cry-db 2.4.33 → 2.4.35

package/dist/mongo.mjs

@@ -1,3 +1,7 @@
+// AI modified: 2026-05-10 (`updateMany` publish payload: `rawUpdate` izpuščen — mongo ne vrne seznama prizadetih `_id`-jev iz `updateMany`, zato spec sam po sebi za consumer-ja ni uporaben. `update` (single-doc) in batch update item-i ga še vedno nosijo, ker tam `_id` poznamo.)
+// AI modified: 2026-05-10 (publish payload za update: `data` je sedaj očiščen (brez mongo operatorjev `$set`/`$unset`/`$pull`/`$[…]`); polja prizadeta z bracket potmi se objavijo kot CELOTNI parent array (sliced iz post-update dokumenta, brez diff-a). Nov `rawUpdate` field na publish payload-u nosi update kot ga je klient poslal (z bracket potmi nedotaknjenimi). Prisoten na update in batch update dogodkih.)
+// AI modified: 2026-05-10 (drop auto-fill `_id` iz bracket id — če element nima `_id`, se zdaj vrže napaka. Avto-zapolnitev je skrivala odjemalske napake; klient mora `_id` vedno nastaviti eksplicitno.)
+// AI modified: 2026-05-09 (kombiniran update: `arr[id].field` sub-field updates + `arr[id]: [els]` terminal-bracket inserts v isti operaciji — sub-field paths se zdaj prevedejo v pipeline `$map` + `$mergeObjects`, namesto da bi se metala napaka. Tudi `$inc`/`$currentDate` (npr. `_rev`/`_ts` pri useRevisions) se zdaj ohranjata v pipeline obliki.)
 // AI modified: 2026-05-09 (terminal bracket-id `arr[<id>]: undefined` → $pull (regular doc, lahko z arrayFilters); kombiniran z insert v unified $filter+$concatArrays pipeline stage per field)
 // AI modified: 2026-05-09 (terminal bracket-id `arr[<id>]` z array vrednostjo → idempotent insert preko aggregation pipeline ($concatArrays + $filter); quoted bracket id `['p0']`/`["p0"]` zdaj enak unquoted `[p0]`)
 // AI modified: 2026-04-25 (GetNewerSpec.specId — disambiguate duplicate-collection specs in findNewerMany / findNewerManyStream)
@@ -634,6 +638,11 @@ export class Mongo extends Db {
         };
         if (this._hasHashedKeys(update))
             await this._processHashedKeys(update);
+        // Snapshot the user-form update BEFORE `_processUpdateObject` so the
+        // bracket form survives bracket translation AND no auto-injected mongo
+        // operators (`$inc: { _rev }`, `$currentDate: { _ts }`) end up in the
+        // publish payload's `rawUpdate`.
+        const inputUpdate = cloneDeep(update);
         update = this._processUpdateObject(update);
         const processed = this._applyBracketProcessing(update);
         if (processed.arrayFilters)
@@ -654,8 +663,8 @@ export class Mongo extends Db {
             let res = await conn.findOneAndUpdate(query, processed.update, opts);
             if (!res)
                 return null;
-            let resObj = isPipeline ? res : this._removeUnchanged(res, update, !!(options === null || options === void 0 ? void 0 : options.returnFullObject));
-            await this._publishAndAudit('update', dbName, collection, resObj);
+            let resObj = this._buildPublishDelta(res, inputUpdate, !!(options === null || options === void 0 ? void 0 : options.returnFullObject));
+            await this._publishAndAudit('update', dbName, collection, resObj, false, inputUpdate);
             return resObj;
         }, !!seqKeys, { operation: "updateOne", collection, query, update: processed.update, options });
         fjLog.debug('updateOne returns', obj);
@@ -674,6 +683,7 @@ export class Mongo extends Db {
         let _id = Mongo.toId(id || update._id) || Mongo.newid();
         if (this._hasHashedKeys(update))
             await this._processHashedKeys(update);
+        const inputUpdate = cloneDeep(update);
         update = this._processUpdateObject(update);
         const processed = this._applyBracketProcessing(update);
         if (processed.arrayFilters)
@@ -692,8 +702,8 @@ export class Mongo extends Db {
             let res = await conn.findOneAndUpdate({ _id }, processed.update, opts);
             if (!res)
                 return null;
-            let resObj = isPipeline ? res : this._removeUnchanged(res, update, !!(options === null || options === void 0 ? void 0 : options.returnFullObject));
-            await this._publishAndAudit('update', dbName, collection, resObj);
+            let resObj = this._buildPublishDelta(res, inputUpdate, !!(options === null || options === void 0 ? void 0 : options.returnFullObject));
+            await this._publishAndAudit('update', dbName, collection, resObj, false, inputUpdate);
             return resObj;
         }, !!seqKeys, { operation: "save", collection, _id, update: processed.update, options });
         fjLog.debug('save returns', obj);
@@ -737,6 +747,9 @@ export class Mongo extends Db {
                 n: res.modifiedCount,
                 ok: !!res.acknowledged
             };
+            // No `rawUpdate` for `updateMany` — mongo doesn't return per-doc _id-s,
+            // so the spec is not actionable on the consumer side. Subscribers see
+            // `enquireLastTs: true` on the rev event and refetch via `findNewer*`.
