OPERATIONS, c as operationsByPolicyKey, i as ALL_OPERATIONS, l as createMongoPurgePort, n as Repository, o as OP_REGISTRY, r as AggregationBuilder, s as READ_OPERATIONS, t as HOOK_PRIORITY } from "./Repository-BMgPSkqZ.mjs";
-import { C as isCreateManyPartialError, g as LookupBuilder, v as compileFilterToMongo } from "./update-DG0fCwRJ.mjs";
+import { a as MUTATING_OPERATIONS, c as operationsByPolicyKey, i as ALL_OPERATIONS, l as createMongoPurgePort, n as Repository, o as OP_REGISTRY, r as AggregationBuilder, s as READ_OPERATIONS, t as HOOK_PRIORITY } from "./Repository-CYhSC9ut.mjs";
+import { C as isCreateManyPartialError, g as LookupBuilder, v as compileFilterToMongo } from "./update-WgeAUJ_I.mjs";
 import { n as warn, t as configureLogger } from "./logger-K7dPmu2U.mjs";
 import { n as isDuplicateKeyError, r as parseDuplicateKeyError, t as createError } from "./error-BuByZwKU.mjs";
+import { a as assertQueryDefaultsConfigured, c as getQueryDefaults, l as resetQueryDefaults, o as configureAggregateDefaults, s as configureQueryDefaults, t as QUERY_DEFAULTS_ERROR_CODES, u as resolveQueryOptions } from "./query-defaults-BxUcSOoF.mjs";
 import { t as actions_exports } from "./actions/index.mjs";
-import { c as classifyHelloReply, d as resolveMongoCapabilities, f as resolveTransactionSupport, i as withTransaction, l as probeMongoCapabilities, n as isTransactionUnsupported, o as MONGOKIT_CAPABILITIES, p as transactionResolutionOf, r as supportsTransactions, s as capabilitiesForSupport, t as batchTransaction, u as resetCapabilityProbeCache } from "./transaction-B5L9glO0.mjs";
-import { _ as AuditTrailQuery, a as declareTenantContextKey, b as auditLogPlugin, c as tenantContextKeysOf, d as ensureSequenceAtLeast, f as getNextSequence, g as cachePlugin, h as sequentialId, i as multiTenantPlugin, l as customIdPlugin, m as readSequence, n as softDeletePlugin, o as forwardScope, p as prefixedId, r as adminBypass, s as isScopeKey, t as timestampPlugin, u as dateSequentialId, v as auditTrailPlugin, y as ensureAuditTrailReady } from "./timestamp.plugin-DF0gJB6p.mjs";
+import { c as classifyHelloReply, d as resolveMongoCapabilities, f as resolveTransactionSupport, i as withTransaction, l as probeMongoCapabilities, n as isTransactionUnsupported, o as MONGOKIT_CAPABILITIES, p as transactionResolutionOf, r as supportsTransactions, s as capabilitiesForSupport, t as batchTransaction, u as resetCapabilityProbeCache } from "./transaction-BrRYtH_b.mjs";
+import { _ as AuditTrailQuery, a as declareTenantContextKey, b as auditLogPlugin, c as tenantContextKeysOf, d as ensureSequenceAtLeast, f as getNextSequence, g as cachePlugin, h as sequentialId, i as multiTenantPlugin, l as customIdPlugin, m as readSequence, n as softDeletePlugin, o as forwardScope, p as prefixedId, r as adminBypass, s as isScopeKey, t as timestampPlugin, u as dateSequentialId, v as auditTrailPlugin, y as ensureAuditTrailReady } from "./timestamp.plugin-zfdLYZiO.mjs";
 import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "./method-registry.plugin-C63pGn1d.mjs";
-import { a as getPaginationDefaults, i as configurePaginationDefaults, o as resetPaginationDefaults, t as PaginationEngine } from "./PaginationEngine-Dvl8jcRY.mjs";
+import { c as PAGINATION_ERROR_CODES, h as resetPaginationDefaults, m as getPaginationDefaults, p as configurePaginationDefaults, t as PaginationEngine } from "./PaginationEngine-CfT2Cxkj.mjs";
 import { GEO_OPERATORS, parseGeoFilter } from "./query/primitives/geo.mjs";
-import { t as createRepository } from "./create-repository-BzBUMvd1.mjs";
+import { n as declareCollectionScope, t as JOIN_ERROR_CODES } from "./join-scope-DSAznE8E.mjs";
+import { t as createRepository } from "./create-repository-BYyWzLbt.mjs";
 import { n as defineModel, r as isModelRegistered, t as ModelCollisionError } from "./model-registry-ClKtWiHa.mjs";
-import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "./validation-chain.plugin-BLY2gLEk.mjs";
+import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "./validation-chain.plugin-CHUHWMtk.mjs";
 import { i as getMongooseProjection, n as filterResponseData, r as getFieldsForUser, t as createFieldPreset } from "./field-selection-FSQFLpsU.mjs";
 import { buildFieldTypeMap, coerceHeuristic } from "./query/primitives/coercion.mjs";
 import { extractSchemaIndexes } from "./query/primitives/indexes.mjs";
 import { n as createMemoryCache, t as toPlain } from "./to-plain-vksRrLtc.mjs";
-import { n as buildCrudSchemasFromMongooseSchema, t as buildCrudSchemasFromModel } from "./mongooseToJsonSchema-waUVQwK4.mjs";
+import { n as buildCrudSchemasFromMongooseSchema, t as buildCrudSchemasFromModel } from "./mongooseToJsonSchema-C3k4ide0.mjs";
 import { runChunkedPurge } from "@classytic/repo-core/repository";
+import { stableStringify } from "@classytic/repo-core/hash";
 import { OPERATOR_DESCRIPTIONS, QueryGrammarError, URL_OPERATORS, clausesToFilter, escapeRegex, isQueryGrammarError, readFilterClauses, readPageRequest, readSearch, readSelect, readSort } from "@classytic/repo-core/query-parser";
 //#region src/actions/cascade-references.ts
 /**
@@ -219,6 +222,45 @@ function defineModels(spec) {
 	};
 }
 //#endregion
+//#region src/pagination/keyset-source.ts
+/**
+* `keysetSource(repo, { name, sort, filters, ...scope })` — a mongokit repository as a repo-core
+* `KeysetSource`, for `mergeKeysetPages`. Pages are `getAll({ mode: 'keyset' })` under the given
+* scope; the per-row cursor is `repo.keysetCursor` (scope-bound like every mongokit cursor); the
+* source's `scope` string binds the composite cursor to (collection, filters, tenant values).
+*/
+function keysetSource(repo, options) {
+	const { name, sort, filters = {}, ...scope } = options;
+	const { session: _session, user: _user, ...tenant } = forwardScope(scope);
