@classytic/mongokit 3.44.0 → 3.45.0

package/dist/{multi-tenant.plugin-DfeDMiI8.d.mts → multi-tenant.plugin-BTPtCLNK.d.mts}

@@ -1,5 +1,5 @@
-import { A as ObjectId } from "./pagination-DAUg5zOY.mjs";
-import { l as Plugin, p as RepositoryContext } from "./repository-DzVIwhU2.mjs";
+import { A as ObjectId } from "./pagination-BAM9cA4N.mjs";
+import { l as Plugin, p as RepositoryContext } from "./repository-B0aFVgP2.mjs";
 import mongoose, { Connection } from "mongoose";
 import { CacheAdapter as CacheAdapter$1, CacheOptions, RepositoryCacheHandle as RepositoryCacheHandle$1, RepositoryCachePluginOptions, cachePlugin } from "@classytic/repo-core/cache";
 import { TenantConfig } from "@classytic/repo-core/tenant";

package/dist/{operations-Dw9OFV0V.d.mts → operations-D6XsHx4e.d.mts}

@@ -1,4 +1,4 @@
-import { A as ObjectId, F as SortSpec, M as ReadPreferenceType, N as SelectSpec, b as WriteConcernSpec, i as CountStrategy, j as PopulateSpec, r as CollationOptions, v as ReadConcernLevel } from "./pagination-DAUg5zOY.mjs";
+import { A as ObjectId, F as SortSpec, M as ReadPreferenceType, N as SelectSpec, b as WriteConcernSpec, i as CountStrategy, j as PopulateSpec, r as CollationOptions, v as ReadConcernLevel } from "./pagination-BAM9cA4N.mjs";
 import { DeleteManyResult, DeleteResult, LookupPopulateResult, UpdateManyResult } from "@classytic/repo-core/repository";
 import { PipelineStage, PopulateOptions } from "mongoose";
 import { Filter } from "@classytic/repo-core/filter";
@@ -378,12 +378,11 @@ interface CacheOperationOptions {
   cache?: import('@classytic/repo-core/cache').CacheOptions;
 }
 /**
- * `session.withTransaction()`'s own options param — `TransactionOptions` (readConcern,
- * writeConcern, readPreference, maxCommitTimeMS) PLUS the driver's `timeoutMS`, which is
- * NOT a field on `TransactionOptions` itself (verified against the installed mongodb
- * driver's `ClientSession.withTransaction` overload, mongodb.d.ts). `timeoutMS` bounds the
- * WHOLE `withTransaction` call, including its built-in retry loop (default 120s) — distinct
- * from `maxCommitTimeMS`, which only bounds a single `commitTransaction` server call.
+ * `TransactionOptions` (readConcern, writeConcern, readPreference, maxCommitTimeMS) PLUS
+ * `timeoutMS`: the budget for the WHOLE transaction, including its retry loop (default 120 s).
+ * It is enforced by mongokit, NOT the driver (the driver's `timeoutMS` is a no-op since 7.8):
+ * every mongokit operation inside is sent with `maxTimeMS` = what remains, and the commit with
+ * `maxCommitTimeMS` = what remained when the attempt started.
  */
 type ConvenientTransactionOptions = import('mongoose').mongo.TransactionOptions & {
   timeoutMS?: number;

package/dist/outbox/index.d.mts

@@ -1,5 +1,5 @@
-import { r as Repository } from "../Repository-B6oL6OMv.mjs";
-import { u as PaginationConfig } from "../pagination-DAUg5zOY.mjs";
+import { r as Repository } from "../Repository-DJuRmBNx.mjs";
+import { u as PaginationConfig } from "../pagination-BAM9cA4N.mjs";
 import { Connection, Model } from "mongoose";
 /** Delivery states. `dead_letter` is terminal and operator-visible. */
 export declare const OUTBOX_STATUSES: readonly ['pending', 'delivered', 'dead_letter'];

package/dist/outbox/index.mjs

@@ -1,5 +1,5 @@
-import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-CGAepsBU.mjs";
-import { n as Repository } from "../Repository-eMRYZ_2Y.mjs";
+import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-BeJfQBJV.mjs";
+import { n as Repository } from "../Repository-DheA7oW-.mjs";
 import { Schema } from "mongoose";
 // src/outbox/index.ts
 /**

package/dist/pagination/PaginationEngine.d.mts

@@ -1,2 +1,2 @@
-import { n as PaginationEngine, t as CountMemoKey } from "../PaginationEngine-D17AthKw.mjs";
+import { n as PaginationEngine, t as CountMemoKey } from "../PaginationEngine-BWb-c47a.mjs";
 export { CountMemoKey, PaginationEngine };

package/dist/pagination/PaginationEngine.mjs

@@ -1 +1 @@
-export { t as PaginationEngine } from "../PaginationEngine-C9iS0U5l.mjs";
+export { t as PaginationEngine } from "../PaginationEngine-BRlLTQQz.mjs";

package/dist/pagination/utils/limits.d.mts

@@ -1,4 +1,4 @@
-import { u as PaginationConfig } from "../../pagination-DAUg5zOY.mjs";
+import { u as PaginationConfig } from "../../pagination-BAM9cA4N.mjs";
 /**
  * Validates and sanitizes limit value
  * Parses strings to numbers and prevents NaN bugs

