@classytic/mongokit 3.6.4 → 3.8.0

package/dist/index.mjs

@@ -1,13 +1,14 @@
-import { a as warn, n as parseDuplicateKeyError, r as configureLogger, t as createError } from "./error-Bpbi_NKo.mjs";
-import { y as LookupBuilder } from "./update-AVfKWNGt.mjs";
+import { r as warn, t as configureLogger } from "./logger-DJ7egMnd.mjs";
+import { b as LookupBuilder } from "./update-yjSoNnWy.mjs";
+import { n as parseDuplicateKeyError, t as createError } from "./error-Lw9GEAro.mjs";
 import { t as actions_exports } from "./actions/index.mjs";
-import { t as PaginationEngine } from "./PaginationEngine-CunXkR9p.mjs";
-import { A as auditTrailPlugin, C as HOOK_PRIORITY, D as AggregationBuilder, E as withTransaction, M as aggregateHelpersPlugin, O as batchOperationsPlugin, S as cachePlugin, T as isTransactionUnsupported, _ as dateSequentialId, a as uniqueField, b as sequentialId, c as subdocumentPlugin, d as multiTenantPlugin, f as mongoOperationsPlugin, g as customIdPlugin, h as elasticSearchPlugin, i as requireField, j as auditLogPlugin, k as AuditTrailQuery, l as softDeletePlugin, m as fieldFilterPlugin, n as blockIf, o as validationChainPlugin, p as methodRegistryPlugin, r as immutableField, s as timestampPlugin, t as autoInject, u as observabilityPlugin, v as getNextSequence, w as Repository, x as cascadePlugin, y as prefixedId } from "./validation-chain.plugin-7A5qGEQq.mjs";
+import { A as AuditTrailQuery, C as cachePlugin, D as withTransaction, E as isTransactionUnsupported, F as MUTATING_OPERATIONS, I as OP_REGISTRY, L as READ_OPERATIONS, M as auditLogPlugin, N as aggregateHelpersPlugin, O as AggregationBuilder, P as ALL_OPERATIONS, R as operationsByPolicyKey, S as cascadePlugin, T as Repository, _ as customIdPlugin, a as uniqueField, b as prefixedId, c as createTenantContext, d as observabilityPlugin, f as multiTenantPlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, j as auditTrailPlugin, k as batchOperationsPlugin, l as subdocumentPlugin, m as methodRegistryPlugin, n as blockIf, o as validationChainPlugin, p as mongoOperationsPlugin, r as immutableField, s as timestampPlugin, t as autoInject, u as softDeletePlugin, v as dateSequentialId, w as HOOK_PRIORITY, x as sequentialId, y as getNextSequence } from "./validation-chain.plugin-DwoOOWse.mjs";
+import { t as PaginationEngine } from "./PaginationEngine-C2_tAvAD.mjs";
 import { isGeoOperator, parseGeoFilter } from "./query/primitives/geo.mjs";
-import { i as getMongooseProjection, n as filterResponseData, r as getFieldsForUser, t as createFieldPreset } from "./field-selection-C5o7jyyA.mjs";
+import { i as getMongooseProjection, n as filterResponseData, r as getFieldsForUser, t as createFieldPreset } from "./field-selection-dI0m4RBs.mjs";
 import { buildFieldTypeMap, coerceFieldValue, coerceHeuristic } from "./query/primitives/coercion.mjs";
 import { extractSchemaIndexes } from "./query/primitives/indexes.mjs";
-import { a as isFieldUpdateAllowed, i as getSystemManagedFields, n as buildCrudSchemasFromMongooseSchema, o as validateUpdateBody, r as getImmutableFields, s as createMemoryCache, t as buildCrudSchemasFromModel } from "./mongooseToJsonSchema-BlfkI9LC.mjs";
+import { a as isFieldUpdateAllowed, i as getSystemManagedFields, n as buildCrudSchemasFromMongooseSchema, o as validateUpdateBody, r as getImmutableFields, s as createMemoryCache, t as buildCrudSchemasFromModel } from "./mongooseToJsonSchema-DUwXPStK.mjs";
 //#region src/query/QueryParser.ts
 /**
 * Modern Query Parser
@@ -48,15 +49,47 @@ var QueryParser = class {
 	*/
 	_schemaIndexes;
 	/**
-	* Regex patterns that can cause catastrophic backtracking (ReDoS attacks)
-	* Detects:
+	* Regex patterns that can cause catastrophic backtracking (ReDoS attacks).
+	* Detects common footguns:
 	* - Quantifiers: {n,m}
 	* - Possessive quantifiers: *+, ++, ?+
 	* - Nested quantifiers: (a+)+, (a*)*
 	* - Backreferences: \1, \2, etc.
 	* - Complex character classes: [...]...[...]
+	*
+	* This pattern detector is FAIL-SAFE (on match, the input is escaped), but
+	* it is not exhaustive. {@link _regexComplexityExceedsBudget} complements
+	* it with a deterministic static complexity budget so patterns that happen
+	* to evade the detector still fail over when their unbounded-quantifier
+	* density is pathological.
 	*/
 	dangerousRegexPatterns = /(\{[0-9,]+\}|\*\+|\+\+|\?\+|(\(.+\))\+|\(\?:|\\[0-9]|(\[.+\]).+(\[.+\]))/;
+	/**
+	* Static complexity budget for user-supplied regex patterns.
+	* Returns `true` if the pattern crosses a budget that empirically correlates
+	* with ReDoS risk — independent of the heuristic regex detector.
+	*
+	* Budget components (any single threshold crossed → over budget):