+	return {
+		name,
+		scope: `${repo.Model.collection.collectionName}:${stableStringify({
+			filters,
+			tenant
+		})}`,
+		async page({ after, limit }) {
+			const page = await repo.getAll({
+				...scope,
+				filters,
+				sort,
+				limit,
+				mode: "keyset",
+				...after ? { after } : {}
+			});
+			if (page.method !== "keyset") throw new Error("[mongokit] keysetSource: getAll did not return a keyset page");
+			return {
+				data: page.data,
+				hasMore: page.hasMore
+			};
+		},
+		cursorOf: (row) => repo.keysetCursor(row, {
+			...scope,
+			sort,
+			filters
+		})
+	};
+}
+//#endregion
 //#region src/query/parser/pipeline-sanitizer.ts
 /**
 * Sanitize $match configuration to prevent dangerous operators.
@@ -1059,12 +1101,14 @@ var QueryParser = class {
 	parse(query) {
 		const rt = this.rt;
 		const q = query ?? {};
-		const { page, limit, sort, populate, search, after, cursor, select, lookup, aggregate } = q;
+		const { page, limit, sort, populate, search, after, cursor, before, mode, select, lookup, aggregate } = q;
 		const pageRequest = guarded(rt, () => readPageRequest({
 			page,
 			limit,
 			after,
-			cursor
+			cursor,
+			before,
+			mode
 		}, { maxLimit: rt.options.maxLimit }), readPageRequest({}, { maxLimit: rt.options.maxLimit }));
 		const effectiveSort = sort === void 0 && isSortFieldAllowed(rt, "-createdAt") ? DEFAULT_PARSER_SORT : sort;
 		const sanitizedSearch = sanitizeSearch(rt, search);
@@ -1092,6 +1136,8 @@ var QueryParser = class {
 		if (rt.options.enableLookups && lookup) parsed.lookups = parseLookups(rt, lookup);
 		if (rt.options.enableAggregations && aggregate) parsed.aggregation = parseAggregation(rt, aggregate);
 		if (pageRequest.after !== void 0) parsed.after = pageRequest.after;
+		if (pageRequest.before !== void 0) parsed.before = pageRequest.before;
+		if (pageRequest.mode !== void 0) parsed.mode = pageRequest.mode;
 		if (pageRequest.page !== void 0) parsed.page = pageRequest.page;
 		return parsed;
 	}
@@ -1391,4 +1437,4 @@ function systemContext(extra) {
 */
 var src_default = Repository;
 //#endregion
-export { ALL_OPERATIONS, AggregationBuilder, AuditTrailQuery, HOOK_PRIORITY, LookupBuilder, MONGOKIT_CAPABILITIES, MONGOKIT_PLUGIN_NAMES, MUTATING_OPERATIONS, ModelCollisionError, OP_REGISTRY, PaginationEngine, QueryParser, READ_OPERATIONS, Repository, actions_exports as actions, adminBypass, aggregateHelpersPlugin, appendOnlyPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, batchTransaction, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, capabilitiesForSupport, cascadePlugin, cascadePurgeReferences, classifyHelloReply, compileFilterToMongo, configureLogger, configurePaginationDefaults, createError, createFieldPreset, createMemoryCache, createOptionsExtractor, createRepository, createTenantContext, customIdPlugin, dateSequentialId, declareTenantContextKey, src_default as default, defineModel, defineModels, elasticSearchPlugin, ensureAuditTrailReady, ensureSequenceAtLeast, fieldFilterPlugin, filterResponseData, forwardScope, getFieldsForUser, getMongooseProjection, getNextSequence, getPaginationDefaults, idVariants, idempotencyStorePlugin, immutableField, immutableStatesPlugin, isCreateManyPartialError, isDuplicateKeyError, isModelRegistered, isTransactionUnsupported, leasePlugin, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, operationsByPolicyKey, parseDuplicateKeyError, prefixedId, probeMongoCapabilities, readSequence, repoOptionsFromCtx, requireField, resetCapabilityProbeCache, resetPaginationDefaults, resolveMongoCapabilities, resolveTransactionSupport, sequentialId, softDeletePlugin, subdocumentPlugin, supportsTransactions, systemContext, tenantContextKeysOf, timestampPlugin, toPlain, transactionResolutionOf, uniqueField, validationChainPlugin, withTransaction };
+export { ALL_OPERATIONS, AggregationBuilder, AuditTrailQuery, HOOK_PRIORITY, JOIN_ERROR_CODES, LookupBuilder, MONGOKIT_CAPABILITIES, MONGOKIT_PLUGIN_NAMES, MUTATING_OPERATIONS, ModelCollisionError, OP_REGISTRY, PAGINATION_ERROR_CODES, PaginationEngine, QUERY_DEFAULTS_ERROR_CODES, QueryParser, READ_OPERATIONS, Repository, actions_exports as actions, adminBypass, aggregateHelpersPlugin, appendOnlyPlugin, assertQueryDefaultsConfigured, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, batchTransaction, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, capabilitiesForSupport, cascadePlugin, cascadePurgeReferences, classifyHelloReply, compileFilterToMongo, configureAggregateDefaults, configureLogger, configurePaginationDefaults, configureQueryDefaults, createError, createFieldPreset, createMemoryCache, createOptionsExtractor, createRepository, createTenantContext, customIdPlugin, dateSequentialId, declareCollectionScope, declareTenantContextKey, src_default as default, defineModel, defineModels, elasticSearchPlugin, ensureAuditTrailReady, ensureSequenceAtLeast, fieldFilterPlugin, filterResponseData, forwardScope, getFieldsForUser, getMongooseProjection, getNextSequence, getPaginationDefaults, getQueryDefaults, idVariants, idempotencyStorePlugin, immutableField, immutableStatesPlugin, isCreateManyPartialError, isDuplicateKeyError, isModelRegistered, isTransactionUnsupported, keysetSource, leasePlugin, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, operationsByPolicyKey, parseDuplicateKeyError, prefixedId, probeMongoCapabilities, readSequence, repoOptionsFromCtx, requireField, resetCapabilityProbeCache, resetPaginationDefaults, resetQueryDefaults, resolveMongoCapabilities, resolveQueryOptions, resolveTransactionSupport, sequentialId, softDeletePlugin, subdocumentPlugin, supportsTransactions, systemContext, tenantContextKeysOf, timestampPlugin, toPlain, transactionResolutionOf, uniqueField, validationChainPlugin, withTransaction };