package/dist/{pagination-DAUg5zOY.d.mts → pagination-BAM9cA4N.d.mts}

@@ -1,4 +1,4 @@
-import { Connection, Document, Model, PipelineStage, PopulateOptions, Types } from "mongoose";
+import { Document, Model, PipelineStage, PopulateOptions, Types } from "mongoose";
 /**
  * Core query/document primitives shared across every mongokit module —
  * sort/select/populate/filter specs and the mongoose-facing aliases.
@@ -99,17 +99,15 @@ declare function getQueryDefaults(): {
 /** Back to no deployment defaults. For tests. */
 declare function resetQueryDefaults(): void;
 /**
- * Boot check (M7): throws unless the deployment sets a query `maxTimeMS`, and — when a connection
- * is passed — unless its client carries a CSOT `timeoutMS`. Returns what it verified.
+ * Boot check (M7): throws unless the deployment sets a query `maxTimeMS`. Returns what it verified.
+ * A client `timeoutMS` is not checked: the driver (7.8+) drops it from the client options and only
+ * logs a process warning, so there is nothing to read; it bounds nothing either way.
  */
-declare function assertQueryDefaultsConfigured(connection?: Connection): {
+declare function assertQueryDefaultsConfigured(): {
   maxTimeMS: number;
-  timeoutMS?: number;
 };
 declare const QUERY_DEFAULTS_ERROR_CODES: {
   readonly NOT_CONFIGURED: 'mongokit.query_defaults.not_configured';
-  /** A per-call bound inside a transaction that carries its own CSOT budget (the driver forbids both). */
-  readonly TIMEOUT_IN_TRANSACTION: 'mongokit.query_defaults.timeout_in_transaction';
 };
 /** Resolve the options one command runs with. `repo` is the repository's own defaults. */
 declare function resolveQueryOptions(kind: CommandKind, perCall: PerCallQueryOptions, repo?: {

package/dist/{plugin-options-Bpcuz9kS.d.mts → plugin-options-DrNGWV5b.d.mts}

@@ -1,5 +1,5 @@
-import { A as ObjectId, F as SortSpec, N as SelectSpec, j as PopulateSpec } from "./pagination-DAUg5zOY.mjs";
-import { h as RepositoryInstance, p as RepositoryContext } from "./repository-DzVIwhU2.mjs";
+import { A as ObjectId, F as SortSpec, N as SelectSpec, j as PopulateSpec } from "./pagination-BAM9cA4N.mjs";
+import { h as RepositoryInstance, p as RepositoryContext } from "./repository-B0aFVgP2.mjs";
 import { OffsetPaginationResult } from "@classytic/repo-core/pagination";
 /** Field preset configuration (field-filter plugin) */
 interface FieldPreset {