+	*   - unbounded quantifiers (`*`, `+`, `?`) — hard cap 20
+	*   - nested groups `(` — hard cap 8
+	*   - alternations `|` — hard cap 10
+	*   - combined: (quantifiers * groups) — hard cap 40
+	*
+	* These thresholds are intentionally permissive for legitimate queries and
+	* tight enough to refuse known-pathological patterns like `(a+)+b` with
+	* heavy repetition.
+	*/
+	_regexComplexityExceedsBudget(patternStr) {
+		const stripped = patternStr.replace(/\\[^\\]/g, "");
+		const unboundedQuantifiers = (stripped.match(/[*+?]/g) ?? []).length;
+		const groups = (stripped.match(/\(/g) ?? []).length;
+		const alternations = (stripped.match(/\|/g) ?? []).length;
+		if (unboundedQuantifiers > 20) return true;
+		if (groups > 8) return true;
+		if (alternations > 10) return true;
+		if (unboundedQuantifiers * groups > 40) return true;
+		return false;
+	}
 	constructor(options = {}) {
 		this.options = {
 			maxRegexLength: options.maxRegexLength ?? 500,
@@ -770,6 +803,10 @@ var QueryParser = class {
 			warn("[mongokit] Potentially dangerous regex pattern, escaping");
 			return new RegExp(this._escapeRegex(patternStr), flags);
 		}
+		if (this._regexComplexityExceedsBudget(patternStr)) {
+			warn("[mongokit] Regex complexity budget exceeded, escaping");
+			return new RegExp(this._escapeRegex(patternStr), flags);
+		}
 		try {
 			return new RegExp(patternStr, flags);
 		} catch {
@@ -783,7 +820,11 @@ var QueryParser = class {
 	* Sanitize $match configuration to prevent dangerous operators
 	* Recursively filters out operators like $where, $function, $accumulator
 	*/
-	_sanitizeMatchConfig(config) {
+	_sanitizeMatchConfig(config, depth = 0) {
+		if (depth > this.options.maxFilterDepth) {
+			warn(`[mongokit] $match sanitize depth ${depth} exceeds maximum ${this.options.maxFilterDepth}, truncating branch`);
+			return {};
+		}
 		const sanitized = {};
 		const logicalArrayOps = new Set([
 			"$or",
@@ -795,10 +836,10 @@ var QueryParser = class {
 				warn(`[mongokit] Blocked dangerous operator in aggregation: ${key}`);
 				continue;
 			}
-			if (value && typeof value === "object" && !Array.isArray(value)) sanitized[key] = this._sanitizeMatchConfig(value);
+			if (value && typeof value === "object" && !Array.isArray(value)) sanitized[key] = this._sanitizeMatchConfig(value, depth + 1);
 			else if (Array.isArray(value)) {
 				const sanitizedArray = value.map((item) => {
-					if (item && typeof item === "object" && !Array.isArray(item)) return this._sanitizeMatchConfig(item);
+					if (item && typeof item === "object" && !Array.isArray(item)) return this._sanitizeMatchConfig(item, depth + 1);
 					return item;
 				});
 				if (logicalArrayOps.has(key)) {
@@ -945,4 +986,4 @@ function createRepository(Model, plugins = [], paginationConfig = {}, options =
 }
 var src_default = Repository;
 //#endregion
-export { AggregationBuilder, AuditTrailQuery, HOOK_PRIORITY, LookupBuilder, PaginationEngine, QueryParser, Repository, actions_exports as actions, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, cascadePlugin, configureLogger, createError, createFieldPreset, createMemoryCache, createRepository, customIdPlugin, dateSequentialId, src_default as default, elasticSearchPlugin, fieldFilterPlugin, filterResponseData, getFieldsForUser, getImmutableFields, getMongooseProjection, getNextSequence, getSystemManagedFields, immutableField, isFieldUpdateAllowed, isTransactionUnsupported, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, parseDuplicateKeyError, prefixedId, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, timestampPlugin, uniqueField, validateUpdateBody, validationChainPlugin, withTransaction };
+export { ALL_OPERATIONS, AggregationBuilder, AuditTrailQuery, HOOK_PRIORITY, LookupBuilder, MUTATING_OPERATIONS, OP_REGISTRY, PaginationEngine, QueryParser, READ_OPERATIONS, Repository, actions_exports as actions, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, blockIf, buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, cachePlugin, cascadePlugin, configureLogger, createError, createFieldPreset, createMemoryCache, createRepository, createTenantContext, customIdPlugin, dateSequentialId, src_default as default, elasticSearchPlugin, fieldFilterPlugin, filterResponseData, getFieldsForUser, getImmutableFields, getMongooseProjection, getNextSequence, getSystemManagedFields, immutableField, isFieldUpdateAllowed, isTransactionUnsupported, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, operationsByPolicyKey, parseDuplicateKeyError, prefixedId, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, timestampPlugin, uniqueField, validateUpdateBody, validationChainPlugin, withTransaction };

