@homespunapps/core 1.6.38 → 1.6.40

package/dist/client.d.ts

@@ -613,6 +613,26 @@ export declare class HomespunClient {
      * is a 404 (HomespunApiError `row_not_found`), matching a normal delete.
      */
     purgeAppRow(appId: string, collection: string, key: string): Promise<void>;
+    /**
+     * POST /v1/apps/:id/collections/:name/:key/restore: undo a soft delete.
+     *
+     * Owner/agent only, independent of the collection's permission lists. A row
+     * that was PURGED is not restorable (410 `restore_expired`), and a restore
+     * can legitimately fail on quota or on a unique value another live row took
+     * while this one was deleted (409 `restore_conflict`).
+     */
+    restoreAppRow(appId: string, collection: string, key: string): Promise<{
+        row: AppRow;
+    }>;
+    /**
+     * GET /v1/apps/:id/collections/:name/deleted: the recovery bin, newest
+     * deletion first. Owner/agent only. Page with `before`, passing back the
+     * previous page's `next_before`.
+     */
+    listDeletedAppRows(appId: string, collection: string, opts?: {
+        limit?: number;
+        before?: string;
+    }): Promise<DeletedAppRowsPage>;
     /** PATCH /v1/apps/:id/collections/:name/:key — optimistic-locked update. */
     updateAppRow(appId: string, collection: string, key: string, body: {
         data: unknown;
@@ -666,6 +686,15 @@ export declare class HomespunClient {
         decision: "approve" | "reject";
         note?: string;
     }): Promise<CommunitySubmissionDetail>;
+    /**
+     * POST /v1/community/submissions/:id/unpublish (publisher): take your own
+     * live listing down. It leaves the public gallery, search, and the direct
+     * snapshot install link; existing installs are untouched, because an install
+     * is a fresh private copy rather than a live reference. Idempotent, and 404
+     * when the snapshot does not exist OR is not yours (indistinguishable on
+     * purpose). Republish a new version to undo it.
+     */
+    unpublishCommunityTemplate(snapshotId: string): Promise<CommunitySubmissionDetail>;
     /**
      * GET the install-time config contract for an installable template (its
      * settings collection + the ordered keyed config/upload steps). Use it to
@@ -1100,6 +1129,32 @@ export interface AppRow {
     updated_at: string;
     deleted_at: string | null;
 }
+/** One tombstoned row as the recovery bin reports it. */
+export interface DeletedAppRow {
+    key: string;
+    data: unknown;
+    version: number;
+    /** Who removed it. */
+    author: {
+        kind: string;
+        id: string;
+    };
+    /** Who created it; null on rows predating the creator columns. */
+    creator: {
+        kind: string;
+        id: string;
+    } | null;
+    created_at: string;
+    deleted_at: string;
+    /** When this row stops being recoverable. */
+    recoverable_until: string;
+    /** True once purged: contents already scrubbed, and restore refuses it. */
+    purged: boolean;
+}
+export interface DeletedAppRowsPage {
+    rows: DeletedAppRow[];
+    next_before: string | null;
+}
 export interface AppRowsPage {
     rows: AppRow[];
     next_cursor: string | null;

package/dist/client.js

@@ -1045,6 +1045,37 @@ export class HomespunClient {
         if (!r.ok)
             this.fail(r);
     }
+    /**
+     * POST /v1/apps/:id/collections/:name/:key/restore: undo a soft delete.
+     *
+     * Owner/agent only, independent of the collection's permission lists. A row
+     * that was PURGED is not restorable (410 `restore_expired`), and a restore
+     * can legitimately fail on quota or on a unique value another live row took
+     * while this one was deleted (409 `restore_conflict`).
+     */
+    async restoreAppRow(appId, collection, key) {
+        const r = await this.call("POST", `/v1/apps/${encodeURIComponent(appId)}/collections/${encodeURIComponent(collection)}/${encodeURIComponent(key)}/restore`);
+        if (!r.ok)
+            this.fail(r);
+        return this.asObject(r);
+    }
+    /**
+     * GET /v1/apps/:id/collections/:name/deleted: the recovery bin, newest
+     * deletion first. Owner/agent only. Page with `before`, passing back the
+     * previous page's `next_before`.
+     */
+    async listDeletedAppRows(appId, collection, opts = {}) {
+        const q = new URLSearchParams();
+        if (opts.limit !== undefined)
+            q.set("limit", String(opts.limit));
+        if (opts.before !== undefined)
+            q.set("before", opts.before);
+        const qs = q.toString();
+        const r = await this.call("GET", `/v1/apps/${encodeURIComponent(appId)}/collections/${encodeURIComponent(collection)}/deleted${qs ? `?${qs}` : ""}`);
+        if (!r.ok)
+            this.fail(r);
+        return this.asObject(r);
+    }
     /** PATCH /v1/apps/:id/collections/:name/:key — optimistic-locked update. */
     async updateAppRow(appId, collection, key, body) {
         const r = await this.call("PATCH", `/v1/apps/${encodeURIComponent(appId)}/collections/${encodeURIComponent(collection)}/${encodeURIComponent(key)}`, body);
@@ -1164,6 +1195,21 @@ export class HomespunClient {
             this.fail(r);
         return this.asObject(r);
     }
+    /**
+     * POST /v1/community/submissions/:id/unpublish (publisher): take your own
+     * live listing down. It leaves the public gallery, search, and the direct
+     * snapshot install link; existing installs are untouched, because an install
+     * is a fresh private copy rather than a live reference. Idempotent, and 404
+     * when the snapshot does not exist OR is not yours (indistinguishable on
+     * purpose). Republish a new version to undo it.
+     */
+    async unpublishCommunityTemplate(snapshotId) {
+        const path = `/v1/community/submissions/${encodeURIComponent(snapshotId)}/unpublish`;
+        const r = await this.call("POST", path);
+        if (!r.ok)
+            this.fail(r);
+        return this.asObject(r);
+    }
     // -------------------------------------------------------------------------
     // Agent-key community install (install-config programme, PR 4). Both act AS
     // the calling agent's owning human, who becomes the installed app's owner. A

package/dist/icons.js

@@ -65,8 +65,8 @@ export function validateIconEmoji(raw) {
             error: "icon_emoji must not contain control characters",
         };
     }
-    // Count grapheme clusters. Intl.Segmenter is available in Node 20+ and all
-    // evergreen browsers (our targets); guard defensively anyway.
+    // Count grapheme clusters. Intl.Segmenter is available in every supported
+    // Node and all evergreen browsers (our targets); guard defensively anyway.
     let graphemeCount;
     if (typeof Intl !== "undefined" && typeof Intl.Segmenter === "function") {
         const seg = new Intl.Segmenter("en", { granularity: "grapheme" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homespunapps/core",
-  "version": "1.6.38",
+  "version": "1.6.40",
   "description": "Homespun relay client: typed HTTP + WebSocket operations against a Homespun relay. Framework-free.",
   "license": "MIT",
   "type": "module",
@@ -45,10 +45,10 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.1.2",
     "@types/ws": "^8.18.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.10"
   },
   "repository": {
     "type": "git",