@everystack/mcp 0.4.6 → 0.4.7

package/dist/core.md

@@ -104,7 +104,7 @@ const handler = createHandler(db, schema, {
   protectedFields: { profiles: ['role'] },      // Strip from writes
   rowOwnership: { posts: { column: 'authorId', userField: 'sub' } },
   hooks: { posts: { beforeCreate: async (body, user) => ({ ...body, authorId: user?.sub }) } },
-  softDelete: { column: 'deletedAt', tables: ['posts'] },
+  softDelete: { column: 'deletedAt', tables: ['posts'] },  // Models: derived, don't hand-write
   maxEmbedDepth: 3,
   maxLimit: 1000,
 });

package/dist/handler-options.md

@@ -100,6 +100,7 @@ maxLimit: 1000,        // Max ?limit= value (default: 10000)
 ### Other
 ```typescript
 softDelete: { column: 'deletedAt', tables: ['posts'] },  // DELETE -> UPDATE SET deletedAt
+// ^ With Models this is DERIVED from each model's `softDelete: true` — do not hand-write it.
 naming: 'snake_case',  // Response key format ('camelCase' default)
 ```
 

package/dist/index.cjs

@@ -22411,9 +22411,12 @@ function registerDesignSchemaPrompt(server) {
                 "Declare each table with `defineModel`, following these conventions:",
                 "- UUID primary keys: `id: field.uuid().primaryKey().defaultRandom()`",
                 "- Timestamps: `createdAt: field.timestamptz().defaultNow().notNull()`",
-                "- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` \u2014 the flag is what",
-                "  excludes soft-deleted rows from public reads and the data API. The field alone does nothing:",
-                "  visibility is declared, never inferred from a column name",
+                "- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` \u2014 the field alone",
+                "  does nothing. The flag decides DURABILITY (true makes DELETE mark deleted_at instead of",
+                "  destroying the row, and hides marked rows from the data API) and, where there is a public",
+                "  read, VISIBILITY (deleted_at IS NULL in the anon policy). defineModel REFUSES to guess on any",
+                "  model with deletedAt that has a public read or can be deleted from, so it throws at import if",
+                "  you omit it. Never hand-write the handler softDelete config \u2014 it is derived from this flag",
                 "- Foreign keys via relations: `field.uuid().references(() => Author)` / `belongsTo`/`hasMany`",
                 "- Sensitive columns: `.private()` (hidden from the API); write-guarded: `.readonly()`",
                 "- Named exports (PascalCase model var, e.g. `export const Post = defineModel('posts', \u2026)`)",
@@ -23761,7 +23764,7 @@ async function runGovernanceCli(argv) {
 }
 
 // src/index.ts
-var version2 = (true ? "0.4.6" : null) ?? "0.3.0-dev";
+var version2 = (true ? "0.4.7" : null) ?? "0.3.0-dev";
 var INSTRUCTIONS = [
   "You govern how any agent builds everystack \u2014 a self-hosted application stack for Expo apps on AWS.",
   "Your job is not only to advise but to keep the build on-script: the architecture the maintainer",

package/dist/schema-patterns.md

@@ -34,6 +34,9 @@ export const Post = defineModel('posts', {
     updatedAt: field.timestamptz().notNull().defaultNow(),
     deletedAt: field.timestamptz(),
   },
+  // Required here, not optional: this model has a `deletedAt` field AND grants DELETE, so
+  // `defineModel` refuses to guess. See Soft Delete below for what each value means.
+  softDelete: true,
   abilities: [can('read'), can('create'), can('update'), can('delete')],
 });
 ```
@@ -59,11 +62,34 @@ updatedAt: field.timestamptz().notNull().defaultNow(),
 ```
 
 ### Soft Delete
-Add `deletedAt` for soft-deletable tables:
+The field alone does nothing. Declare BOTH — the column and what it means:
 ```typescript
 deletedAt: field.timestamptz(),
+softDelete: true,   // on the model, beside `fields` — NOT in the handler
 ```
-Configure in handler: `softDelete: { column: 'deletedAt', tables: ['posts'] }`.
+
+**`defineModel` REFUSES to guess** when a model has `deletedAt` and either a public read or a
+way to DELETE (`can('delete')`, `can('manage')` — which is "all actions" — or a `privileges`
+DELETE grant). Omit the line on such a model and it throws at import.
+
+It is declared because it changes two different things, and neither default is safe:
+
+- **Durability, on every model** — `true` makes a `DELETE` mark `deleted_at` instead of
+  removing the row, and then hides marked rows from the data API's reads and updates. `false`
+  makes `DELETE` permanent.
+- **Visibility, only where there is a public read** — `true` AND-s `deleted_at IS NULL` into
+  the anon policy. On an owner-scoped or admin-only model the compiled SQL is identical either
+  way, so the durability half is the one that matters there.
+
+Pick `true` if the row is meant to survive its own deletion — anything with a cleanup or purge
+job, an audit trail, or rows other tables reference. Pick `false` if `deleted_at` here is
+audit-only and a `DELETE` really should remove the row. Getting this wrong is not cosmetic: a
+table whose S3 cleanup job finds work by `deleted_at IS NOT NULL` orphans every file it should
+have purged if the row is hard-deleted instead.
+
+**Do not hand-write the handler's `softDelete: { column, tables }`.** With Models, the handler
+config is DERIVED from this flag (`deriveHandlerConfig`), so writing both is how the two drift
+apart — and a hand-written list silently losing a table is exactly how this bug shipped.
 
