@push.rocks/smartdb 4.1.0 → 5.0.1

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartdb',
-    version: '4.1.0',
+    version: '5.0.1',
     description: 'A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxxQkFBcUI7SUFDM0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHFIQUFxSDtDQUNuSSxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdb",
-  "version": "4.1.0",
+  "version": "5.0.1",
   "private": false,
   "description": "A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.",
   "exports": {

package/readme.hints.md

@@ -1,5 +1,19 @@
 # smartdb hints
 
+## Restricted Deny-All Views
+
+- `rustdb-commands/src/views.rs` is the sole owner of `system.views` parsing, bounds, canonical `_id_` metadata validation, exact deny-all pipeline validation, and authoritative namespace classification. There is intentionally no mutable cross-command view cache; aggregate and transaction commit reuse one immutable authoritative catalog per database for that operation.
+- The only accepted definition is `viewOn: <same-db collection name>` plus exact pipeline `[{ $match: { $expr: { $eq: [1, 0] } } }]`. A logical view has no physical collection and never reads `viewOn`.
+- `system.views` is a physical reserved catalog. It is visible as a collection in wire `listCollections`, export, import, and content digest, but command-layer `IndexEngine` creation and direct wire access are forbidden. Internal view create/drop uses storage point insert/delete and preserves the storage adapter's canonical `_id` metadata.
+- Catalog loading is bounded to 1,024 view records and 1 MiB of encoded view documents and never enumerates all physical collections. Runtime validation checks each bounded logical name with `collection_exists`; snapshot/import validation uses its already-provided physical-name set without adding a runtime collection ceiling. Exact document shape is `_id`, `viewOn`, and `pipeline`; malformed records, noncanonical indexes, duplicate/reserved names, and physical/view collisions fail closed.
+- Publication permits validate once per newly observed publication state; databases without an epoch use an internal observed sentinel. Epoch refresh validates before recording the new observation. Startup validates databases whose publication lease can be acquired before listener bind; publication-held databases are validated on their first later permit. Snapshot/export explicitly revalidate. Import validates the source candidate, remaps only the exact source database prefix in catalog `_id` values, then validates the target candidate before mutation and clears its observed state after replacement.
+- Content digest hashes the physical catalog but removes its already-validated deterministic database prefix from `_id` first, preserving the database-name-independent digest contract across cross-name imports.
+- DDL and transaction commit take the maintenance write gate. View create/drop additionally lock the logical target and `${db}.system.views` in sorted order. View DDL validates the complete prospective catalog and performs cursor/index cleanup before its final point insert/delete, so cancellation cannot publish catalog state without cleanup. Commit locks every touched namespace in sorted order, loads one catalog per touched database, reclassifies each namespace, and transfers those guards into the storage completion closure.
+- Mutation handlers reclassify after acquiring their target namespace lock and before existence, auto-create, or lazy-index work. Logical-view data/index/output/rename mutations and direct `system.views` operations return `CommandNotSupportedOnView` code 166; `dropCollection` removes a logical view, while direct catalog drop remains forbidden. Ordinary create collision with a logical view returns `NamespaceExists`.
+- Find/count/distinct are empty outside a transaction, aggregate applies the client pipeline to an empty source, and lookup/union resolution is empty. A transaction first reading a current view snapshots an empty vector, while a populated snapshot captured before a rename-plus-view transition remains authoritative for find/count/distinct until commit revalidation. Do not infer view semantics from physical collection absence.
+- Successful create/drop/rename/dropDatabase publication removes affected namespace cursors before releasing DDL guards. A subsequent `getMore` cannot continue against stale namespace contents.
+- Management oplog revert rejects entries targeting `system.views` or a currently logical view. Logical-view `dropCollection` and whole-database drop are the catalog-removal exceptions; direct `system.views` drop is code 166. Database drop clears database indexes, cursors, oplog state, and observed publication state.
+
 ## Multikey Query Planning
 
 - SmartDB detects when an indexed path resolves through an array and keeps that state on the in-memory index until a complete rebuild.

package/readme.md

@@ -458,9 +458,9 @@ Grant principals can read only their exact allocation database. Reads, collectio
 
 `revokeDatabaseAllocationReadAccessGrant()` takes `databaseName`, `grantId`, and the complete allocation identity, returns `{ revoked: true }` without a secret, and is idempotent. Revoke-before-issue records anti-replay state only while a read permit proves that exact allocation is current. A delayed revoke after deprovision returns success without recreating auth metadata.
 