             await this._publishAndAudit('updateMany', dbName, collection, resObj);
             return resObj;
         }, !!seqKeys, { operation: "update", collection, query, update: processed.update });
@@ -761,6 +774,7 @@ export class Mongo extends Db {
         fjLog.debug('upsert called', collection, query, update);
         if (this._hasHashedKeys(update))
             await this._processHashedKeys(update);
+        const inputUpdate = cloneDeep(update);
         update = this._processUpdateObject(update);
         const processed = this._applyBracketProcessing(update);
         if (processed.arrayFilters)
@@ -783,10 +797,12 @@ export class Mongo extends Db {
                 // Detect if this was an insert or update by checking _rev
                 const isInsert = this.revisions && ret._rev === 1;
                 let oper = isInsert ? "insert" : "update";
-                // For inserts, use full record to capture query fields; for updates, only changed fields
-                let retObj = isInsert ? ret : this._removeUnchanged(ret, update, !!(options === null || options === void 0 ? void 0 : options.returnFullObject));
-                await this._publishAndAudit(oper, dbName, collection, retObj);
-                return this._removeUnchanged(ret, update, !!(options === null || options === void 0 ? void 0 : options.returnFullObject));
+                // For inserts, surface the full record (query fields like {a:4} need to land);
+                // for updates, build the de-bracketed delta. rawUpdate is sent on update only —
+                // an insert isn't a delta against a prior state, so the spec adds no signal there.
+                let retObj = isInsert ? ret : this._buildPublishDelta(ret, inputUpdate, !!(options === null || options === void 0 ? void 0 : options.returnFullObject));
+                await this._publishAndAudit(oper, dbName, collection, retObj, false, isInsert ? undefined : inputUpdate);
+                return this._buildPublishDelta(ret, inputUpdate, !!(options === null || options === void 0 ? void 0 : options.returnFullObject));
             }
             ;
             return ret;
@@ -866,9 +882,9 @@ export class Mongo extends Db {
                             update = this.replaceIds(update);
                             if (this._hasHashedKeys(update))
                                 await this._processHashedKeys(update);
+                            const inputUpdate = cloneDeep(update);
                             const processedBase = this._processUpdateObject({ ...update });
                             const processed = this._applyBracketProcessing(processedBase);
-                            const isPipeline = Array.isArray(processed.update);
                             const opts = {
                                 upsert: true,
                                 returnDocument: "after",
@@ -884,12 +900,15 @@ export class Mongo extends Db {
                                 // Determine if this was an insert or update based on lastErrorObject
                                 const wasInsert = !((_a = res.lastErrorObject) === null || _a === void 0 ? void 0 : _a.updatedExisting);
                                 const operation = wasInsert ? 'insert' : 'update';
-                                // For inserts (or pipeline updates) return full object; for regular
-                                // updates, strip fields that didn't change. _removeUnchanged expects
-                                // doc-form update — skip for pipeline.
-                                const retObj = (wasInsert || isPipeline) ? res.value : this._removeUnchanged(res.value, processedBase, false);
+                                // Inserts surface the full doc (query fields must reach the client).
+                                // Updates always go through _buildPublishDelta so bracket keys collapse
+                                // to top-level parent array slices read straight from the post-update
+                                // doc — non-bracket keys keep the legacy literal-key behavior.
+                                const retObj = wasInsert
+                                    ? res.value
+                                    : this._buildPublishDelta(res.value, inputUpdate, false);
                                 this._processReturnedObject(retObj);
-                                return { success: true, _id, data: retObj, operation, wasInsert };
+                                return { success: true, _id, data: retObj, operation, wasInsert, rawUpdate: wasInsert ? undefined : inputUpdate };
                             }
                             return { success: false, _id, error: 'Operation failed' };
                         }
@@ -911,7 +930,11 @@ export class Mongo extends Db {
                             else {
                                 result.results.updated.push(dbEntity);
                             }
-                            batchData.push({ operation: res.operation, data: res.data });
+                            const item = { operation: res.operation, data: res.data };
+                            // rawUpdate is meaningful only for the update branch — inserts publish the full doc.
