monsqlize 3.3.3 → 3.4.0

package/CHANGELOG.md

@@ -1,18 +1,20 @@
 # CHANGELOG
 
-> Summary index — the 3.3.3 versioned details are in [changelogs/v3.3.3.md](./changelogs/v3.3.3.md). A versioned note does not establish npm publication; check the registry and immutable tag before deployment.
-> **Last updated**: 2026-10-23
+> Summary index — the 3.4.0 versioned details are in [changelogs/v3.4.0.md](./changelogs/v3.4.0.md). A versioned note does not establish npm publication; check the registry and immutable tag before deployment.
+> **Last updated**: 2026-10-27
 
 ---
 
 ## Unreleased
 
-The schema-dsl 3.0.5 dependency upgrade is assigned to **3.3.3** ([versioned notes](./changelogs/v3.3.3.md)); the audited 3.3.2 repairs are in its [versioned notes](./changelogs/v3.3.2.md) and the [next-change staging log](https://github.com/devcodex-labs/monSQLize/blob/main/changelogs/unreleased.md). Untagged checkouts remain release candidates.
+The Search index lifecycle API is assigned to **3.4.0** ([versioned notes](./changelogs/v3.4.0.md)); the weekly-scan cache-key, health-check and lockfile security fixes are in [3.3.4](./changelogs/v3.3.4.md); the schema-dsl 3.0.5 upgrade is in [3.3.3](./changelogs/v3.3.3.md); the audited 3.3.2 repairs are in its [versioned notes](./changelogs/v3.3.2.md) and the [next-change staging log](https://github.com/devcodex-labs/monSQLize/blob/main/changelogs/unreleased.md). Untagged checkouts remain release candidates.
 
 ## Version Overview
 
 | Version | Date | Summary | Details |
 |---------|------|---------|---------|
+| [v3.4.0](./changelogs/v3.4.0.md) | 2026-10-27 | Minor: Search index lifecycle API for Atlas Search and Vector Search | [View](./changelogs/v3.4.0.md) |
+| [v3.3.4](./changelogs/v3.3.4.md) | 2026-10-26 | Patch: cached-read keys under autoConvertObjectId, hung health-check pings, lockfile security patches | [View](./changelogs/v3.3.4.md) |
 | [v3.3.3](./changelogs/v3.3.3.md) | 2026-10-23 | Patch: pin schema-dsl 3.0.5 (dependency bug fixes only) | [View](./changelogs/v3.3.3.md) |
 | [v3.3.2](./changelogs/v3.3.2.md) | 2026-10-22 | Patch: BSON/cache identity, Model invalidation, pagination, transaction/sync lifecycle and upgrade safeguards; availability requires registry/tag verification | [View](./changelogs/v3.3.2.md) |
 | [v3.3.1](./changelogs/v3.3.1.md) | 2026-09-23 | Patch: audited Model, count, transaction, cache, sync, pool, Data Task and SSH corrections | [View](./changelogs/v3.3.1.md) |

package/README.md

@@ -14,7 +14,7 @@ Upgrade and security: [Migration Guide](./MIGRATION.md) · [Private Vulnerabilit
 
 The npm `latest` dist-tag and GitHub Pages are the stable channel; `main` may contain the next release. Pages deployment accepts only a versioned Git tag whose package version is already present on npm, so unpublished APIs are not promoted as stable documentation. The Google site ownership verification file is copied separately from the workflow commit, with its source commit and content hash recorded in the deployment summary.
 
-This source tree targets **3.3.3**, a dependency-only patch pinning `schema-dsl@3.0.5` (see the [3.3.3 notes](./changelogs/v3.3.3.md)). The 3.3.2 cache, Model, pagination and sync fixes, including cold-cache upgrades and checkpoint rollback limits, are described in the [3.3.2 notes](./changelogs/v3.3.2.md) and [migration guide](./MIGRATION.md). Read the upgrade guide in [English](https://github.com/devcodex-labs/monSQLize/blob/main/docs/en/upgrade-3.3.2.md) or [简体中文](https://github.com/devcodex-labs/monSQLize/blob/main/docs/zh/upgrade-3.3.2.md). Untagged checkouts remain release candidates; verify the immutable tag and requested registry version before deployment. Candidate preparation does not publish npm or update stable Pages.
+This source tree targets **3.4.0**, a minor release that adds the Search index lifecycle API for Atlas Search and Vector Search (see the [3.4.0 notes](./changelogs/v3.4.0.md)); 3.3.4 fixed cached-read keys under `autoConvertObjectId`, hung health-check pings and lockfile security advisories. The 3.3.2 cache, Model, pagination and sync fixes, including cold-cache upgrades and checkpoint rollback limits, are described in the [3.3.2 notes](./changelogs/v3.3.2.md) and [migration guide](./MIGRATION.md). Read the upgrade guide in [English](https://github.com/devcodex-labs/monSQLize/blob/main/docs/en/upgrade-3.3.2.md) or [简体中文](https://github.com/devcodex-labs/monSQLize/blob/main/docs/zh/upgrade-3.3.2.md). Untagged checkouts remain release candidates; verify the immutable tag and requested registry version before deployment. Candidate preparation does not publish npm or update stable Pages.
 