package/dist/plugins/index.d.mts

@@ -1,7 +1,7 @@
-import { A as ImmutablePurgeEvent, B as elasticSearchPlugin, C as MethodRegistryRepository, D as LeasePluginOptions, E as LeasePendingFilter, F as IdempotencyStoreMethods, G as batchOperationsPlugin, H as BatchOperationsMethods, I as IdempotencyStorePluginOptions, J as AppendOnlyPurgeEvent, K as auditLogPlugin, L as idempotencyStorePlugin, M as ImmutableStatesPluginOptions, N as immutableStatesPlugin, O as leasePlugin, P as IdempotencyClaim, R as fieldFilterPlugin, S as mongoOperationsPlugin, T as LeaseMethods, V as cascadePlugin, X as AggregateHelpersMethods, Y as appendOnlyPlugin, Z as aggregateHelpersPlugin, _ as searchKeysPlugin, a as requireField, b as observabilityPlugin, c as timestampPlugin, d as createTenantContext, f as SubdocumentMethods, g as SearchKeysPluginOptions, h as softDeletePlugin, i as immutableField, j as ImmutablePurgeRequest, k as ImmutableClaimView, l as TenantContext, m as SoftDeleteMethods, n as autoInject, o as uniqueField, p as subdocumentPlugin, q as AppendOnlyPluginOptions, r as blockIf, s as validationChainPlugin, t as OperationType, u as TenantStore, v as ObservabilityOptions, w as methodRegistryPlugin, x as MongoOperationsMethods, y as OperationMetric, z as ElasticSearchOptions } from "../validation-chain.plugin-B3gZCZj4.mjs";
-import { A as cachePlugin, B as EnsureAuditTrailReadyOptions, C as prefixedId, D as CacheOptions, E as CacheAdapter, F as AuditTrailMethods, H as ensureAuditTrailReady, I as AuditTrailMode, L as AuditTrailOptions, M as AuditOperation, N as AuditQueryOptions, O as RepositoryCacheHandle, P as AuditQueryResult, R as AuditTrailQuery, T as sequentialId, V as auditTrailPlugin, _ as customIdPlugin, a as DateSequentialIdOptions, b as getNextPeriodSequence, i as CustomIdOptions, j as AuditEntry, k as RepositoryCachePluginOptions, m as SequentialIdOptions, o as IdGenerator, r as multiTenantPlugin, t as MultiTenantOptions, u as PrefixedIdOptions, v as dateSequentialId, x as getNextSequence, z as AuditTrailQueryOptions } from "../multi-tenant.plugin-DfeDMiI8.mjs";
-import { C as RepositoryPluginName, S as MongoKitPluginName, l as Plugin, x as MONGOKIT_PLUGIN_NAMES } from "../repository-DzVIwhU2.mjs";
-import { n as RetentionPurgeEvent, r as RetentionPurgeRequest, t as RETENTION_PURGE_ERROR_CODES } from "../retention-purge-DqcYvRnG.mjs";
+import { A as ImmutablePurgeEvent, B as elasticSearchPlugin, C as MethodRegistryRepository, D as LeasePluginOptions, E as LeasePendingFilter, F as IdempotencyStoreMethods, G as batchOperationsPlugin, H as BatchOperationsMethods, I as IdempotencyStorePluginOptions, J as AppendOnlyPurgeEvent, K as auditLogPlugin, L as idempotencyStorePlugin, M as ImmutableStatesPluginOptions, N as immutableStatesPlugin, O as leasePlugin, P as IdempotencyClaim, R as fieldFilterPlugin, S as mongoOperationsPlugin, T as LeaseMethods, V as cascadePlugin, X as AggregateHelpersMethods, Y as appendOnlyPlugin, Z as aggregateHelpersPlugin, _ as searchKeysPlugin, a as requireField, b as observabilityPlugin, c as timestampPlugin, d as createTenantContext, f as SubdocumentMethods, g as SearchKeysPluginOptions, h as softDeletePlugin, i as immutableField, j as ImmutablePurgeRequest, k as ImmutableClaimView, l as TenantContext, m as SoftDeleteMethods, n as autoInject, o as uniqueField, p as subdocumentPlugin, q as AppendOnlyPluginOptions, r as blockIf, s as validationChainPlugin, t as OperationType, u as TenantStore, v as ObservabilityOptions, w as methodRegistryPlugin, x as MongoOperationsMethods, y as OperationMetric, z as ElasticSearchOptions } from "../validation-chain.plugin-COYrUdd8.mjs";
+import { A as cachePlugin, B as EnsureAuditTrailReadyOptions, C as prefixedId, D as CacheOptions, E as CacheAdapter, F as AuditTrailMethods, H as ensureAuditTrailReady, I as AuditTrailMode, L as AuditTrailOptions, M as AuditOperation, N as AuditQueryOptions, O as RepositoryCacheHandle, P as AuditQueryResult, R as AuditTrailQuery, T as sequentialId, V as auditTrailPlugin, _ as customIdPlugin, a as DateSequentialIdOptions, b as getNextPeriodSequence, i as CustomIdOptions, j as AuditEntry, k as RepositoryCachePluginOptions, m as SequentialIdOptions, o as IdGenerator, r as multiTenantPlugin, t as MultiTenantOptions, u as PrefixedIdOptions, v as dateSequentialId, x as getNextSequence, z as AuditTrailQueryOptions } from "../multi-tenant.plugin-BTPtCLNK.mjs";
+import { C as RepositoryPluginName, S as MongoKitPluginName, l as Plugin, x as MONGOKIT_PLUGIN_NAMES } from "../repository-B0aFVgP2.mjs";
+import { n as RetentionPurgeEvent, r as RetentionPurgeRequest, t as RETENTION_PURGE_ERROR_CODES } from "../retention-purge-CCd_VXUf.mjs";
 import { ChangeLogStore } from "@classytic/repo-core/sync";
 interface ChangeLogPluginOptions {
   /** Durable feed implementing the repo-core/sync contract. */

package/dist/plugins/index.mjs

@@ -1,7 +1,7 @@
-import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-DNY6MIF6.mjs";
-import { C as ensureAuditTrailReady, S as auditTrailPlugin, _ as prefixedId, b as cachePlugin, d as customIdPlugin, f as dateSequentialId, h as getNextSequence, i as multiTenantPlugin, m as getNextPeriodSequence, n as softDeletePlugin, t as timestampPlugin, w as auditLogPlugin, x as AuditTrailQuery, y as sequentialId } from "../timestamp.plugin-Bz_zL9PX.mjs";
-import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-CGAepsBU.mjs";
-import { d as RETENTION_PURGE_ERROR_CODES, i as searchKeysPlugin } from "../Repository-eMRYZ_2Y.mjs";
+import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-DJplVJ12.mjs";
+import { C as ensureAuditTrailReady, S as auditTrailPlugin, _ as prefixedId, b as cachePlugin, d as customIdPlugin, f as dateSequentialId, h as getNextSequence, i as multiTenantPlugin, m as getNextPeriodSequence, n as softDeletePlugin, t as timestampPlugin, w as auditLogPlugin, x as AuditTrailQuery, y as sequentialId } from "../timestamp.plugin-B-IJrlYb.mjs";
+import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-BeJfQBJV.mjs";
+import { d as RETENTION_PURGE_ERROR_CODES, i as searchKeysPlugin } from "../Repository-DheA7oW-.mjs";
 // src/plugins/change-log.plugin.ts
 const PLUGIN_NAME = "changeLog";
 /** Marks a repository already captured: the store and scope it writes to. */