+                            if (!res.wasInsert)
+                                item.rawUpdate = res.rawUpdate;
+                            batchData.push(item);
                         }
                         else if (!res.success && res.error) {
                             errors.push({ _id: String(res._id), error: res.error });
@@ -1050,11 +1073,11 @@ export class Mongo extends Db {
                 };
                 if (this._hasHashedKeys(update))
                     await this._processHashedKeys(update);
+                const inputUpdate = cloneDeep(update);
                 const processedBase = this._processUpdateObject({ ...update });
                 const processed = this._applyBracketProcessing(processedBase);
                 if (processed.arrayFilters)
                     options.arrayFilters = processed.arrayFilters;
-                const isPipeline = Array.isArray(processed.update);
                 const result = await conn.findOneAndUpdate(query, processed.update, options);
                 if (!((_a = result === null || result === void 0 ? void 0 : result.value) === null || _a === void 0 ? void 0 : _a._id))
                     return null;
@@ -1070,9 +1093,11 @@ export class Mongo extends Db {
                 else {
                     oper = "insert";
                 }
-                const retObj = oper === "insert" ? ret : (isPipeline ? ret : this._removeUnchanged(ret, processedBase, !!(opts === null || opts === void 0 ? void 0 : opts.returnFullObject)));
+                const retObj = oper === "insert"
+                    ? ret
+                    : this._buildPublishDelta(ret, inputUpdate, !!(opts === null || opts === void 0 ? void 0 : opts.returnFullObject));
                 this._processReturnedObject(retObj);
-                return { operation: oper, data: retObj };
+                return { operation: oper, data: retObj, rawUpdate: oper === 'update' ? inputUpdate : undefined };
             });
             const results = await Promise.all(upsertPromises);
             // Filter out nulls and separate batchData and changes
@@ -1080,7 +1105,10 @@ export class Mongo extends Db {
             const changes = [];
             for (const result of results) {
                 if (result) {
-                    batchData.push(result);
+                    const item = { operation: result.operation, data: result.data };
+                    if (result.rawUpdate)
+                        item.rawUpdate = result.rawUpdate;
+                    batchData.push(item);
                     changes.push(result.data);
                 }
             }
@@ -2178,19 +2206,50 @@ export class Mongo extends Db {
         }
         return into;
     }
-    _removeUnchanged(wholerecord, diff, returnFullObject) {
+    /**
+     * Build the publish-data slice for an update result. Bracket paths in
+     * `inputUpdate` are mapped to their top-level parent array field, whose
+     * post-update value is taken straight from `wholerecord` (the document
+     * `findOneAndUpdate` returned with `returnDocument: "after"`). Nothing
+     * is synthesized — we only slice.
+     *
+     * Non-bracket keys keep the legacy literal-key lookup, so a mixed update
+     * like `{ name: 'X', 'arr[id].f': 1 }` still publishes top-level scalars
+     * the way it always has, while bracket-keyed paths now collapse to a
+     * top-level parent slice that downstream consumers can apply directly.
+     *
+     * `inputUpdate` is the user-form snapshot taken AFTER `_processHashedKeys`
+     * and BEFORE `_processUpdateObject` — keys may be in top-level shorthand
+     * (`{ "arr[id]": v }`) or already wrapped in `$set`/`$unset`/etc.
+     */
+    _buildPublishDelta(wholerecord, inputUpdate, returnFullObject) {
         if (returnFullObject)
             return wholerecord;
-        let a = {};
         wholerecord = wholerecord || {};
-        this._getFieldsRecursively(diff).forEach(k => a[k] = wholerecord[k]);
-        if (wholerecord._rev)
-            a._rev = wholerecord._rev;
-        if (wholerecord._ts)
-            a._ts = wholerecord._ts;
-        if (wholerecord._id)
-            a._id = wholerecord._id;
-        return a;
+        const out = {};
+        const keys = this._getFieldsRecursively(inputUpdate);
+        for (const k of keys) {
+            const bracketIdx = k.indexOf('[');
+            if (bracketIdx < 0) {
+                out[k] = wholerecord[k];
+                continue;
+            }
+            // Bracket path: publish the top-level parent field as a whole,
+            // sliced from the post-update document. The "top-level parent" is
+            // everything before the FIRST `.` or `[` separator.
