monsqlize 3.2.0 → 3.3.1

package/CHANGELOG.md

@@ -1,14 +1,20 @@
 # CHANGELOG
 
-> Summary index — the latest stable release details are in [changelogs/v3.2.0.md](./changelogs/v3.2.0.md); the earlier RC note remains an unpublished rehearsal archive.
-> **Last updated**: 2026-08-07
+> Summary index — the newest versioned release details are in [changelogs/v3.3.1.md](./changelogs/v3.3.1.md); the earlier RC note remains an unpublished rehearsal archive.
+> **Last updated**: 2026-09-23
 
 ---
 
+## Unreleased
+
+No changes are currently recorded after v3.3.1.
+
 ## Version Overview
 
 | Version | Date | Summary | Details |
 |---------|------|---------|---------|
+| [v3.3.1](./changelogs/v3.3.1.md) | 2026-09-23 | Patch: audited Model, count, transaction, cache, sync, pool, Data Task and SSH corrections | [View](./changelogs/v3.3.1.md) |
+| [v3.3.0](./changelogs/v3.3.0.md) | 2026-08-11 | Minor: static Model schema type inference, schema-dsl 3.0.4, and silent-by-default Pool logging | [View](./changelogs/v3.3.0.md) |
 | [v3.2.0](./changelogs/v3.2.0.md) | 2026-08-07 | Minor: Vector Search APIs, relation-safe Model deletion, and relation projection improvements | [View](./changelogs/v3.2.0.md) |
 | [v3.1.0](./changelogs/v3.1.0.md) | 2026-07-15 | Minor: schema-dsl v3 GA consumption, canonical validation errors, and normalized full-document persistence | [View](./changelogs/v3.1.0.md) |
 | [v3.0.0](./changelogs/v3.0.0.md) | 2026-07-14 | Major: two-instance preview/apply/restore data tasks, write-path policy, runtime-scoped schema DSL, stricter OCC/sync/query contracts, and release recovery controls | [View](./changelogs/v3.0.0.md) |

package/README.md

@@ -14,7 +14,7 @@ Upgrade and security: [Migration Guide](./MIGRATION.md) · [Private Vulnerabilit
 
 The npm `latest` dist-tag and GitHub Pages are the stable channel; `main` may contain the next release. Pages deployment accepts only a versioned Git tag whose package version is already present on npm, so unpublished APIs are not promoted as stable documentation.
 
-This source tree contains the stable `3.1.0` release candidate, pinned to verified registry `schema-dsl@3.0.0`. The v3 package remains subject to the full release gate before its immutable tag and npm publication.
+This development source is pinned to verified registry `schema-dsl@3.0.4`. The v3 package remains subject to the full release gate before an immutable tag and npm publication.
 
 ```bash
 npm install monsqlize
@@ -234,6 +234,30 @@ const user = await User.insertOne({
 });
 ```
 
+### TypeScript Schema Inference
+
+For a static object-literal schema, `defineModel()` carries the schema-derived document type from definition through registration to runtime access. Registration remains explicit, so it does not change the process-wide Model registry behavior.
+
+```ts
+import { defineModel, Model } from 'monsqlize';
+
+const User = defineModel('users', {
+  schema: {
+    email: 'email!',
+    age: 'number?'
+  }
+});
+
+Model.define(User);
+
+const users = msq.model(User);
+const user = await users.findOne({ email: 'ada@example.com' });
+// user?.email: string
+// user?.age: number | undefined
+```
+
+Call `Model.define(User)` before `model(User)`, `use(...).model(User)`, or `pool(...).model(User)`. Callback-based or dynamically composed schemas continue to use the existing explicit generic API, such as `msq.model<UserDocument>('users')`; managed fields added by timestamps, soft delete, versioning, relations, or virtuals are not synthesized into this schema-derived type.
+
 When a service needs runtime-local custom types, messages, locale, or an already-owned schema-dsl runtime, configure `schemaDsl` on the MonSQLize instance:
 
 ```js
@@ -308,6 +332,14 @@ Relative model paths are resolved from `process.cwd()`. In production services,
 Model-declared indexes are still created automatically by default for backward compatibility. Production services can turn off automatic indexing and run an explicit preflight before creating missing indexes:
 