package/dist/logger-DJ7egMnd.mjs

@@ -0,0 +1,30 @@
+//#region src/utils/logger.ts
+const noop = () => {};
+let current = {
+	warn: console.warn.bind(console),
+	debug: noop
+};
+/**
+* Configure the internal logger.
+* Pass `false` to silence all output.
+*/
+function configureLogger(config) {
+	if (config === false) current = {
+		warn: noop,
+		debug: noop
+	};
+	else current = {
+		...current,
+		...config
+	};
+}
+/** Emit a warning — security blocks, config issues, performance hints */
+function warn(message, ...args) {
+	current.warn(message, ...args);
+}
+/** Emit debug info — only visible when debug is enabled */
+function debug(message, ...args) {
+	current.debug(message, ...args);
+}
+//#endregion
+export { debug as n, warn as r, configureLogger as t };

package/dist/{mongooseToJsonSchema-BvD1NDl9.d.mts → mongooseToJsonSchema-BZaKOXXI.d.mts}

@@ -1,4 +1,4 @@
-import { T as FieldPreset, _ as CrudSchemas, k as HttpError, ot as SchemaBuilderOptions, s as CacheAdapter, xt as ValidationResult, yt as UserContext } from "./types-BoH1qdHo.mjs";
+import { A as HttpError, St as ValidationResult, T as FieldPreset, _ as CrudSchemas, bt as UserContext, s as CacheAdapter, st as SchemaBuilderOptions } from "./types-D57SZJeE.mjs";
 import mongoose, { Schema } from "mongoose";
 
 //#region src/utils/error.d.ts
@@ -15,13 +15,29 @@ import mongoose, { Schema } from "mongoose";
  * throw createError(403, 'Access denied');
  */
 declare function createError(status: number, message: string): HttpError;
+/** Options for parseDuplicateKeyError */
+interface ParseDuplicateKeyOptions {
+  /**
+   * Include the offending values inline in the error message and under
+   * `error.duplicate.values`. Default is `false` because those values can be
+   * PII (emails, tokens, phone numbers) and end up in logs/crash reports.
+   * Enable in dev or for trusted internal tools only.
+   */
+  exposeValues?: boolean;
+}
 /**
  * Detect and convert a MongoDB E11000 duplicate-key error into
  * a 409 HttpError with an actionable message.
  *
+ * PII-safe by default: the error message lists only the conflicting field
+ * names, never the values. Structured field names are attached under
+ * `error.duplicate.fields` for downstream handlers. Pass
+ * `{ exposeValues: true }` to opt into including the values (dev or trusted
+ * server-to-server contexts only).
+ *
  * Returns `null` when the error is not a duplicate-key error.
  */
-declare function parseDuplicateKeyError(error: unknown): HttpError | null;
+declare function parseDuplicateKeyError(error: unknown, options?: ParseDuplicateKeyOptions): HttpError | null;
 //#endregion
 //#region src/utils/field-selection.d.ts
 /**

package/dist/{mongooseToJsonSchema-BlfkI9LC.mjs → mongooseToJsonSchema-DUwXPStK.mjs}

@@ -1,4 +1,4 @@
-import { n as isObjectIdInstance } from "./id-resolution-LZ-cCwR5.mjs";
+import { n as isObjectIdInstance } from "./id-resolution-e4BT9zAV.mjs";
 import mongoose from "mongoose";
 //#region src/utils/memory-cache.ts
 /**

package/dist/pagination/PaginationEngine.d.mts

@@ -1,4 +1,4 @@
-import { F as KeysetPaginationResult, G as PaginationConfig, H as OffsetPaginationOptions, P as KeysetPaginationOptions, U as OffsetPaginationResult, a as AnyDocument, n as AggregatePaginationOptions, r as AggregatePaginationResult } from "../types-BoH1qdHo.mjs";
+import { F as KeysetPaginationOptions, I as KeysetPaginationResult, K as PaginationConfig, U as OffsetPaginationOptions, W as OffsetPaginationResult, a as AnyDocument, n as AggregatePaginationOptions, r as AggregatePaginationResult } from "../types-D57SZJeE.mjs";
 import { Model } from "mongoose";
 
 //#region src/pagination/PaginationEngine.d.ts
@@ -11,6 +11,8 @@ interface ResolvedPaginationConfig {
   maxPage: number;
   deepPageThreshold: number;
   cursorVersion: number;
+  minCursorVersion: number;
+  strictKeysetSortFields: string[] | undefined;
   useEstimatedCount: boolean;
 }
 /**

package/dist/pagination/PaginationEngine.mjs

@@ -1,2 +1,2 @@
-import { t as PaginationEngine } from "../PaginationEngine-CunXkR9p.mjs";
+import { t as PaginationEngine } from "../PaginationEngine-C2_tAvAD.mjs";
 export { PaginationEngine };