package/dist/join-scope-DSAznE8E.mjs

@@ -0,0 +1,168 @@
+import { t as createError } from "./error-BuByZwKU.mjs";
+import mongoose from "mongoose";
+//#region src/repository/join-scope.ts
+/**
+* Join scope — a joined collection is read under ITS OWN policy, or not at all.
+*
+* Policy plugins (`multiTenantPlugin`, `softDeletePlugin`) declare a scope rule on the MODEL they
+* are bound to, and every repository marks its model governed. {@link scopeJoins} walks a
+* pipeline (nested sub-pipelines and `$facet` branches included) and, for each `$lookup`,
+* `$unionWith` and `$graphLookup`, resolves `from` to the registered models that own that
+* collection, then prepends the union of their rules (fail closed). It REFUSES, with a closed
+* code, a `from` no model owns (the silent-empty-join: a wrong literal matches nothing and raises
+* nothing) and a collection no repository governs. `unscopedJoins` names collections the caller
+* asserts are company-wide; a collection with a declared rule cannot be unscoped that way —
+* `bypassTenant` is the explicit cross-tenant form.
+*/
+const JOIN_ERROR_CODES = {
+	UNKNOWN_COLLECTION: "mongokit.join.unknown_collection",
+	UNGOVERNED_COLLECTION: "mongokit.join.ungoverned_collection",
+	UNSCOPE_REFUSED: "mongokit.join.unscope_refused",
+	UNRESOLVABLE_FROM: "mongokit.join.unresolvable_from"
+};
+const RULES = Symbol.for("@classytic/mongokit/collection-scope-rules");
+const GOVERNED = Symbol.for("@classytic/mongokit/governed-model");
+const TENANT_FIELDS = Symbol.for("@classytic/mongokit/tenant-fields");
+/** Called by a policy plugin at bind: reads of this model's collection carry `rule`. */
+function declareCollectionScope(model, rule, meta = {}) {
+	const holder = model;
+	if (!holder[RULES]) Object.defineProperty(holder, RULES, {
+		value: /* @__PURE__ */ new Set(),
+		enumerable: false
+	});
+	holder[RULES]?.add(rule);
+	if (meta.tenantField) {
+		if (!holder[TENANT_FIELDS]) Object.defineProperty(holder, TENANT_FIELDS, {
+			value: /* @__PURE__ */ new Set(),
+			enumerable: false
+		});
+		holder[TENANT_FIELDS]?.add(meta.tenantField);
+	}
+}
+/** The tenant fields declared on this model by its repositories' tenant plugins. */
+function tenantFieldsOf(model) {
+	return [...model[TENANT_FIELDS] ?? []];
+}
+/** Called by every Repository: this model's scope is known (possibly none). */
+function markGoverned(model) {
+	const holder = model;
+	if (!holder[GOVERNED]) Object.defineProperty(holder, GOVERNED, {
+		value: true,
+		enumerable: false
+	});
+}
+function owners(connection, collection) {
+	return Object.values(connection.models).filter((m) => m.collection?.collectionName === collection);
+}
+function resemblance(connection, from) {
+	const pluralize = mongoose.pluralize();
+	const target = from.toLowerCase();
+	return Object.values(connection.models).filter((m) => {
+		const name = m.modelName.toLowerCase();
+		return name === target || `${name}s` === target || pluralize?.(m.modelName) === target;
+	}).map((m) => `model '${m.modelName}' lives in collection '${m.collection?.collectionName}'`).join("; ");
+}
+/** The predicate a join into `from` must carry, `undefined` for none; throws when unknown. */
+function scopeForCollection(from, env) {
+	if (typeof from !== "string" || from.length === 0) throw createError(500, `[mongokit] a join's 'from' must be a collection name, got ${JSON.stringify(from)}`, {
+		code: JOIN_ERROR_CODES.UNRESOLVABLE_FROM,
+		meta: { from }
+	});
+	const unscoped = env.unscopedJoins?.includes(from) === true;
+	const found = owners(env.connection, from);
+	if (found.length === 0) {
+		if (unscoped) return void 0;
+		const hint = resemblance(env.connection, from);