+            const dotIdx = k.indexOf('.');
+            const cutAt = dotIdx >= 0 && dotIdx < bracketIdx ? dotIdx : bracketIdx;
+            const topField = k.substring(0, cutAt);
+            if (topField && !(topField in out))
+                out[topField] = wholerecord[topField];
+        }
+        if (wholerecord._rev != null)
+            out._rev = wholerecord._rev;
+        if (wholerecord._ts != null)
+            out._ts = wholerecord._ts;
+        if (wholerecord._id != null)
+            out._id = wholerecord._id;
+        return out;
     }
     _shouldAuditCollection(db, col) {
         if (!this.auditing)
@@ -2198,7 +2257,7 @@ export class Mongo extends Db {
         const fullName = ((db ? db + "." : "") + (col || "")).toLowerCase();
         return this.auditedCollectionsLower.some(m => fullName.includes(m));
     }
-    async _publishAndAudit(operation, db, collection, dataToPublish, noEmit) {
+    async _publishAndAudit(operation, db, collection, dataToPublish, noEmit, rawUpdate) {
         if (!dataToPublish._id && !["deleteMany", "updateMany"].includes(operation))
             throw new Error(`_publishAndAudit requires _id for ${operation}`);
         let data = cloneDeep(dataToPublish);
@@ -2212,7 +2271,7 @@ export class Mongo extends Db {
         let toPublishAll = [];
         this._processReturnedObject(data, this._findNewerRemoveFields);
         if (this.emittingPublishEvents && data) {
-            const toPublish = this._makeDataPublication(db, collection, data, operation);
+            const toPublish = this._makeDataPublication(db, collection, data, operation, rawUpdate);
             if (toPublish) {
                 if (!noEmit)
                     this.emit("publish", toPublish);
@@ -2233,15 +2292,18 @@ export class Mongo extends Db {
         }
         return toPublishAll;
     }
-    _makeDataPublication(db, collection, data, operation) {
+    _makeDataPublication(db, collection, data, operation, rawUpdate) {
+        const payload = {
+            db,
+            collection,
+            operation,
+            data,
+        };
+        if (rawUpdate)
+            payload.rawUpdate = rawUpdate;
         let toPublish = {
             channel: `db/${db}/${collection}${data._id ? "/" + data._id.toString() : ""}`,
-            payload: {
-                db,
-                collection,
-                operation,
-                data,
-            }
+            payload: payload,
         };
         if (data && data._auth)
             toPublish.user = data._auth.username;
@@ -2585,21 +2647,25 @@ export class Mongo extends Db {
         return id;
     }
     /**
-     * Pre-processing pass that VALIDATES and AUTO-FILLS element `_id` for terminal
-     * bracket-id paths in `$set` whose value is an object (replace) or array of
-     * objects (insert).
+     * Pre-processing pass that VALIDATES element `_id` for terminal bracket-id
+     * paths in `$set` whose value is an object (replace) or array of objects
+     * (insert).
      *
-     * Three rules enforced:
+     * Two rules enforced:
      *   1) `_id` in brackets must be non-empty            (empty → throw via `_unquoteBracketId`)
-     *   2) `_id` in brackets must equal element's `_id`   (mismatch → throw, prevents data corruption)
-     *   3) element `_id` may be omitted                   (auto-fill from bracket id)
+     *   2) every element MUST carry an `_id` that equals the bracket id
+     *      (missing or mismatched → throw, prevents data corruption / silent renaming)
      *
-     * Mutates element objects in place (auto-fill). Throws on rule 1/2 violation.
-     * Skips primitive values (caller knows what they're doing) and `null` (rare,
-     * not a typical insert/replace shape).
+     * Throws on violation. Skips primitive values (caller knows what they're
+     * doing) and `null` (rare, not a typical insert/replace shape).
      *
      * Called BEFORE `_extractArrayInserts`/`_extractArrayRemoves`/`_extractArrayFilters`
-     * so downstream code can assume validated/filled element `_id`.
+     * so downstream code can assume every element has an `_id`.
+     *
+     * Note: auto-fill of missing `_id` from the bracket id was previously supported
+     * but was removed because it hid client bugs (e.g. constructing an insert with
+     * the wrong field name and silently writing an element identified by the bracket).
+     * Always set `_id` explicitly on the client.
