json-rest-api 1.0.20 → 1.0.22

package/audit/traces/trace-read-query.md

@@ -0,0 +1,25 @@
+# Trace: Read Query
+
+## Scope
+- Non-anyapi path only.
+
+## Scenario
+- Query collection of resources (`books.query`) with JSON:API envelope.
+
+## Input shape
+- Method call: `api.resources.books.query({ queryParams, simplified: false })`
+
+## Call path
+1. `register-scope-routes` binds `GET /:scope` to `scope.query` ([plugins/core/rest-api-plugin-hooks/register-scope-routes.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-hooks/register-scope-routes.js)).
+2. `query.js` validates query params then runs `scope.checkPermissions` before storage ([query.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/query.js)).
+3. `helpers.dataQuery` builds SQL + include/pagination transforms in knex plugin ([rest-api-knex-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-knex-plugin.js)).
+4. JSON:API response assembly flows through query transformers and field helpers ([plugins/core/lib/querying/knex-json-api-transformers-querying.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/querying/knex-json-api-transformers-querying.js)).
+
+## Runtime evidence
+- `npm test` confirms collection query path in CRUD suite:
+  - `ok 3 - should retrieve collection of resources` at `audit/evidence/tests/npm-test-json-rest-api.log:5490`
+  - suite pass marker `ok 2 - GET - Retrieve Resources` at `...:5495`
+
+## Result
+- [Verified][C4] Standard read-query path executes successfully in regression suite.
+- [Unknown][C2] Query-count bound (N+1 avoidance budget) is not asserted by runtime tests.

package/audit/traces/trace-relationship-endpoints.md

@@ -0,0 +1,31 @@
+# Trace: Relationship Endpoints
+
+## Scope
+- Non-anyapi path only.
+
+## Scenarios
+1. Add to-many members: `postRelationship`
+2. Remove to-many members: `deleteRelationship`
+3. Replace relationship via patch endpoint: `patchRelationship` error-path probe
+
+## Call path
+- Entry points in relationship method files:
+  - [post-relationship.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/post-relationship.js)
+  - [delete-relationship.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/delete-relationship.js)
+  - [patch-relationship.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js)
+- Core relationship mutation helpers:
+  - [relationship-processor.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/writing/relationship-processor.js)
+  - [many-to-many-manipulations.js](/home/merc/Development/current/json-rest-api/plugins/core/lib/writing/many-to-many-manipulations.js)
+
+## Runtime evidence
+- Relationship endpoint suite passes post/delete paths:
+  - `ok 2 - should add authors to book via POST relationship endpoint` (`...log:5050`)
+  - `ok 4 - should remove specific authors via DELETE relationship endpoint` (`...log:5060`)
+- Patch endpoint failure-path defect reproduced by dedicated probe:
+  - `handleWriteMethodError is not defined`
+  - [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
+
+## Result
+- [Verified][C4] POST/DELETE relationship endpoint behavior is covered and passing.
+- [Verified][C5] PATCH relationship endpoint has a runtime error-handling defect on failure paths.
+- [Unknown][C2] No upstream suite currently asserts successful `patchRelationship` endpoint behavior directly.

package/audit/traces/trace-write-delete.md

@@ -0,0 +1,17 @@
+# Trace: Write Delete
+
+## Scope
+- Non-anyapi path only.
+
+## Scenario
+- Delete single resource and return 204-style no-content path.
+
+## Call path
+1. `delete.js` creates/uses transaction, fetches minimal record, checks permissions, then invokes `helpers.dataDelete` ([delete.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/delete.js)).
+2. Commit and afterCommit hooks run on success; rollback on errors via common handling.
+
+## Runtime evidence
+- CRUD suite: `ok 1 - should delete an existing resource` at `audit/evidence/tests/npm-test-json-rest-api.log:5514`.
+
+## Result
+- [Verified][C4] Delete flow is validated in regression suite.