package/dist/plugins/index.d.mts

@@ -1,2 +1,2 @@
-import { A as dateSequentialId, B as AuditEntry, C as elasticSearchPlugin, D as PrefixedIdOptions, E as IdGenerator, F as CacheMethods, G as AuditTrailOptions, H as AuditQueryOptions, I as cachePlugin, J as auditLogPlugin, K as AuditTrailQuery, L as BatchOperationsMethods, M as prefixedId, N as sequentialId, O as SequentialIdOptions, P as cascadePlugin, S as ElasticSearchOptions, T as DateSequentialIdOptions, U as AuditQueryResult, V as AuditOperation, W as AuditTrailMethods, X as aggregateHelpersPlugin, Y as AggregateHelpersMethods, _ as MongoOperationsMethods, a as uniqueField, b as methodRegistryPlugin, c as SubdocumentMethods, d as softDeletePlugin, f as ObservabilityOptions, g as multiTenantPlugin, h as MultiTenantOptions, i as requireField, j as getNextSequence, k as customIdPlugin, l as subdocumentPlugin, m as observabilityPlugin, n as blockIf, o as validationChainPlugin, p as OperationMetric, q as auditTrailPlugin, r as immutableField, s as timestampPlugin, t as autoInject, u as SoftDeleteMethods, v as mongoOperationsPlugin, w as CustomIdOptions, x as fieldFilterPlugin, y as MethodRegistryRepository, z as batchOperationsPlugin } from "../validation-chain.plugin-BXx6Ogpp.mjs";
-export { type AggregateHelpersMethods, type AuditEntry, type AuditOperation, type AuditQueryOptions, type AuditQueryResult, type AuditTrailMethods, type AuditTrailOptions, AuditTrailQuery, type BatchOperationsMethods, type CacheMethods, type CustomIdOptions, type DateSequentialIdOptions, type ElasticSearchOptions, type IdGenerator, type MethodRegistryRepository, type MongoOperationsMethods, type MultiTenantOptions, type ObservabilityOptions, type OperationMetric, type PrefixedIdOptions, type SequentialIdOptions, type SoftDeleteMethods, type SubdocumentMethods, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, blockIf, cachePlugin, cascadePlugin, customIdPlugin, dateSequentialId, elasticSearchPlugin, fieldFilterPlugin, getNextSequence, immutableField, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, prefixedId, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, timestampPlugin, uniqueField, validationChainPlugin };
+import { $ as aggregateHelpersPlugin, A as PrefixedIdOptions, B as BatchOperationsMethods, C as methodRegistryPlugin, D as CustomIdOptions, E as elasticSearchPlugin, F as prefixedId, G as AuditQueryOptions, H as batchOperationsPlugin, I as sequentialId, J as AuditTrailOptions, K as AuditQueryResult, L as cascadePlugin, M as customIdPlugin, N as dateSequentialId, O as DateSequentialIdOptions, P as getNextSequence, Q as AggregateHelpersMethods, R as CacheMethods, S as MethodRegistryRepository, T as ElasticSearchOptions, U as AuditEntry, W as AuditOperation, X as auditTrailPlugin, Y as AuditTrailQuery, Z as auditLogPlugin, _ as observabilityPlugin, a as uniqueField, b as MongoOperationsMethods, c as TenantContext, d as SubdocumentMethods, f as subdocumentPlugin, g as OperationMetric, h as ObservabilityOptions, i as requireField, j as SequentialIdOptions, k as IdGenerator, l as TenantStore, m as softDeletePlugin, n as blockIf, o as validationChainPlugin, p as SoftDeleteMethods, q as AuditTrailMethods, r as immutableField, s as timestampPlugin, t as autoInject, u as createTenantContext, v as MultiTenantOptions, w as fieldFilterPlugin, x as mongoOperationsPlugin, y as multiTenantPlugin, z as cachePlugin } from "../validation-chain.plugin-wGF34Ym-.mjs";
+export { type AggregateHelpersMethods, type AuditEntry, type AuditOperation, type AuditQueryOptions, type AuditQueryResult, type AuditTrailMethods, type AuditTrailOptions, AuditTrailQuery, type BatchOperationsMethods, type CacheMethods, type CustomIdOptions, type DateSequentialIdOptions, type ElasticSearchOptions, type IdGenerator, type MethodRegistryRepository, type MongoOperationsMethods, type MultiTenantOptions, type ObservabilityOptions, type OperationMetric, type PrefixedIdOptions, type SequentialIdOptions, type SoftDeleteMethods, type SubdocumentMethods, type TenantContext, type TenantStore, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, blockIf, cachePlugin, cascadePlugin, createTenantContext, customIdPlugin, dateSequentialId, elasticSearchPlugin, fieldFilterPlugin, getNextSequence, immutableField, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, prefixedId, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, timestampPlugin, uniqueField, validationChainPlugin };

package/dist/plugins/index.mjs

@@ -1,2 +1,2 @@
-import { A as auditTrailPlugin, M as aggregateHelpersPlugin, O as batchOperationsPlugin, S as cachePlugin, _ as dateSequentialId, a as uniqueField, b as sequentialId, c as subdocumentPlugin, d as multiTenantPlugin, f as mongoOperationsPlugin, g as customIdPlugin, h as elasticSearchPlugin, i as requireField, j as auditLogPlugin, k as AuditTrailQuery, l as softDeletePlugin, m as fieldFilterPlugin, n as blockIf, o as validationChainPlugin, p as methodRegistryPlugin, r as immutableField, s as timestampPlugin, t as autoInject, u as observabilityPlugin, v as getNextSequence, x as cascadePlugin, y as prefixedId } from "../validation-chain.plugin-7A5qGEQq.mjs";
-export { AuditTrailQuery, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, blockIf, cachePlugin, cascadePlugin, customIdPlugin, dateSequentialId, elasticSearchPlugin, fieldFilterPlugin, getNextSequence, immutableField, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, prefixedId, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, timestampPlugin, uniqueField, validationChainPlugin };
+import { A as AuditTrailQuery, C as cachePlugin, M as auditLogPlugin, N as aggregateHelpersPlugin, S as cascadePlugin, _ as customIdPlugin, a as uniqueField, b as prefixedId, c as createTenantContext, d as observabilityPlugin, f as multiTenantPlugin, g as elasticSearchPlugin, h as fieldFilterPlugin, i as requireField, j as auditTrailPlugin, k as batchOperationsPlugin, l as subdocumentPlugin, m as methodRegistryPlugin, n as blockIf, o as validationChainPlugin, p as mongoOperationsPlugin, r as immutableField, s as timestampPlugin, t as autoInject, u as softDeletePlugin, v as dateSequentialId, x as sequentialId, y as getNextSequence } from "../validation-chain.plugin-DwoOOWse.mjs";
+export { AuditTrailQuery, aggregateHelpersPlugin, auditLogPlugin, auditTrailPlugin, autoInject, batchOperationsPlugin, blockIf, cachePlugin, cascadePlugin, createTenantContext, customIdPlugin, dateSequentialId, elasticSearchPlugin, fieldFilterPlugin, getNextSequence, immutableField, methodRegistryPlugin, mongoOperationsPlugin, multiTenantPlugin, observabilityPlugin, prefixedId, requireField, sequentialId, softDeletePlugin, subdocumentPlugin, timestampPlugin, uniqueField, validationChainPlugin };

