@everystack/api 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -4,13 +4,102 @@ All notable changes to `@everystack/api` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
-## [Unreleased]
+## [0.4.4] - 2026-10-15
+
+### Added
+
+- PATCH honours ?deleted=include|only so a soft-deleted row can be restored
+
+### Fixed
+
+- refuse a JOIN embed list that names no real column
+- restore through PATCH is off unless softDelete.restore names the caller's role
+- a PATCH whose final body has nothing to write answers 400, not 500
+
+## [0.4.3] - 2026-10-14
+
+### BREAKING CHANGES
+
+- rowOwnership fails closed
+- a public route with a token answers 503 when the verifier is down
+
+### Added
+
+- a throwing after-hook reaches onError as kind 'hook'
+
+### Fixed
+
+- guard explicit hidden column query references
+- check select depth before hidden column traversal
+- audit refused hidden column requests
+- exclude hidden columns from relation embeds
+- resolve embed exclusions by column identity
+- fail closed on unresolved embed hidden columns
+- warn on invalid hidden column configuration
+- rowOwnership exceptRoles lifts the backstop for manage roles
+- an excepted role must filter its PATCH; role claim must be a string
+- a write filter must build a SQL condition
+- an infrastructure outage answers 503, never 401, and never leaks driver text
+- classify a wrapped outage cause, and close the review findings
+- the outage 503 is never cached
+- an empty owner value is not an owner
+- an owner cannot reassign the ownership column
+- rowOwnership throws on an unknown table
+- a non-string role claim never satisfies a role gate
+- rowOwnership.exceptRoles requires pgSettings
+- an excepted write needs a role from pgSettings
+- the unbacked-exemption 500 reaches onError
+- a throwing before-hook reaches onError
+- an auth outage 503 reaches onError
+- the auth-outage report never throws and names only known routes
+- an RPC name resolves only to an own key of rpc
+- a JWKS timeout and a bad service credential answer 503
+- a table request that hits an outage answers 503
+- an outage fault names only a declared RPC
+- reporting a fault never throws on an unreadable error
+- an outage inside a before-hook answers 503
+- an after-hook fault no longer claims the write committed
+- after-hooks run after the commit
+- before-hook faults are reported after the transaction
+- guard every read of a thrown value in the handler
+- resolve embeds and table-name twins by own keys only
+
+### Documentation
+
+- say that an RPC name resolves only to an own key
+- say why the 2xx guard stands and what a retry wrapper must reset
+- rowOwnership exceptRoles
+- rowOwnership fails closed, and createHandler validates it
+- name the breaks, and correct the non-owner write response
+- an owner cannot change the ownership column on PATCH
+- the protectedFields strip is per spelling; the owner compare is on strings
+- rowOwnership refuses a table it cannot find anywhere
+- say what the unknown-table check cannot catch
+- a thrown non-Error has no stack in the onError fault
+- tell a verifier that logs in as the caller to catch class 28
+- publicRoutes and publicRpc skip the token, not the client check
+- afterRpc runs after the commit, the table after-hooks before it
+
+## [0.4.2] - 2026-09-22
+
+### Fixed
+
+- refresh expired JWT instead of silently failing every request
+
+## [0.4.1] - 2026-09-22
 
 ### Added
 
 - auto-generated changelogs from conventional commits
 - automate the version-drift check — a manual note is not a gate
 
+### Fixed
+
+- coerce date-typed column values before insert/update
+- review follow-ups on date-column coercion
+- second review pass -- ISO strictness, null rows, sibling array-safety
+- reject offset-less datetime strings (ambiguous: server-local, not UTC)
+
 ## [0.4.0] - 2026-07-14
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/api",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "PostgREST-compatible HTTP handler + typed fetch client for Drizzle ORM",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/client/index.ts

@@ -39,6 +39,9 @@ export interface CountResponse<T> extends ClientResponse<T> {
   total: number;
 }
 