 This development source is pinned to verified registry `schema-dsl@3.0.5`. The v3 package remains subject to the full release gate before an immutable tag and npm publication.
 

package/changelogs/v3.3.4.md

@@ -0,0 +1,21 @@
+# monSQLize v3.3.4
+
+> Release date: 2026-10-26
+> Publication authority: the immutable tag and npm registry. An untagged checkout is a release candidate; the date above does not establish registry availability.
+
+## Highlights
+
+Bug-fix and security patch. Public entry points, signatures, Node.js `>=18`, build formats and package budgets remain unchanged from 3.3.3.
+
+## Fixed
+
+- Key cached `find`, `findOne`, `count` and `distinct` reads by the exact filter sent to MongoDB. With `autoConvertObjectId`, a filter whose `toBSON()` yields a 24-hex string `_id` no longer shares a cache entry with the equivalent `ObjectId` query; plain string filters still convert and share keys as before. Uncached results, invalidation descriptors and public signatures are unchanged.
+- Let a health check whose ping hangs past `timeout` keep counting failures: later checks wait on the same pending ping instead of skipping, so the pool reaches `down` after `retries` timeouts. Still only one ping per pool is in flight, and a late ping result cannot overwrite newer status.
+
+## Security
+
+- Refresh lockfile-only security patches: `fast-uri` 3.1.9 (production, via schema-dsl/ajv; clears 4 GHSA advisories that failed `test:audit`), dev-only `follow-redirects` 1.16.2 and overridden `brace-expansion` 1.1.21/5.0.12. No direct dependency version changes.
+
+## Upgrade and rollback
+
+No migration is required. Cached reads whose filter uses `toBSON()` with `autoConvertObjectId` get a new key and are read once from MongoDB after upgrade; all other cache keys are unchanged. Rollback to 3.3.3 restores the previous behavior and lockfile.

package/changelogs/v3.4.0.md

@@ -0,0 +1,28 @@
+# monSQLize v3.4.0
+
+> Release date: 2026-10-27
+> Publication authority: the immutable tag and npm registry. An untagged checkout is a release candidate; the date above does not establish registry availability.
+
+## Highlights
+
+Minor release. Adds the Search index lifecycle API on collection accessors and Models for full-text `search` and `vectorSearch` indexes. Existing APIs, defaults and dependency versions are unchanged. Node.js `>=18` remains the consumer runtime.
+
+## Added
+
+- Search index lifecycle API: `createSearchIndex`, `createSearchIndexes`, `listSearchIndexes`, `getSearchIndex`, `updateSearchIndex`, `dropSearchIndex`, and `waitForSearchIndex`. Write methods follow `writePathPolicy` as `management` operations.
+- `SearchIndexInfo` reports `typeSource` (`server` / `inferred` / `unknown`) and infers the type from the definition when the server omits a top-level `type` (self-managed mongot).
+- Six error codes: `INVALID_SEARCH_INDEX_DEFINITION`, `SEARCH_INDEX_EXISTS`, `SEARCH_INDEX_NOT_FOUND`, `SEARCH_INDEX_UNSUPPORTED`, `SEARCH_INDEX_BUILD_FAILED`, `SEARCH_INDEX_WAIT_TIMEOUT`.
+- Opt-in real-environment check: `npm run test:search-index:real` against `mongodb-atlas-local`.
+
+## Behavior notes
+
+- Whether a `vectorSearch` index can be updated in place depends on the deployment: rejected on `mongodb-atlas-local` (mongod 8.3.13); accepted on Community 8.2.12 with mongot; Atlas cloud not tested by this release. monSQLize passes server rejections through as `MONGODB_ERROR` with `serverCode` and does not fall back automatically. Docs describe a zero-downtime rename-and-switch pattern and a drop-then-recreate option when brief downtime is acceptable.
+
+## Budgets
+
+- Root CJS/ESM bundle budgets rise from 820,000 to 840,000 bytes per artifact; the CLI budget stays 50,000 bytes.
+- Documentation site single JavaScript file budget rises from 700,000 to 720,000 bytes for the new Search index page.
+
+## Upgrade and rollback
+
+No migration is required for existing APIs. New Search index methods are additive. Rollback to 3.3.4 removes the Search index lifecycle API and restores the previous root/site bundle budgets.

