@classytic/mongokit 3.44.0 → 3.46.0

package/dist/index.mjs

@@ -1,21 +1,21 @@
 import { n as idVariants } from "./id-resolution-Cqh49d9J.mjs";
-import { a as ALL_OPERATIONS, c as READ_OPERATIONS, d as RETENTION_PURGE_ERROR_CODES, i as searchKeysPlugin, l as operationsByPolicyKey, n as Repository, o as MUTATING_OPERATIONS, r as AggregationBuilder, s as OP_REGISTRY, t as HOOK_PRIORITY, u as createMongoPurgePort } from "./Repository-eMRYZ_2Y.mjs";
-import { C as isCreateManyPartialError, g as LookupBuilder, v as compileFilterToMongo } from "./update-DcfmNbJe.mjs";
-import { t as actions_exports } from "./actions-DExyXMTy.mjs";
-import { a as supportsTransactions, c as MONGOKIT_CAPABILITIES, d as probeMongoCapabilities, f as resetCapabilityProbeCache, h as transactionResolutionOf, i as runTransaction, l as capabilitiesForSupport, m as resolveTransactionSupport, n as batchTransaction, o as withTransaction, p as resolveMongoCapabilities, r as isTransactionUnsupported, t as TRANSACTION_ERROR_CODES, u as classifyHelloReply } from "./transaction-C2PFxfIv.mjs";
-import { t as createRepository } from "./create-repository-D7MQpIZo.mjs";
+import { a as ALL_OPERATIONS, c as READ_OPERATIONS, d as RETENTION_PURGE_ERROR_CODES, i as searchKeysPlugin, l as operationsByPolicyKey, n as Repository, o as MUTATING_OPERATIONS, r as AggregationBuilder, s as OP_REGISTRY, t as HOOK_PRIORITY, u as createMongoPurgePort } from "./Repository-DheA7oW-.mjs";
+import { C as isCreateManyPartialError, g as LookupBuilder, v as compileFilterToMongo } from "./update-CYaJMu6j.mjs";
+import { t as actions_exports } from "./actions-DKQx9ToJ.mjs";
+import { a as supportsTransactions, c as MONGOKIT_CAPABILITIES, d as probeMongoCapabilities, f as resetCapabilityProbeCache, h as transactionResolutionOf, i as runTransaction, l as capabilitiesForSupport, m as resolveTransactionSupport, n as batchTransaction, o as withTransaction, p as resolveMongoCapabilities, r as isTransactionUnsupported, t as TRANSACTION_ERROR_CODES, u as classifyHelloReply } from "./transaction-C6Oj941P.mjs";
+import { t as createRepository } from "./create-repository-C9DHHcl7.mjs";
 import { n as defineModel, r as isModelRegistered, t as ModelCollisionError } from "./model-registry-DrVfJ3Nt.mjs";
-import { c as PAGINATION_ERROR_CODES, h as resetPaginationDefaults, m as getPaginationDefaults, p as configurePaginationDefaults, t as PaginationEngine } from "./PaginationEngine-C9iS0U5l.mjs";
-import { C as ensureAuditTrailReady, S as auditTrailPlugin, _ as prefixedId, a as declareTenantContextKey, b as cachePlugin, c as tenantContextKeysOf, d as customIdPlugin, f as dateSequentialId, g as periodCounterKey, h as getNextSequence, i as multiTenantPlugin, l as civilPeriodKey, m as getNextPeriodSequence, n as softDeletePlugin, o as forwardScope, p as ensureSequenceAtLeast, r as adminBypass, s as isScopeKey, t as timestampPlugin, u as createSequenceCounter, v as readSequence, w as auditLogPlugin, x as AuditTrailQuery, y as sequentialId } from "./timestamp.plugin-Bz_zL9PX.mjs";
-import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "./validation-chain.plugin-DNY6MIF6.mjs";
-import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "./method-registry.plugin-CGAepsBU.mjs";
+import { c as PAGINATION_ERROR_CODES, h as resetPaginationDefaults, m as getPaginationDefaults, p as configurePaginationDefaults, t as PaginationEngine } from "./PaginationEngine-BRlLTQQz.mjs";
+import { C as ensureAuditTrailReady, S as auditTrailPlugin, _ as prefixedId, a as declareTenantContextKey, b as cachePlugin, c as tenantContextKeysOf, d as customIdPlugin, f as dateSequentialId, g as periodCounterKey, h as getNextSequence, i as multiTenantPlugin, l as civilPeriodKey, m as getNextPeriodSequence, n as softDeletePlugin, o as forwardScope, p as ensureSequenceAtLeast, r as adminBypass, s as isScopeKey, t as timestampPlugin, u as createSequenceCounter, v as readSequence, w as auditLogPlugin, x as AuditTrailQuery, y as sequentialId } from "./timestamp.plugin-B-IJrlYb.mjs";
+import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "./validation-chain.plugin-DJplVJ12.mjs";
+import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "./method-registry.plugin-BeJfQBJV.mjs";
 import { n as warn, t as configureLogger } from "./logger-hbWOlj_X.mjs";
 import { GEO_OPERATORS, parseGeoFilter } from "./query/primitives/geo.mjs";
 import { buildFieldTypeMap, coerceHeuristic } from "./query/primitives/coercion.mjs";
 import { n as isDuplicateKeyError, r as parseDuplicateKeyError, t as createError } from "./error-DjdmPLWO.mjs";
 import { extractSchemaIndexes } from "./query/primitives/indexes.mjs";
 import { n as declareCollectionScope, t as JOIN_ERROR_CODES } from "./join-scope-C1gOtZ59.mjs";
-import { a as assertQueryDefaultsConfigured, c as getQueryDefaults, l as resetQueryDefaults, o as configureAggregateDefaults, s as configureQueryDefaults, t as QUERY_DEFAULTS_ERROR_CODES, u as resolveQueryOptions } from "./query-defaults-aUoKlEbh.mjs";
+import { a as configureAggregateDefaults, c as resetQueryDefaults, i as assertQueryDefaultsConfigured, l as resolveQueryOptions, o as configureQueryDefaults, s as getQueryDefaults, t as QUERY_DEFAULTS_ERROR_CODES } from "./query-defaults-DwvWUjZU.mjs";
 import { _ as tokenizeSearchText, d as buildSearchKeys, f as prefixSearchFilter, g as normalizeSearchText, h as findSearchMatches, l as DEFAULT_SEARCH_KEYS_FIELD, m as searchKeysPath, n as SearchKeysWriteError, p as searchKeysIndex, t as SEARCH_KEYS_ERROR_CODES, u as MAX_PREFIX_SEARCH_TERMS } from "./derive-Dxsc31fV.mjs";
 import { i as getMongooseProjection, n as filterResponseData, r as getFieldsForUser, t as createFieldPreset } from "./field-selection-DPFaFw9Y.mjs";
 import "./search/index.mjs";