package/dist/query/primitives/coercion.d.mts

@@ -1,2 +1,2 @@
-import { a as coerceHeuristic, i as coerceFieldValue, n as SchemaPathsLike, o as coerceToType, r as buildFieldTypeMap, s as normalizeMongooseType, t as FieldType } from "../../coercion-B19MD38s.mjs";
+import { a as coerceHeuristic, i as coerceFieldValue, n as SchemaPathsLike, o as coerceToType, r as buildFieldTypeMap, s as normalizeMongooseType, t as FieldType } from "../../coercion-oM8G4b6m.mjs";
 export { FieldType, SchemaPathsLike, buildFieldTypeMap, coerceFieldValue, coerceHeuristic, coerceToType, normalizeMongooseType };

package/dist/query/primitives/coercion.mjs

@@ -1,4 +1,4 @@
-import { n as isObjectIdInstance } from "../../id-resolution-LZ-cCwR5.mjs";
+import { n as isObjectIdInstance } from "../../id-resolution-e4BT9zAV.mjs";
 import mongoose from "mongoose";
 //#region src/query/primitives/coercion.ts
 /**

package/dist/query/primitives/indexes.d.mts

@@ -1,2 +1,2 @@
-import { n as SchemaIndexes, r as extractSchemaIndexes, t as IndexableSchema } from "../../indexes-qIBCZ3mY.mjs";
+import { n as SchemaIndexes, r as extractSchemaIndexes, t as IndexableSchema } from "../../indexes-C26GNZRU.mjs";
 export { IndexableSchema, SchemaIndexes, extractSchemaIndexes };

package/dist/{sort-C-BJEWUZ.mjs → sort-CrZjTK25.mjs}

@@ -21,21 +21,36 @@ function normalizeSort(sort) {
 	return normalized;
 }
 /**
-* Validates and normalizes sort for keyset pagination
-* Auto-adds _id tie-breaker if needed
-* Ensures _id direction matches primary field
+* Validates and normalizes sort for keyset pagination.
+* Auto-adds `_id` tie-breaker if needed; ensures `_id` direction matches the
+* primary field.
+*
+* **Known limitation (MongoDB mixed-type sort):** keyset pagination across a
+* field that can hold both typed values (Date, Number) and `null`/`undefined`
+* is lossy — `$lt/$gt` don't cross the type boundary in BSON comparison, so
+* some docs at the null/non-null boundary are unreachable. If your sort field
+* is nullable, either:
+*   - sort by `_id` alone (always safe), or
+*   - use `allowedPrimaryFields` to lock keyset sort to fields your schema
+*     guarantees non-null (see `PaginationConfig.strictKeysetSortFields`).
 *
 * @param sort - Sort specification
+* @param allowedPrimaryFields - Optional allowlist of primary (non-_id) sort
+*   field names. When set, rejects sorts whose primary field isn't listed.
+*   `_id` is always allowed.
 * @returns Validated and normalized sort
 * @throws Error if sort is invalid for keyset pagination
 */
-function validateKeysetSort(sort) {
+function validateKeysetSort(sort, allowedPrimaryFields) {
 	const keys = Object.keys(sort);
 	if (keys.length === 0) throw new Error("Keyset pagination requires at least one sort field");
 	if (keys.length === 1 && keys[0] === "_id") return normalizeSort(sort);
 	for (const key of keys) if (sort[key] !== 1 && sort[key] !== -1) throw new Error(`Invalid sort direction for "${key}": must be 1 or -1, got ${sort[key]}`);
 	const nonIdKeys = keys.filter((k) => k !== "_id");
 	const primaryDirection = sort[nonIdKeys[0]];
+	if (allowedPrimaryFields && allowedPrimaryFields.length > 0) {
+		for (const key of nonIdKeys) if (!allowedPrimaryFields.includes(key)) throw new Error(`Keyset sort field "${key}" is not in the strictKeysetSortFields allowlist. Allowed: ${allowedPrimaryFields.join(", ")}. (See PaginationConfig.strictKeysetSortFields — protects against lossy null/non-null keyset boundaries.)`);
+	}
 	for (const key of nonIdKeys) if (sort[key] !== primaryDirection) throw new Error("All sort fields must share the same direction for keyset pagination");
 	if (keys.includes("_id") && sort._id !== primaryDirection) throw new Error("_id direction must match primary field direction");
 	if (!keys.includes("_id")) return normalizeSort({