      */
     _validateAndAutoFillTerminalBracketValues(update) {
         const $set = update.$set;
@@ -2630,10 +2696,10 @@ export class Mongo extends Db {
                     throw new Error(`cry-db: bracket-id terminal at "${path}"${locator} — value must be an object with _id matching bracket id "${bracketId}" (got ${el === null ? 'null' : typeof el}).`);
                 }
                 if (el._id == null) {
-                    el._id = bracketId; // auto-fill rule 3
+                    throw new Error(`cry-db: bracket-id terminal at "${path}"${locator} — element is missing _id. Set it explicitly to "${bracketId}" (auto-fill is no longer supported).`);
                 }
-                else if (String(el._id) !== bracketId) {
-                    throw new Error(`cry-db: bracket-id terminal at "${path}"${locator} — element _id "${el._id}" does not match bracket id "${bracketId}". Either omit element _id (auto-filled from bracket) or align both.`);
+                if (String(el._id) !== bracketId) {
+                    throw new Error(`cry-db: bracket-id terminal at "${path}"${locator} — element _id "${el._id}" does not match bracket id "${bracketId}".`);
                 }
             };
             if (Array.isArray(value)) {
@@ -2780,11 +2846,234 @@ export class Mongo extends Db {
             delete update.$unset;
         return Array.from(removesByField.entries()).map(([field, ids]) => ({ field, ids }));
     }
+    /**
+     * Extracts SINGLE-bracket bracket-by-_id paths from `$set`/`$unset`, grouped
+     * by `(parentArrayField, elementId)`. Used when pipeline form is needed
+     * (because terminal-bracket inserts/removes are present) — these paths must
+     * be expressed as `$map` + `$mergeObjects` stages, since mongo does not
+     * allow `arrayFilters` to coexist with aggregation pipelines.
+     *
+     * Path forms detected (mutated out of `$set`/`$unset`):
+     *   - `$set` `arr[id].field`           → sets["field"] = value     (sub-field set)
+     *   - `$set` `arr[id].sub.field`       → sets["sub.field"] = value (deep sub-field set)
+     *   - `$set` `arr[id]` (object value)  → replace = value           (whole-element replace)
+     *   - `$unset` `arr[id].field`         → unsets.push("field")      (sub-field unset)
+     *
+     * NOT detected (left in `$set`/`$unset` for caller to handle):
+     *   - paths with NESTED brackets (e.g. `arr[A].sub[B].field`) — caller must
+     *     reject these when in pipeline mode (still unsupported).
+     *   - terminal `arr[id]` already removed by `_extractArrayInserts`/`_extractArrayRemoves`.
+     *
+     * Mutates `update.$set` and `update.$unset`. Returns the grouped ops, or
+     * `undefined` if no extractable paths were present.
+     */
+    _extractArraySubFieldUpdates(update) {
+        const result = new Map();
+        let extractedAny = false;
+        const ensureEntry = (parentField, id) => {
+            if (!result.has(parentField))
+                result.set(parentField, new Map());
+            const idMap = result.get(parentField);
+            if (!idMap.has(id))
+                idMap.set(id, { sets: {}, unsets: [] });
+            return idMap.get(id);
+        };
+        const processOp = (opName) => {
+            const op = update[opName];
+            if (!op || typeof op !== 'object')
+                return;
+            let hasBracket = false;
+            for (const k of Object.keys(op)) {
+                if (k.indexOf('[') >= 0) {
+                    hasBracket = true;
+                    break;
+                }
+            }
+            if (!hasBracket)
+                return;
+            const remaining = {};
+            let mutated = false;
+            for (const path of Object.keys(op)) {
+                const tokens = Mongo._tokenizePath(path);
+                let bracketCount = 0;
+                let bracketIdx = -1;
+                for (let i = 0; i < tokens.length; i++) {
+                    const t = tokens[i];
+                    if (t.length >= 2 && t.charCodeAt(0) === 91 /* [ */ && t.charCodeAt(t.length - 1) === 93 /* ] */) {
+                        bracketCount++;
+                        bracketIdx = i;
+                    }
+                }
+                if (bracketCount === 1 && bracketIdx > 0) {
+                    const parentField = tokens.slice(0, bracketIdx).join('.');
+                    const id = Mongo._unquoteBracketId(tokens[bracketIdx], path);
+                    const restPath = tokens.slice(bracketIdx + 1).join('.');
+                    const elOps = ensureEntry(parentField, id);
+                    if (opName === '$set') {
+                        if (restPath === '') {
+                            // `arr[id]: <obj>` — whole-element replace.
+                            elOps.replace = op[path];
+                        }
+                        else {
+                            elOps.sets[restPath] = op[path];
+                        }
+                    }
+                    else {
+                        // `$unset arr[id].field` — sub-field unset. Terminal `$unset arr[id]`
+                        // is already extracted by `_extractArrayRemoves`.
+                        if (restPath === '') {
+                            remaining[path] = op[path];
+                            continue;
+                        }
+                        elOps.unsets.push(restPath);
+                    }
+                    mutated = true;
+                    extractedAny = true;
+                    continue;
+                }
+                remaining[path] = op[path];
+            }
+            if (mutated) {
+                update[opName] = remaining;
+                if (Object.keys(remaining).length === 0)
+                    delete update[opName];
+            }
+        };
+        processOp('$set');
+        processOp('$unset');
+        return extractedAny ? result : undefined;
+    }
+    /**
+     * Build an aggregation expression that produces a transformed copy of an
+     * element, applying the given sets/unsets and (optionally) a whole-element
+     * replacement.
