jpie 3.10.0 → 3.10.1.pre.202608310314

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 637098cfaf33f60d61c1669573a007686467f5218a1b20aff8701886b3fa79d5
-  data.tar.gz: 95e995bb47caddc5f3ae867b0e4d3aa2b5fb2de9f40225bba36a7edb527b62b0
+  metadata.gz: 7d7b7930d242f1cb28bae23269e93bf730e4bc30bfdcc10c951936a8a077dc8f
+  data.tar.gz: b03c030bea6499e3857aaa243c1f616f9382dcb2d36a55447c696c9d2e5bf398
 SHA512:
-  metadata.gz: ccbdca591a2dcd1a6745f72beb4f477777ac96bfbbf0f3973c56bb4d2f7e63ebecc4bd20feab45d345e887a4d2903aa97c2bce3efa30a36f26403d771311d3fb
-  data.tar.gz: 3a6f363d40e998ce65c9805ed06fcf7a2fea1b5e2aac13fd14360f0b8250937b9a00302b230e2a2931d32b8991e55ffdfd93c779cc3534f54f7ed06a1e0755bf
+  metadata.gz: 866881fe03f8816b4a3ed08b4ff962e17b2551717912d81a7902c01907c4f7a3f7fb1c69d2281cfd1c2ecc3ca363cc4f6293b99bf97900d41a106cedb9944d0e
+  data.tar.gz: 138eea7549a9cf59006fdc2df0e8a481cc5d2776a98bdfe3da8b4b740b0a5ae9e3d964b420cb1e5c8f6bcf5a5a9c45a933e69e9b8edd0991dd641ffd33f6a764

data/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+This project follows [semantic versioning](https://semver.org/spec/v2.0.0.html).
+
+Add your entry under "Unreleased". Klaay staff move it into a version section
+at release time.
+
+## [Unreleased]
+
+### Added
+
+- Open-source documents: `LICENSE`, `NOTICE`, `CONTRIBUTING.md`,
+  `CODE_OF_CONDUCT.md`, `SECURITY.md`, `TRADEMARK.md`, `CLA.md`,
+  `THIRD_PARTY_LICENSES.md`, and this changelog.
+- GitHub issue templates, a pull request template, a Dependabot config, and a
+  CLA Assistant workflow.
+
+## [3.10.0]
+
+### Fixed
+
+- Resolve the create definition with the request namespace.
+- Give a member route the same include preloads as a collection.
+- Run an attachment sideload through the authorization hook.
+
+## Earlier releases
+
+Releases before 3.10.0 predate this file. Read their history in the git tags
+and in the [GitHub releases](https://github.com/klaayinc/json_api/releases).
+
+[Unreleased]: https://github.com/klaayinc/json_api/compare/v3.10.0...HEAD
+[3.10.0]: https://github.com/klaayinc/json_api/compare/v3.9.0...v3.10.0