+		throw createError(500, `[mongokit] join into '${from}': no registered model owns that collection, so the join would match nothing.${hint ? ` Did you mean: ${hint}?` : ""} Take 'from' from Model.collection.name.`, {
+			code: JOIN_ERROR_CODES.UNKNOWN_COLLECTION,
+			meta: {
+				from,
+				suggestion: hint || void 0
+			}
+		});
+	}
+	const governed = found.some((m) => m[GOVERNED] === true);
+	const rules = /* @__PURE__ */ new Set();
+	for (const m of found) for (const r of m[RULES] ?? []) rules.add(r);
+	if (!governed && rules.size === 0) {
+		if (unscoped) return void 0;
+		throw createError(500, `[mongokit] join into '${from}': no repository governs it, so its tenant/soft-delete scope is unknown. Build its repository, or list it in unscopedJoins if it is company-wide.`, {
+			code: JOIN_ERROR_CODES.UNGOVERNED_COLLECTION,
+			meta: {
+				from,
+				models: found.map((m) => m.modelName)
+			}
+		});
+	}
+	const predicates = [];
+	for (const rule of rules) {
+		const p = rule(env.context, env.operation);
+		if (p && Object.keys(p).length > 0) predicates.push(p);
+	}
+	if (predicates.length === 0) return void 0;
+	if (unscoped) throw createError(500, `[mongokit] join into '${from}': it is scoped by its repository and cannot be listed in unscopedJoins. Use bypassTenant for a deliberate cross-tenant read.`, {
+		code: JOIN_ERROR_CODES.UNSCOPE_REFUSED,
+		meta: { from }
+	});
+	return predicates.length === 1 ? predicates[0] : { $and: predicates };
+}
+function scopedPipeline(sub, scope, env) {
+	const walked = walk(Array.isArray(sub) ? sub : [], env);
+	return scope ? [{ $match: scope }, ...walked] : walked;
+}
+/**
+* Return `pipeline` with every join scoped; throws on an unknown or ungoverned `from`. The result
+* is the one documented narrowing of a caller's stage array to mongoose's stage union (stage
+* validity is the server's call); `aggregatePipeline` no longer carries its own.
+*/
+function scopeJoins(pipeline, env) {
+	return walk(pipeline, env);
+}
+function walk(pipeline, env) {
+	return pipeline.map((raw) => {
+		const stage = raw;
+		if (stage.$lookup) {
+			const l = stage.$lookup;
+			if (l.from === void 0) return { $lookup: {
+				...l,
+				pipeline: scopedPipeline(l.pipeline, void 0, env)
+			} };
+			const scope = scopeForCollection(l.from, env);
+			if (!scope && l.pipeline === void 0) return stage;
+			return { $lookup: {
+				...l,
+				pipeline: scopedPipeline(l.pipeline, scope, env)
+			} };
+		}
+		if (stage.$unionWith) {
+			const u = typeof stage.$unionWith === "string" ? { coll: stage.$unionWith } : stage.$unionWith;
+			if (u.coll === void 0) return { $unionWith: {
+				...u,
+				pipeline: scopedPipeline(u.pipeline, void 0, env)
+			} };
+			const scope = scopeForCollection(u.coll, env);
+			if (!scope && u.pipeline === void 0) return stage;
+			return { $unionWith: {
+				...u,
+				pipeline: scopedPipeline(u.pipeline, scope, env)
+			} };
+		}
+		if (stage.$graphLookup) {
+			const g = stage.$graphLookup;
+			const scope = scopeForCollection(g.from, env);
+			if (!scope) return stage;
+			const existing = g.restrictSearchWithMatch;
+			return { $graphLookup: {
+				...g,
+				restrictSearchWithMatch: existing ? { $and: [existing, scope] } : scope
+			} };
+		}
+		if (stage.$facet) {
+			const branches = stage.$facet;
+			return { $facet: Object.fromEntries(Object.entries(branches).map(([k, v]) => [k, walk(v, env)])) };
+		}
+		return stage;
+	});
+}
+//#endregion
+export { scopeJoins as a, scopeForCollection as i, declareCollectionScope as n, tenantFieldsOf as o, markGoverned as r, JOIN_ERROR_CODES as t };

package/dist/{mongooseToJsonSchema-waUVQwK4.mjs → mongooseToJsonSchema-C3k4ide0.mjs}