 ```js
+const MonSQLize = require('monsqlize');
+
+async function main() {
+MonSQLize.Model.define('users', {
+  schema: { email: 'email!' },
+  indexes: [{ key: { email: 1 }, unique: true }]
+});
+
 const msq = new MonSQLize({
   type: 'mongodb',
   databaseName: 'mydb',
@@ -315,11 +347,18 @@ const msq = new MonSQLize({
   autoIndex: false
 });
 
-const plan = await msq.ensureModelIndexes({ models: ['users'], dryRun: true });
-
-if (plan.totals.conflicts === 0) {
-  await msq.ensureModelIndexes({ models: ['users'], throwOnError: true });
+try {
+  await msq.connect();
+  const plan = await msq.ensureModelIndexes({ models: ['users'], dryRun: true });
+  if (plan.totals.conflicts === 0) {
+    await msq.ensureModelIndexes({ models: ['users'], throwOnError: true });
+  }
+} finally {
+  await msq.close();
 }
+}
+
+main().catch((error) => { console.error(error); process.exitCode = 1; });
 ```
 
 `ensureModelIndexes()` creates only missing indexes. It does not drop, rename, or rebuild conflicting indexes.
@@ -425,6 +464,8 @@ Transaction cache invalidations are recorded during the transaction and flushed
 ### Connection Pools
 
 ```js
+const MonSQLize = require('monsqlize');
+async function main() {
 const msq = new MonSQLize({
   type: 'mongodb',
   databaseName: 'main',
@@ -434,7 +475,16 @@ const msq = new MonSQLize({
   ]
 });
 