package/dist/cjs/cli/data-task.cjs

@@ -31,7 +31,7 @@ var import_node_url = require("node:url");
 // package.json
 var package_default = {
   name: "monsqlize",
-  version: "3.3.3",
+  version: "3.4.0",
   description: "TypeScript production data runtime layer for MongoDB today, with cache, transactions, pools, models, sync, and observability",
   type: "commonjs",
   main: "./dist/cjs/index.cjs",
@@ -52,7 +52,9 @@ var package_default = {
     "./package.json": "./package.json"
   },
   files: [
+    "changelogs/v3.4.0.md",
     "changelogs/v3.3.3.md",
+    "changelogs/v3.3.4.md",
     "changelogs/v3.3.2.md",
     "changelogs/v3.3.1.md",
     "changelogs/v3.3.0.md",
@@ -151,6 +153,7 @@ var package_default = {
     "test:compatibility": "npm run build && npm run build:tests && node --test .generated/test-dist/test/compatibility/exports/exports.test.js .generated/test-dist/test/compatibility/matrix.test.js",
     "probe:server-matrix": "node scripts/validation/probe-memory-server-matrix.cjs",
     "test:server-matrix": "node scripts/validation/run-memory-server-matrix.cjs",
+    "test:search-index:real": "npm run build && node scripts/validation/run-search-index-real-env.cjs",
     "test:real-env:private": "node scripts/validation/run-private-real-env-checks.cjs",
     "test:examples": "npm run build && tsc -p tsconfig.examples.json && node scripts/run-examples.cjs",
     "test:performance": "npm run build && npm run build:tests && node .generated/test-dist/test/performance/baselines/function-cache.benchmark.js",
@@ -164,7 +167,7 @@ var package_default = {
     "test:coverage": "node scripts/run-coverage.cjs",
     "test:audit": "npm audit --omit=dev --registry=https://registry.npmjs.org/",
     test: "npm run build && npm run build:tests && node test/run-tests.cjs",
-    "type-check": "npm run build && tsc -p tsconfig.json --noEmit && tsd --files test/types/root-import.test-d.ts --files test/types/cache-usage.test-d.ts --files test/types/model-usage.test-d.ts --files test/types/pool-usage.test-d.ts --files test/types/sync-usage.test-d.ts --files test/types/slow-query-log-usage.test-d.ts --files test/types/saga-usage.test-d.ts --files test/types/data-tasks-usage.test-d.ts",
+    "type-check": "npm run build && tsc -p tsconfig.json --noEmit && tsd --files test/types/root-import.test-d.ts --files test/types/cache-usage.test-d.ts --files test/types/model-usage.test-d.ts --files test/types/pool-usage.test-d.ts --files test/types/sync-usage.test-d.ts --files test/types/slow-query-log-usage.test-d.ts --files test/types/saga-usage.test-d.ts --files test/types/data-tasks-usage.test-d.ts --files test/types/search-index-usage.test-d.ts",
     "check:test-language": "node scripts/check-test-language.cjs",
     "check:docs-examples": "node scripts/validation/check-doc-example-matrix.cjs",
     "check:release-candidate": "node scripts/check-release-candidate.cjs",
@@ -199,12 +202,12 @@ var package_default = {
     ssh2: "1.17.0"
   },
   overrides: {
-    "fast-uri": "^3.1.8",
+    "fast-uri": "^3.1.9",
     "minimatch@3.1.5": {
-      "brace-expansion": "1.1.18"
+      "brace-expansion": "1.1.21"
     },
     "minimatch@10.2.5": {
-      "brace-expansion": "5.0.9"
+      "brace-expansion": "5.0.12"
     }
   }
 };