@@ -46,14 +46,18 @@ function buildCrudSchemasFromMongooseSchema(mongooseSchema, options = {}) {
 	const jsonCreate = buildJsonSchemaFromPaths(mongooseSchema, options);
 	const jsonUpdate = buildJsonSchemaForUpdate(jsonCreate, options);
 	const jsonResponse = buildJsonSchemaForResponse(mongooseSchema, options);
+	const idPath = mongooseSchema.path("_id");
 	return {
 		createBody: jsonCreate,
 		updateBody: jsonUpdate,
 		params: {
 			type: "object",
-			properties: { id: {
+			properties: { id: idPath === void 0 || isObjectIdInstance(idPath.instance ?? "") ? {
 				type: "string",
 				pattern: "^[0-9a-fA-F]{24}$"
+			} : {
+				type: "string",
+				minLength: 1
 			} },
 			required: ["id"]
 		},

package/dist/{multi-tenant.plugin-CBgCo9im.d.mts → multi-tenant.plugin-a3UhQARj.d.mts}

@@ -1,5 +1,5 @@
-import { g as ObjectId } from "./pagination-BpIv2bdS.mjs";
-import { l as Plugin, p as RepositoryContext } from "./repository-odl03582.mjs";
+import { A as ObjectId } from "./pagination-D6psses0.mjs";
+import { l as Plugin, p as RepositoryContext } from "./repository-DNHfjAZX.mjs";
 import mongoose, { Connection } from "mongoose";
 import { CacheAdapter as CacheAdapter$1, CacheOptions, RepositoryCacheHandle as RepositoryCacheHandle$1, RepositoryCachePluginOptions, cachePlugin } from "@classytic/repo-core/cache";
 import { TenantConfig } from "@classytic/repo-core/tenant";

package/dist/{operations-CrRIoc8Z.d.mts → operations-XiFgG5US.d.mts}

@@ -1,4 +1,4 @@
-import { _ as PopulateSpec, g as ObjectId, i as CountStrategy, r as CollationOptions, v as ReadPreferenceType, x as SortSpec, y as SelectSpec } from "./pagination-BpIv2bdS.mjs";
+import { A as ObjectId, F as SortSpec, M as ReadPreferenceType, N as SelectSpec, b as WriteConcernSpec, i as CountStrategy, j as PopulateSpec, r as CollationOptions, v as ReadConcernLevel } from "./pagination-D6psses0.mjs";
 import { DeleteManyResult, DeleteResult, LookupPopulateResult, UpdateManyResult } from "@classytic/repo-core/repository";
 import { PipelineStage, PopulateOptions } from "mongoose";
 import { Filter } from "@classytic/repo-core/filter";
@@ -312,13 +312,20 @@ interface SessionOptions {
    * substitute for access control — gate it at the host layer.
    */
   bypassAppendOnly?: boolean;
+  /** Write concern for this call; beats `queryDefaults.writeConcern`. Ignored by reads. */
+  writeConcern?: WriteConcernSpec;
   /** Extensible — plugins can read custom fields from options */
   [key: string]: unknown;
 }
-/** Read options — session + readPreference for read-only operations */
+/** Read options. Each field beats the repository and deployment `queryDefaults`. */
 interface ReadOptions extends SessionOptions {
   /** Read preference for replica sets (e.g. 'secondaryPreferred') */
   readPreference?: ReadPreferenceType;
+  /** Server-side time bound for this command. */
+  maxTimeMS?: number;
+  readConcern?: ReadConcernLevel;
+  /** Profiler / log tag. */
+  comment?: string;
 }
 /** Repository operation options */
 interface OperationOptions extends ReadOptions {
@@ -436,21 +443,17 @@ interface FindOneAndUpdateOptions extends OperationOptions {
   runValidators?: boolean;
   /** Collation for locale-aware string comparison. */
   collation?: CollationOptions;
-  /** Maximum execution time in milliseconds. */
-  maxTimeMS?: number;
+  /** Force an index (name or key pattern). */
+  hint?: string | Record<string, 1 | -1>;
 }
 /** Aggregate operation options */
 interface AggregateOptions extends ReadOptions {
   /** Allow aggregation to use disk for large sorts/groups */
   allowDiskUse?: boolean;
-  /** Comment for profiler/logs */
-  comment?: string;
-  /** Maximum execution time in milliseconds */
-  maxTimeMS?: number;
-  /** Read concern level */
-  readConcern?: {
-    level: string;
-  };
+  /** Force an index (name or key pattern). */
+  hint?: string | Record<string, 1 | -1>;
+  /** Collections the caller asserts are company-wide, joinable without a governing repository. */
+  unscopedJoins?: readonly string[];
   /** Collation for locale-aware string comparison */
   collation?: CollationOptions;
   /** Maximum allowed pipeline stages (governance) */
@@ -532,5 +535,25 @@ interface MinMaxResult {
   min: unknown;
   max: unknown;
 }
+/** Kit-native options for the portable `aggregate(req)`; each field beats every default. */
+interface AggregateCallOptions {
+  /** Also return the winning plan (a second command). */
+  explain?: 'queryPlanner' | 'executionStats' | 'allPlansExecution';
+  /** Collections the caller asserts are company-wide (see `join-scope.ts`). */
+  unscopedJoins?: readonly string[];
+  maxTimeMS?: number;
+  readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  comment?: string;
+}
+/** `getByIds` options: chunked `$in` reads, optionally aligned with the input order. */
+interface GetByIdsOptions extends OperationOptions {
+  /** Ids per `$in` command. Default `DEFAULT_ID_CHUNK` (10,000). */
+  chunkSize?: number;
+  /** Chunks in flight at once outside a session. Default 4. */
+  concurrency?: number;
+  /** Return `Array<TDoc | undefined>` aligned with the input ids instead of a Map. */
+  preserveOrder?: boolean;
+}
 //#endregion
-export { UpdateOptions as _, CreateOptions as a, LookupOptions as b, FindOneAndUpdateOptions as c, LookupPopulateResult as d, MinMaxResult as f, UpdateManyResult as g, SessionOptions as h, ConvenientTransactionOptions as i, GroupResult as l, ReadOptions as m, CacheOperationOptions as n, DeleteManyResult as o, OperationOptions as p, CacheableOptions as r, DeleteResult as s, AggregateOptions as t, LookupPopulateOptions as u, WithTransactionOptions as v, LookupBuilder as y };
+export { LookupOptions as S, SessionOptions as _, ConvenientTransactionOptions as a, WithTransactionOptions as b, DeleteResult as c, GroupResult as d, LookupPopulateOptions as f, ReadOptions as g, OperationOptions as h, CacheableOptions as i, FindOneAndUpdateOptions as l, MinMaxResult as m, AggregateOptions as n, CreateOptions as o, LookupPopulateResult as p, CacheOperationOptions as r, DeleteManyResult as s, AggregateCallOptions as t, GetByIdsOptions as u, UpdateManyResult as v, LookupBuilder as x, UpdateOptions as y };