package/dist/kernel-conformance/index.d.mts

@@ -37,14 +37,16 @@ export declare const KERNEL_CONFORMANCE_CHECKS: readonly [
 /** §11.5 — an injected outbox that does not enlist `ctx.session` is REFUSED. (conditional) */
 'outbox-requires-transactional-save',
 /** §11.10 — a blueprint with optional modules off registers no extra models. (conditional) */
-'optional-modules-register-no-models'];
+'optional-modules-register-no-models',
+/** scale D7 — every unique index leads with the tenant field, or is a registered global. (conditional) */
+'unique-indexes-tenant-prefixed'];
 type ConformanceCheck = (typeof KERNEL_CONFORMANCE_CHECKS)[number];
 /**
  * Checks that only run when the kernel supplies the input they need. When the input is
  * absent they are reported as NOT EXERCISED — a visible marker test plus a report entry,
  * never a silent pass.
  */
-export declare const CONDITIONAL_CHECKS: readonly ["bind-verifies-requirements", "outbox-requires-transactional-save", "optional-modules-register-no-models"];
+export declare const CONDITIONAL_CHECKS: readonly ["bind-verifies-requirements", "outbox-requires-transactional-save", "optional-modules-register-no-models", "unique-indexes-tenant-prefixed"];
 /**
  * The two runner functions the suite needs, INJECTED by the consumer.
  *
@@ -118,6 +120,23 @@ interface KernelConformanceReport {
   readonly skipped: readonly ConformanceCheckStatus[];
   readonly notExercised: readonly ConformanceCheckStatus[];
 }
+/** What becomes of a deliberately global unique index once a deployment is sharded or podded (D7). */
+type GlobalUniqueDisposition = 'shard-key-prefix' | 'identity-registry' | 'pod-local' | 'drop';
+/** A unique index that is global ON PURPOSE. A bare name is not enough: the reason is the contract. */
+interface AllowedGlobalUnique {
+  /** The index NAME as declared (`options.name`), or its keys joined by `,` when unnamed. */
+  readonly index: string;
+  readonly reason: string;
+  readonly t2: GlobalUniqueDisposition;
+}
+interface TenantUniquesOptions {
+  /** The tenant field the kernel prefixes with, e.g. `'organizationId'`. */
+  readonly tenantField: string;
+  /** Bind the kernel with tenancy ENABLED (field strategy) on the connection the suite supplies. */
+  readonly bindScoped: (connection: Connection) => unknown | Promise<unknown>;
+  /** Deliberate globals. Empty (the default) means every unique index must be tenant-led. */
+  readonly allowGlobal?: readonly AllowedGlobalUnique[];
+}
 interface KernelConformanceOptions<TBlueprint extends KernelBlueprintLike, TEngine> {
   /** Kernel name, e.g. `'party'`. Used in test titles and to derive legacy export names. */
   readonly name: string;
@@ -215,6 +234,28 @@ interface KernelConformanceOptions<TBlueprint extends KernelBlueprintLike, TEngi
    * `optional-modules-register-no-models` (§11.10).
    */
   readonly minimalBlueprint?: () => TBlueprint;
+  /**
+   * Enables `unique-indexes-tenant-prefixed` (scale decision D7).
+   *
+   * MongoDB refuses `shardCollection` on a tenant key when ANY unique index does not start with
+   * that key, so one global unique makes the whole collection unshardable by tenant and turns a
+   * later move to pods or shards into a data migration. The check binds the kernel with tenancy
+   * ON, reads every registered schema's indexes, and requires each unique one to lead with the
+   * tenant field, or to be registered in `allowGlobal` with a reason and a T2 disposition.
+   *
+   * It also fails when it inspected no unique index at all (a scan that finds nothing proves
+   * nothing), and when an `allowGlobal` entry names an index that no longer exists or is now
+   * tenant-led (a stale entry would hide a real one).
+   *
+   * ```ts
+   * tenantUniques: {
+   *   tenantField: 'organizationId',
+   *   bindScoped: (connection) => defineX({ tenant: { enabled: true } }).bind(connection, runtime),
+   *   allowGlobal: [{ index: 'directory_site_slug', reason: 'public slug resolved without a tenant', t2: 'identity-registry' }],
+   * }
+   * ```
+   */
+  readonly tenantUniques?: TenantUniquesOptions;
   /**
    * Explicit, reasoned opt-outs. Unknown or duplicate ids throw at call time. Every skip is
    * printed and registered as a visible marker test.
@@ -240,4 +281,4 @@ interface InstrumentedTransport {
  * "did I create this?", never by inspecting the object.
  */
 export declare function instrumentTransport(inner: EventTransportLike): InstrumentedTransport;
-export type { ConformanceCheck, ConformanceCheckOutcome, ConformanceCheckStatus, ConformanceConnect, ConformanceConnectionHandle, ConformanceEvent, ConformanceRunner, ConformanceSkip, EventTransportLike, InstrumentedTransport, KernelBindContext, KernelBlueprintLike, KernelConformanceOptions, KernelConformanceReport };
+export type { AllowedGlobalUnique, ConformanceCheck, ConformanceCheckOutcome, ConformanceCheckStatus, ConformanceConnect, ConformanceConnectionHandle, ConformanceEvent, ConformanceRunner, ConformanceSkip, EventTransportLike, GlobalUniqueDisposition, InstrumentedTransport, KernelBindContext, KernelBlueprintLike, KernelConformanceOptions, KernelConformanceReport, TenantUniquesOptions };

