@everystack/api 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -4,13 +4,90 @@ All notable changes to `@everystack/api` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
-## [Unreleased]
+## [0.4.3] - 2026-10-14
+
+### BREAKING CHANGES
+
+- rowOwnership fails closed
+- a public route with a token answers 503 when the verifier is down
+
+### Added
+
+- a throwing after-hook reaches onError as kind 'hook'
+
+### Fixed
+
+- guard explicit hidden column query references
+- check select depth before hidden column traversal
+- audit refused hidden column requests
+- exclude hidden columns from relation embeds
+- resolve embed exclusions by column identity
+- fail closed on unresolved embed hidden columns
+- warn on invalid hidden column configuration
+- rowOwnership exceptRoles lifts the backstop for manage roles
+- an excepted role must filter its PATCH; role claim must be a string
+- a write filter must build a SQL condition
+- an infrastructure outage answers 503, never 401, and never leaks driver text
+- classify a wrapped outage cause, and close the review findings
+- the outage 503 is never cached
+- an empty owner value is not an owner
+- an owner cannot reassign the ownership column
+- rowOwnership throws on an unknown table
+- a non-string role claim never satisfies a role gate
+- rowOwnership.exceptRoles requires pgSettings
+- an excepted write needs a role from pgSettings
+- the unbacked-exemption 500 reaches onError
+- a throwing before-hook reaches onError
+- an auth outage 503 reaches onError
+- the auth-outage report never throws and names only known routes
+- an RPC name resolves only to an own key of rpc
+- a JWKS timeout and a bad service credential answer 503
+- a table request that hits an outage answers 503
+- an outage fault names only a declared RPC
+- reporting a fault never throws on an unreadable error
+- an outage inside a before-hook answers 503
+- an after-hook fault no longer claims the write committed
+- after-hooks run after the commit
+- before-hook faults are reported after the transaction
+- guard every read of a thrown value in the handler
+- resolve embeds and table-name twins by own keys only
+
+### Documentation
+
+- say that an RPC name resolves only to an own key
+- say why the 2xx guard stands and what a retry wrapper must reset
+- rowOwnership exceptRoles
+- rowOwnership fails closed, and createHandler validates it
+- name the breaks, and correct the non-owner write response
+- an owner cannot change the ownership column on PATCH
+- the protectedFields strip is per spelling; the owner compare is on strings
+- rowOwnership refuses a table it cannot find anywhere
+- say what the unknown-table check cannot catch
+- a thrown non-Error has no stack in the onError fault
+- tell a verifier that logs in as the caller to catch class 28
+- publicRoutes and publicRpc skip the token, not the client check
+- afterRpc runs after the commit, the table after-hooks before it
+
+## [0.4.2] - 2026-09-22
+
+### Fixed
+
+- refresh expired JWT instead of silently failing every request
+
+## [0.4.1] - 2026-09-22
 
 ### Added
 
 - auto-generated changelogs from conventional commits
 - automate the version-drift check — a manual note is not a gate
 
+### Fixed
+
+- coerce date-typed column values before insert/update
+- review follow-ups on date-column coercion
+- second review pass -- ISO strictness, null rows, sibling array-safety
+- reject offset-less datetime strings (ambiguous: server-local, not UTC)
+
 ## [0.4.0] - 2026-07-14
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/api",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "PostgREST-compatible HTTP handler + typed fetch client for Drizzle ORM",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/client/index.ts

@@ -13,6 +13,8 @@ export interface ClientOptions {
   getToken?: () => string | null | Promise<string | null>;
   /** Called on 401 — return a new token to retry, or null to fail */
   onTokenExpired?: () => Promise<string | null>;
+  /** Called when a 401 could not be recovered — refresh failed, or the retry with the refreshed token also 401/403'd */
+  onAuthFailure?: () => void;
   /** Client credentials sent with every request */
   clientCredentials?: {
     id: string;
@@ -296,6 +298,8 @@ async function fetchWithRetry(
       const retryResponse = await fetch(url, { ...init, headers: retryHeaders });
 
       if (!retryResponse.ok) {
+        // Refreshed token was still rejected — unrecoverable.
+        options.onAuthFailure?.();
         return { retried: { data: null, error: await parseError(retryResponse) } };
       }
 
@@ -303,7 +307,8 @@ async function fetchWithRetry(
       return { response: retryResponse };
     }
 
-    // Refresh failed
+    // Refresh failed — unrecoverable.
+    options.onAuthFailure?.();
     return { retried: { data: null, error: await parseError(response) } };
   }