data/CLA.md

@@ -0,0 +1,122 @@
+# JPie Individual Contributor License Agreement ("Agreement") v1.0
+
+> This Agreement adapts the Apache Software Foundation Individual Contributor
+> License Agreement V2.2 for Klaay ApS. The intellectual-property terms are the
+> Apache text, unchanged. Klaay ApS is the counterparty. The data handling in the
+> final section follows Klaay's privacy policy.
+
+Thank you for your interest in JPie. To clarify the intellectual property
+license granted with Contributions from any person or entity, Klaay ApS (the
+"Company"), a company registered in Denmark, must have on file a signed
+Contributor License Agreement ("CLA") from each Contributor, indicating agreement
+with the license terms below. This agreement is for your protection as a
+Contributor as well as the protection of the Company and the users of the Work.
+It does not change your rights to use your own Contributions for any other
+purpose.
+
+You do not email this Agreement. When you open your first pull request, the CLA
+Assistant bot posts a link and records your agreement against your GitHub
+account. For questions, contact legal@klaay.com.
+
+You accept and agree to the following terms and conditions for Your
+Contributions (present and future) that you submit to the Company. Except for
+the license granted herein to the Company and recipients of software distributed
+by the Company, You reserve all right, title, and interest in and to Your
+Contributions.
+
+1. Definitions.
+
+   "You" (or "Your") shall mean the copyright owner or legal entity authorized
+   by the copyright owner that is making this Agreement with the Company. For
+   legal entities, the entity making a Contribution and all other entities that
+   control, are controlled by, or are under common control with that entity are
+   considered to be a single Contributor. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the direction or
+   management of such entity, whether by contract or otherwise, or (ii)
+   ownership of fifty percent (50%) or more of the outstanding shares, or (iii)
+   beneficial ownership of such entity.
+
+   "Contribution" shall mean any original work of authorship, including any
+   modifications or additions to an existing work, that is intentionally
+   submitted by You to the Company for inclusion in, or documentation of, any of
+   the products owned or managed by the Company (the "Work"). For the purposes
+   of this definition, "submitted" means any form of electronic, verbal, or
+   written communication sent to the Company or its representatives, including
+   but not limited to communication on electronic mailing lists, source code
+   control systems, and issue tracking systems that are managed by, or on behalf
+   of, the Company for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise designated
+   in writing by You as "Not a Contribution."
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+   Agreement, You hereby grant to the Company and to recipients of software
+   distributed by the Company a perpetual, worldwide, non-exclusive, no-charge,
+   royalty-free, irrevocable copyright license to reproduce, prepare derivative
+   works of, publicly display, publicly perform, sublicense, and distribute Your
+   Contributions and such derivative works.
+
+   > This grant lets the Company distribute Your Contributions under the
+   > project's MIT license and under other license terms. Klaay ApS
+   > uses this right to keep the option of a commercial or dual license of the
+   > combined Work.
+
+3. Grant of Patent License. Subject to the terms and conditions of this
+   Agreement, You hereby grant to the Company and to recipients of software
+   distributed by the Company a perpetual, worldwide, non-exclusive, no-charge,
+   royalty-free, irrevocable (except as stated in this section) patent license
+   to make, have made, use, offer to sell, sell, import, and otherwise transfer
+   the Work, where such license applies only to those patent claims licensable
+   by You that are necessarily infringed by Your Contribution(s) alone or by
+   combination of Your Contribution(s) with the Work to which such
+   Contribution(s) was submitted. If any entity institutes patent litigation
+   against You or any other entity (including a cross-claim or counterclaim in a
+   lawsuit) alleging that your Contribution, or the Work to which you have
+   contributed, constitutes direct or contributory patent infringement, then any
+   patent licenses granted to that entity under this Agreement for that
+   Contribution or Work shall terminate as of the date such litigation is filed.
+
+4. You represent that you are legally entitled to grant the above license. If
+   your employer(s) has rights to intellectual property that you create that
+   includes your Contributions, you represent that you have received permission
+   to make Contributions on behalf of that employer, that your employer has
+   waived such rights for your Contributions to the Company, or that your
+   employer has executed a separate Corporate CLA with the Company.
+
+5. You represent that each of Your Contributions is Your original creation (see
+   section 7 for submissions on behalf of others). You represent that Your
+   Contribution submissions include complete details of any third-party license
+   or other restriction (including, but not limited to, related patents and
+   trademarks) of which you are personally aware and which are associated with
+   any part of Your Contributions.
+
+6. You are not expected to provide support for Your Contributions, except to the
+   extent You desire to provide support. You may provide support for free, for a
+   fee, or not at all. Unless required by applicable law or agreed to in writing,
+   You provide Your Contributions on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+   CONDITIONS OF ANY KIND, either express or implied, including, without
+   limitation, any warranties or conditions of TITLE, NONINFRINGEMENT,
+   MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+7. Should You wish to submit work that is not Your original creation, You may
+   submit it to the Company separately from any Contribution, identifying the
+   complete details of its source and of any license or other restriction
+   (including, but not limited to, related patents, trademarks, and license
+   agreements) of which you are personally aware, and conspicuously marking the
+   work as "Submitted on behalf of a third-party: [named here]".
+
+8. You agree to notify the Company of any facts or circumstances of which you
+   become aware that would make these representations inaccurate in any respect.
+
+## Governing law and personal data
+
+This Agreement is governed by the laws of Denmark, without regard to its
+conflict-of-law rules. The Danish courts have exclusive jurisdiction over any
+dispute that arises from it.
+
+Klaay ApS is the data controller for the personal data in this Agreement. To
+record and manage your agreement, Klaay ApS stores your name, your email address,
+and your GitHub username, on the lawful basis of its legitimate interest in
+establishing the license to Your Contributions. Klaay ApS keeps this record for
+as long as the Work uses Your Contributions. Klaay's privacy policy at
+https://klaay.com/privacy-policy describes your rights and how to exercise them.
+For data questions, contact privacy@klaay.com.