package/dist/kernel-conformance/index.mjs

@@ -104,7 +104,8 @@ const KERNEL_CONFORMANCE_CHECKS = [
 	"maintenance-fails-loud",
 	"bind-verifies-requirements",
 	"outbox-requires-transactional-save",
-	"optional-modules-register-no-models"
+	"optional-modules-register-no-models",
+	"unique-indexes-tenant-prefixed"
 ];
 /**
 * Checks that only run when the kernel supplies the input they need. When the input is
@@ -114,7 +115,8 @@ const KERNEL_CONFORMANCE_CHECKS = [
 const CONDITIONAL_CHECKS = [
 	"bind-verifies-requirements",
 	"outbox-requires-transactional-save",
-	"optional-modules-register-no-models"
+	"optional-modules-register-no-models",
+	"unique-indexes-tenant-prefixed"
 ];
 // src/kernel-conformance/suite.ts
 /**
@@ -217,12 +219,14 @@ function describeKernelConformance(opts) {
 	const conditionalInputs = {
 		"bind-verifies-requirements": "bindWithUnmetRequirement",
 		"outbox-requires-transactional-save": "bindWithNonTransactionalOutbox",
-		"optional-modules-register-no-models": "minimalBlueprint"
+		"optional-modules-register-no-models": "minimalBlueprint",
+		"unique-indexes-tenant-prefixed": "tenantUniques"
 	};
 	const conditionalSupplied = {
 		"bind-verifies-requirements": opts.bindWithUnmetRequirement !== void 0,
 		"outbox-requires-transactional-save": opts.bindWithNonTransactionalOutbox !== void 0,
-		"optional-modules-register-no-models": opts.minimalBlueprint !== void 0
+		"optional-modules-register-no-models": opts.minimalBlueprint !== void 0,
+		"unique-indexes-tenant-prefixed": opts.tenantUniques !== void 0
 	};
 	const statuses = KERNEL_CONFORMANCE_CHECKS.map((check) => {
 		const reason = skipReasons.get(check);
@@ -589,6 +593,41 @@ function describeKernelConformance(opts) {
 				assert(check, drift.extra.length === 0 && drift.missing.length === 0, `the minimal bind registered [${registered.join(", ")}] but declared [${minimal.modelNames.join(", ")}] — a disabled module still compiled a model`);
 			});
 		});
+		register("unique-indexes-tenant-prefixed", "every unique index leads with the tenant field, or is a registered global", async () => {
+			const check = "unique-indexes-tenant-prefixed";
+			const cfg = opts.tenantUniques;
+			const allowed = new Map((cfg.allowGlobal ?? []).map((g) => [g.index, g]));
+			for (const g of allowed.values()) assert(check, g.reason.trim().length > 0, `allowGlobal entry '${g.index}' has no reason — a global unique index without one is the defect this check exists to catch`);
+			await withConnection(async (connection) => {
+				const before = new Set(Object.keys(connection.models));
+				await opts.tenantUniques?.bindScoped(connection);
+				const offenders = [];
+				const seenGlobals = /* @__PURE__ */ new Set();
+				let inspected = 0;
+				for (const modelName of Object.keys(connection.models).filter((n) => !before.has(n))) {
+					const schema = connection.models[modelName]?.schema;
+					for (const [fields, options] of schema?.indexes() ?? []) {
+						if (!options?.unique) continue;
+						inspected++;
+						const keys = Object.keys(fields);
+						const name = String(options.name ?? keys.join(","));
+						if (keys[0] === cfg.tenantField) {
+							assert(check, !allowed.has(name), `allowGlobal lists '${name}' but it already leads with '${cfg.tenantField}' — remove the stale entry (it would hide a future global)`);
+							continue;
+						}
+						if (allowed.has(name)) {
+							seenGlobals.add(name);
+							continue;
+						}
+						offenders.push(`${modelName}.${name} {${keys.join(", ")}}`);
+					}
+				}
+				assert(check, offenders.length === 0, `unique index(es) that do not lead with '${cfg.tenantField}': [${offenders.join("; ")}]. MongoDB refuses shardCollection on a tenant key while any unique index lacks it. Prefix the index with the tenant field, or register it in tenantUniques.allowGlobal with a reason and a T2 disposition.`);
+				assert(check, inspected > 0, "no unique index was inspected — the scoped bind registered none, so this check proved nothing");
+				const stale = [...allowed.keys()].filter((n) => !seenGlobals.has(n));
+				assert(check, stale.length === 0, `allowGlobal names index(es) that no scoped model declares: [${stale.join(", ")}] — remove them`);
+			});
+		});
 	});
 }
 function defaultReport(report) {

package/dist/{method-registry.plugin-CGAepsBU.mjs → method-registry.plugin-BeJfQBJV.mjs}

@@ -31,7 +31,8 @@ const BULK_WRITE_OPTIONS = [
 	"bypassDocumentValidation",
 	"comment",
 	"let",
-	"ignoreUndefined"
+	"ignoreUndefined",
+	"maxTimeMS"
 ];
 /**
 * Driver options that EXIST but this method does not forward.
@@ -51,7 +52,6 @@ const BULK_WRITE_OPTIONS = [
 const UNSUPPORTED_DRIVER_OPTIONS = /* @__PURE__ */ new Set([
 	"forceServerObjectId",
 	"timeoutMS",
-	"maxTimeMS",
 	"retryWrites",
 	"checkKeys",
 	"serializeFunctions",

package/dist/{multi-tenant.plugin-DfeDMiI8.d.mts → multi-tenant.plugin-BTPtCLNK.d.mts}

@@ -1,5 +1,5 @@
-import { A as ObjectId } from "./pagination-DAUg5zOY.mjs";
-import { l as Plugin, p as RepositoryContext } from "./repository-DzVIwhU2.mjs";
+import { A as ObjectId } from "./pagination-BAM9cA4N.mjs";
+import { l as Plugin, p as RepositoryContext } from "./repository-B0aFVgP2.mjs";
 import mongoose, { Connection } from "mongoose";
 import { CacheAdapter as CacheAdapter$1, CacheOptions, RepositoryCacheHandle as RepositoryCacheHandle$1, RepositoryCachePluginOptions, cachePlugin } from "@classytic/repo-core/cache";
 import { TenantConfig } from "@classytic/repo-core/tenant";

