@veloxts/router 0.8.1 → 0.8.3

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @veloxts/router
 
+## 0.8.3
+
+### Patch Changes
+
+- bump dependencies across packages (April 2026)
+- Updated dependencies
+  - @veloxts/core@0.8.3
+  - @veloxts/validation@0.8.3
+
+## 0.8.2
+
+### Patch Changes
+
+- merge URL params into POST input for flat .rest() paths
+- Updated dependencies
+  - @veloxts/core@0.8.2
+  - @veloxts/validation@0.8.2
+
 ## 0.8.1
 
 ### Patch Changes
@@ -453,6 +471,7 @@
 - ### feat(auth): Unified Adapter-Only Architecture
 
   **New Features:**
+
   - Add `JwtAdapter` implementing the `AuthAdapter` interface for unified JWT authentication
   - Add `jwtAuth()` convenience function for direct adapter usage with optional built-in routes (`/api/auth/refresh`, `/api/auth/logout`)
   - Add `AuthContext` discriminated union (`NativeAuthContext | AdapterAuthContext`) for type-safe auth mode handling
@@ -460,20 +479,24 @@
   - Add shared decoration utilities (`decorateAuth`, `setRequestAuth`, `checkDoubleRegistration`)
 
   **Architecture Changes:**
+
   - `authPlugin` now uses `JwtAdapter` internally - all authentication flows through the adapter pattern
   - Single code path for authentication (no more dual native/adapter modes)
   - `authContext.authMode` is now always `'adapter'` with `providerId='jwt'` when using `authPlugin`
 
   **Breaking Changes:**
+
   - Remove deprecated `LegacySessionConfig` interface (use `sessionMiddleware` instead)
   - Remove deprecated `session` field from `AuthConfig`
   - `User` interface no longer has index signature (extend via declaration merging)
 
   **Type Safety Improvements:**
+
   - `AuthContext` discriminated union enables exhaustive type narrowing based on `authMode`
   - Export `NativeAuthContext` and `AdapterAuthContext` types for explicit typing
 
   **Migration:**
+
   - Existing `authPlugin` usage remains backward-compatible
   - If checking `authContext.token`, use `authContext.session` instead (token stored in session for adapter mode)
 
@@ -492,10 +515,12 @@
   Addresses 9 user feedback items to improve DX, reduce boilerplate, and eliminate template duplications.
 
   ### Phase 1: Validation Helpers (`@veloxts/validation`)
+
   - Add `prismaDecimal()`, `prismaDecimalNullable()`, `prismaDecimalOptional()` for Prisma Decimal → number conversion
   - Add `dateToIso`, `dateToIsoNullable`, `dateToIsoOptional` aliases for consistency
 
   ### Phase 2: Template Deduplication (`@veloxts/auth`)
+
   - Export `createEnhancedTokenStore()` with token revocation and refresh token reuse detection
   - Export `parseUserRoles()` and `DEFAULT_ALLOWED_ROLES`
   - Fix memory leak: track pending timeouts for proper cleanup on `destroy()`
@@ -503,17 +528,20 @@
   - Fix jwtManager singleton pattern in templates
 
   ### Phase 3: Router Helpers (`@veloxts/router`)
+
   - Add `createRouter()` returning `{ collections, router }` for DRY setup
   - Add `toRouter()` for router-only use cases
   - Update all router templates to use `createRouter()`
 
   ### Phase 4: Guard Type Narrowing - Experimental (`@veloxts/auth`, `@veloxts/router`)
+
   - Add `NarrowingGuard` interface with phantom `_narrows` type
   - Add `authenticatedNarrow` and `hasRoleNarrow()` guards
   - Add `guardNarrow()` method to `ProcedureBuilder` for context narrowing
   - Enables `ctx.user` to be non-null after guard passes
 
   ### Phase 5: Documentation (`@veloxts/router`)
+
   - Document `.rest()` override patterns
   - Document `createRouter()` helper usage
   - Document `guardNarrow()` experimental API
@@ -1438,6 +1466,7 @@
 ### Patch Changes
 
 - Fix Prisma client generation in scaffolder
+
   - Added automatic Prisma client generation after dependency installation in create-velox-app
   - Fixed database template to validate DATABASE_URL environment variable
   - Added alpha release warning to all package READMEs

package/dist/rest/adapter.js

@@ -218,25 +218,20 @@ function gatherInput(request, route) {
     const params = isPlainObject(request.params) ? request.params : {};
     const query = isPlainObject(request.query) ? request.query : {};
     const body = isPlainObject(request.body) ? request.body : {};
-    // Check if this is a nested route (has single parent or multiple parents)
-    const hasParentResource = route.procedure.parentResource !== undefined ||
-        (route.procedure.parentResources !== undefined && route.procedure.parentResources.length > 0);
     switch (route.method) {
         case 'GET':
         case 'DELETE':
             // GET/DELETE: params (for :id and all parent params) + query (for filters/pagination/options)
             return { ...params, ...query };
+        case 'POST':
         case 'PUT':
         case 'PATCH':
-            // PUT/PATCH: params (for :id and all parent params) + body (for data)
+            // POST/PUT/PATCH: params (for :id and all parent params) + body (for data).
+            // POST must merge params unconditionally — flat conventional creates have
+            // empty params (no-op spread), but RPC-style .rest() overrides such as
+            // POST /retro/phase/:sessionId/next rely on this merge to surface path
+            // params to the input schema.
             return { ...params, ...body };
-        case 'POST':
-            // POST: For nested routes, merge params (for all parent IDs) with body
-            // For flat routes, use body only (no ID in params for creates)
-            if (hasParentResource) {
-                return { ...params, ...body };
-            }
-            return request.body;
         default:
             return request.body;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veloxts/router",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Procedure definitions with tRPC and REST routing for VeloxTS framework",
   "type": "module",
   "main": "dist/index.js",
@@ -37,17 +37,17 @@
     }
   },
   "dependencies": {
-    "@trpc/server": "11.12.0",
-    "fastify": "5.8.2",
-    "@veloxts/core": "0.8.1",
-    "@veloxts/validation": "0.8.1"
+    "@trpc/server": "11.16.0",
+    "fastify": "5.8.5",
+    "@veloxts/core": "0.8.3",
+    "@veloxts/validation": "0.8.3"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "4.1.0",
-    "esbuild": "0.27.4",
+    "@vitest/coverage-v8": "4.1.5",
+    "esbuild": "0.28.0",
     "typescript": "5.9.3",
-    "vite": "7.3.1",
-    "vitest": "4.1.0",
+    "vite": "7.3.2",
+    "vitest": "4.1.5",
     "zod": "4.3.6"
   },
   "peerDependencies": {