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,83 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at security@klaay.com. All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at [https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at [https://www.contributor-covenant.org/faq][FAQ]. Translations are available at [https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

data/CONTRIBUTING.md

@@ -0,0 +1,164 @@
+# Contributing to JPie
+
+Thank you for your interest in JPie. This guide explains how to build the gem,
+how to send a change, and the standards a change must meet.
+
+## License and the CLA
+
+JPie is licensed under the MIT License. When you open your first pull request,
+the CLA Assistant bot asks you to sign the
+[Contributor License Agreement](CLA.md). Sign it once. The bot records your
+agreement against your GitHub account and marks later pull requests as covered.
+
+The CLA lets Klaay distribute your change under the project license and keep
+the option of a commercial license of the combined work. You keep the copyright
+to your contribution.
+
+## Ways to contribute
+
+- Report a bug. Open an issue with the bug report template.
+- Request a feature. Open an issue with the feature request template.
+- Send a fix or a feature. Open a pull request from your fork.
+- Improve the documentation. The same pull request flow applies.
+
+For a large change, open an issue first and agree on the approach. This saves
+you from a rewrite after review.
+
+## Set up the repository
+
+You need Ruby 3.4 or later. Install the dependencies:
+
+```bash
+bin/setup
+```
+
+Open a console with the gem loaded:
+
+```bash
+bin/console
+```
+
+## Run the tests
+
+The suite runs against a dummy Rails application in `spec/dummy`. It needs no
+external database; it uses SQLite.
+
+```bash
+bundle exec rspec
+```
+
+Run one file:
+
+```bash
+bundle exec rspec spec/requests/regression/authorization_scope_show_bypass_spec.rb
+```
+
+## Run the benchmarks
+
+The benchmark suite measures query counts and memory for large `include` trees:
+
+```bash
+rake benchmark
+```
+
+It writes `tmp/request_benchmark_results.json`. Compare that file against
+[PERFORMANCE_BASELINE.md](PERFORMANCE_BASELINE.md) after any change to
+serialization or preloading. Set `DEBUG_QUERIES=1` to dump the raw SQL logs.
+
+## Before you open a pull request
+
+Run the same checks that CI runs. All must pass:
+
+```bash
+bundle exec rspec
+bundle exec rubocop
+```
+
+Do not silence a check to make it pass. Never add a `rubocop:disable` comment,
+and never change `.rubocop.yml` to hide an offense. Correct the code instead.
+
+## Write the test first
+
+JPie follows test-driven development. A change starts with a failing test:
+
+1. Write the test at the highest level the change allows. Prefer a request spec
+   in `spec/requests` over a unit spec.
+2. Run it and watch it fail.
+3. Write the smallest code that makes it pass.
+4. Refactor with the test green.
+
+A bug fix needs a regression spec in `spec/requests/regression/`. The spec must
+fail before the fix and pass after it.
+
+## Pull request standards
+
+- Keep each commit small, logical, and able to be reverted on its own.
+- Write a clear commit message. State what the commit does and why.
+- Add tests for a fix or a feature.
+- Keep the pull request focused. Do not mix unrelated changes.
+- Update `README.md` when you change or add a public behavior.
+- Add an entry to `CHANGELOG.md` under "Unreleased".
+- Never commit a token, a password, or a real account identifier.
+
+## Public API and versions
+