+     *
+     * - `replace`: when set, becomes the new base (full element replacement).
+     * - `sets`: dot-paths within element → values; deep-merged via recursive
+     *   `$mergeObjects`/`$ifNull` so nested updates preserve sibling fields.
+     * - `unsets`: dot-paths within element to remove. Implemented via
+     *   `$arrayToObject($filter($objectToArray(merged), kv.k notIn unsets))` —
+     *   `$$REMOVE` inside `$mergeObjects` does NOT drop the field (mongo treats
+     *   it as a missing value and falls through to the previous operand), so
+     *   the explicit kv-filter is required.
+     *
+     * The returned expression is suitable as the `in:` argument of `$map`.
+     */
+    static _buildElementMergeExpr(baseExpr, ops) {
+        const hasSets = Object.keys(ops.sets).length > 0;
+        const hasUnsets = ops.unsets.length > 0;
+        const hasReplace = ops.replace !== undefined;
+        if (!hasSets && !hasUnsets && !hasReplace)
+            return baseExpr;
+        if (!hasSets && !hasUnsets) {
+            // Pure replace — embed as literal so client-supplied field names like
+            // "_id" don't get interpreted as field paths.
+            return { $literal: ops.replace };
+        }
+        const root = { directs: {}, nested: {}, unsets: [] };
+        const walkInsert = (path, isUnset, value) => {
+            const parts = path.split('.');
+            let node = root;
+            for (let i = 0; i < parts.length - 1; i++) {
+                const key = parts[i];
+                if (!node.nested[key])
+                    node.nested[key] = { directs: {}, nested: {}, unsets: [] };
+                node = node.nested[key];
+            }
+            const leaf = parts[parts.length - 1];
+            if (isUnset)
+                node.unsets.push(leaf);
+            else
+                node.directs[leaf] = value;
+        };
+        for (const [p, v] of Object.entries(ops.sets))
+            walkInsert(p, false, v);
+        for (const p of ops.unsets)
+            walkInsert(p, true);
+        // Recursively build merge expression. `basePath` is a string field path
+        // (e.g. "$$el", "$$el.sub") used to read the existing nested value.
+        const buildOverlay = (node, basePath) => {
+            const overlay = {};
+            for (const [k, v] of Object.entries(node.directs))
+                overlay[k] = v;
+            for (const [k, sub] of Object.entries(node.nested)) {
+                const subPath = `${basePath}.${k}`;
+                overlay[k] = buildOverlay(sub, subPath);
+            }
+            // Merge sets/nested onto the existing object (or {} if absent).
+            let merged = { $mergeObjects: [{ $ifNull: [basePath, {}] }, overlay] };
+            // Drop unset top-level keys at this level via kv-filter.
+            if (node.unsets.length > 0) {
+                merged = {
+                    $arrayToObject: {
+                        $filter: {
+                            input: { $objectToArray: merged },
+                            as: 'kv',
+                            cond: { $not: { $in: ['$$kv.k', node.unsets] } },
+                        },
+                    },
+                };
+            }
+            return merged;
+        };
+        // If a replace is also requested, treat replacement as the new base.
+        // Wrap with `$let` since a literal object isn't addressable by string field path.
+        if (hasReplace) {
+            const overlayExpr = buildOverlay(root, '$$replaced');
+            return {
+                $let: {
+                    vars: { replaced: { $literal: ops.replace } },
+                    in: overlayExpr,
+                },
+            };
+        }
+        return buildOverlay(root, baseExpr);
+    }
+    /**
+     * Translate an update doc's `$inc` and `$currentDate` operators into
+     * pipeline-stage equivalents, so revisions (`_rev` increment, `_ts` timestamp)
+     * still fire when the rest of the update goes through aggregation pipeline.
+     *
+     *   - `$inc: { f: n }`               → `{ $set: { f: { $add: [{ $ifNull: ['$f', 0] }, n] } } }`
+     *   - `$currentDate: { f: true }`    → `{ $set: { f: '$$NOW' } }`              (Date)
+     *   - `$currentDate: { f: { $type: 'date' } }`      → same as above
+     *   - `$currentDate: { f: { $type: 'timestamp' } }` → `{ $set: { f: '$$CLUSTER_TIME' } }` (Timestamp)
+     *
+     * Mutates `update` (deletes `$inc` and `$currentDate`). Returns 0..2 pipeline stages.