package/dist/{types-BoH1qdHo.d.mts → types-D57SZJeE.d.mts}

@@ -570,6 +570,19 @@ interface RepositoryOptions {
    * Required for regex mode to take effect.
    */
   searchFields?: string[];
+  /**
+   * How to react to a plugin composition that is known to be unsafe.
+   * - 'warn' (default): log a warning via the configured logger.
+   * - 'throw': fail fast at construction time — recommended for production.
+   * - 'off': disable the check entirely.
+   *
+   * Checks currently enforced:
+   *   - soft-delete must precede batch-operations (otherwise deleteMany /
+   *     updateMany skip the soft-delete filter injection).
+   *   - multi-tenant must precede cache (otherwise cache keys are computed
+   *     before tenant scoping → cross-tenant cache poisoning risk).
+   */
+  pluginOrderChecks?: 'warn' | 'throw' | 'off';
 }
 /** Pagination configuration */
 interface PaginationConfig {
@@ -583,6 +596,27 @@ interface PaginationConfig {
   deepPageThreshold?: number;
   /** Cursor version for forward compatibility (default: 1) */
   cursorVersion?: number;
+  /**
+   * Minimum cursor version accepted. Bump alongside `cursorVersion` when a
+   * breaking format change ships so stale client cursors are rejected with a
+   * clear error instead of silently paginating from the wrong position.
+   * Default: 1 (accept any cursor <= cursorVersion).
+   */
+  minCursorVersion?: number;
+  /**
+   * Allowlist of primary sort fields for keyset pagination. When set, any
+   * `getAll({ sort })` whose primary (non-_id) field is not in this list
+   * throws at validation time.
+   *
+   * Use this to lock down keyset pagination to fields that are structurally
+   * guaranteed non-null in your schema — keyset sort across null/non-null
+   * boundaries is lossy (MongoDB's `$lt/$gt` semantics leave a gap at the
+   * type boundary, so not every doc is reachable).
+   *
+   * `_id` is always allowed regardless of this list.
+   * Undefined (default) = no allowlist, any sort field accepted.
+   */
+  strictKeysetSortFields?: string[];
   /** Use estimatedDocumentCount for faster counts on large collections */
   useEstimatedCount?: boolean;
 }
@@ -788,6 +822,31 @@ interface UpdateOptions extends OperationOptions {
   /** Array filters for positional operator $[<identifier>] updates */
   arrayFilters?: Record<string, unknown>[];
 }
+/**
+ * Options for atomic findOneAndUpdate (compare-and-set primitive).
+ *
+ * Designed for outbox/lock/semaphore patterns that need a single round-trip
+ * match-and-mutate. Goes through the full hook pipeline (multi-tenant scope,
+ * soft-delete, audit) the same way `update()` does.
+ */
+interface FindOneAndUpdateOptions extends OperationOptions {
+  /** Sort to disambiguate when filter matches multiple docs (e.g. FIFO claim). */
+  sort?: SortSpec;
+  /** Return doc state before or after the update. Default: 'after'. */
+  returnDocument?: 'before' | 'after';
+  /** Insert if no doc matches. Default: false. */
+  upsert?: boolean;
+  /** Array filters for positional `$[<identifier>]` updates. */
+  arrayFilters?: Record<string, unknown>[];
+  /** Allow aggregation-pipeline updates (array form). Default: false. */
+  updatePipeline?: boolean;
+  /** Run mongoose schema validators on the update. Default: true. */
+  runValidators?: boolean;
+  /** Collation for locale-aware string comparison. */
+  collation?: CollationOptions;
+  /** Maximum execution time in milliseconds. */
+  maxTimeMS?: number;
+}
 /** Aggregate operation options */
 interface AggregateOptions extends ReadOptions {
   /** Allow aggregation to use disk for large sorts/groups */
@@ -993,7 +1052,7 @@ interface RepositoryInstance {
   [key: string]: unknown;
 }
 /** Repository operation names */
-type RepositoryOperation = 'create' | 'createMany' | 'update' | 'updateMany' | 'delete' | 'deleteMany' | 'restore' | 'getById' | 'getByQuery' | 'getOne' | 'getAll' | 'findAll' | 'getOrCreate' | 'count' | 'exists' | 'distinct' | 'aggregate' | 'aggregatePaginate' | 'lookupPopulate' | 'bulkWrite';
+type RepositoryOperation = 'create' | 'createMany' | 'update' | 'updateMany' | 'findOneAndUpdate' | 'delete' | 'deleteMany' | 'restore' | 'getById' | 'getByQuery' | 'getOne' | 'getAll' | 'findAll' | 'getOrCreate' | 'count' | 'exists' | 'distinct' | 'aggregate' | 'aggregatePaginate' | 'lookupPopulate' | 'bulkWrite';
 /** Event lifecycle phases */
 type EventPhase = 'before' | 'after' | 'error';
 /** Repository event names (generated from template literals) */
@@ -1139,7 +1198,7 @@ interface ValidatorDefinition {
   /** Validator name */
   name: string;
   /** Operations to apply validator to */
-  operations?: Array<'create' | 'createMany' | 'update' | 'delete'>;
+  operations?: Array<'create' | 'createMany' | 'update' | 'findOneAndUpdate' | 'delete'>;
   /** Validation function */
   validate: (context: RepositoryContext, repo?: RepositoryInstance) => void | Promise<void>;
 }
@@ -1269,6 +1328,17 @@ interface CacheOptions {
   skipIf?: {
     largeLimit?: number;
   };
+  /**
+   * TTL jitter to mitigate cache stampedes. When many entries share the same