+JPie follows semantic versioning. Treat these as the public API:
+
+- The `jsonapi_resources` routing DSL.
+- The `JSONAPI::Resource` class methods and their options.
+- `JSONAPI::Configuration` and its settings.
+- The controller behavior and the response documents.
+- The test helpers in `JSONAPI::Testing`.
+
+Anything under `JSONAPI::Support` is internal. It may change in a patch
+release. State in your pull request when a change breaks the public API.
+
+## How a change gets merged
+
+Klaay staff merge to `main`. Branch protection requires a passing CI run and a
+review from a maintainer. Open your pull request from a fork; the CI job runs
+on it automatically.
+
+Klaay staff cut releases. Do not bump `lib/json_api/version.rb` in a pull
+request.
+
+## Writing standard for prose
+
+All prose in this repository — documentation, code comments, commit messages,
+and pull request text — follows ASD-STE100 (Simplified Technical English) and
+George Orwell's six rules of writing.
+
+ASD-STE100:
+
+- Use only approved words. One word, one meaning. Technical names and technical
+  verbs of this domain are permitted.
+- Write in the active voice. Use the present tense where possible.
+- Keep sentences short. Use a maximum of 20 words in an instruction and 25
+  words in descriptive text.
+- Give one instruction per sentence. Start an instruction with the command form
+  of the verb.
+- Do not make noun clusters of more than three nouns.
+- Do not use slang, idioms, or Latin abbreviations.
+- Use a vertical list when you give more than three facts or steps in sequence.
+- Start a warning or a caution with the command, not the explanation.
+
+Orwell's six rules:
+
+1. Never use a metaphor, simile, or other figure of speech which you are used
+   to seeing in print.
+2. Never use a long word where a short one will do.
+3. If it is possible to cut a word out, always cut it out.
+4. Never use the passive where you can use the active.
+5. Never use a foreign phrase, a scientific word, or a jargon word if you can
+   think of an everyday English equivalent.
+6. Break any of these rules sooner than say anything outright barbarous.
+
+## Code of conduct
+
+This project follows the [Contributor Covenant](CODE_OF_CONDUCT.md). By taking
+part, you agree to uphold it. Report unacceptable behavior to security@klaay.com.
+
+## Security
+
+Do not report a security problem in a public issue. Follow the private process
+in [SECURITY.md](SECURITY.md).

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Klaay ApS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/NOTICE

@@ -0,0 +1,25 @@
+JPie
+Copyright (c) 2026 Klaay ApS
+
+This gem is free software. You may use it under the terms of the MIT License.
+See the LICENSE file for the full text.
+
+------------------------------------------------------------------------------
+Third-party software
+------------------------------------------------------------------------------
+
+Runtime dependencies
+  JPie depends on four gems at runtime: rails, actionpack, pg_query, and
+  prosopite. Their licenses are MIT, BSD-3-Clause, and Apache-2.0. The full
+  list is in THIRD_PARTY_LICENSES.md. Every one is compatible with the MIT
+  license of this gem.
+
+  JPie bundles no third-party code. Bundler resolves and installs each
+  dependency from rubygems.org.
+
+------------------------------------------------------------------------------
+Trademarks
+------------------------------------------------------------------------------
+
+JPie, Klaay, and the Klaay logo are trademarks of Klaay ApS. The MIT license
+grants no rights to use these marks. See TRADEMARK.md.

