@push.rocks/smartdb 5.2.2 → 5.2.3

package/dist_rust/rustdb_linux_amd64.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "b585eaae112a1eec36542e1e80410744695543cef34191d03de002ac215c8bd8",
+  "binarySha256": "5540a957900ae9ffb3c4ac119e61b508126143e6db827208f8d4555180569a72",
   "buildInfo": {
     "projectName": "@push.rocks/smartdb",
-    "projectVersion": "5.2.2",
-    "gitCommit": "08f85430fb5272560782a39019414511a0cfedba",
+    "projectVersion": "5.2.3",
+    "gitCommit": "b09765bbcdf06fe4be46005a63c22be532d7bfa2",
     "gitDirty": false,
-    "builtAt": "2026-08-21T06:39:21.040Z",
+    "builtAt": "2026-08-22T22:52:46.361Z",
     "tsrustVersion": "1.10.0",
     "binary": "rustdb",
     "target": "linux_amd64"

package/dist_rust/rustdb_linux_arm64.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "a40dedd961feb9bcc0cb13f45e280ef0d8d2d819697d612023c9a3990fb51cc4",
+  "binarySha256": "81eccfcdbbb51956608e04a3dbac5a13278ea45ad73b756083d614693120b6ba",
   "buildInfo": {
     "projectName": "@push.rocks/smartdb",
-    "projectVersion": "5.2.2",
-    "gitCommit": "08f85430fb5272560782a39019414511a0cfedba",
+    "projectVersion": "5.2.3",
+    "gitCommit": "b09765bbcdf06fe4be46005a63c22be532d7bfa2",
     "gitDirty": false,
-    "builtAt": "2026-08-21T06:39:59.105Z",
+    "builtAt": "2026-08-22T22:53:24.138Z",
     "tsrustVersion": "1.10.0",
     "binary": "rustdb",
     "target": "linux_arm64"

package/dist_rust/rustdb_macos_amd64.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "125f06fb8af9bdc5194ba9772344730aec39a3bd7f1b83c8419a26391649bf2a",
+  "binarySha256": "ada67fe412512c8f3a1654f161278a86f4734d07fc45a1229f37d5e90d27de03",
   "buildInfo": {
     "projectName": "@push.rocks/smartdb",
-    "projectVersion": "5.2.2",
-    "gitCommit": "08f85430fb5272560782a39019414511a0cfedba",
+    "projectVersion": "5.2.3",
+    "gitCommit": "b09765bbcdf06fe4be46005a63c22be532d7bfa2",
     "gitDirty": false,
-    "builtAt": "2026-08-21T06:41:11.089Z",
+    "builtAt": "2026-08-22T22:54:32.399Z",
     "tsrustVersion": "1.10.0",
     "binary": "rustdb",
     "target": "macos_amd64"

package/dist_rust/rustdb_macos_arm64.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "2c7bc50ca344c883d1039886e509be8d945bc85bc16f6dbbadae7d39084ee9cb",
+  "binarySha256": "0b953034b6a3c24ed9bbb0c5e6d3500be88b76c3c6bca8765549edddb81ebdd1",
   "buildInfo": {
     "projectName": "@push.rocks/smartdb",
-    "projectVersion": "5.2.2",
-    "gitCommit": "08f85430fb5272560782a39019414511a0cfedba",
+    "projectVersion": "5.2.3",
+    "gitCommit": "b09765bbcdf06fe4be46005a63c22be532d7bfa2",
     "gitDirty": false,
-    "builtAt": "2026-08-21T06:41:51.892Z",
+    "builtAt": "2026-08-22T22:55:12.046Z",
     "tsrustVersion": "1.10.0",
     "binary": "rustdb",
     "target": "macos_arm64"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartdb',
-    version: '5.2.2',
+    version: '5.2.3',
     description: 'A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxxQkFBcUI7SUFDM0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHFIQUFxSDtDQUNuSSxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdb",
-  "version": "5.2.2",
+  "version": "5.2.3",
   "private": false,
   "description": "A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.",
   "exports": {

package/readme.md

@@ -967,6 +967,28 @@ const names = await collection.distinct('name');
 
 Advertises MongoDB wire protocol versions 0–21. The documented command surface is tested with the official `mongodb` Node.js driver version 7.5.x.
 
+OP_MSG parsing rejects unknown required flags, invalid CRC-32C checksums,
+duplicate BSON keys, noncanonical array indexes, malformed section boundaries,
+multiple body sections, duplicate or colliding document-sequence identifiers,
+and missing or non-string `$db` fields. Unknown optional flags are ignored. A
+message is limited to 48,000,000 bytes, each BSON document to 16,777,216 bytes,
+and BSON nesting to 100 levels. One message may contain at most 128 sections,
+10,000 document-sequence documents, 100,000 BSON elements, and 100,000 BSON
+document or array containers. The advertised `maxWriteBatchSize` is therefore
+10,000.
+
+The `moreToCome` request flag is accepted only for the exact `endSessions` or
+`killSessions` cleanup envelope: an `admin` command body containing only the
+session array, `writeConcern: { w: 0 }`, and `$db: "admin"`, with no document
+sequence. It executes without a transport response and leaves the connection
+reusable. Every other `moreToCome` envelope closes before command routing or
+response-owned resource creation.
+
+Raw receive buffers and parsed requests are charged separately against a
+process-wide 256 MiB encoded-byte admission budget. Large unread pipelines remain
+charged and are compacted only at geometric utilization thresholds; the budget is
+an encoded-input bound rather than a claim about exact allocator heap usage.
+
 ### Read and Write Concerns
 
 SmartDB 5.x does not implement MongoDB `readConcern` or `writeConcern`

package/readme.plan.md

@@ -3,14 +3,14 @@
 Status: canonical direction, approved 2026-08-17. Reread before starting engine or
 managed-service work.
 
