monsqlize 3.3.0 → 3.3.1

package/CHANGELOG.md

@@ -1,18 +1,19 @@
 # CHANGELOG
 
-> Summary index — the newest versioned release details are in [changelogs/v3.3.0.md](./changelogs/v3.3.0.md); the earlier RC note remains an unpublished rehearsal archive.
-> **Last updated**: 2026-08-11
+> Summary index — the newest versioned release details are in [changelogs/v3.3.1.md](./changelogs/v3.3.1.md); the earlier RC note remains an unpublished rehearsal archive.
+> **Last updated**: 2026-09-23
 
 ---
 
 ## Unreleased
 
-No changes are currently recorded after v3.3.0.
+No changes are currently recorded after v3.3.1.
 
 ## Version Overview
 
 | Version | Date | Summary | Details |
 |---------|------|---------|---------|
+| [v3.3.1](./changelogs/v3.3.1.md) | 2026-09-23 | Patch: audited Model, count, transaction, cache, sync, pool, Data Task and SSH corrections | [View](./changelogs/v3.3.1.md) |
 | [v3.3.0](./changelogs/v3.3.0.md) | 2026-08-11 | Minor: static Model schema type inference, schema-dsl 3.0.4, and silent-by-default Pool logging | [View](./changelogs/v3.3.0.md) |
 | [v3.2.0](./changelogs/v3.2.0.md) | 2026-08-07 | Minor: Vector Search APIs, relation-safe Model deletion, and relation projection improvements | [View](./changelogs/v3.2.0.md) |
 | [v3.1.0](./changelogs/v3.1.0.md) | 2026-07-15 | Minor: schema-dsl v3 GA consumption, canonical validation errors, and normalized full-document persistence | [View](./changelogs/v3.1.0.md) |

package/README.md

@@ -332,6 +332,14 @@ Relative model paths are resolved from `process.cwd()`. In production services,
 Model-declared indexes are still created automatically by default for backward compatibility. Production services can turn off automatic indexing and run an explicit preflight before creating missing indexes:
 
 ```js
+const MonSQLize = require('monsqlize');
+
+async function main() {
+MonSQLize.Model.define('users', {
+  schema: { email: 'email!' },
+  indexes: [{ key: { email: 1 }, unique: true }]
+});
+
 const msq = new MonSQLize({
   type: 'mongodb',
   databaseName: 'mydb',
@@ -339,11 +347,18 @@ const msq = new MonSQLize({
   autoIndex: false
 });
 
-const plan = await msq.ensureModelIndexes({ models: ['users'], dryRun: true });
-
-if (plan.totals.conflicts === 0) {
-  await msq.ensureModelIndexes({ models: ['users'], throwOnError: true });
+try {
+  await msq.connect();
+  const plan = await msq.ensureModelIndexes({ models: ['users'], dryRun: true });
+  if (plan.totals.conflicts === 0) {
+    await msq.ensureModelIndexes({ models: ['users'], throwOnError: true });
+  }
+} finally {
+  await msq.close();
 }
+}
+
+main().catch((error) => { console.error(error); process.exitCode = 1; });
 ```
 
 `ensureModelIndexes()` creates only missing indexes. It does not drop, rename, or rebuild conflicting indexes.
@@ -449,6 +464,8 @@ Transaction cache invalidations are recorded during the transaction and flushed
 ### Connection Pools
 
 ```js
+const MonSQLize = require('monsqlize');
+async function main() {
 const msq = new MonSQLize({
   type: 'mongodb',
   databaseName: 'main',
@@ -458,7 +475,16 @@ const msq = new MonSQLize({
   ]
 });
 
-const reports = msq.pool('analytics').collection('reports');
+try {
+  await msq.connect();
+  const reports = msq.pool('analytics').collection('reports');
+  console.log(await reports.countDocuments({}));
+} finally {
+  await msq.close();
+}
+}
+
+main().catch((error) => { console.error(error); process.exitCode = 1; });
 ```
 