+/** Soft-delete scope: `include` reads or writes live and deleted rows, `only` deleted rows. */
+export type DeletedMode = 'include' | 'only';
+
 export interface QueryBuilder {
   eq(column: string, value: string): QueryBuilder;
   neq(column: string, value: string): QueryBuilder;
@@ -68,6 +71,9 @@ export interface QueryBuilder {
   order(column: string, direction?: 'asc' | 'desc'): QueryBuilder;
   limit(count: number): QueryBuilder;
   offset(count: number): QueryBuilder;
+  /** Soft-delete tables: ?deleted=include|only on select and update. `.deleted('only').update({ deletedAt: null })` restores,
+   *  for a role the handler lists in `softDelete.restore`; for anyone else update ignores it. */
+  deleted(mode: DeletedMode): QueryBuilder;
   execute(): Promise<ClientResponse<unknown[]>>;
   executeWithCount(): Promise<CountResponse<unknown[]>>;
   single(): Promise<ClientResponse<unknown>>;
@@ -123,6 +129,7 @@ function createQueryBuilder(options: ClientOptions, table: string): QueryBuilder
   let orderParam: string | null = null;
   let limitParam: number | null = null;
   let offsetParam: number | null = null;
+  let deletedParam: DeletedMode | null = null;
 
   const builder: QueryBuilder = {
     eq(column, value) { filters.push([column, `eq.${value}`]); return builder; },
@@ -151,9 +158,10 @@ function createQueryBuilder(options: ClientOptions, table: string): QueryBuilder
     order(column, direction = 'asc') { orderParam = `${column}.${direction}`; return builder; },
     limit(count) { limitParam = count; return builder; },
     offset(count) { offsetParam = count; return builder; },
+    deleted(mode) { deletedParam = mode; return builder; },
 
     async execute(): Promise<ClientResponse<unknown[]>> {
-      const url = buildUrl(options.baseUrl, table, filters, selectParam, orderParam, limitParam, offsetParam);
+      const url = buildUrl(options.baseUrl, table, filters, selectParam, orderParam, limitParam, offsetParam, deletedParam);
       const headers = await buildHeaders(options);
       const { response, retried } = await fetchWithRetry(url, { method: 'GET', headers }, options);
 
@@ -168,7 +176,7 @@ function createQueryBuilder(options: ClientOptions, table: string): QueryBuilder
     },
 
     async executeWithCount(): Promise<CountResponse<unknown[]>> {
-      const url = buildUrl(options.baseUrl, table, filters, selectParam, orderParam, limitParam, offsetParam);
+      const url = buildUrl(options.baseUrl, table, filters, selectParam, orderParam, limitParam, offsetParam, deletedParam);
       const headers = await buildHeaders(options);
       headers['Prefer'] = 'count=exact';
 
@@ -220,7 +228,7 @@ function createQueryBuilder(options: ClientOptions, table: string): QueryBuilder
     },
 
     async update(data: Record<string, unknown>): Promise<ClientResponse<unknown[]>> {
-      const url = buildUrl(options.baseUrl, table, filters, selectParam, orderParam, null, null);
+      const url = buildUrl(options.baseUrl, table, filters, selectParam, orderParam, null, null, deletedParam);
       const headers = await buildHeaders(options);
       headers['Content-Type'] = 'application/json';
 
@@ -340,6 +348,7 @@ function buildUrl(
   order: string | null,
   limit: number | null,
   offset: number | null,
+  deleted: DeletedMode | null = null,
 ): string {
   const path = `${baseUrl}/${table}`;
   const base = typeof globalThis.location !== 'undefined' ? globalThis.location.origin : undefined;
@@ -355,6 +364,7 @@ function buildUrl(
   if (order) url.searchParams.set('order', order);
   if (limit !== null) url.searchParams.set('limit', String(limit));
   if (offset !== null) url.searchParams.set('offset', String(offset));
+  if (deleted) url.searchParams.set('deleted', deleted);
 
   return url.toString();
 }