-`exportDatabase()` drains live MongoDB wire commands for the selected database and holds an exclusive local and cross-process database lease while producing the snapshot. The export is therefore consistent across all collections. It enforces server ceilings while visiting documents instead of first materializing an unbounded database; callers can request lower `maxEncodedBytes`, `maxCollections`, `maxDocuments`, and `maxIndexes` limits. The result emits canonical MongoDB Extended JSON so every BSON type, including 64-bit integers, survives the JSON management channel exactly. `importDatabase()` accepts canonical or relaxed Extended JSON. Database migration clients should preserve the exported objects as JSON values and must not coerce Extended JSON numeric wrappers into JavaScript numbers.
+`exportDatabase()` drains live MongoDB wire commands for the selected database and holds an exclusive local and cross-process database lease while producing the snapshot. The export is therefore consistent across all collections. It enforces server ceilings while visiting documents instead of first materializing an unbounded database; callers can request lower `maxEncodedBytes`, `maxCollections`, `maxDocuments`, and `maxIndexes` limits. The result emits canonical MongoDB Extended JSON so every BSON type, including 64-bit integers, survives the JSON management channel exactly. Restricted views are carried only through the physical `system.views` catalog and are never materialized. `importDatabase()` accepts canonical or relaxed Extended JSON, validates a candidate catalog before mutation, and remaps exact `system.views._id` source-database prefixes when importing under another database name. Database migration clients should preserve the exported objects as JSON values and must not coerce Extended JSON numeric wrappers into JavaScript numbers.
 
-`getDatabaseContentDigest()` computes a bounded, database-name-independent SHA-256 over collection names, exact BSON document bytes, and persisted index specifications. Collection, document, and index enumeration order is normalized; BSON field order and compound-index key order remain significant. `ISmartDbGetDatabaseContentDigestInput` accepts `databaseName` and optional `ISmartDbDatabaseContentDigestLimits` fields `maxScannedBsonBytes`, `maxCollections`, `maxDocuments`, and `maxIndexes`. Callers may lower the server ceilings of 96 MiB scanned BSON, 10,000 collections, 1,000,000 documents, and 100,000 indexes. The `ISmartDbDatabaseContentDigest` result reports format `smartdb.database.content-digest.v1`, algorithm `sha256`, the lowercase digest, and exact scan counters.
+`getDatabaseContentDigest()` computes a bounded, database-name-independent SHA-256 over collection names, exact BSON document bytes, and persisted index specifications. Collection, document, and index enumeration order is normalized; BSON field order and compound-index key order remain significant. The physical `system.views` catalog is included, with only its already-validated deterministic database prefix removed from `_id` for hashing so a cross-name import retains the same digest. `ISmartDbGetDatabaseContentDigestInput` accepts `databaseName` and optional `ISmartDbDatabaseContentDigestLimits` fields `maxScannedBsonBytes`, `maxCollections`, `maxDocuments`, and `maxIndexes`. Callers may lower the server ceilings of 96 MiB scanned BSON, 10,000 collections, 1,000,000 documents, and 100,000 indexes. The `ISmartDbDatabaseContentDigest` result reports format `smartdb.database.content-digest.v1`, algorithm `sha256`, the lowercase digest, and exact scan counters.
 