package/dist/{query-defaults-aUoKlEbh.mjs → query-defaults-DwvWUjZU.mjs}

@@ -9,13 +9,13 @@ import mongoose from "mongoose";
 * An explicit value always wins (FL1). For an aggregation the aggregate chain is consulted before
 * the generic query chain, because it is the more specific instruction.
 *
-* The bound travels as per-op CSOT `timeoutMS` (the driver derives the wire `maxTimeMS` from
-* it, and a client-level `timeoutMS` cannot override it). It and `comment` go to the commands Mongoose itself bounds with its global `maxTimeMS`
-* (find, findOne, countDocuments, distinct, findOneAndUpdate, aggregate:
-* lib/query.js:2465,2812,2905,3074,3610; lib/aggregate.js:1106). Writes get `writeConcern`. The
-* connection's CSOT `timeoutMS` bounds everything else; {@link assertQueryDefaultsConfigured}
-* checks both at boot. Inside a transaction a DEFAULT read/write concern or read preference is
-* dropped (the transaction owns them); a per-call one is passed and the driver judges it.
+* The bound travels as the server-side `maxTimeMS` on the command (driver 7.8 made the client-side
+* `timeoutMS` / CSOT a no-op, CVE-2026-119179, so there is no per-op client budget any more). It
+* reaches find, findOne, countDocuments, distinct, findOneAndUpdate, aggregate, insertMany,
+* update/delete and bulkWrite. A single-document `create()` goes through Mongoose `save()`, which
+* forwards no `maxTimeMS`, so it is NOT server-bounded. Writes also get `writeConcern`.
+* {@link assertQueryDefaultsConfigured} checks the deployment bound at boot. Inside a transaction a DEFAULT read/write concern or read
+* preference is dropped (the transaction owns them); a per-call one is passed and the driver judges it.
 */
 /** On `globalThis`, for the reason `pagination/defaults.ts` gives: a duplicated install must share it. */
 const POLICY_SLOT = Symbol.for("classytic.mongokit.queryDefaults");
@@ -60,31 +60,19 @@ function resetQueryDefaults() {
 	};
 }
 /**
-* Boot check (M7): throws unless the deployment sets a query `maxTimeMS`, and — when a connection
-* is passed — unless its client carries a CSOT `timeoutMS`. Returns what it verified.
+* Boot check (M7): throws unless the deployment sets a query `maxTimeMS`. Returns what it verified.
+* A client `timeoutMS` is not checked: the driver (7.8+) drops it from the client options and only
+* logs a process warning, so there is nothing to read; it bounds nothing either way.
 */
-function assertQueryDefaultsConfigured(connection) {
+function assertQueryDefaultsConfigured() {
 	const maxTimeMS = policy().query.maxTimeMS;
 	if (maxTimeMS === void 0) throw createError(500, "[mongokit] no deployment query time bound: call configureQueryDefaults({ maxTimeMS }) at boot", {
 		code: QUERY_DEFAULTS_ERROR_CODES.NOT_CONFIGURED,
 		meta: { missing: "maxTimeMS" }
 	});
-	if (!connection) return { maxTimeMS };
-	const timeoutMS = connection.getClient().options.timeoutMS;
-	if (!(typeof timeoutMS === "number" && timeoutMS > 0)) throw createError(500, "[mongokit] the connection has no CSOT timeoutMS: pass { timeoutMS } to mongoose.connect()", {
-		code: QUERY_DEFAULTS_ERROR_CODES.NOT_CONFIGURED,
-		meta: { missing: "timeoutMS" }
-	});
-	return {
-		maxTimeMS,
-		timeoutMS
-	};
+	return { maxTimeMS };
 }
-const QUERY_DEFAULTS_ERROR_CODES = {
-	NOT_CONFIGURED: "mongokit.query_defaults.not_configured",
-	/** A per-call bound inside a transaction that carries its own CSOT budget (the driver forbids both). */
-	TIMEOUT_IN_TRANSACTION: "mongokit.query_defaults.timeout_in_transaction"
-};
+const QUERY_DEFAULTS_ERROR_CODES = { NOT_CONFIGURED: "mongokit.query_defaults.not_configured" };
 const TX_DEADLINE = Symbol.for("@classytic/mongokit/transaction-deadline");
 /**
 * Set (or clear) the transaction budget's deadline (`performance.now()` ms) on a session.
@@ -108,14 +96,6 @@ function inTransaction(session) {
 	const s = session;
 	return typeof s?.inTransaction === "function" && s.inTransaction();
 }
-/**
-* A `withTransaction` running under a CSOT budget: the driver refuses any per-op `timeoutMS`
-* there (mongodb lib/utils.js:451, `session.explicit && session.timeoutContext != null`).
-*/
-function csotTransaction(session) {
-	const s = session;
-	return inTransaction(session) && s?.explicit === true && s.timeoutContext != null;
-}
 /** Resolve the options one command runs with. `repo` is the repository's own defaults. */
 function resolveQueryOptions(kind, perCall, repo = {}) {
 	const deployment = policy();
@@ -132,7 +112,6 @@ function resolveQueryOptions(kind, perCall, repo = {}) {
 	const budget = tx ? transactionRemaining(perCall.session) : void 0;
 	if (budget !== void 0 && budget <= 0) throw new mongoose.mongo.MongoOperationTimeoutError("Transaction budget exhausted before this operation");
 	if (kind !== "write") {
-		if (csotTransaction(perCall.session) && perCall.maxTimeMS !== void 0) throw createError(400, "[mongokit] a per-call maxTimeMS cannot be honoured inside a transaction with its own timeoutMS budget; bound the transaction instead", { code: QUERY_DEFAULTS_ERROR_CODES.TIMEOUT_IN_TRANSACTION });
 		const bound = tx ? perCall.maxTimeMS : perCall.maxTimeMS ?? (kind === "aggregate" ? repo.aggregate?.maxTimeMs ?? deployment.aggregate.maxTimeMs : void 0) ?? q.maxTimeMS;
 		const capped = budget === void 0 ? bound : Math.min(bound ?? Number.POSITIVE_INFINITY, budget);
 		if (capped !== void 0) out.maxTimeMS = capped;
@@ -174,34 +153,20 @@ function readPreferenceMode(value) {
 }
 /** Apply resolved options to a mongoose Query. */
 function applyToQuery(query, o) {
-	if (o.maxTimeMS !== void 0) {
-		const csot = { timeoutMS: o.maxTimeMS };
-		query.setOptions(csot);
-	}
+	if (o.maxTimeMS !== void 0) query.maxTimeMS(o.maxTimeMS);
 	if (o.comment !== void 0) query.setOptions({ comment: o.comment });
 	if (o.readPreference !== void 0) query.read(readPreferenceMode(o.readPreference));
 	if (o.readConcern !== void 0) query.readConcern(o.readConcern);
 	if (o.writeConcern !== void 0) query.setOptions({ writeConcern: o.writeConcern });
 	if (o.hint !== void 0) query.hint(o.hint);
 }
-/**
-* Make a find cursor's bound apply PER BATCH (CSOT `timeoutMode: 'iteration'`). Only when some
-* `timeoutMS` exists (this op's, or the client's): the driver refuses a timeoutMode without one
-* (mongodb lib/cursor/abstract_cursor.js:114). In iteration mode the driver enforces the budget
-* client-side per batch and sends no wire maxTimeMS.
-*/
-function applyCursorTimeoutMode(query, o, connection) {
-	const clientTimeout = connection.getClient().options.timeoutMS;
-	if (o.maxTimeMS === void 0 && clientTimeout === void 0) return;
-	query.setOptions({ timeoutMode: "iteration" });
-}
 /** Apply resolved options to a mongoose Aggregate. */
 function applyToAggregate(aggregation, o) {
-	if (o.maxTimeMS !== void 0) aggregation.option({ timeoutMS: o.maxTimeMS });
+	if (o.maxTimeMS !== void 0) aggregation.option({ maxTimeMS: o.maxTimeMS });
 	if (o.comment !== void 0) aggregation.option({ comment: o.comment });
 	if (o.readPreference !== void 0) aggregation.read(readPreferenceMode(o.readPreference));
 	if (o.readConcern !== void 0) aggregation.readConcern(o.readConcern);
 	if (o.allowDiskUse !== void 0) aggregation.allowDiskUse(o.allowDiskUse);
 	if (o.hint !== void 0) aggregation.hint(o.hint);
 }
-export { assertQueryDefaultsConfigured as a, getQueryDefaults as c, setTransactionDeadline as d, applyToQuery as i, resetQueryDefaults as l, applyCursorTimeoutMode as n, configureAggregateDefaults as o, applyToAggregate as r, configureQueryDefaults as s, QUERY_DEFAULTS_ERROR_CODES as t, resolveQueryOptions as u };
+export { configureAggregateDefaults as a, resetQueryDefaults as c, assertQueryDefaultsConfigured as i, resolveQueryOptions as l, applyToAggregate as n, configureQueryDefaults as o, applyToQuery as r, getQueryDefaults as s, QUERY_DEFAULTS_ERROR_CODES as t, setTransactionDeadline as u };