+   * TTL and expire simultaneously, every concurrent reader misses and hammers
+   * the DB at once. Jitter spreads expirations over a window.
+   *
+   * - `number` in [0, 1]: fractional symmetric jitter. `0.1` multiplies the
+   *   TTL by a random factor in [0.9, 1.1]. Default: 0 (no jitter).
+   * - `function(ttl)`: full control — receive the configured TTL (seconds),
+   *   return the effective TTL (seconds) to store with.
+   */
+  jitter?: number | ((ttlSeconds: number) => number);
 }
 /** Options for cache-aware operations */
 interface CacheOperationOptions {
@@ -1325,6 +1395,16 @@ interface HttpError extends Error {
     validator: string;
     error: string;
   }>;
+  /**
+   * Structured metadata for duplicate-key (E11000) errors. Safe to surface in
+   * logs/audit. Includes the offending field names and a boolean-only mirror
+   * of whether each field had a duplicate value — never the value itself
+   * unless `parseDuplicateKeyError` was called with `{ exposeValues: true }`.
+   */
+  duplicate?: {
+    fields: string[]; /** Only populated when parseDuplicateKeyError was called with exposeValues:true. */
+    values?: Record<string, unknown>;
+  };
 }
 /**
  * Combines all plugin method types into a single type
@@ -1470,4 +1550,4 @@ type AllPluginMethods<TDoc> = {
  */
 type WithPlugins<TDoc, TRepo extends RepositoryInstance = RepositoryInstance> = TRepo & AllPluginMethods<TDoc>;
 //#endregion
-export { ReadPreferenceType as $, InferDocument as A, LookupOptions as At, NonNullableFields as B, EventPayload as C, WithPlugins as Ct, GroupResult as D, IRequestContext as Dt, FieldRules as E, IControllerResponse as Et, KeysetPaginationResult as F, PaginationConfig as G, OffsetPaginationOptions as H, Logger as I, Plugin as J, PaginationResult as K, LookupPopulateOptions as L, JsonSchema as M, KeysOfType as N, HookMode as O, IResponseFormatter as Ot, KeysetPaginationOptions as P, ReadOptions as Q, LookupPopulateResult as R, EventHandlers as S, ValidatorDefinition as St, FieldPreset as T, IController as Tt, OffsetPaginationResult as U, ObjectId as V, OperationOptions as W, PluginType as X, PluginFunction as Y, PopulateSpec as Z, CrudSchemas as _, UpdateOptions as _t, AnyDocument as a, RequiredBy as at, DeleteResult as b, ValidationChainOptions as bt, CacheOperationOptions as c, SessionOptions as ct, CacheableOptions as d, SoftDeleteRepository as dt, RepositoryContext as et, CascadeOptions as f, SortDirection as ft, CreateOptions as g, UpdateManyResult as gt, CreateInput as h, UpdateInput as ht, AllPluginMethods as i, RepositoryOptions as it, InferRawDoc as j, HttpError as k, LookupBuilder as kt, CacheOptions as l, SoftDeleteFilterMode as lt, CollationOptions as m, Strict as mt, AggregatePaginationOptions as n, RepositoryInstance as nt, AnyModel as o, SchemaBuilderOptions as ot, CascadeRelation as p, SortSpec as pt, PartialBy as q, AggregatePaginationResult as r, RepositoryOperation as rt, CacheAdapter as s, SelectSpec as st, AggregateOptions as t, RepositoryEvent as tt, CacheStats as u, SoftDeleteOptions as ut, DecodedCursor as v, UpdateWithValidationResult as vt, EventPhase as w, WithTransactionOptions as wt, DocField as x, ValidationResult as xt, DeepPartial as y, UserContext as yt, MinMaxResult as z };
+export { ReadOptions as $, HttpError as A, LookupBuilder as At, MinMaxResult as B, EventPayload as C, ValidatorDefinition as Ct, FindOneAndUpdateOptions as D, IControllerResponse as Dt, FieldRules as E, IController as Et, KeysetPaginationOptions as F, OperationOptions as G, ObjectId as H, KeysetPaginationResult as I, PartialBy as J, PaginationConfig as K, Logger as L, InferRawDoc as M, JsonSchema as N, GroupResult as O, IRequestContext as Ot, KeysOfType as P, PopulateSpec as Q, LookupPopulateOptions as R, EventHandlers as S, ValidationResult as St, FieldPreset as T, WithTransactionOptions as Tt, OffsetPaginationOptions as U, NonNullableFields as V, OffsetPaginationResult as W, PluginFunction as X, Plugin as Y, PluginType as Z, CrudSchemas as _, UpdateManyResult as _t, AnyDocument as a, RepositoryOptions as at, DeleteResult as b, UserContext as bt, CacheOperationOptions as c, SelectSpec as ct, CacheableOptions as d, SoftDeleteOptions as dt, ReadPreferenceType as et, CascadeOptions as f, SoftDeleteRepository as ft, CreateOptions as g, UpdateInput as gt, CreateInput as h, Strict as ht, AllPluginMethods as i, RepositoryOperation as it, InferDocument as j, LookupOptions as jt, HookMode as k, IResponseFormatter as kt, CacheOptions as l, SessionOptions as lt, CollationOptions as m, SortSpec as mt, AggregatePaginationOptions as n, RepositoryEvent as nt, AnyModel as o, RequiredBy as ot, CascadeRelation as p, SortDirection as pt, PaginationResult as q, AggregatePaginationResult as r, RepositoryInstance as rt, CacheAdapter as s, SchemaBuilderOptions as st, AggregateOptions as t, RepositoryContext as tt, CacheStats as u, SoftDeleteFilterMode as ut, DecodedCursor as v, UpdateOptions as vt, EventPhase as w, WithPlugins as wt, DocField as x, ValidationChainOptions as xt, DeepPartial as y, UpdateWithValidationResult as yt, LookupPopulateResult as z };