 ### Foreign Keys
 ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/mcp",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Governance layer that governs how any agent builds everystack — grounding, cheat gates, and Model-aware tooling over MCP",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -40,9 +40,9 @@
     "tsx": "4.21.0",
     "typescript": "5.9.3",
     "zod": "3.25.67",
-    "@everystack/cli": "0.4.49",
-    "@everystack/model": "0.4.13",
-    "@everystack/server": "0.4.19"
+    "@everystack/cli": "0.4.57",
+    "@everystack/model": "0.4.16",
+    "@everystack/server": "0.4.20"
   },
   "scripts": {
     "test": "jest",

package/src/prompts/design-schema.ts

@@ -41,9 +41,12 @@ export function registerDesignSchemaPrompt(server: McpServer): void {
                 'Declare each table with `defineModel`, following these conventions:',
                 '- UUID primary keys: `id: field.uuid().primaryKey().defaultRandom()`',
                 '- Timestamps: `createdAt: field.timestamptz().defaultNow().notNull()`',
-                '- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` — the flag is what',
-                '  excludes soft-deleted rows from public reads and the data API. The field alone does nothing:',
-                '  visibility is declared, never inferred from a column name',
+                '- Soft delete: a `deletedAt: field.timestamptz()` field PLUS `softDelete: true` — the field alone',
+                '  does nothing. The flag decides DURABILITY (true makes DELETE mark deleted_at instead of',
+                '  destroying the row, and hides marked rows from the data API) and, where there is a public',
+                '  read, VISIBILITY (deleted_at IS NULL in the anon policy). defineModel REFUSES to guess on any',
+                '  model with deletedAt that has a public read or can be deleted from, so it throws at import if',
+                '  you omit it. Never hand-write the handler softDelete config — it is derived from this flag',
                 '- Foreign keys via relations: `field.uuid().references(() => Author)` / `belongsTo`/`hasMany`',
                 '- Sensitive columns: `.private()` (hidden from the API); write-guarded: `.readonly()`',
                 '- Named exports (PascalCase model var, e.g. `export const Post = defineModel(\'posts\', …)`)',

package/src/resources/core.md

@@ -104,7 +104,7 @@ const handler = createHandler(db, schema, {
   protectedFields: { profiles: ['role'] },      // Strip from writes
   rowOwnership: { posts: { column: 'authorId', userField: 'sub' } },
   hooks: { posts: { beforeCreate: async (body, user) => ({ ...body, authorId: user?.sub }) } },
-  softDelete: { column: 'deletedAt', tables: ['posts'] },
+  softDelete: { column: 'deletedAt', tables: ['posts'] },  // Models: derived, don't hand-write
   maxEmbedDepth: 3,
   maxLimit: 1000,
 });

package/src/resources/handler-options.md

@@ -100,6 +100,7 @@ maxLimit: 1000,        // Max ?limit= value (default: 10000)
 ### Other
 ```typescript
 softDelete: { column: 'deletedAt', tables: ['posts'] },  // DELETE -> UPDATE SET deletedAt
+// ^ With Models this is DERIVED from each model's `softDelete: true` — do not hand-write it.
 naming: 'snake_case',  // Response key format ('camelCase' default)
 ```
 

package/src/resources/schema-patterns.md

@@ -34,6 +34,9 @@ export const Post = defineModel('posts', {
     updatedAt: field.timestamptz().notNull().defaultNow(),
     deletedAt: field.timestamptz(),
   },
+  // Required here, not optional: this model has a `deletedAt` field AND grants DELETE, so
+  // `defineModel` refuses to guess. See Soft Delete below for what each value means.
+  softDelete: true,
   abilities: [can('read'), can('create'), can('update'), can('delete')],
 });
 ```
@@ -59,11 +62,34 @@ updatedAt: field.timestamptz().notNull().defaultNow(),
 ```
 
 ### Soft Delete
-Add `deletedAt` for soft-deletable tables:
+The field alone does nothing. Declare BOTH — the column and what it means:
 ```typescript
 deletedAt: field.timestamptz(),
+softDelete: true,   // on the model, beside `fields` — NOT in the handler
 ```
-Configure in handler: `softDelete: { column: 'deletedAt', tables: ['posts'] }`.
+
+**`defineModel` REFUSES to guess** when a model has `deletedAt` and either a public read or a
+way to DELETE (`can('delete')`, `can('manage')` — which is "all actions" — or a `privileges`
+DELETE grant). Omit the line on such a model and it throws at import.
+
+It is declared because it changes two different things, and neither default is safe:
+
+- **Durability, on every model** — `true` makes a `DELETE` mark `deleted_at` instead of
+  removing the row, and then hides marked rows from the data API's reads and updates. `false`
+  makes `DELETE` permanent.
+- **Visibility, only where there is a public read** — `true` AND-s `deleted_at IS NULL` into
+  the anon policy. On an owner-scoped or admin-only model the compiled SQL is identical either
+  way, so the durability half is the one that matters there.
+
+Pick `true` if the row is meant to survive its own deletion — anything with a cleanup or purge
+job, an audit trail, or rows other tables reference. Pick `false` if `deleted_at` here is
+audit-only and a `DELETE` really should remove the row. Getting this wrong is not cosmetic: a
+table whose S3 cleanup job finds work by `deleted_at IS NOT NULL` orphans every file it should
+have purged if the row is hard-deleted instead.
+
+**Do not hand-write the handler's `softDelete: { column, tables }`.** With Models, the handler
+config is DERIVED from this flag (`deriveHandlerConfig`), so writing both is how the two drift
+apart — and a hand-written list silently losing a table is exactly how this bug shipped.
 
 ### Foreign Keys
 ```typescript