package/dist/read-model/index.d.mts

@@ -1,4 +1,4 @@
-import { r as Repository } from "../Repository-B6oL6OMv.mjs";
+import { r as Repository } from "../Repository-DJuRmBNx.mjs";
 import { BulkUpsertResult } from "@classytic/repo-core/repository";
 export declare const READ_MODEL_ERROR_CODES: {
   readonly MERGE_IN_TRANSACTION: 'mongokit.read_model.merge_in_transaction';

package/dist/{repository-DzVIwhU2.d.mts → repository-B0aFVgP2.d.mts}

@@ -1,4 +1,4 @@
-import { A as ObjectId, D as AnyDocument, F as SortSpec, M as ReadPreferenceType, N as SelectSpec, _ as QueryDefaults, b as WriteConcernSpec, i as CountStrategy, j as PopulateSpec, k as FilterQuery, p as AggregateDefaults, v as ReadConcernLevel } from "./pagination-DAUg5zOY.mjs";
+import { A as ObjectId, D as AnyDocument, F as SortSpec, M as ReadPreferenceType, N as SelectSpec, _ as QueryDefaults, b as WriteConcernSpec, i as CountStrategy, j as PopulateSpec, k as FilterQuery, p as AggregateDefaults, v as ReadConcernLevel } from "./pagination-BAM9cA4N.mjs";
 import { r as DocField } from "./type-utils-CKvuewAL.mjs";
 import { DistributionConfig, DistributionMissHandler, RepoCapabilities, RepositoryBase } from "@classytic/repo-core/repository";
 import { Model, PipelineStage } from "mongoose";

