chore: pin package dependencies for v2.0.2

Author: rockyshi1993

.npmrc

@@ -1,10 +1,10 @@
 # npm 配置文件
 
-# 不生成 package-lock.json 到 npm 包
-package-lock=false
+# 保持 package-lock.json 与 package.json 同步
+package-lock=true
 
-# 使用范围版本而非精确版本（安装依赖时）
-save-exact=false
+# 保存依赖时使用精确版本
+save-exact=true
 
 # 发布时使用公开访问（如果使用 scoped package）
 access=public

CHANGELOG.md

@@ -1,14 +1,15 @@
 # CHANGELOG
 
-> Summary index — current release details are packaged in [changelogs/v2.0.1.md](./changelogs/v2.0.1.md); historical details live in the repository changelog archive.
-> **Last updated**: 2026-06-03
+> Summary index — current release details are packaged in [changelogs/v2.0.2.md](./changelogs/v2.0.2.md); historical details live in the repository changelog archive.
+> **Last updated**: 2026-06-09
 
 ---
 
 ## Version Overview
 
 | Version | Date | Summary | Details |
 |---------|------|---------|---------|
+| [v2.0.2](./changelogs/v2.0.2.md) | 2026-06-09 | Patch: direct runtime, optional and development dependencies pinned to exact versions for deterministic consumer installs | [View](./changelogs/v2.0.2.md) |
 | [v2.0.1](./changelogs/v2.0.1.md) | 2026-06-03 | Patch: model collection/pool compatibility, automatic-index task dedupe, runtime cache/pool v1 smooth-upgrade fixes, and current docs/types alignment | [View](./changelogs/v2.0.1.md) |
 | [v2.0.0](./changelogs/v2.0.0.md) | 2026-06-01 | 🎉 **v2.0.0 — TypeScript rewrite**: full TypeScript source, cache-hub integration, schema-dsl `^2.0.3` TS dependency, Apache-2.0 licensing, English README, MultiLevel cache support, v1 API compat preserved, optimized npm artifact boundary without default sourcemaps, JSDoc coverage complete, `getPoolStats/getPoolHealth` keyed by pool name, v1 compat fixes included, workspace smooth-upgrade bridge validated for downstream consumers | [View](./changelogs/v2.0.0.md) |
 | [v1.3.0](https://github.com/vextjs/monSQLize/blob/main/changelogs/v1.3.0.md) | 2026-04-27 | 🆕 **新功能**：链式池访问 API — `pool(name)` / `use(dbName)` / `scopedCollection()` / `scopedModel()` 四个公开方法，支持多连接池多数据库路由，connection 合并语义，TypeScript 类型签名完整覆盖 | [查看](https://github.com/vextjs/monSQLize/blob/main/changelogs/v1.3.0.md) |

changelogs/v2.0.2.md

@@ -0,0 +1,22 @@
+# v2.0.2 — 2026-06-09
+
+## Overview
+
+v2.0.2 is a package metadata patch for deterministic installs. It keeps the runtime API unchanged while pinning direct dependency declarations to the exact versions already resolved by the lockfile.
+
+---
+
+## Changes
+
+- Pinned direct `dependencies`, `optionalDependencies` and `devDependencies` in `package.json` to exact versions.
+- Kept peer metadata unchanged.
+- Updated `.npmrc` so future dependency saves keep `package-lock.json` enabled and use exact versions.
+- Added this release note to the packaged changelog set.
+
+---
+
+## Validation
+
+- `npm ci`
+- `npm run release:preflight`
+- `npm pack --dry-run --json`

docs/file-dependency-governance.md

@@ -1,26 +1,26 @@
 # 依赖发布边界治理
 
-当前根包采用**公开 semver 依赖策略**：
+当前根包采用**精确版本依赖策略**：
 
 | 依赖 | 策略 | 原因 |
 |------|------|------|
-| `cache-hub` | 公开 semver `^1.0.0` | 上游已发布稳定版本，验证通过 |
-| `schema-dsl` | 公开 semver `^2.0.3` | npm `latest` 指向 2.0.3，且该版本是当前 TypeScript 正式线；monSQLize 仅依赖 `dsl` / `validate` 能力，已用 2.0.3 实跑 type-check、model 测试、integration 与 examples 验证通过 |
+| `cache-hub` | 精确版本 `1.0.0` | 上游已发布稳定版本，验证通过；发布包不再通过 semver range 自动漂移 |
+| `schema-dsl` | 精确版本 `2.0.3` | npm `latest` 指向 2.0.3，且该版本是当前 TypeScript 正式线；monSQLize 仅依赖 `dsl` / `validate` 能力，已用 2.0.3 实跑 type-check、model 测试、integration 与 examples 验证通过 |
 
 > `schema-dsl@2.0.3` 与工作区 sibling `../schema-dsl` 当前版本一致；npm 上存在更高的 `2.3.x`，但已标记为误发布 / deprecated，不得跟随升级。
 
 ## 当前风险
 
-1. **上游版本漂移**：`cache-hub` / `schema-dsl` 都使用 semver，需防止无意吸收 breaking change。
+1. **上游版本漂移**：`cache-hub` / `schema-dsl` 已固定为精确版本，升级必须走显式版本调整。
 2. **误发布版本风险**：`schema-dsl` 的 npm `2.3.x` 已标记为误发布，不得跟随升级。
 3. **联动回归盲区**：升级任意上游依赖后，必须重新覆盖关键回归面。
 
 ## 当前治理规则
 
 ### 开发态
 
-- `cache-hub` 跟随公开 semver `^1.0.0`。
-- `schema-dsl` 跟随公开 semver `^2.0.3`。
+- `cache-hub` 固定为 `1.0.0`。
+- `schema-dsl` 固定为 `2.0.3`。
 - 本地 sibling `../schema-dsl` 仅用于上游库自身调试，不再作为 monSQLize 根包安装前提。
 