package/dist/outbox/index.d.mts

@@ -1,4 +1,4 @@
-import { r as Repository } from "../Repository-CR8Y9g2E.mjs";
+import { r as Repository } from "../Repository-pnLw1rG5.mjs";
 import { Connection, Model } from "mongoose";
 //#region src/outbox/index.d.ts
 /** Delivery states. `dead_letter` is terminal and operator-visible. */

package/dist/outbox/index.mjs

@@ -1,4 +1,4 @@
-import { n as Repository } from "../Repository-BMgPSkqZ.mjs";
+import { n as Repository } from "../Repository-CYhSC9ut.mjs";
 import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-C63pGn1d.mjs";
 import { Schema } from "mongoose";
 //#region src/outbox/index.ts

package/dist/pagination/PaginationEngine.d.mts

@@ -1,2 +1,2 @@
-import { t as PaginationEngine } from "../PaginationEngine-D-P19Y9m.mjs";
-export { PaginationEngine };
+import { n as PaginationEngine, t as CountMemoKey } from "../PaginationEngine-CRHyuUtw.mjs";
+export { CountMemoKey, PaginationEngine };

package/dist/pagination/PaginationEngine.mjs

@@ -1,2 +1,2 @@
-import { t as PaginationEngine } from "../PaginationEngine-Dvl8jcRY.mjs";
+import { t as PaginationEngine } from "../PaginationEngine-CfT2Cxkj.mjs";
 export { PaginationEngine };

package/dist/pagination/utils/limits.d.mts

@@ -1,4 +1,4 @@
-import { u as PaginationConfig } from "../../pagination-BpIv2bdS.mjs";
+import { u as PaginationConfig } from "../../pagination-D6psses0.mjs";
 //#region src/pagination/utils/limits.d.ts
 /**
  * Validates and sanitizes limit value