package/dist/{retention-purge-DqcYvRnG.d.mts → retention-purge-CCd_VXUf.d.mts}

@@ -1,4 +1,4 @@
-import { p as RepositoryContext } from "./repository-DzVIwhU2.mjs";
+import { p as RepositoryContext } from "./repository-B0aFVgP2.mjs";
 /** Per-call retention purge request (`options.retentionPurge`). */
 interface RetentionPurgeRequest {
   /** Why the rows are removed (e.g. `'retention: 7 years'`). Required, non-blank. */
@@ -17,6 +17,8 @@ interface RetentionPurgeEvent {
   filter: Record<string, unknown> | undefined;
   /** Rows removed (`delete`: 1 or 0). */
   deletedCount: number;
+  /** True when the delete is an `archiveByFilter` chunk the sink acknowledged first. */
+  archived: boolean;
   /**
    * The delete's session, when the call ran in one. Write the audit row with it
    * (`{ session: event.session }`) so the delete and its audit commit or abort
@@ -31,5 +33,6 @@ declare const RETENTION_PURGE_ERROR_CODES: {
   readonly REASON_REQUIRED: 'RETENTION_PURGE_REASON_REQUIRED';
   readonly INVALID_ACTOR: 'RETENTION_PURGE_INVALID_ACTOR';
   readonly HARD_ONLY: 'RETENTION_PURGE_HARD_ONLY';
+  readonly ARCHIVE_UNATTESTED: 'RETENTION_PURGE_ARCHIVE_UNATTESTED';
 };
 export { RetentionPurgeEvent as n, RetentionPurgeRequest as r, RETENTION_PURGE_ERROR_CODES as t };

package/dist/sync/index.d.mts

@@ -1,5 +1,5 @@
 import { ClientSession, Connection, Model } from "mongoose";
-import { ChangeEntry, ChangeLogAppendOptions, ChangeLogStore, ChangesSinceOptions, CommandStreamStore, CommandStreamTx } from "@classytic/repo-core/sync";
+import { ChangeEntry, ChangeLogAppendOptions, ChangeLogStore, ChangesPage, ChangesSinceOptions, CommandStreamStore, CommandStreamTx } from "@classytic/repo-core/sync";
 export interface ChangeLogModelOptions {
   /** Entries collection. Default `sync_changes`; its counter lives in `<collection>_counter`. */
   collection?: string;
@@ -43,12 +43,21 @@ export interface ChangeLogModels {
   feed: string;
 }
 export declare function createChangeLogModels(connection: Connection, options?: ChangeLogModelOptions): ChangeLogModels;
+/** {@link MongoChangeLogStore.snapshot}'s options: the reader's view, plus the bound after the first page. */
+export interface ChangesSnapshotOptions extends ChangesSinceOptions {
+  /** The `upTo` the first page returned; omit it on the first page. */
+  readonly upTo?: string;
+}
+/** One snapshot page. `cursor` pages the snapshot; `upTo` is where `since()` resumes once `hasMore` is false. */
+export interface ChangesSnapshotPage extends ChangesPage {
+  readonly upTo: string;
+}
 /** The mongo change feed: the `ChangeLogStore` contract plus superseded-entry compaction. */
 export interface MongoChangeLogStore extends ChangeLogStore {
   /**
-   * Delete every entry a later COMMITTED entry of the same `(tenantId, scope, docId)` replaced. Safe for any client
-   * cursor: entries carry whole documents, so a reader only ever needs the latest one; tombstones and
-   * each document's latest entry stay. Idempotent; run it on a schedule.
+   * Delete every entry of a `(tenantId, scope, docId)` but the one a reader ends on (the last
+   * tombstone, or the highest-version upsert after it). Safe for any client cursor: entries carry
+   * whole documents, and a reader would have skipped every deleted one. Idempotent; run it on a schedule.
    */
   compactSuperseded(options?: {
     batchSize?: number;
@@ -57,9 +66,8 @@ export interface MongoChangeLogStore extends ChangeLogStore {
   }>;
   /**
    * Retention with a horizon (the `ChangeLogStore.prune` contract). Deletes every entry older than
-   * `before` (`at < before`) that a later entry of the same `(tenantId, scope, docId)` replaced:
-   * each document's latest entry stays, tombstone or not, so a full reload still sees every
-   * document. Records a HORIZON (the highest deleted cursor, never lowered) per `(tenantId, scope)`
+   * `before` (`at < before`) except, per `(tenantId, scope, docId)`, the one a reader ends on (as
+   * `compactSuperseded` keeps), so a snapshot still sees every document. Records a HORIZON (the highest deleted cursor, never lowered) per `(tenantId, scope)`
    * and feed-wide, BEFORE deleting, and returns the feed-wide one, `''` while nothing was ever
    * pruned. `since(cursor, options)` with a cursor below the horizon of what that reader can see
    * (its tenant, shared scopes and `scopes`; the feed-wide horizon when unfiltered; `''` included)
@@ -73,6 +81,14 @@ export interface MongoChangeLogStore extends ChangeLogStore {
   prune(before: Date, options?: {
     batchSize?: number;
   }): Promise<string>;
+  /**
+   * The resync bootstrap for a reader `since()` expired: each document's latest entry at or below
+   * `upTo` (the reader's horizon, fixed by the first page), tombstones left out, in feed order. Then
+   * `since(upTo)` carries on, delivering every change above it, deletes included. Complete because
+   * `prune` and `compactSuperseded` never delete a document's latest entry. If that `since(upTo)`
+   * expires again, a prune raised the horizon in between: bootstrap again.
+   */
+  snapshot(cursor: string, options?: ChangesSnapshotOptions): Promise<ChangesSnapshotPage>;
   /**
    * The compaction horizon cursor a reader with these options is held to (`''` while nothing it
    * can see was pruned); feed-wide without options.
@@ -94,8 +110,8 @@ export interface MongoChangeLogStore extends ChangeLogStore {
    * entry; `null` when the feed holds none. Reads only (it never runs the sequencer), so it is cheap on a hot
    * path, e.g. a writer that needs the last recorded state of a record before it appends the next change.
    * A document is `(tenantId, scope, docId)`: `tenantId` omitted or `null` reads the untenanted document.
-   * Pass `session` to see what the caller staged or appended in its own transaction. A pruned or compacted
-   * document still has its latest entry (both keep it).
+   * Pass `session` to see what the caller staged or appended in its own transaction. Pruning and
+   * compaction keep the entry a reader ends on, which may not be the last one recorded.
    */
   latestOf(scope: string, docId: string, options?: {
     tenantId?: string | null;