 ### 发布态
@@ -34,14 +34,14 @@ npm run release:preflight
 
 ## schema-dsl 2.x 升级闭环
 
-本轮已将 `schema-dsl` 从 `^1.2.5` 升级到 `^2.0.3`，闭环标准如下：
+本轮已将 `schema-dsl` 从历史 `^1.2.5` 升级并固定到 `2.0.3`，闭环标准如下：
 
 1. 上游在 npm 发布了**非 deprecated** 的 2.x latest 版本：`2.0.3`。
-2. `npm install schema-dsl@^2.0.3` 后通过 `npm run type-check`。
+2. `npm install schema-dsl@2.0.3` 后通过 `npm run type-check`。
 3. model 相关单测 / 集成测试全通过（随 `npm run test:unit` 与 `npm run test:integration` 覆盖）。
 4. `npm run test:examples` 全通过。
 5. 发布前仍需以 `npm run release:preflight` 作为最终门禁。
-6. 本文件、Profile、CHANGELOG 与 lockfile 必须同步到 `^2.0.3`。
+6. 本文件、Profile、CHANGELOG 与 lockfile 必须同步到 `2.0.3`。
 
 ## 联动验证建议
 
@@ -53,5 +53,5 @@ npm run release:preflight
 
 ## 长期方向
 
-1. `schema-dsl` 继续跟随 npm `latest`，但必须排除 deprecated 误发布版本。
+1. `schema-dsl` 后续不自动跟随 npm `latest`；升级必须显式确认目标版本，并继续排除 deprecated 误发布版本。
 2. 发布态持续保持对工作区路径零依赖；所有上游依赖都必须可由公开 semver 解析。

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "monsqlize",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "TypeScript-native MongoDB ODM with multi-level caching (cache-hub), distributed locks, Saga orchestration, unified expression system (122 operators), connection pool management, ChangeStream sync, slow-query logging, and full v1 API compatibility",
   "type": "commonjs",
   "main": "./dist/cjs/index.cjs",
@@ -18,6 +18,7 @@
     "dist/**/*.cjs",
     "dist/**/*.mjs",
     "dist/**/*.d.ts",
+    "changelogs/v2.0.2.md",
     "changelogs/v2.0.1.md",
     "changelogs/v2.0.0.md",
     "README.md",
@@ -95,26 +96,26 @@
     }
   },
   "optionalDependencies": {
-    "ioredis": "^5.8.2",
-    "ssh2": "^1.17.0"
+    "ioredis": "5.8.2",
+    "ssh2": "1.17.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.1",
-    "@types/node": "^25.0.1",
-    "@types/semver": "^7.7.1",
-    "c8": "^11.0.0",
-    "chai": "^6.2.2",
-    "esbuild": "^0.25.5",
-    "eslint": "^9.39.1",
-    "mongodb-memory-server": "^11.1.0",
-    "sinon": "^22.0.0",
-    "tsd": "^0.33.0",
-    "typescript": "^5.9.3"
+    "@eslint/js": "9.39.4",
+    "@types/node": "25.6.2",
+    "@types/semver": "7.7.1",
+    "c8": "11.0.0",
+    "chai": "6.2.2",
+    "esbuild": "0.25.12",
+    "eslint": "9.39.4",
+    "mongodb-memory-server": "11.1.0",
+    "sinon": "22.0.0",
+    "tsd": "0.33.0",
+    "typescript": "5.9.3"
   },
   "dependencies": {
-    "async-lock": "^1.4.1",
-    "cache-hub": "^1.0.0",
-    "mongodb": "^6.21.0",
-    "schema-dsl": "^2.0.3"
+    "async-lock": "1.4.1",
+    "cache-hub": "1.0.0",
+    "mongodb": "6.21.0",
+    "schema-dsl": "2.0.3"
   }
 }

package.json

@@ -19,7 +19,7 @@ test/compatibility/
 - `package.json` 的 `engines.node` 与当前测试矩阵一致
 - Node `20.x` 当前环境（`v20.20.2`）已完成 `npm run verify` 与 `npm run test:compatibility`
 - Node `22.x` 已通过 `volta run --node 22` 实跑
-- `mongodb@^6.21.0` 作为当前依赖基线存在且与矩阵声明一致
+- `mongodb@6.21.0` 作为当前依赖基线存在且与矩阵声明一致
 - MongoDB Driver `7.x` 已通过临时安装 `mongodb@7.2.0` 完成扩展验证，验证后已恢复 `6.21.0` 基线
 - MongoDB Server `6.0.14` / `7.0.14` 已通过 `mongodb-memory-server` 的单机 + replica set 双路径实跑
 - `npm run test:server-matrix` 已完成 **Node 20 / 22 × Driver 6 / 7 × MongoDB 6 / 7** 内存矩阵回归

test/compatibility/README.md

@@ -1,6 +1,6 @@
 {
-  "generatedAt": "2026-05-24",
-  "packageVersion": "2.0.0",
+  "generatedAt": "2026-06-09",
+  "packageVersion": "2.0.2",
   "support": {
     "node": {
       "declared": ">=18.0.0",
@@ -31,7 +31,7 @@
       "pending": []
     },
     "mongodbDriver": {
-      "declaredDependency": "^6.21.0",
+      "declaredDependency": "6.21.0",
       "additionalVerifiedDrivers": [
         {
           "sampleVersion": "7.2.0",
@@ -259,4 +259,4 @@
       "MultiLevelCache"
     ]
   }
-}
+}