package/dist/{pagination-BpIv2bdS.d.mts → pagination-D6psses0.d.mts}

@@ -1,4 +1,4 @@
-import { Document, Model, PipelineStage, PopulateOptions, Types } from "mongoose";
+import { Connection, Document, Model, PipelineStage, PopulateOptions, Types } from "mongoose";
 //#region src/types/core.d.ts
 /**
  * Core query/document primitives shared across every mongokit module —
@@ -47,6 +47,79 @@ type SelectSpec = string | readonly string[] | Record<string, 0 | 1>;
 /** Filter query type for MongoDB queries (compatible with Mongoose 8 & 9) */
 type FilterQuery<_T = unknown> = Record<string, unknown>;
 //#endregion
+//#region src/repository/query-defaults.d.ts
+type ReadConcernLevel = 'local' | 'available' | 'majority' | 'linearizable' | 'snapshot';
+interface WriteConcernSpec {
+  w?: number | 'majority';
+  j?: boolean;
+  wtimeoutMS?: number;
+}
+/** Defaults for every repository command. */
+interface QueryDefaults {
+  maxTimeMS?: number;
+  readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  writeConcern?: WriteConcernSpec;
+  /** Profiler / log tag. */
+  comment?: string;
+}
+/** Defaults for aggregations only; consulted before {@link QueryDefaults}. */
+interface AggregateDefaults {
+  maxTimeMs?: number;
+  allowDiskUse?: boolean;
+}
+/** What one call may pass. Every field beats every default. */
+interface PerCallQueryOptions {
+  maxTimeMS?: number;
+  readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  writeConcern?: WriteConcernSpec;
+  comment?: string;
+  hint?: string | Record<string, 1 | -1>;
+  allowDiskUse?: boolean;
+  session?: unknown;
+}
+/** The options a command is executed with, after resolution. */
+interface ResolvedQueryOptions {
+  maxTimeMS?: number;
+  readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  writeConcern?: WriteConcernSpec;
+  comment?: string;
+  hint?: string | Record<string, 1 | -1>;
+  allowDiskUse?: boolean;
+}
+type CommandKind = 'read' | 'aggregate' | 'write' | 'findAndModify';
+/** Set the deployment's query defaults. Merges; an explicit `undefined` changes nothing. */
+declare function configureQueryDefaults(defaults: QueryDefaults): void;
+/** Set the deployment's aggregation defaults. Merges; an explicit `undefined` changes nothing. */
+declare function configureAggregateDefaults(defaults: AggregateDefaults): void;
+/** A copy of the deployment defaults. */
+declare function getQueryDefaults(): {
+  query: QueryDefaults;
+  aggregate: AggregateDefaults;
+};
+/** Back to no deployment defaults. For tests. */
+declare function resetQueryDefaults(): void;
+/**
+ * Boot check (M7): throws unless the deployment sets a query `maxTimeMS`, and — when a connection
+ * is passed — unless its client carries a CSOT `timeoutMS`. Returns what it verified.
+ */
+declare function assertQueryDefaultsConfigured(connection?: Connection): {
+  maxTimeMS: number;
+  timeoutMS?: number;
+};
+declare const QUERY_DEFAULTS_ERROR_CODES: {
+  readonly NOT_CONFIGURED: "mongokit.query_defaults.not_configured";
+  /** A per-call bound inside a transaction that carries its own CSOT budget (the driver forbids both). */
+  readonly TIMEOUT_IN_TRANSACTION: "mongokit.query_defaults.timeout_in_transaction";
+};
+/** Resolve the options one command runs with. `repo` is the repository's own defaults. */
+declare function resolveQueryOptions(kind: CommandKind, perCall: PerCallQueryOptions, repo?: {
+  query?: QueryDefaults;
+  aggregate?: AggregateDefaults;
+}): ResolvedQueryOptions;
+//#endregion
 //#region src/pagination/utils/cursor-signing.d.ts
 /**
  * HMAC signing for pagination cursors.
@@ -108,7 +181,11 @@ type CursorSecret = string | readonly string[];
  * Declared ONCE and referenced everywhere — this union was hand-copied to eight
  * declarations, which is how the aggregate variant silently lost a member.
  */
-type CountStrategy = 'exact' | 'estimated' | 'capped' | 'none';
+/**
+ * `cached`: the capped count memoised per (collection, filter, collation, hint) for
+ * `countCacheTtlMs`; never inside a transaction (it would publish uncommitted rows).
+ */
+type CountStrategy = 'exact' | 'estimated' | 'capped' | 'none' | 'cached';
 /**
  * What mongokit adds to repo-core's offset envelope, via its reserved `TExtra`
  * slot: `OffsetPaginationResult<TDoc, MongokitPageExtras>`.
@@ -123,16 +200,13 @@ type MongokitPageExtras = {
   /** Deep-page or clamped-limit advice. Human-readable; never branch on it. */
   warning?: string;
   /**
-   * `total` is a FLOOR, not a count — the scan stopped at `countLimit`. Render
-   * it as `10,000+`, and never compute a percentage or a last-page number from
-   * a total carrying this flag.
-   *
-   * A separate boolean rather than a sentinel `total` (`-1`, `null`): a total
-   * that lies in a field typed `number` is read as a number by every consumer
-   * that has not been taught otherwise, which is the failure this flag exists
-   * to make impossible to miss.
+   * `total` is not an exact count of the rows matching right now: a capped count at its
+   * ceiling (a floor — render `10,000+`), an estimate, a memoised (`cached`) count, or no count
+   * (`none`). Never derive a last-page number or a percentage from a total carrying it.