package/dist/{operations-Dw9OFV0V.d.mts → operations-D6XsHx4e.d.mts}

@@ -1,4 +1,4 @@
-import { A as ObjectId, F as SortSpec, M as ReadPreferenceType, N as SelectSpec, b as WriteConcernSpec, i as CountStrategy, j as PopulateSpec, r as CollationOptions, v as ReadConcernLevel } from "./pagination-DAUg5zOY.mjs";
+import { A as ObjectId, F as SortSpec, M as ReadPreferenceType, N as SelectSpec, b as WriteConcernSpec, i as CountStrategy, j as PopulateSpec, r as CollationOptions, v as ReadConcernLevel } from "./pagination-BAM9cA4N.mjs";
 import { DeleteManyResult, DeleteResult, LookupPopulateResult, UpdateManyResult } from "@classytic/repo-core/repository";
 import { PipelineStage, PopulateOptions } from "mongoose";
 import { Filter } from "@classytic/repo-core/filter";
@@ -378,12 +378,11 @@ interface CacheOperationOptions {
   cache?: import('@classytic/repo-core/cache').CacheOptions;
 }
 /**
- * `session.withTransaction()`'s own options param — `TransactionOptions` (readConcern,
- * writeConcern, readPreference, maxCommitTimeMS) PLUS the driver's `timeoutMS`, which is
- * NOT a field on `TransactionOptions` itself (verified against the installed mongodb
- * driver's `ClientSession.withTransaction` overload, mongodb.d.ts). `timeoutMS` bounds the
- * WHOLE `withTransaction` call, including its built-in retry loop (default 120s) — distinct
- * from `maxCommitTimeMS`, which only bounds a single `commitTransaction` server call.
+ * `TransactionOptions` (readConcern, writeConcern, readPreference, maxCommitTimeMS) PLUS
+ * `timeoutMS`: the budget for the WHOLE transaction, including its retry loop (default 120 s).
+ * It is enforced by mongokit, NOT the driver (the driver's `timeoutMS` is a no-op since 7.8):
+ * every mongokit operation inside is sent with `maxTimeMS` = what remains, and the commit with
+ * `maxCommitTimeMS` = what remained when the attempt started.
  */
 type ConvenientTransactionOptions = import('mongoose').mongo.TransactionOptions & {
   timeoutMS?: number;

package/dist/outbox/index.d.mts

@@ -1,5 +1,5 @@
-import { r as Repository } from "../Repository-B6oL6OMv.mjs";
-import { u as PaginationConfig } from "../pagination-DAUg5zOY.mjs";
+import { r as Repository } from "../Repository-DJuRmBNx.mjs";
+import { u as PaginationConfig } from "../pagination-BAM9cA4N.mjs";
 import { Connection, Model } from "mongoose";
 /** Delivery states. `dead_letter` is terminal and operator-visible. */
 export declare const OUTBOX_STATUSES: readonly ['pending', 'delivered', 'dead_letter'];

package/dist/outbox/index.mjs

@@ -1,5 +1,5 @@
-import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-CGAepsBU.mjs";
-import { n as Repository } from "../Repository-eMRYZ_2Y.mjs";
+import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-BeJfQBJV.mjs";
+import { n as Repository } from "../Repository-DheA7oW-.mjs";
 import { Schema } from "mongoose";
 // src/outbox/index.ts
 /**

package/dist/pagination/PaginationEngine.d.mts

@@ -1,2 +1,2 @@
-import { n as PaginationEngine, t as CountMemoKey } from "../PaginationEngine-D17AthKw.mjs";
+import { n as PaginationEngine, t as CountMemoKey } from "../PaginationEngine-BWb-c47a.mjs";
 export { CountMemoKey, PaginationEngine };

package/dist/pagination/PaginationEngine.mjs

@@ -1 +1 @@
-export { t as PaginationEngine } from "../PaginationEngine-C9iS0U5l.mjs";
+export { t as PaginationEngine } from "../PaginationEngine-BRlLTQQz.mjs";

package/dist/pagination/utils/limits.d.mts

@@ -1,4 +1,4 @@
-import { u as PaginationConfig } from "../../pagination-DAUg5zOY.mjs";
+import { u as PaginationConfig } from "../../pagination-BAM9cA4N.mjs";
 /**
  * Validates and sanitizes limit value
  * Parses strings to numbers and prevents NaN bugs

package/dist/{pagination-DAUg5zOY.d.mts → pagination-BAM9cA4N.d.mts}

@@ -1,4 +1,4 @@
-import { Connection, Document, Model, PipelineStage, PopulateOptions, Types } from "mongoose";
+import { Document, Model, PipelineStage, PopulateOptions, Types } from "mongoose";
 /**
  * Core query/document primitives shared across every mongokit module —
  * sort/select/populate/filter specs and the mongoose-facing aliases.
@@ -99,17 +99,15 @@ declare function getQueryDefaults(): {
 /** Back to no deployment defaults. For tests. */
 declare function resetQueryDefaults(): void;
 /**
- * Boot check (M7): throws unless the deployment sets a query `maxTimeMS`, and — when a connection
- * is passed — unless its client carries a CSOT `timeoutMS`. Returns what it verified.
+ * Boot check (M7): throws unless the deployment sets a query `maxTimeMS`. Returns what it verified.
+ * A client `timeoutMS` is not checked: the driver (7.8+) drops it from the client options and only
+ * logs a process warning, so there is nothing to read; it bounds nothing either way.
  */
-declare function assertQueryDefaultsConfigured(connection?: Connection): {
+declare function assertQueryDefaultsConfigured(): {
   maxTimeMS: number;
-  timeoutMS?: number;
 };
 declare const QUERY_DEFAULTS_ERROR_CODES: {
   readonly NOT_CONFIGURED: 'mongokit.query_defaults.not_configured';
-  /** A per-call bound inside a transaction that carries its own CSOT budget (the driver forbids both). */
-  readonly TIMEOUT_IN_TRANSACTION: 'mongokit.query_defaults.timeout_in_transaction';
 };
 /** Resolve the options one command runs with. `repo` is the repository's own defaults. */
 declare function resolveQueryOptions(kind: CommandKind, perCall: PerCallQueryOptions, repo?: {

package/dist/{plugin-options-Bpcuz9kS.d.mts → plugin-options-DrNGWV5b.d.mts}

@@ -1,5 +1,5 @@
-import { A as ObjectId, F as SortSpec, N as SelectSpec, j as PopulateSpec } from "./pagination-DAUg5zOY.mjs";
-import { h as RepositoryInstance, p as RepositoryContext } from "./repository-DzVIwhU2.mjs";
+import { A as ObjectId, F as SortSpec, N as SelectSpec, j as PopulateSpec } from "./pagination-BAM9cA4N.mjs";
+import { h as RepositoryInstance, p as RepositoryContext } from "./repository-B0aFVgP2.mjs";
 import { OffsetPaginationResult } from "@classytic/repo-core/pagination";
 /** Field preset configuration (field-filter plugin) */
 interface FieldPreset {