 `SmartdbServer.start()` and the lifecycle-critical health, fence-state, digest, export, import, publication-commit, tenant-allocation, tenant-attestation, tenant-ensure, tenant-delete, read-grant issue, and read-grant revoke methods accept optional `ISmartDbManagementOperationOptions` with `signal?: AbortSignal` and `timeoutMs?: number`. `timeoutMs`, when provided, must be a positive safe integer no greater than `2,147,483,647`. Startup applies both cancellation and one deadline across legacy storage migration, sidecar spawn, auth metadata migration, and database readiness. Cancellation and deadlines are fail-stop once the sidecar is owned: SmartDB attempts to terminate the Rust engine before rejecting. Once termination is confirmed, the operation cannot continue after the caller releases ownership. If termination itself fails, the rejection retains bridge ownership and the service owner must retry `stop()` until it succeeds. After cancellation or deadline termination, restart SmartDB before accepting more traffic.
 
@@ -762,10 +762,62 @@ await admin.ping();
 await admin.serverStatus();
 ```
 
-SmartDB creates ordinary collections only. Unsupported collection semantics,
-including views, capped collections, validators, collation, time-series
-collections, clustered indexes, and encrypted fields, are rejected before the
-database or namespace is created.
+SmartDB creates ordinary collections and one deliberately restricted view form.
+Capped collections, validators, collation, time-series collections, clustered
+indexes, encrypted fields, and all general view pipelines remain unsupported and
+are rejected before the database or namespace is created.
+
+### Restricted Deny-All Views
+
+The only accepted view definition is the exact deny-all pipeline below. This is
+intended for compatibility barriers such as renaming a legacy source and leaving
+its old namespace present but permanently empty:
+
+```typescript
+await db.collection('secrets').rename('secrets_v2');
+await db.createCollection('secrets', {
+  viewOn: 'secrets_v2',
+  pipeline: [{ $match: { $expr: { $eq: [1, 0] } } }],
+});
+```
+
+Both `viewOn` and `pipeline` are required. The pipeline must contain exactly one
+`$match` stage with exactly `$expr: { $eq: [1, 0] }`; empty pipelines, numeric or
+structural variants, additional stages, and additional collection-definition
+options are rejected with `InvalidOptions` (code 72) before mutation. Command
+metadata such as `$db`, `lsid`, `comment`, and API-version fields remains
+accepted. `viewOn` must identify an existing same-database collection or
+restricted view at creation time. General MongoDB views are not supported.
+
+The logical view has no physical collection. `find`, `count`, and `distinct`
+return empty results. `aggregate` starts with an empty source and still applies
+the client pipeline; `$lookup` and `$unionWith` resolve the view as empty.
+Transactions first reading a current view record an explicit empty snapshot; a
+transaction that captured a populated collection before it is renamed and
+replaced by a view keeps that original snapshot for `find`, `count`, and
+`distinct` until commit conflict handling. Inserts, updates, deletes,
+`findAndModify`, indexes, `$out`, `$merge`, rename, and other data mutations fail
+with `CommandNotSupportedOnView` (code 166). `dropCollection` is the supported
+DDL exception for removing a logical restricted view.
+
+Definitions are persisted in the physical `system.views` catalog. As in MongoDB,
+`listCollections` lists `system.views` as a physical storage collection and the
+logical namespace as type `view` with `{ viewOn, pipeline }`, read-only metadata,
+and no `idIndex`. `system.views` is reserved from direct wire reads,
+writes, index operations, create, drop, rename, and aggregation output. Whole
+database drop and trusted database export/import/digest operations handle it as
+physical catalog data. Export never materializes a view; cross-database import
+remaps the exact catalog `_id` database prefix. Startup validates databases whose
+publication lease can be acquired before listener bind; a publication-held
+database is validated on its first permit after release. Import validates before
+mutation. Malformed, oversized, noncanonical, duplicate, reserved, or colliding
+catalog state fails closed.
+
+`system.views` was not interpreted by earlier SmartDB releases. This reservation
+is a major-version compatibility boundary: before upgrading, operators must use
+the older release to rename or remove any unrelated physical `system.views`
+collection. Once upgraded, direct catalog rename or drop is intentionally
+rejected with code 166.
 
 ### Bulk Operations
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdb',
-  version: '4.1.0',
+  version: '5.0.1',
   description: 'A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.'
 }