    */
-  totalIsLowerBound?: boolean;
+  totalIsEstimate: boolean;
+  /** When `total` was counted; `null` when nothing was counted (`none`). */
+  countedAt: Date | null;
 };
 /** Pagination configuration */
 interface PaginationConfig {
@@ -142,6 +216,13 @@ interface PaginationConfig {
   maxLimit?: number;
   /** Maximum allowed page number (default: 10000) */
   maxPage?: number;
+  /**
+   * Deepest `skip` an offset page may ask for (default 100,000). Past it the call is refused
+   * with `mongokit.pagination.offset_too_deep` (400): walk with keyset (`after`) instead.
+   */
+  maxOffset?: number;
+  /** Freshness window of `countStrategy: 'cached'` (default 30,000 ms). */
+  countCacheTtlMs?: number;
   /** Page number that triggers performance warning (default: 100) */
   deepPageThreshold?: number;
   /** Cursor version for forward compatibility (default: 1) */
@@ -249,6 +330,13 @@ interface BasePaginationOptions {
   maxTimeMS?: number;
   /** Read preference for replica sets (e.g. 'secondaryPreferred') */
   readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  comment?: string;
+  /**
+   * Already-resolved time bound and concerns (the Repository passes these, defaults folded in).
+   * When absent the engine resolves the per-call fields above against the deployment defaults.
+   */
+  queryOptions?: ResolvedQueryOptions;
   /** Collation for locale-aware string comparison and case-insensitive sorting */
   collation?: CollationOptions;
 }
@@ -325,9 +413,20 @@ interface AggregatePaginationOptions {
   mode?: 'offset';
   /** Read preference for replica sets (e.g. 'secondaryPreferred') */
   readPreference?: ReadPreferenceType;
+  readConcern?: ReadConcernLevel;
+  comment?: string;
+  /** Collections the caller asserts are company-wide (see `join-scope.ts`). */
+  unscopedJoins?: readonly string[];
+  /**
+   * The caller states the pipeline's last `$sort` is a TOTAL order (unique per output row), so the
+   * not-provably-total warning is silenced. Only for a sort total by domain knowledge.
+   */
+  sortIsTotal?: boolean;
+  /** Already-resolved options; see {@link BasePaginationOptions.queryOptions}. */
+  queryOptions?: ResolvedQueryOptions;
 }
 /** Value type identifier for cursor serialization */
-type ValueType = 'date' | 'objectid' | 'boolean' | 'number' | 'string' | 'null' | 'unknown';
+type ValueType = 'date' | 'objectid' | 'decimal' | 'boolean' | 'number' | 'string' | 'null' | 'unknown';
 /** Cursor payload */
 interface CursorPayload {
   /** Primary sort field value (legacy single-field) */
@@ -346,6 +445,8 @@ interface CursorPayload {
   vals?: Record<string, string | number | boolean | null>;
   /** Compound sort value types */
   types?: Record<string, ValueType>;
+  /** Scope fingerprint: collection + post-policy filter + collation (see `utils/guards.ts`). */
+  fp: string;
 }
 /** Decoded cursor */
 interface DecodedCursor {
@@ -359,6 +460,8 @@ interface DecodedCursor {
   version: number;
   /** All sort field values (rehydrated) — for compound sort */
   values?: Record<string, unknown>;
+  /** Scope fingerprint the cursor was minted under. */
+  scope: string;
 }
 //#endregion
-export { PopulateSpec as _, CursorPayload as a, SortDirection as b, MongokitPageExtras as c, ValueType as d, CursorSecret as f, ObjectId as g, FilterQuery as h, CountStrategy as i, OffsetPaginationOptions as l, AnyModel as m, BasePaginationOptions as n, DecodedCursor as o, AnyDocument as p, CollationOptions as r, KeysetPaginationOptions as s, AggregatePaginationOptions as t, PaginationConfig as u, ReadPreferenceType as v, SortSpec as x, SelectSpec as y };
+export { ObjectId as A, configureQueryDefaults as C, AnyDocument as D, resolveQueryOptions as E, SortSpec as F, ReadPreferenceType as M, SelectSpec as N, AnyModel as O, SortDirection as P, configureAggregateDefaults as S, resetQueryDefaults as T, QueryDefaults as _, CursorPayload as a, WriteConcernSpec as b, MongokitPageExtras as c, ValueType as d, CursorSecret as f, QUERY_DEFAULTS_ERROR_CODES as g, PerCallQueryOptions as h, CountStrategy as i, PopulateSpec as j, FilterQuery as k, OffsetPaginationOptions as l, CommandKind as m, BasePaginationOptions as n, DecodedCursor as o, AggregateDefaults as p, CollationOptions as r, KeysetPaginationOptions as s, AggregatePaginationOptions as t, PaginationConfig as u, ReadConcernLevel as v, getQueryDefaults as w, assertQueryDefaultsConfigured as x, ResolvedQueryOptions as y };

package/dist/{plugin-options-Zk46lD6F.d.mts → plugin-options-CRhIvSzx.d.mts}

@@ -1,5 +1,5 @@
-import { _ as PopulateSpec, g as ObjectId, x as SortSpec, y as SelectSpec } from "./pagination-BpIv2bdS.mjs";
-import { h as RepositoryInstance, p as RepositoryContext } from "./repository-odl03582.mjs";
+import { A as ObjectId, F as SortSpec, N as SelectSpec, j as PopulateSpec } from "./pagination-D6psses0.mjs";
+import { h as RepositoryInstance, p as RepositoryContext } from "./repository-DNHfjAZX.mjs";
 import { OffsetPaginationResult } from "@classytic/repo-core/pagination";
 //#region src/types/plugin-options.d.ts
 /** Field preset configuration (field-filter plugin) */