data/README.md

@@ -1,5 +1,11 @@
 # JPie
 
+<img width="300" height="300" alt="ChatGPT Image Aug 30, 2026, 03_23_31 PM" src="https://github.com/user-attachments/assets/6f63901c-5415-4a7a-b359-dfa4a6b91e14" />
+
+[![Gem Version](https://badge.fury.io/rb/jpie.svg)](https://rubygems.org/gems/jpie)
+[![CI](https://github.com/klaayinc/json_api/actions/workflows/ci.yml/badge.svg)](https://github.com/klaayinc/json_api/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
 A Rails 8+ gem that provides JSON:API compliant routing DSL and generic JSON:API controllers for producing and consuming JSON:API resources.
 
 ## Features
@@ -1768,7 +1774,7 @@ For polymorphic relationships, omit the `type` in the model definition and provi
 ```typescript
 // Model definition - no type constraint
 api.define(
-  "workstream",
+  "activity",
   {
     topic: {},
     subject: {
@@ -1777,15 +1783,15 @@ api.define(
     },
   },
   {
-    collectionPath: "workstreams",
+    collectionPath: "activities",
   },
 );
 
 // Create with polymorphic relationship
-const { data: workstream } = await api
-  .create("workstream", {
+const { data: activity } = await api
+  .create("activity", {
     topic: "edit",
-    subject: { id: "456", type: "vendors" }, // Provide type at runtime
+    subject: { id: "456", type: "posts" }, // Provide type at runtime
   })
   .toPromise();
 ```
@@ -1831,10 +1837,51 @@ try {
 3. **Content-Type header**: Must be `application/vnd.api+json` for POST/PATCH/PUT requests
 4. **Filter values**: Comma-separated filter values are parsed as a single string; use array notation for multiple values
 
+## Releases
+
+Two paths publish the gem to rubygems.org:
+
+- **Real release**: run `bin/release [major|minor|patch]` on a branch. The
+  script bumps `lib/json_api/version.rb` and commits. Open a PR. When the bump
+  lands on main, the `Release` workflow publishes the gem and pushes the
+  `v<version>` tag. No OTP code is needed.
+- **Nightly prerelease**: the `Nightly prerelease` workflow runs each night at
+  03:00 UTC. When main has commits that no release or nightly covers, it
+  publishes `<next-patch>.pre.<stamp>` (for example `3.10.1.pre.202608300300`).
+  Bundler ignores prerelease versions unless a Gemfile asks for one, so
+  consumers on a normal pin never see them. The workflow moves the `nightly`
+  git tag to the published commit; `bin/nightly` computes the version and never
+  commits it.
+
+Both workflows authenticate with [trusted publishing](https://guides.rubygems.org/trusted-publishing/),
+so no API key or OTP code is stored anywhere. Set it up once on rubygems.org:
+open the jpie gem → Trusted publishers → add two GitHub Actions publishers for
+repository `klaayinc/json_api`, one with workflow `nightly.yml` and one with
+workflow `release.yml`.
+
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/klaay/json_api.
+Bug reports and pull requests are welcome. Read
+[CONTRIBUTING.md](CONTRIBUTING.md) before you open one. It covers the test
+suite, the writing standard, and the pull request checklist.
+
+- Report a bug or request a feature in the
+  [issue tracker](https://github.com/klaayinc/json_api/issues).
+- Sign the [Contributor License Agreement](CLA.md). The bot asks on your first
+  pull request.
+- Follow the [Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Security
+
+Do not report a security problem in a public issue. Send it to
+security@klaay.com. Read [SECURITY.md](SECURITY.md) for the process.
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+JPie is free software under the [MIT License](LICENSE).
+
+Copyright (c) 2026 Klaay ApS.
+
+The dependency licenses are in [THIRD_PARTY_LICENSES.md](THIRD_PARTY_LICENSES.md).
+The license grants no rights to the JPie and Klaay names or logos. Read
+[TRADEMARK.md](TRADEMARK.md).