package/dist/plugins/index.d.mts

@@ -1,7 +1,7 @@
-import { A as ImmutablePurgeEvent, B as elasticSearchPlugin, C as MethodRegistryRepository, D as LeasePluginOptions, E as LeasePendingFilter, F as IdempotencyStoreMethods, G as batchOperationsPlugin, H as BatchOperationsMethods, I as IdempotencyStorePluginOptions, J as AppendOnlyPurgeEvent, K as auditLogPlugin, L as idempotencyStorePlugin, M as ImmutableStatesPluginOptions, N as immutableStatesPlugin, O as leasePlugin, P as IdempotencyClaim, R as fieldFilterPlugin, S as mongoOperationsPlugin, T as LeaseMethods, V as cascadePlugin, X as AggregateHelpersMethods, Y as appendOnlyPlugin, Z as aggregateHelpersPlugin, _ as searchKeysPlugin, a as requireField, b as observabilityPlugin, c as timestampPlugin, d as createTenantContext, f as SubdocumentMethods, g as SearchKeysPluginOptions, h as softDeletePlugin, i as immutableField, j as ImmutablePurgeRequest, k as ImmutableClaimView, l as TenantContext, m as SoftDeleteMethods, n as autoInject, o as uniqueField, p as subdocumentPlugin, q as AppendOnlyPluginOptions, r as blockIf, s as validationChainPlugin, t as OperationType, u as TenantStore, v as ObservabilityOptions, w as methodRegistryPlugin, x as MongoOperationsMethods, y as OperationMetric, z as ElasticSearchOptions } from "../validation-chain.plugin-B3gZCZj4.mjs";
-import { A as cachePlugin, B as EnsureAuditTrailReadyOptions, C as prefixedId, D as CacheOptions, E as CacheAdapter, F as AuditTrailMethods, H as ensureAuditTrailReady, I as AuditTrailMode, L as AuditTrailOptions, M as AuditOperation, N as AuditQueryOptions, O as RepositoryCacheHandle, P as AuditQueryResult, R as AuditTrailQuery, T as sequentialId, V as auditTrailPlugin, _ as customIdPlugin, a as DateSequentialIdOptions, b as getNextPeriodSequence, i as CustomIdOptions, j as AuditEntry, k as RepositoryCachePluginOptions, m as SequentialIdOptions, o as IdGenerator, r as multiTenantPlugin, t as MultiTenantOptions, u as PrefixedIdOptions, v as dateSequentialId, x as getNextSequence, z as AuditTrailQueryOptions } from "../multi-tenant.plugin-DfeDMiI8.mjs";
-import { C as RepositoryPluginName, S as MongoKitPluginName, l as Plugin, x as MONGOKIT_PLUGIN_NAMES } from "../repository-DzVIwhU2.mjs";
-import { n as RetentionPurgeEvent, r as RetentionPurgeRequest, t as RETENTION_PURGE_ERROR_CODES } from "../retention-purge-DqcYvRnG.mjs";
+import { A as ImmutablePurgeEvent, B as elasticSearchPlugin, C as MethodRegistryRepository, D as LeasePluginOptions, E as LeasePendingFilter, F as IdempotencyStoreMethods, G as batchOperationsPlugin, H as BatchOperationsMethods, I as IdempotencyStorePluginOptions, J as AppendOnlyPurgeEvent, K as auditLogPlugin, L as idempotencyStorePlugin, M as ImmutableStatesPluginOptions, N as immutableStatesPlugin, O as leasePlugin, P as IdempotencyClaim, R as fieldFilterPlugin, S as mongoOperationsPlugin, T as LeaseMethods, V as cascadePlugin, X as AggregateHelpersMethods, Y as appendOnlyPlugin, Z as aggregateHelpersPlugin, _ as searchKeysPlugin, a as requireField, b as observabilityPlugin, c as timestampPlugin, d as createTenantContext, f as SubdocumentMethods, g as SearchKeysPluginOptions, h as softDeletePlugin, i as immutableField, j as ImmutablePurgeRequest, k as ImmutableClaimView, l as TenantContext, m as SoftDeleteMethods, n as autoInject, o as uniqueField, p as subdocumentPlugin, q as AppendOnlyPluginOptions, r as blockIf, s as validationChainPlugin, t as OperationType, u as TenantStore, v as ObservabilityOptions, w as methodRegistryPlugin, x as MongoOperationsMethods, y as OperationMetric, z as ElasticSearchOptions } from "../validation-chain.plugin-COYrUdd8.mjs";
+import { A as cachePlugin, B as EnsureAuditTrailReadyOptions, C as prefixedId, D as CacheOptions, E as CacheAdapter, F as AuditTrailMethods, H as ensureAuditTrailReady, I as AuditTrailMode, L as AuditTrailOptions, M as AuditOperation, N as AuditQueryOptions, O as RepositoryCacheHandle, P as AuditQueryResult, R as AuditTrailQuery, T as sequentialId, V as auditTrailPlugin, _ as customIdPlugin, a as DateSequentialIdOptions, b as getNextPeriodSequence, i as CustomIdOptions, j as AuditEntry, k as RepositoryCachePluginOptions, m as SequentialIdOptions, o as IdGenerator, r as multiTenantPlugin, t as MultiTenantOptions, u as PrefixedIdOptions, v as dateSequentialId, x as getNextSequence, z as AuditTrailQueryOptions } from "../multi-tenant.plugin-BTPtCLNK.mjs";
+import { C as RepositoryPluginName, S as MongoKitPluginName, l as Plugin, x as MONGOKIT_PLUGIN_NAMES } from "../repository-B0aFVgP2.mjs";
+import { n as RetentionPurgeEvent, r as RetentionPurgeRequest, t as RETENTION_PURGE_ERROR_CODES } from "../retention-purge-CCd_VXUf.mjs";
 import { ChangeLogStore } from "@classytic/repo-core/sync";
 interface ChangeLogPluginOptions {
   /** Durable feed implementing the repo-core/sync contract. */