-const reports = msq.pool('analytics').collection('reports');
+try {
+  await msq.connect();
+  const reports = msq.pool('analytics').collection('reports');
+  console.log(await reports.countDocuments({}));
+} finally {
+  await msq.close();
+}
+}
+
+main().catch((error) => { console.error(error); process.exitCode = 1; });
 ```
 
 ### Change Streams

package/changelogs/v3.3.0.md

@@ -0,0 +1,29 @@
+# monSQLize v3.3.0
+
+> Release date: 2026-08-11
+
+## Highlights
+
+- Added schema-derived TypeScript document inference for static Model definitions.
+- Made Pool logging silent by default while preserving explicit logger delivery.
+
+## Added
+
+- Added `defineModel()` and `ModelDescriptor` so object-literal `schema` definitions carry their inferred document type through `Model.define()`, `model()`, `scopedModel()`, `use().model()`, and `pool().model()`.
+- Added CJS, ESM, public-type, compatibility, pack-consumer, and registry-consumer verification for the descriptor API.
+
+## Changed
+
+- Updated the exact production dependency from `schema-dsl@3.0.0` to `schema-dsl@3.0.4`.
+- Extended current-version validation so README and bilingual dependency-governance documents must match the exact `schema-dsl` version in `package.json`.
+
+## Fixed
+
+- Forwarded the configured `ConnectionPoolManager` logger to `PoolSelector`, `HealthChecker`, and `PoolStatsManager`.
+- Removed implicit `console` fallback logging from Pool helpers when no logger is configured.
+
+## Compatibility boundaries
+
+- This is a backward-compatible minor release. Existing string-based Model registration/access, manual TypeScript generics, Pool APIs, and explicit process-wide Model registry lifecycle remain unchanged.
+- `defineModel()` creates a static descriptor; it does not register the Model. Call `Model.define(descriptor)` before binding it through a runtime accessor.
+- Callback or dynamically composed schemas continue to use explicit document generics. Schema-derived types do not synthesize timestamp, soft-delete, version, relation, or virtual fields.

package/changelogs/v3.3.1.md

@@ -0,0 +1,28 @@
+# monSQLize v3.3.1
+
+> Release date: 2026-09-23
+
+## Highlights
+
+This backward-compatible patch closes the post-3.3.0 runtime audit findings. It corrects Model validation, soft-delete, relation and strict-version behavior; count cancellation; transaction, cache, pool and sync lifecycle edges; and backup/restore data fidelity.
+
+## Fixed
+
+- Model writes now surface a schema factory error only when full-document validation is required. Disabling validation or using `skipValidation` no longer blocks unrelated writes and management methods.
+- Boolean soft delete consistently treats only `true` as deleted across reads, batch deletion and relation-usage checks. Hydrated `remove()` follows Model hooks and soft-delete rules.
+- Strict `updateMany` and `updateBatch` preserve the original business filter during each atomic write. A candidate that no longer matches that filter is reported as skipped; a still-matching candidate with a changed version is a conflict. Candidate enumeration is no longer limited by the public find default.
+- Populate pagination applies `skip` and `limit` per parent. Model batch writes, query cache keys, expression evaluation and write-path checks retain their original filters and BSON semantics.
+- Public count operations forward the caller's abort signal to CountQueue, including queued and running work. Running slots remain occupied until the underlying operation settles.
+- Managed transaction aborts reject later wrapped writes. Redis invalidation does not rebroadcast received events, pool close/capacity races are handled, and Change Stream sync preserves resume tokens and failure barriers.
+- Data Task backup/restore preserves canonical BSON values. Optional SSH host verification and local failure cleanup are available without changing the default connection path.
+
+## Compatibility and verification
+
+- No breaking public method signature, package entry point, runtime Node requirement or direct production dependency change. MongoDB remains the only complete adapter; Node.js `>=18` remains the runtime contract.
+- The transitive `fast-uri` override now permits patched v3 releases and resolves to 3.1.8; the development-only `js-yaml` lockfile entry is refreshed to 4.3.2. Both clear high-severity advisories found during release review without changing the supported major versions.
+- Release automation uses npm trusted publishing through GitHub Actions OIDC. The pre-tag check verifies runner readiness; npm verifies the configured publisher during the actual publish.
+- Validation-disabled writes and strict batch-result classification may behave differently from the faulty post-3.3.0 main branch; applications relying on the documented contracts receive the corrected behavior.
+- The root CJS/ESM byte budget moves from 720,000 to 740,000 to cover the audited runtime fixes while retaining a tight size guard. The CLI budget remains 50,000 bytes.
+- The release gate covers full tests and coverage, Node 18/20/22 CI, Node 20/22 × MongoDB Driver 6/7 × MongoDB Server 7.0.37/8.0.26, package installation, and bilingual website verification.
+
+Private SSH and Atlas deployments remain operator-managed integration checks; local and public CI coverage does not claim to replace them.

package/dist/cjs/cli/data-task.cjs

@@ -31,7 +31,7 @@ var import_node_url = require("node:url");
 // package.json
 var package_default = {
   name: "monsqlize",
-  version: "3.2.0",
+  version: "3.3.1",
   description: "TypeScript production data runtime layer for MongoDB today, with cache, transactions, pools, models, sync, and observability",
   type: "commonjs",
   main: "./dist/cjs/index.cjs",
@@ -52,6 +52,8 @@ var package_default = {
     "./package.json": "./package.json"
   },
   files: [
+    "changelogs/v3.3.1.md",
+    "changelogs/v3.3.0.md",
     "changelogs/v3.2.0.md",
     "changelogs/v3.1.14.md",
     "changelogs/v3.1.13.md",
@@ -191,11 +193,11 @@ var package_default = {
     "cache-hub": "2.2.4",
     ioredis: "5.11.1",
     mongodb: "6.21.0",
-    "schema-dsl": "3.0.0",
+    "schema-dsl": "3.0.4",
     ssh2: "1.17.0"
   },
   overrides: {
-    "fast-uri": "3.1.5",
+    "fast-uri": "^3.1.8",
     "minimatch@3.1.5": {
       "brace-expansion": "1.1.18"
     },