package/audit/traces/trace-write-patch.md

@@ -0,0 +1,26 @@
+# Trace: Write Patch
+
+## Scope
+- Non-anyapi path only.
+
+## Scenario A
+- Standard partial update (`scope.patch`) in CRUD path.
+
+## Scenario B
+- Relationship endpoint patch error-path (`patchRelationship`) with malformed relationship payload.
+
+## Call path
+1. Standard patch: `patch.js` -> `setupCommonRequest` -> validators -> permission checks -> `helpers.dataPatch` -> commit/rollback ([patch.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch.js)).
+2. Relationship patch: `patch-relationship.js` wraps and delegates to `scope.patch` with synthesized `relationships` payload.
+3. Catch path in `patch-relationship.js` calls undefined `handleWriteMethodError` symbol ([patch-relationship.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/patch-relationship.js:53)).
+
+## Runtime evidence
+- Standard patch success: `ok 1 - should partially update a resource` at `audit/evidence/tests/npm-test-json-rest-api.log:5502`.
+- Error-path probe reproduces runtime defect:
+  - `ERROR_NAME=ReferenceError`
+  - `ERROR_MESSAGE=handleWriteMethodError is not defined`
+  - Evidence log: [probe-patch-relationship-referenceerror.log](/home/merc/Development/current/json-rest-api/audit/evidence/runtime/probe-patch-relationship-referenceerror.log)
+
+## Result
+- [Verified][C5] Standard patch path passes.
+- [Verified][C5] Relationship patch error path is broken in runtime (ReferenceError masks original error and bypasses canonical handler flow).

package/audit/traces/trace-write-post.md

@@ -0,0 +1,22 @@
+# Trace: Write Post
+
+## Scope
+- Non-anyapi path only.
+
+## Scenario
+- Create resource (`countries.post`) with JSON:API payload.
+
+## Input shape
+- `inputRecord.data = { type, attributes, relationships? }`
+
+## Call path
+1. `post.js` calls `setupCommonRequest` (transaction/context/type checks) ([post.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/post.js)).
+2. Validation + relationship access checks run before `scope.checkPermissions` and before `helpers.dataPost`.
+3. `helpers.dataPost` inserts row through knex adapter and returns new ID ([rest-api-knex-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-knex-plugin.js)).
+4. Commit/rollback handled in method catch/finalization via common helper.
+
+## Runtime evidence
+- `ok 1 - should create a country` and `ok 1 - POST - Create Resources` at `audit/evidence/tests/npm-test-json-rest-api.log:5458,5473`.
+
+## Result
+- [Verified][C4] Post path executes as expected in core CRUD suite.

package/audit/traces/trace-write-put.md

@@ -0,0 +1,23 @@
+# Trace: Write Put
+
+## Scope
+- Non-anyapi path only.
+
+## Scenario
+- Complete relationship replacement via PUT semantics in relationship-heavy flow.
+
+## Input shape
+- `api.resources.books.put({ id, inputRecord, simplified: false })`
+
+## Call path
+1. `put.js` runs `setupCommonRequest`, minimal-record lookup, validation, and permission checks before storage ([put.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-plugin-methods/put.js)).
+2. Storage update via `helpers.dataPut` with idProperty-aware adapter path ([rest-api-knex-plugin.js](/home/merc/Development/current/json-rest-api/plugins/core/rest-api-knex-plugin.js)).
+3. Relationship reconciliation routed through common relationship helpers.
+
+## Runtime evidence
+- Relationship suite confirms PUT replacement path:
+  - `ok 2 - should update many-to-many relationships via PUT (complete replacement)` at `audit/evidence/tests/npm-test-json-rest-api.log:5199`
+  - Additional custom-id PUT coverage at `...:1869`.
+
+## Result
+- [Verified][C4] Put path works on non-anyapi coverage scenarios.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "json-rest-api",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "main": "index.js",
   "type": "module",
   "scripts": {
@@ -24,8 +24,8 @@
   "homepage": "https://mobily-enterprises.github.io/json-rest-api",
   "description": "REST API plugin for hooked-api with JSON:API compliance",
   "dependencies": {
-    "hooked-api": "^1.0.23",
-    "json-rest-schema": "^1.0.11",
+    "hooked-api": "^1.0.24",
+    "json-rest-schema": "^1.0.12",
     "semver": "^7.7.2"
   },
   "peerDependencies": {
@@ -35,7 +35,7 @@
     "express": "^4.0.0 || ^5.0.0",
     "formidable": "^3.0.0",
     "fractional-indexing": "^3.2.0",
-    "jose": "^5.10.0",
+    "jose": "^5.10.0 || ^6.0.0",
     "knex": "^3.1.0",
     "raw-body": "^2.0.0",
     "redis": "^5.6.0",
@@ -81,7 +81,7 @@
     "better-sqlite3": "^11.10.0",
     "express": "^5.1.0",
     "fractional-indexing": "^3.2.0",
-    "jose": "^5.10.0",
+    "jose": "^6.2.2",
     "knex": "^3.1.0",
     "redis": "^5.6.0",
     "socket.io": "^4.8.1",