package/dist/plugins/index.mjs

@@ -1,7 +1,7 @@
-import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-DNY6MIF6.mjs";
-import { C as ensureAuditTrailReady, S as auditTrailPlugin, _ as prefixedId, b as cachePlugin, d as customIdPlugin, f as dateSequentialId, h as getNextSequence, i as multiTenantPlugin, m as getNextPeriodSequence, n as softDeletePlugin, t as timestampPlugin, w as auditLogPlugin, x as AuditTrailQuery, y as sequentialId } from "../timestamp.plugin-Bz_zL9PX.mjs";
-import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-CGAepsBU.mjs";
-import { d as RETENTION_PURGE_ERROR_CODES, i as searchKeysPlugin } from "../Repository-eMRYZ_2Y.mjs";
+import { _ as cascadePlugin, a as uniqueField, c as subdocumentPlugin, d as mongoOperationsPlugin, f as leasePlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, l as observabilityPlugin, m as idempotencyStorePlugin, n as blockIf, o as validationChainPlugin, p as immutableStatesPlugin, r as immutableField, s as createTenantContext, t as autoInject, u as MONGOKIT_PLUGIN_NAMES, v as appendOnlyPlugin, y as aggregateHelpersPlugin } from "../validation-chain.plugin-DJplVJ12.mjs";
+import { C as ensureAuditTrailReady, S as auditTrailPlugin, _ as prefixedId, b as cachePlugin, d as customIdPlugin, f as dateSequentialId, h as getNextSequence, i as multiTenantPlugin, m as getNextPeriodSequence, n as softDeletePlugin, t as timestampPlugin, w as auditLogPlugin, x as AuditTrailQuery, y as sequentialId } from "../timestamp.plugin-B-IJrlYb.mjs";
+import { n as batchOperationsPlugin, t as methodRegistryPlugin } from "../method-registry.plugin-BeJfQBJV.mjs";
+import { d as RETENTION_PURGE_ERROR_CODES, i as searchKeysPlugin } from "../Repository-DheA7oW-.mjs";
 // src/plugins/change-log.plugin.ts
 const PLUGIN_NAME = "changeLog";
 /** Marks a repository already captured: the store and scope it writes to. */