data/SECURITY.md

@@ -0,0 +1,49 @@
+# Security Policy
+
+## Report a vulnerability
+
+Do not open a public issue for a security problem. Public disclosure puts users
+at risk before a fix exists.
+
+Send the report by email to **security@klaay.com**. Include:
+
+- A description of the problem.
+- The steps to reproduce it.
+- The JPie version and the Rails version you tested.
+- A minimal resource, route, or request that shows the problem.
+
+You may encrypt the report. Ask for a key at the same address.
+
+## What happens next
+
+- Klaay confirms receipt within three working days.
+- Klaay investigates and agrees a fix timeline with you.
+- Klaay credits you in the release notes, unless you ask to stay anonymous.
+
+Please give Klaay a reasonable time to release a fix before you disclose the
+problem in public.
+
+## Supported versions
+
+Klaay fixes security problems in the latest minor release. Upgrade to the
+latest version before you report a problem.
+
+## Scope
+
+This policy covers the JPie gem in this repository. It does not cover an
+application that uses JPie, and it does not cover the Klaay backend service.
+Report a backend problem to the same address, and Klaay routes it to the right
+team.
+
+## What counts as a JPie vulnerability
+
+JPie serializes and deserializes data that an application exposes. A report
+that matters most describes one of these:
+
+- A request that reads a record the authorization scope excludes.
+- A request that writes an attribute or a relationship the resource does not
+  declare as writable.
+- A filter, sort, or include value that reaches the database unchecked.
+- A response that leaks an attribute outside the declared fields.
+
+Never paste production data, a token, or a customer identifier into a report.

data/THIRD_PARTY_LICENSES.md

@@ -0,0 +1,27 @@
+# Third-party licenses
+
+JPie bundles no third-party code. It declares the four runtime dependencies
+below. Bundler installs them from rubygems.org when a user installs the gem.
+Every license is compatible with the MIT license in `LICENSE`.
+
+| Gem | Version | License |
+|---|---|---|
+| actionpack | 8.1.1 | MIT |
+| pg_query | 6.2.2 | BSD-3-Clause |
+| prosopite | 2.1.2 | Apache-2.0 |
+| rails | 8.1.1 | MIT |
+
+The versions are the ones in `Gemfile.lock`. A user resolves their own
+versions inside the range that `jpie.gemspec` declares.
+
+Regenerate this table after any dependency change:
+
+```bash
+bin/third-party-licenses
+```
+
+## Development dependencies
+
+The gems in the `development, test` group of the `Gemfile` do not ship with
+JPie. They build and test the gem. They place no license obligation on a user
+of the published gem.

data/TRADEMARK.md

@@ -0,0 +1,35 @@
+# Trademark Policy
+
+The JPie source code is free software under the MIT License. The names and the
+logos are not part of that license.
+
+## Reserved marks
+
+"JPie", "Klaay", and the Klaay logo are trademarks of Klaay ApS. The MIT
+License grants you rights to the code. It grants you no rights to these marks.
+
+## What you may do
+
+- Use the names to refer to this project truthfully. For example, state that
+  your application "uses JPie" or "is built on JPie".
+- Keep the names and the notices intact when you redistribute the gem
+  unchanged.
+
+## What you may not do
+
+- Do not use the names or the logo for a modified version in a way that
+  suggests Klaay makes it or endorses it.
+- Do not use the names or the logo for your product, your company, or your
+  domain name.
+- Do not publish a gem whose name suggests that Klaay maintains it.
+- Do not change or remove the marks to pass the software off as your own.
+
+## Modified versions
+
+You may fork and modify the code. The MIT License gives you this freedom. If
+you publish a modified gem, give it a different name and remove the Klaay logo,
+so users do not confuse it with the official gem.
+
+## Questions
+
+Ask about trademark use at legal@klaay.com.