-Baseline: `@push.rocks/smartdb` 5.2.1. SmartDB is a Rust database engine with a
+Baseline: `@push.rocks/smartdb` 5.2.2. SmartDB is a Rust database engine with a
 TypeScript lifecycle facade, a MongoDB wire-protocol command surface, file and
 memory storage, authentication, transactions, resource fencing, and official
 MongoDB Node.js driver integration.
 
 Current execution status:
 
-- the legal and provenance gate has not passed
+- the legal and provenance gate passed on 2026-08-22
 - Phase 0 and the Phase 1 gate have not passed
 - 5.x maintenance now treats `data.rdb` as authoritative, ignores unverifiable
   legacy hint contents, streams CRC validation, and repairs only an incomplete
@@ -131,7 +131,8 @@ and reproducible baseline measurements.
 
 - stop over-advertising MongoDB version, wire behavior, and batch limits
 - reject ignored concerns, options, commands, and successful administrative stubs
-- validate OP_MSG required flags, checksums, and no-response behavior
+- completed slice (2026-08-22): validate OP_MSG required flags, CRC-32C
+  checksums, bounded framing, and exact no-response admission and execution
 - preserve complete BSON type and value identity for document and index keys
 - reconcile ambiguous point-write failures before returning control to callers
 - journal DDL and sync every required file and parent directory

package/third-party-notices.md

@@ -8,10 +8,8 @@ own MIT license and are not repeated below.
 
 ## Component Inventory
 
-The package selects MIT wherever an upstream expression offers MIT as an
-alternative. The selected licenses for the remaining components are stated in
-the table. This inventory was generated from the lockfile with
-`cargo license --json`.
+The selected license for each component is stated in the table. This inventory
+was generated from the lockfile with `cargo license --json`.
 
 | Component | Version | Upstream expression | Selected license |
 | --- | --- | --- | --- |
@@ -40,6 +38,7 @@ the table. This inventory was generated from the lockfile with
 | clap_lex | 1.1.0 | Apache-2.0 OR MIT | MIT |
 | colorchoice | 1.0.5 | Apache-2.0 OR MIT | MIT |
 | cpufeatures | 0.2.17 | Apache-2.0 OR MIT | MIT |
+| crc32c | 0.6.8 | Apache-2.0 OR MIT | Apache-2.0 |
 | crc32fast | 1.5.0 | Apache-2.0 OR MIT | MIT |
 | crossbeam-utils | 0.8.21 | Apache-2.0 OR MIT | MIT |
 | crypto-common | 0.1.7 | Apache-2.0 OR MIT | MIT |
@@ -111,6 +110,7 @@ the table. This inventory was generated from the lockfile with
 | regex-automata | 0.4.14 | Apache-2.0 OR MIT | MIT |
 | regex-syntax | 0.8.10 | Apache-2.0 OR MIT | MIT |
 | ring | 0.17.14 | Apache-2.0 AND ISC | Apache-2.0 AND ISC |
+| rustc_version | 0.4.1 | Apache-2.0 OR MIT | MIT |
 | rustix | 1.1.4 | Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT | MIT |
 | rustls | 0.23.40 | Apache-2.0 OR ISC OR MIT | MIT |
 | rustls-pemfile | 2.2.0 | Apache-2.0 OR ISC OR MIT | MIT |
@@ -248,7 +248,7 @@ Copyright (c) 2016 Joe Wilm (utf8parse)
 
 Copyright (c) 2016 Joseph Birr-Pixton <jpixton@gmail.com> (rustls, rustls-pemfile)
 
-Copyright (c) 2016 The Rust Project Developers (lock_api, parking_lot, parking_lot_core, thread_local)
+Copyright (c) 2016 The Rust Project Developers (lock_api, parking_lot, parking_lot_core, rustc_version, thread_local)
 
 Copyright (c) 2016 Titus Wormer <tituswormer@gmail.com> (strsim)
 
@@ -374,7 +374,9 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-## Apache-2.0 Notice for ring
+## Apache-2.0 Notices
+
+### ring
 
 `ring` includes BoringSSL-derived, once_cell-derived, and fiat-crypto-derived
 code under the Apache License 2.0. The fiat-crypto-derived code carries this
@@ -741,6 +743,30 @@ the following restrictions:
    misrepresented as being the original software.
 3. This notice may not be removed or altered from any source distribution.
 
+## Zlib-derived Notice for crc32c
+
+The `crc32c` component's `src/combine.rs` is based on the Zlib project's
+`crc32.c` combine implementation and carries the following notice:
+
+crc32.c -- compute the CRC-32 of a data stream
+Copyright (C) 1995-2006, 2010, 2011, 2012, 2016 Mark Adler
+
+This software is provided 'as-is', without any express or implied warranty. In
+no event will the authors be held liable for any damages arising from the use of
+this software.
+
+Permission is granted to anyone to use this software for any purpose, including
+commercial applications, and to alter it and redistribute it freely, subject to
+the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not claim
+   that you wrote the original software. If you use this software in a product,
+   an acknowledgment in the product documentation would be appreciated but is
+   not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.
+
 ## Unicode License V3 for unicode-ident
 
 COPYRIGHT AND PERMISSION NOTICE

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdb',
-  version: '5.2.2',
+  version: '5.2.3',
   description: 'A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.'
 }