package/dist/{query-defaults-aUoKlEbh.mjs → query-defaults-DwvWUjZU.mjs}

@@ -9,13 +9,13 @@ import mongoose from "mongoose";
 * An explicit value always wins (FL1). For an aggregation the aggregate chain is consulted before
 * the generic query chain, because it is the more specific instruction.
 *
-* The bound travels as per-op CSOT `timeoutMS` (the driver derives the wire `maxTimeMS` from
-* it, and a client-level `timeoutMS` cannot override it). It and `comment` go to the commands Mongoose itself bounds with its global `maxTimeMS`
-* (find, findOne, countDocuments, distinct, findOneAndUpdate, aggregate:
-* lib/query.js:2465,2812,2905,3074,3610; lib/aggregate.js:1106). Writes get `writeConcern`. The
-* connection's CSOT `timeoutMS` bounds everything else; {@link assertQueryDefaultsConfigured}
-* checks both at boot. Inside a transaction a DEFAULT read/write concern or read preference is
-* dropped (the transaction owns them); a per-call one is passed and the driver judges it.
+* The bound travels as the server-side `maxTimeMS` on the command (driver 7.8 made the client-side
+* `timeoutMS` / CSOT a no-op, CVE-2026-119179, so there is no per-op client budget any more). It
+* reaches find, findOne, countDocuments, distinct, findOneAndUpdate, aggregate, insertMany,
+* update/delete and bulkWrite. A single-document `create()` goes through Mongoose `save()`, which
+* forwards no `maxTimeMS`, so it is NOT server-bounded. Writes also get `writeConcern`.
+* {@link assertQueryDefaultsConfigured} checks the deployment bound at boot. Inside a transaction a DEFAULT read/write concern or read
+* preference is dropped (the transaction owns them); a per-call one is passed and the driver judges it.
 */
 /** On `globalThis`, for the reason `pagination/defaults.ts` gives: a duplicated install must share it. */
 const POLICY_SLOT = Symbol.for("classytic.mongokit.queryDefaults");
@@ -60,31 +60,19 @@ function resetQueryDefaults() {
 	};
 }
 /**
-* Boot check (M7): throws unless the deployment sets a query `maxTimeMS`, and — when a connection
-* is passed — unless its client carries a CSOT `timeoutMS`. Returns what it verified.
+* Boot check (M7): throws unless the deployment sets a query `maxTimeMS`. Returns what it verified.
+* A client `timeoutMS` is not checked: the driver (7.8+) drops it from the client options and only
+* logs a process warning, so there is nothing to read; it bounds nothing either way.
 */
-function assertQueryDefaultsConfigured(connection) {
+function assertQueryDefaultsConfigured() {
 	const maxTimeMS = policy().query.maxTimeMS;
 	if (maxTimeMS === void 0) throw createError(500, "[mongokit] no deployment query time bound: call configureQueryDefaults({ maxTimeMS }) at boot", {
 		code: QUERY_DEFAULTS_ERROR_CODES.NOT_CONFIGURED,
 		meta: { missing: "maxTimeMS" }
 	});
-	if (!connection) return { maxTimeMS };
-	const timeoutMS = connection.getClient().options.timeoutMS;
-	if (!(typeof timeoutMS === "number" && timeoutMS > 0)) throw createError(500, "[mongokit] the connection has no CSOT timeoutMS: pass { timeoutMS } to mongoose.connect()", {
-		code: QUERY_DEFAULTS_ERROR_CODES.NOT_CONFIGURED,
-		meta: { missing: "timeoutMS" }
-	});
-	return {
-		maxTimeMS,
-		timeoutMS
-	};
+	return { maxTimeMS };
 }
-const QUERY_DEFAULTS_ERROR_CODES = {
-	NOT_CONFIGURED: "mongokit.query_defaults.not_configured",
-	/** A per-call bound inside a transaction that carries its own CSOT budget (the driver forbids both). */
-	TIMEOUT_IN_TRANSACTION: "mongokit.query_defaults.timeout_in_transaction"
-};
+const QUERY_DEFAULTS_ERROR_CODES = { NOT_CONFIGURED: "mongokit.query_defaults.not_configured" };
 const TX_DEADLINE = Symbol.for("@classytic/mongokit/transaction-deadline");
 /**
 * Set (or clear) the transaction budget's deadline (`performance.now()` ms) on a session.
@@ -108,14 +96,6 @@ function inTransaction(session) {
 	const s = session;
 	return typeof s?.inTransaction === "function" && s.inTransaction();
 }
-/**
-* A `withTransaction` running under a CSOT budget: the driver refuses any per-op `timeoutMS`
-* there (mongodb lib/utils.js:451, `session.explicit && session.timeoutContext != null`).
-*/
-function csotTransaction(session) {
-	const s = session;
-	return inTransaction(session) && s?.explicit === true && s.timeoutContext != null;
-}
 /** Resolve the options one command runs with. `repo` is the repository's own defaults. */
 function resolveQueryOptions(kind, perCall, repo = {}) {
 	const deployment = policy();
@@ -132,7 +112,6 @@ function resolveQueryOptions(kind, perCall, repo = {}) {
 	const budget = tx ? transactionRemaining(perCall.session) : void 0;
 	if (budget !== void 0 && budget <= 0) throw new mongoose.mongo.MongoOperationTimeoutError("Transaction budget exhausted before this operation");
 	if (kind !== "write") {
-		if (csotTransaction(perCall.session) && perCall.maxTimeMS !== void 0) throw createError(400, "[mongokit] a per-call maxTimeMS cannot be honoured inside a transaction with its own timeoutMS budget; bound the transaction instead", { code: QUERY_DEFAULTS_ERROR_CODES.TIMEOUT_IN_TRANSACTION });
 		const bound = tx ? perCall.maxTimeMS : perCall.maxTimeMS ?? (kind === "aggregate" ? repo.aggregate?.maxTimeMs ?? deployment.aggregate.maxTimeMs : void 0) ?? q.maxTimeMS;
 		const capped = budget === void 0 ? bound : Math.min(bound ?? Number.POSITIVE_INFINITY, budget);
 		if (capped !== void 0) out.maxTimeMS = capped;
@@ -174,34 +153,20 @@ function readPreferenceMode(value) {
 }
 /** Apply resolved options to a mongoose Query. */
 function applyToQuery(query, o) {
-	if (o.maxTimeMS !== void 0) {
-		const csot = { timeoutMS: o.maxTimeMS };
-		query.setOptions(csot);
-	}
+	if (o.maxTimeMS !== void 0) query.maxTimeMS(o.maxTimeMS);
 	if (o.comment !== void 0) query.setOptions({ comment: o.comment });
 	if (o.readPreference !== void 0) query.read(readPreferenceMode(o.readPreference));
 	if (o.readConcern !== void 0) query.readConcern(o.readConcern);
 	if (o.writeConcern !== void 0) query.setOptions({ writeConcern: o.writeConcern });
 	if (o.hint !== void 0) query.hint(o.hint);
 }
-/**
-* Make a find cursor's bound apply PER BATCH (CSOT `timeoutMode: 'iteration'`). Only when some
-* `timeoutMS` exists (this op's, or the client's): the driver refuses a timeoutMode without one
-* (mongodb lib/cursor/abstract_cursor.js:114). In iteration mode the driver enforces the budget
-* client-side per batch and sends no wire maxTimeMS.
-*/
-function applyCursorTimeoutMode(query, o, connection) {
-	const clientTimeout = connection.getClient().options.timeoutMS;
-	if (o.maxTimeMS === void 0 && clientTimeout === void 0) return;
-	query.setOptions({ timeoutMode: "iteration" });
-}
 /** Apply resolved options to a mongoose Aggregate. */
 function applyToAggregate(aggregation, o) {
-	if (o.maxTimeMS !== void 0) aggregation.option({ timeoutMS: o.maxTimeMS });
+	if (o.maxTimeMS !== void 0) aggregation.option({ maxTimeMS: o.maxTimeMS });
 	if (o.comment !== void 0) aggregation.option({ comment: o.comment });
 	if (o.readPreference !== void 0) aggregation.read(readPreferenceMode(o.readPreference));
 	if (o.readConcern !== void 0) aggregation.readConcern(o.readConcern);
 	if (o.allowDiskUse !== void 0) aggregation.allowDiskUse(o.allowDiskUse);
 	if (o.hint !== void 0) aggregation.hint(o.hint);
 }
-export { assertQueryDefaultsConfigured as a, getQueryDefaults as c, setTransactionDeadline as d, applyToQuery as i, resetQueryDefaults as l, applyCursorTimeoutMode as n, configureAggregateDefaults as o, applyToAggregate as r, configureQueryDefaults as s, QUERY_DEFAULTS_ERROR_CODES as t, resolveQueryOptions as u };
+export { configureAggregateDefaults as a, resetQueryDefaults as c, assertQueryDefaultsConfigured as i, resolveQueryOptions as l, applyToAggregate as n, configureQueryDefaults as o, applyToQuery as r, getQueryDefaults as s, QUERY_DEFAULTS_ERROR_CODES as t, setTransactionDeadline as u };

package/dist/read-model/index.d.mts

@@ -1,4 +1,4 @@
-import { r as Repository } from "../Repository-B6oL6OMv.mjs";
+import { r as Repository } from "../Repository-DJuRmBNx.mjs";
 import { BulkUpsertResult } from "@classytic/repo-core/repository";
 export declare const READ_MODEL_ERROR_CODES: {
   readonly MERGE_IN_TRANSACTION: 'mongokit.read_model.merge_in_transaction';

package/dist/{repository-DzVIwhU2.d.mts → repository-B0aFVgP2.d.mts}

@@ -1,4 +1,4 @@
-import { A as ObjectId, D as AnyDocument, F as SortSpec, M as ReadPreferenceType, N as SelectSpec, _ as QueryDefaults, b as WriteConcernSpec, i as CountStrategy, j as PopulateSpec, k as FilterQuery, p as AggregateDefaults, v as ReadConcernLevel } from "./pagination-DAUg5zOY.mjs";
+import { A as ObjectId, D as AnyDocument, F as SortSpec, M as ReadPreferenceType, N as SelectSpec, _ as QueryDefaults, b as WriteConcernSpec, i as CountStrategy, j as PopulateSpec, k as FilterQuery, p as AggregateDefaults, v as ReadConcernLevel } from "./pagination-BAM9cA4N.mjs";
 import { r as DocField } from "./type-utils-CKvuewAL.mjs";
 import { DistributionConfig, DistributionMissHandler, RepoCapabilities, RepositoryBase } from "@classytic/repo-core/repository";
 import { Model, PipelineStage } from "mongoose";