package/dist/sync/index.mjs

@@ -1,4 +1,4 @@
-import { o as withTransaction } from "../transaction-C2PFxfIv.mjs";
+import { o as withTransaction } from "../transaction-C6Oj941P.mjs";
 import { Schema, Types } from "mongoose";
 import { CursorExpiredError } from "@classytic/repo-core/sync";
 // src/sync/index.ts
@@ -394,6 +394,45 @@ function createChangeLogStore(models, storeOptions = {}) {
 		scope: id.scope,
 		docId: id.docId
 	});
+	/**
+	* The entry a reader of one document ends on, which retention keeps. A tombstone applies
+	* unconditionally (`changeLogPlugin` writes version 0); an upsert only above the version held. So:
+	* the last tombstone, unless upserts follow it, then the highest of those (the first on a tie).
+	* Not simply the last cursor: branch stock records a lower version after a higher one.
+	*/
+	const winnerOf = (rows) => {
+		let held = null;
+		for (const row of [...rows].sort((a, b) => a.seq - b.seq)) if (row.op === "delete") held = {
+			seq: row.seq,
+			version: Number.NEGATIVE_INFINITY
+		};
+		else if (!held || row.version > held.version) held = {
+			seq: row.seq,
+			version: row.version
+		};
+		return held?.seq ?? 0;
+	};
+	const winnerSeq = async (filter) => {
+		const tomb = await entries.findOne({
+			...filter,
+			op: "delete"
+		}).sort({ seq: -1 }).select({ seq: 1 }).lean().exec();
+		const bound = filter.seq ?? {};
+		return (await entries.findOne(tomb?.seq === void 0 ? {
+			...filter,
+			op: "upsert"
+		} : {
+			...filter,
+			op: "upsert",
+			seq: {
+				...bound,
+				$gt: tomb.seq
+			}
+		}).sort({
+			version: -1,
+			seq: 1
+		}).select({ seq: 1 }).lean().exec())?.seq ?? tomb?.seq ?? 0;
+	};
 	const toEntry = (row) => ({
 		scope: row.scope,
 		docId: row.docId,
@@ -506,11 +545,11 @@ function createChangeLogStore(models, storeOptions = {}) {
 			const groups = entries.aggregate([
 				{ $group: {
 					_id: docKey,
-					latest: { $max: "$seq" },
+					top: { $max: "$seq" },
 					n: { $sum: 1 }
 				} },
 				{ $match: { n: { $gt: 1 } } },
-				{ $project: { latest: 1 } }
+				{ $project: { top: 1 } }
 			]).allowDiskUse(true).cursor({ batchSize });
 			let removed = 0;
 			let ops = [];
@@ -520,9 +559,17 @@ function createChangeLogStore(models, storeOptions = {}) {
 				ops = [];
 			};
 			for await (const g of groups) {
+				const doc = docOf(g._id);
+				const keep = await winnerSeq({
+					...doc,
+					seq: { $lte: g.top }
+				});
 				ops.push({ deleteMany: { filter: {
-					...docOf(g._id),
-					seq: { $lt: g.latest }
+					...doc,
+					seq: {
+						$lte: g.top,
+						$ne: keep
+					}
 				} } });
 				if (ops.length >= batchSize) await flush();
 			}
@@ -533,6 +580,66 @@ function createChangeLogStore(models, storeOptions = {}) {
 			const seq = await horizonFor(options);
 			return seq > 0 ? toCursor(seq) : "";
 		},
+		async snapshot(cursor, options = {}) {
+			const { upTo: bound, ...view } = options;
+			const limit = view.limit ?? DEFAULT_LIMIT;
+			const upTo = bound === void 0 ? await horizonFor(view) : fromCursor(bound);
+			const after = fromCursor(cursor);
+			const upToCursor = upTo > 0 ? toCursor(upTo) : "";
+			if (after >= upTo) return {
+				changes: [],
+				cursor,
+				hasMore: false,
+				upTo: upToCursor
+			};
+			const rows = await entries.find({
+				seq: {
+					$gt: after,
+					$lte: upTo
+				},
+				...viewOf(view)
+			}).sort({ seq: 1 }).limit(limit + 1).lean().exec();
+			const page = rows.slice(0, limit);
+			const latest = /* @__PURE__ */ new Map();
+			if (page.length > 0) {
+				const keyOf = (r) => JSON.stringify([
+					typeof r.tenantId === "string" ? r.tenantId : null,
+					r.scope,
+					r.docId
+				]);
+				const docs = new Map(page.map((r) => [keyOf(r), r]));
+				const groups = await entries.aggregate([{ $match: {
+					seq: { $lte: upTo },
+					$or: [...docs.values()].map((r) => docOf({
+						tenantId: typeof r.tenantId === "string" ? r.tenantId : null,
+						scope: r.scope,
+						docId: r.docId
+					}))
+				} }, { $group: {
+					_id: docKey,
+					rows: { $push: {
+						seq: "$seq",
+						version: "$version",
+						op: "$op"
+					} }
+				} }]).allowDiskUse(true).exec();
+				for (const g of groups) latest.set(keyOf(g._id), winnerOf(g.rows));
+				const changes = page.filter((r) => latest.get(keyOf(r)) === r.seq && r.op === "upsert").map(toEntry);
+				const last = page[page.length - 1];
+				return {
+					changes,
+					cursor: toCursor(last.seq),
+					hasMore: rows.length > limit,
+					upTo: upToCursor
+				};
+			}
+			return {
+				changes: [],
+				cursor,
+				hasMore: false,
+				upTo: upToCursor
+			};
+		},
 		async prune(before, options = {}) {
 			if (!(before instanceof Date) || Number.isNaN(before.getTime())) throw new Error("[mongokit:sync] prune(before) needs a valid Date");
 			const batchSize = options.batchSize ?? 1e3;
@@ -569,20 +676,23 @@ function createChangeLogStore(models, storeOptions = {}) {
 			};
 			for await (const g of groups) {
 				const doc = docOf(g._id);
-				const latest = await topSeq(doc);
-				let deletedMax;
-				if (latest > g.oldMax) deletedMax = g.oldMax;
-				else if (g.n > 1) deletedMax = await topSeq({
+				const keep = await winnerSeq(doc);
+				const deletedMax = await topSeq({
 					...doc,
 					at: old,
-					seq: { $lt: latest }
+					seq: {
+						$lte: g.oldMax,
+						$ne: keep
+					}
 				});
-				else continue;
 				if (deletedMax <= 0) continue;
 				ops.push({ deleteMany: { filter: {
 					...doc,
 					at: old,
-					seq: { $lte: deletedMax }
+					seq: {
+						$lte: deletedMax,
+						$ne: keep
+					}
 				} } });
 				batchMax = Math.max(batchMax, deletedMax);
 				const key = JSON.stringify([doc.tenantId, doc.scope]);