 ### Change Streams

package/changelogs/v3.3.1.md

@@ -0,0 +1,28 @@
+# monSQLize v3.3.1
+
+> Release date: 2026-09-23
+
+## Highlights
+
+This backward-compatible patch closes the post-3.3.0 runtime audit findings. It corrects Model validation, soft-delete, relation and strict-version behavior; count cancellation; transaction, cache, pool and sync lifecycle edges; and backup/restore data fidelity.
+
+## Fixed
+
+- Model writes now surface a schema factory error only when full-document validation is required. Disabling validation or using `skipValidation` no longer blocks unrelated writes and management methods.
+- Boolean soft delete consistently treats only `true` as deleted across reads, batch deletion and relation-usage checks. Hydrated `remove()` follows Model hooks and soft-delete rules.
+- Strict `updateMany` and `updateBatch` preserve the original business filter during each atomic write. A candidate that no longer matches that filter is reported as skipped; a still-matching candidate with a changed version is a conflict. Candidate enumeration is no longer limited by the public find default.
+- Populate pagination applies `skip` and `limit` per parent. Model batch writes, query cache keys, expression evaluation and write-path checks retain their original filters and BSON semantics.
+- Public count operations forward the caller's abort signal to CountQueue, including queued and running work. Running slots remain occupied until the underlying operation settles.
+- Managed transaction aborts reject later wrapped writes. Redis invalidation does not rebroadcast received events, pool close/capacity races are handled, and Change Stream sync preserves resume tokens and failure barriers.
+- Data Task backup/restore preserves canonical BSON values. Optional SSH host verification and local failure cleanup are available without changing the default connection path.
+
+## Compatibility and verification
+
+- No breaking public method signature, package entry point, runtime Node requirement or direct production dependency change. MongoDB remains the only complete adapter; Node.js `>=18` remains the runtime contract.
+- The transitive `fast-uri` override now permits patched v3 releases and resolves to 3.1.8; the development-only `js-yaml` lockfile entry is refreshed to 4.3.2. Both clear high-severity advisories found during release review without changing the supported major versions.
+- Release automation uses npm trusted publishing through GitHub Actions OIDC. The pre-tag check verifies runner readiness; npm verifies the configured publisher during the actual publish.
+- Validation-disabled writes and strict batch-result classification may behave differently from the faulty post-3.3.0 main branch; applications relying on the documented contracts receive the corrected behavior.
+- The root CJS/ESM byte budget moves from 720,000 to 740,000 to cover the audited runtime fixes while retaining a tight size guard. The CLI budget remains 50,000 bytes.
+- The release gate covers full tests and coverage, Node 18/20/22 CI, Node 20/22 × MongoDB Driver 6/7 × MongoDB Server 7.0.37/8.0.26, package installation, and bilingual website verification.
+
+Private SSH and Atlas deployments remain operator-managed integration checks; local and public CI coverage does not claim to replace them.

package/dist/cjs/cli/data-task.cjs

@@ -31,7 +31,7 @@ var import_node_url = require("node:url");
 // package.json
 var package_default = {
   name: "monsqlize",
-  version: "3.3.0",
+  version: "3.3.1",
   description: "TypeScript production data runtime layer for MongoDB today, with cache, transactions, pools, models, sync, and observability",
   type: "commonjs",
   main: "./dist/cjs/index.cjs",
@@ -52,6 +52,7 @@ var package_default = {
     "./package.json": "./package.json"
   },
   files: [
+    "changelogs/v3.3.1.md",
     "changelogs/v3.3.0.md",
     "changelogs/v3.2.0.md",
     "changelogs/v3.1.14.md",
@@ -196,7 +197,7 @@ var package_default = {
     ssh2: "1.17.0"
   },
   overrides: {
-    "fast-uri": "3.1.5",
+    "fast-uri": "^3.1.8",
     "minimatch@3.1.5": {
       "brace-expansion": "1.1.18"
     },