+     */
+    static _drainIncAndCurrentDateToPipelineStages(update) {
+        const stages = [];
+        const inc = update.$inc;
+        if (inc && typeof inc === 'object') {
+            const setObj = {};
+            for (const [k, v] of Object.entries(inc)) {
+                setObj[k] = { $add: [{ $ifNull: [`$${k}`, 0] }, v] };
+            }
+            if (Object.keys(setObj).length > 0)
+                stages.push({ $set: setObj });
+            delete update.$inc;
+        }
+        const cd = update.$currentDate;
+        if (cd && typeof cd === 'object') {
+            const setObj = {};
+            for (const [k, spec] of Object.entries(cd)) {
+                let isTimestamp = false;
+                if (spec && typeof spec === 'object' && spec.$type === 'timestamp')
+                    isTimestamp = true;
+                setObj[k] = isTimestamp ? '$$CLUSTER_TIME' : '$$NOW';
+            }
+            if (Object.keys(setObj).length > 0)
+                stages.push({ $set: setObj });
+            delete update.$currentDate;
+        }
+        return stages;
+    }
     /**
      * Combined bracket-path processing: extracts inserts (`arr[id]: [els]`),
-     * removes (`arr[id]: undefined` → `$unset`), and arrayFilters (`arr[id].field = X`).
-     * Decides whether mongo update should be sent as a regular doc or as an aggregation
-     * pipeline.
+     * removes (`arr[id]: undefined` → `$unset`), sub-field updates
+     * (`arr[id].field`, `arr[id].sub.field`, `arr[id]: <obj>`) and arrayFilters.
+     * Decides whether mongo update should be sent as a regular doc or as an
+     * aggregation pipeline.
      *
      * Returns `{ update, arrayFilters? }`:
      *   - `update` is the original update doc OR an aggregation pipeline.
@@ -2794,13 +3083,17 @@ export class Mongo extends Db {
      * Strategy matrix:
      *   - no inserts, no removes → existing arrayFilters path (or pure update doc)
      *   - removes only           → adds `$pull` to update doc; arrayFilters allowed
-     *   - inserts (± removes)    → pipeline form with unified `$filter + $concatArrays`
-     *                              per parent field; arrayFilters NOT allowed (throws)
+     *   - inserts (± removes)    → pipeline form; SINGLE-bracket sub-field paths
+     *                              are also translated to pipeline `$map` + `$mergeObjects`
+     *                              so they coexist with the inserts. NESTED-bracket paths
+     *                              (e.g. `arr[A].sub[B].field`) combined with inserts still
+     *                              throw — caller must split into two operations.
      *
-     * The unified pipeline stage atomically filters out elements matching any of
-     * the (removeIds ∪ insertIds), then appends new elements. This makes inserts
-     * idempotent (re-inserting same _id no-ops) and combines remove+insert without
-     * race window.
+     * The unified per-parent-field pipeline stage atomically filters out elements
+     * matching any of (removeIds ∪ insertIds), maps remaining elements through the
+     * sub-field merge expression, then appends new elements. Inserts remain
+     * idempotent (re-inserting same `_id` no-ops). `$inc` and `$currentDate` are
+     * also translated to pipeline stages so revisions (`_rev`/`_ts`) still fire.
      */
     _applyBracketProcessing(update) {
         // Pre-pass: validate bracket-id ↔ element-_id consistency, auto-fill missing _id.
@@ -2808,8 +3101,10 @@ export class Mongo extends Db {
         this._validateAndAutoFillTerminalBracketValues(update);
         const inserts = this._extractArrayInserts(update);
         const removes = this._extractArrayRemoves(update);
-        const arrayFilters = this._extractArrayFilters(update);
+        // Pure sub-field updates only (no inserts, no removes) — keep on legacy
+        // arrayFilters path (faster, smaller payload, doesn't fight $inc/$currentDate).
         if (!inserts && !removes) {
+            const arrayFilters = this._extractArrayFilters(update);
             return arrayFilters ? { update, arrayFilters } : { update };
         }
         // Removes-only path: `$pull` on update doc. Coexists fine with `$set` + arrayFilters.
@@ -2826,32 +3121,60 @@ export class Mongo extends Db {
                 }
             }
             update.$pull = pullOp;
+            const arrayFilters = this._extractArrayFilters(update);
             return arrayFilters ? { update, arrayFilters } : { update };
         }
         // Inserts present (± removes) → pipeline form.
-        if (arrayFilters) {
-            throw new Error('cry-db: cannot combine bracket-by-_id sub-field updates (e.g. `arr[id].field`) with terminal-bracket array inserts (e.g. `arr[id]: [<elements>]`) in the same update. Pipeline form does not support arrayFilters. Split into two separate updateOne/save calls.');
+        // Extract single-bracket sub-field paths so we can express them as pipeline
+        // stages instead of arrayFilters (mongo forbids arrayFilters on pipelines).