package/dist/{update-AVfKWNGt.mjs → update-yjSoNnWy.mjs}

@@ -1,5 +1,6 @@
 import { t as __exportAll } from "./chunk-CfYAbeIz.mjs";
-import { a as warn, t as createError } from "./error-Bpbi_NKo.mjs";
+import { r as warn } from "./logger-DJ7egMnd.mjs";
+import { t as createError } from "./error-Lw9GEAro.mjs";
 //#region src/query/LookupBuilder.ts
 /** Stages that are never valid inside a $lookup pipeline */
 const BLOCKED_PIPELINE_STAGES = [
@@ -728,6 +729,7 @@ async function exists(Model, query, options = {}) {
 //#endregion
 //#region src/actions/update.ts
 var update_exports = /* @__PURE__ */ __exportAll({
+	findOneAndUpdate: () => findOneAndUpdate,
 	increment: () => increment,
 	pullFromArray: () => pullFromArray,
 	pushToArray: () => pushToArray,
@@ -860,6 +862,28 @@ async function updateByQuery(Model, query, data, options = {}) {
 	return document;
 }
 /**
+* Atomic findOneAndUpdate primitive.
+*
+* Returns the matched document (post-update by default) or null when no doc
+* matches and `upsert` is false. Used by outbox relays, distributed locks,
+* and workflow semaphores that need compare-and-set in a single round-trip.
+*/
+async function findOneAndUpdate(Model, filter, update, options = {}) {
+	assertUpdatePipelineAllowed(update, options.updatePipeline);
+	const returnDocument = options.returnDocument ?? "after";
+	return await Model.findOneAndUpdate(filter, update, {
+		returnDocument,
+		upsert: options.upsert ?? false,
+		runValidators: options.runValidators ?? true,
+		session: options.session,
+		...options.sort ? { sort: options.sort } : {},
+		...options.arrayFilters ? { arrayFilters: options.arrayFilters } : {},
+		...options.collation ? { collation: options.collation } : {},
+		...options.maxTimeMS ? { maxTimeMS: options.maxTimeMS } : {},
+		...options.updatePipeline !== void 0 ? { updatePipeline: options.updatePipeline } : {}
+	}).select(options.select || "").populate(parsePopulate(options.populate)).lean(options.lean ?? true);
+}
+/**
 * Increment field
 */
 async function increment(Model, id, field, value = 1, options = {}) {
@@ -878,4 +902,4 @@ async function pullFromArray(Model, id, field, value, options = {}) {
 	return update(Model, id, { $pull: { [field]: value } }, options);
 }
 //#endregion
-export { aggregate_exports as _, exists as a, getOrCreate as c, deleteByQuery as d, delete_exports as f, upsert as g, create_exports as h, count as i, read_exports as l, createMany as m, updateByQuery as n, getById as o, create as p, update_exports as r, getByQuery as s, update as t, deleteById as u, distinct as v, LookupBuilder as y };
+export { upsert as _, count as a, LookupBuilder as b, getByQuery as c, deleteById as d, deleteByQuery as f, create_exports as g, createMany as h, update_exports as i, getOrCreate as l, create as m, update as n, exists as o, delete_exports as p, updateByQuery as r, getById as s, findOneAndUpdate as t, read_exports as u, aggregate_exports as v, distinct as y };

package/dist/utils/index.d.mts

@@ -1,5 +1,5 @@
-import { Z as PopulateSpec, pt as SortSpec, st as SelectSpec } from "../types-BoH1qdHo.mjs";
-import { a as isFieldUpdateAllowed, c as configureLogger, d as getFieldsForUser, f as getMongooseProjection, i as getSystemManagedFields, l as createFieldPreset, n as buildCrudSchemasFromMongooseSchema, o as validateUpdateBody, p as createError, r as getImmutableFields, s as createMemoryCache, t as buildCrudSchemasFromModel, u as filterResponseData } from "../mongooseToJsonSchema-BvD1NDl9.mjs";
+import { Q as PopulateSpec, ct as SelectSpec, mt as SortSpec } from "../types-D57SZJeE.mjs";
+import { a as isFieldUpdateAllowed, c as configureLogger, d as getFieldsForUser, f as getMongooseProjection, i as getSystemManagedFields, l as createFieldPreset, n as buildCrudSchemasFromMongooseSchema, o as validateUpdateBody, p as createError, r as getImmutableFields, s as createMemoryCache, t as buildCrudSchemasFromModel, u as filterResponseData } from "../mongooseToJsonSchema-BZaKOXXI.mjs";
 
 //#region src/utils/cache-keys.d.ts
 /**

package/dist/utils/index.mjs

@@ -1,5 +1,6 @@
-import { r as configureLogger, t as createError } from "../error-Bpbi_NKo.mjs";
-import { n as isObjectIdInstance, r as isValidIdForType, t as getSchemaIdType } from "../id-resolution-LZ-cCwR5.mjs";
-import { a as byIdKey, c as listQueryKey, i as getMongooseProjection, l as modelPattern, n as filterResponseData, o as byQueryKey, r as getFieldsForUser, s as listPattern, t as createFieldPreset, u as versionKey } from "../field-selection-C5o7jyyA.mjs";
-import { a as isFieldUpdateAllowed, i as getSystemManagedFields, n as buildCrudSchemasFromMongooseSchema, o as validateUpdateBody, r as getImmutableFields, s as createMemoryCache, t as buildCrudSchemasFromModel } from "../mongooseToJsonSchema-BlfkI9LC.mjs";
+import { t as configureLogger } from "../logger-DJ7egMnd.mjs";
+import { t as createError } from "../error-Lw9GEAro.mjs";
+import { n as isObjectIdInstance, r as isValidIdForType, t as getSchemaIdType } from "../id-resolution-e4BT9zAV.mjs";
+import { a as byIdKey, c as listQueryKey, i as getMongooseProjection, l as modelPattern, n as filterResponseData, o as byQueryKey, r as getFieldsForUser, s as listPattern, t as createFieldPreset, u as versionKey } from "../field-selection-dI0m4RBs.mjs";
+import { a as isFieldUpdateAllowed, i as getSystemManagedFields, n as buildCrudSchemasFromMongooseSchema, o as validateUpdateBody, r as getImmutableFields, s as createMemoryCache, t as buildCrudSchemasFromModel } from "../mongooseToJsonSchema-DUwXPStK.mjs";
 export { buildCrudSchemasFromModel, buildCrudSchemasFromMongooseSchema, byIdKey, byQueryKey, configureLogger, createError, createFieldPreset, createMemoryCache, filterResponseData, getFieldsForUser, getImmutableFields, getMongooseProjection, getSchemaIdType, getSystemManagedFields, isFieldUpdateAllowed, isObjectIdInstance, isValidIdForType, listPattern, listQueryKey, modelPattern, validateUpdateBody, versionKey };