package/dist/{retention-purge-DqcYvRnG.d.mts → retention-purge-CCd_VXUf.d.mts}

@@ -1,4 +1,4 @@
-import { p as RepositoryContext } from "./repository-DzVIwhU2.mjs";
+import { p as RepositoryContext } from "./repository-B0aFVgP2.mjs";
 /** Per-call retention purge request (`options.retentionPurge`). */
 interface RetentionPurgeRequest {
   /** Why the rows are removed (e.g. `'retention: 7 years'`). Required, non-blank. */
@@ -17,6 +17,8 @@ interface RetentionPurgeEvent {
   filter: Record<string, unknown> | undefined;
   /** Rows removed (`delete`: 1 or 0). */
   deletedCount: number;
+  /** True when the delete is an `archiveByFilter` chunk the sink acknowledged first. */
+  archived: boolean;
   /**
    * The delete's session, when the call ran in one. Write the audit row with it
    * (`{ session: event.session }`) so the delete and its audit commit or abort
@@ -31,5 +33,6 @@ declare const RETENTION_PURGE_ERROR_CODES: {
   readonly REASON_REQUIRED: 'RETENTION_PURGE_REASON_REQUIRED';
   readonly INVALID_ACTOR: 'RETENTION_PURGE_INVALID_ACTOR';
   readonly HARD_ONLY: 'RETENTION_PURGE_HARD_ONLY';
+  readonly ARCHIVE_UNATTESTED: 'RETENTION_PURGE_ARCHIVE_UNATTESTED';
 };
 export { RetentionPurgeEvent as n, RetentionPurgeRequest as r, RETENTION_PURGE_ERROR_CODES as t };

package/dist/sync/index.d.mts

@@ -1,5 +1,5 @@
 import { ClientSession, Connection, Model } from "mongoose";
-import { ChangeEntry, ChangeLogAppendOptions, ChangeLogStore, ChangesSinceOptions, CommandStreamStore, CommandStreamTx } from "@classytic/repo-core/sync";
+import { ChangeEntry, ChangeLogAppendOptions, ChangeLogStore, ChangesPage, ChangesSinceOptions, CommandStreamStore, CommandStreamTx } from "@classytic/repo-core/sync";
 export interface ChangeLogModelOptions {
   /** Entries collection. Default `sync_changes`; its counter lives in `<collection>_counter`. */
   collection?: string;
@@ -43,12 +43,21 @@ export interface ChangeLogModels {
   feed: string;
 }
 export declare function createChangeLogModels(connection: Connection, options?: ChangeLogModelOptions): ChangeLogModels;
+/** {@link MongoChangeLogStore.snapshot}'s options: the reader's view, plus the bound after the first page. */
+export interface ChangesSnapshotOptions extends ChangesSinceOptions {
+  /** The `upTo` the first page returned; omit it on the first page. */
+  readonly upTo?: string;
+}
+/** One snapshot page. `cursor` pages the snapshot; `upTo` is where `since()` resumes once `hasMore` is false. */
+export interface ChangesSnapshotPage extends ChangesPage {
+  readonly upTo: string;
+}
 /** The mongo change feed: the `ChangeLogStore` contract plus superseded-entry compaction. */
 export interface MongoChangeLogStore extends ChangeLogStore {
   /**
-   * Delete every entry a later COMMITTED entry of the same `(tenantId, scope, docId)` replaced. Safe for any client
-   * cursor: entries carry whole documents, so a reader only ever needs the latest one; tombstones and
-   * each document's latest entry stay. Idempotent; run it on a schedule.
+   * Delete every entry of a `(tenantId, scope, docId)` but the one a reader ends on (the last
+   * tombstone, or the highest-version upsert after it). Safe for any client cursor: entries carry
+   * whole documents, and a reader would have skipped every deleted one. Idempotent; run it on a schedule.
    */
   compactSuperseded(options?: {
     batchSize?: number;
@@ -57,9 +66,8 @@ export interface MongoChangeLogStore extends ChangeLogStore {
   }>;
   /**
    * Retention with a horizon (the `ChangeLogStore.prune` contract). Deletes every entry older than
-   * `before` (`at < before`) that a later entry of the same `(tenantId, scope, docId)` replaced:
-   * each document's latest entry stays, tombstone or not, so a full reload still sees every
-   * document. Records a HORIZON (the highest deleted cursor, never lowered) per `(tenantId, scope)`
+   * `before` (`at < before`) except, per `(tenantId, scope, docId)`, the one a reader ends on (as
+   * `compactSuperseded` keeps), so a snapshot still sees every document. Records a HORIZON (the highest deleted cursor, never lowered) per `(tenantId, scope)`
    * and feed-wide, BEFORE deleting, and returns the feed-wide one, `''` while nothing was ever
    * pruned. `since(cursor, options)` with a cursor below the horizon of what that reader can see
    * (its tenant, shared scopes and `scopes`; the feed-wide horizon when unfiltered; `''` included)
@@ -73,6 +81,14 @@ export interface MongoChangeLogStore extends ChangeLogStore {
   prune(before: Date, options?: {
     batchSize?: number;
   }): Promise<string>;
+  /**
+   * The resync bootstrap for a reader `since()` expired: each document's latest entry at or below
+   * `upTo` (the reader's horizon, fixed by the first page), tombstones left out, in feed order. Then
+   * `since(upTo)` carries on, delivering every change above it, deletes included. Complete because
+   * `prune` and `compactSuperseded` never delete a document's latest entry. If that `since(upTo)`
+   * expires again, a prune raised the horizon in between: bootstrap again.
+   */
+  snapshot(cursor: string, options?: ChangesSnapshotOptions): Promise<ChangesSnapshotPage>;
   /**
    * The compaction horizon cursor a reader with these options is held to (`''` while nothing it
    * can see was pruned); feed-wide without options.
@@ -94,8 +110,8 @@ export interface MongoChangeLogStore extends ChangeLogStore {
    * entry; `null` when the feed holds none. Reads only (it never runs the sequencer), so it is cheap on a hot
    * path, e.g. a writer that needs the last recorded state of a record before it appends the next change.
    * A document is `(tenantId, scope, docId)`: `tenantId` omitted or `null` reads the untenanted document.
-   * Pass `session` to see what the caller staged or appended in its own transaction. A pruned or compacted
-   * document still has its latest entry (both keep it).
+   * Pass `session` to see what the caller staged or appended in its own transaction. Pruning and
+   * compaction keep the entry a reader ends on, which may not be the last one recorded.
    */
   latestOf(scope: string, docId: string, options?: {
     tenantId?: string | null;