+        const subFieldOps = this._extractArraySubFieldUpdates(update);
+        // Any bracket paths still in $set/$unset must be NESTED-bracket
+        // (e.g. `arr[A].sub[B].field`) — those aren't expressible without arrayFilters,
+        // so combining them with inserts is still unsupported.
+        const hasNestedBracket = (op) => {
+            if (!op)
+                return false;
+            for (const k of Object.keys(op))
+                if (k.indexOf('[') >= 0)
+                    return true;
+            return false;
+        };
+        if (hasNestedBracket(update.$set) || hasNestedBracket(update.$unset)) {
+            throw new Error('cry-db: cannot combine NESTED-bracket sub-field paths (e.g. `arr[A].sub[B].field`) with terminal-bracket array inserts (e.g. `arr[id]: [<elements>]`) in the same update. Split into two separate updateOne/save calls.');
         }
-        // Group inserts AND removes per parent field — they share one filter+concat stage.
-        // Insert elements implicitly remove existing same-_id entries first (idempotency).
         const fieldOps = new Map();
+        const ensureField = (field) => {
+            if (!fieldOps.has(field))
+                fieldOps.set(field, { removeIds: [], insertElements: [], elementOps: new Map() });
+            return fieldOps.get(field);
+        };
         if (inserts) {
             for (const ins of inserts) {
-                if (!fieldOps.has(ins.field))
-                    fieldOps.set(ins.field, { removeIds: [], insertElements: [] });
-                const ops = fieldOps.get(ins.field);
+                const ops = ensureField(ins.field);
                 ops.removeIds.push(...ins.ids);
                 ops.insertElements.push(...ins.elements);
             }
         }
         if (removes) {
             for (const rm of removes) {
-                if (!fieldOps.has(rm.field))
-                    fieldOps.set(rm.field, { removeIds: [], insertElements: [] });
-                const ops = fieldOps.get(rm.field);
+                const ops = ensureField(rm.field);
                 ops.removeIds.push(...rm.ids);
             }
         }
+        if (subFieldOps) {
+            for (const [field, idMap] of subFieldOps.entries()) {
+                const ops = ensureField(field);
+                for (const [id, elOps] of idMap.entries()) {
+                    // If an insert with the same id is also queued, the insert wins
+                    // (insertElements are already extracted; element merge would only
+                    // affect "existing" rows that survive the filter — but the insert
+                    // id is in removeIds, so it's filtered out anyway). Keep the
+                    // sub-field update so callers that mix these get predictable
+                    // behavior on existing data; it's a no-op if id ends up filtered.
+                    ops.elementOps.set(id, elOps);
+                }
+            }
+        }
         const pipeline = [];
         if (update.$set && Object.keys(update.$set).length > 0) {
             pipeline.push({ $set: update.$set });
@@ -2859,21 +3182,40 @@ export class Mongo extends Db {
         if (update.$unset && Object.keys(update.$unset).length > 0) {
             pipeline.push({ $unset: Object.keys(update.$unset) });
         }
+        // Translate $inc / $currentDate so revisions (_rev/_ts) still update in pipeline form.
+        for (const stage of Mongo._drainIncAndCurrentDateToPipelineStages(update))
+            pipeline.push(stage);
         for (const [field, ops] of fieldOps.entries()) {
             const dedupedRemoveIds = Array.from(new Set(ops.removeIds));
+            const filteredInput = {
+                $filter: {
+                    input: { $ifNull: [`$${field}`, []] },
+                    as: 'el',
+                    cond: { $not: { $in: ['$$el._id', dedupedRemoveIds] } },
+                },
+            };
+            let mappedExisting = filteredInput;
+            if (ops.elementOps.size > 0) {
+                // Build $switch with one branch per (id → merged element).
+                const branches = [];
+                for (const [id, elOps] of ops.elementOps.entries()) {
+                    branches.push({
+                        case: { $eq: ['$$el._id', id] },
+                        then: Mongo._buildElementMergeExpr('$$el', elOps),
+                    });
+                }
+                mappedExisting = {
+                    $map: {
+                        input: filteredInput,
+                        as: 'el',
+                        in: { $switch: { branches, default: '$$el' } },
+                    },
+                };
+            }
             pipeline.push({
                 $set: {
                     [field]: {
-                        $concatArrays: [
-                            {
-                                $filter: {
-                                    input: { $ifNull: [`$${field}`, []] },
-                                    as: 'el',
-                                    cond: { $not: { $in: ['$$el._id', dedupedRemoveIds] } },
-                                },
-                            },
-                            ops.insertElements,
-                        ],
+                        $concatArrays: [mappedExisting, ops.insertElements],
                     },
                 },
             });