package/dist/testkit/index.d.mts

@@ -1,5 +1,5 @@
-import { n as CreateRepositoryConfig } from "../create-repository-BOFUYj1l.mjs";
-import { r as Repository } from "../Repository-B6oL6OMv.mjs";
+import { n as CreateRepositoryConfig } from "../create-repository-DG-gwOf0.mjs";
+import { r as Repository } from "../Repository-DJuRmBNx.mjs";
 import { Connection, Model, Schema } from "mongoose";
 import { MongoMemoryReplSet, MongoMemoryServer } from "mongodb-memory-server";
 /**

package/dist/testkit/index.mjs

@@ -1,4 +1,4 @@
-import { t as createRepository } from "../create-repository-D7MQpIZo.mjs";
+import { t as createRepository } from "../create-repository-C9DHHcl7.mjs";
 import { createConnection } from "mongoose";
 import { rmSync } from "node:fs";
 import { mkdir, mkdtemp, readFile, readdir, rm, stat } from "node:fs/promises";

package/dist/{timestamp.plugin-Bz_zL9PX.mjs → timestamp.plugin-B-IJrlYb.mjs}

@@ -1,4 +1,4 @@
-import { a as ALL_OPERATIONS, s as OP_REGISTRY, t as HOOK_PRIORITY } from "./Repository-eMRYZ_2Y.mjs";
+import { a as ALL_OPERATIONS, s as OP_REGISTRY, t as HOOK_PRIORITY } from "./Repository-DheA7oW-.mjs";
 import { n as warn } from "./logger-hbWOlj_X.mjs";
 import { n as declareCollectionScope } from "./join-scope-C1gOtZ59.mjs";
 import { throwIfAborted, withRetry } from "@classytic/repo-core/repository";

package/dist/{to-plain-PO5r1Qoy.d.mts → to-plain-Do-8jTKC.d.mts}

@@ -1,5 +1,5 @@
-import { y as UserContext } from "./repository-DzVIwhU2.mjs";
-import { r as FieldPreset } from "./plugin-options-Bpcuz9kS.mjs";
+import { y as UserContext } from "./repository-B0aFVgP2.mjs";
+import { r as FieldPreset } from "./plugin-options-DrNGWV5b.mjs";
 import mongoose, { Schema } from "mongoose";
 import { CacheAdapter } from "@classytic/repo-core/cache";
 import { HttpError } from "@classytic/repo-core/errors";