json-rest-api 1.0.23 → 1.0.24

package/plugins/core/rest-api-knex-plugin.js

@@ -8,9 +8,8 @@ import {
   generateKnexMigrationDiff
 } from './lib/dbTablesOperations.js'
 import { introspectKnexTableSnapshot } from './lib/dbIntrospection.js'
-import { applyFieldSelectionToQuery, buildFieldSelection, isNonDatabaseField } from './lib/querying-writing/knex-field-helpers.js'
-import { getForeignKeyFields } from './lib/querying-writing/field-utils.js'
-import { toJsonApiRecord, buildJsonApiResponse } from './lib/querying/knex-json-api-transformers-querying.js'
+import { applyFieldSelectionToQuery, buildFieldSelection } from './lib/querying-writing/knex-field-helpers.js'
+import { buildJsonApiResponse } from './lib/querying/knex-json-api-transformers-querying.js'
 import { processBelongsToRelationships } from './lib/writing/knex-json-api-transformers-writing.js'
 import { toJsonApiRecordWithBelongsTo } from './lib/querying-writing/knex-json-api-transformers.js'
 import { processIncludes } from './lib/querying/knex-process-includes.js'
@@ -46,9 +45,8 @@ export const RestApiKnexPlugin = {
 
   async install ({ helpers, vars, pluginOptions, api, log, scopes, addHook, addScopeMethod }) {
     // Try to import knex dynamically
-    let knexLib
     try {
-      knexLib = await import('knex')
+      await import('knex')
     } catch (e) {
       requirePackage('knex', 'rest-api-knex',
         'Knex.js is required for database operations. This is a peer dependency that allows you to control the version.')
@@ -100,6 +98,7 @@ export const RestApiKnexPlugin = {
 
       return {
         structure: filteredSchema,
+        storage: vars.schemaInfo?.storage,
         indexes: vars.schemaInfo?.indexes || [],
         foreignKeys: vars.schemaInfo?.foreignKeys || [],
         checkConstraints: vars.schemaInfo?.checkConstraints || []
@@ -682,9 +681,7 @@ export const RestApiKnexPlugin = {
           query
             .limit(pageSize)
             .offset((pageNumber - 1) * pageSize)
-        }
-        // Cursor-based pagination
-        else if (queryParams.page.after || queryParams.page.before) {
+        } else if (queryParams.page.after || queryParams.page.before) {
           // Fetch one extra record to determine if there are more
           query.limit(pageSize + 1)
 
@@ -745,9 +742,7 @@ export const RestApiKnexPlugin = {
               }
             )
           }
-        }
-        // Default pagination if only size is specified - treat as cursor-based for "load more"
-        else {
+        } else {
           // Fetch one extra to detect hasMore
           query.limit(pageSize + 1)
         }
@@ -918,7 +913,6 @@ export const RestApiKnexPlugin = {
       if (storageAdapter) {
         context.storageAdapter = storageAdapter
       }
-      const scope = api.resources[scopeName]
       const tableName = storageAdapter?.getTableName?.() || context.schemaInfo.tableName
       const idProperty = storageAdapter?.getIdColumn?.() || context.schemaInfo.idProperty
       const db = context.db || api.knex.instance
@@ -943,12 +937,26 @@ export const RestApiKnexPlugin = {
         })
         : attributes
 
+      const explicitId = dbAttributes[idProperty] ?? inputRecord.data.id
+
       // Insert and get the new ID
       const result = await db(tableName).insert(dbAttributes).returning(idProperty)
 
-      // Extract the ID value (SQLite returns array of objects)
-      const id = result[0]?.[idProperty] || result[0]
-      return id
+      // Extract the ID value. Some dialects ignore .returning() for inserts and can
+      // yield 0 even when the caller explicitly supplied the primary key.
+      const returnedId = Array.isArray(result)
+        ? (result[0]?.[idProperty] ?? result[0])
+        : (result?.[idProperty] ?? result)
+
+      if (
+        explicitId !== undefined &&
+        explicitId !== null &&
+        (returnedId === undefined || returnedId === null || returnedId === 0 || returnedId === '0')
+      ) {
+        return explicitId
+      }
+
+      return returnedId
     }
 
     /**
@@ -1135,7 +1143,6 @@ export const RestApiKnexPlugin = {
       if (storageAdapter) {
         context.storageAdapter = storageAdapter
       }
-      const scope = api.resources[scopeName]
       const id = context.id
 
       const tableName = storageAdapter?.getTableName?.() || context.schemaInfo.tableName

package/plugins/core/rest-api-plugin-hooks/turn-scope-init-into-vars.js

@@ -24,6 +24,7 @@ export default async function turnScopeInitIntoVars ({ context, scopes, vars: ap
 
   // Set idProperty as scope var
   if (typeof scopeOptions.idProperty !== 'undefined') vars.idProperty = scopeOptions.idProperty
+  if (typeof scopeOptions.normalizeId === 'function') vars.normalizeId = scopeOptions.normalizeId
 
   // Add validation for query limits
   if (vars.queryDefaultLimit && vars.queryMaxLimit) {

package/plugins/core/rest-api-plugin-methods/common.js

@@ -3,6 +3,7 @@ import {
   RestApiValidationError
 } from '../../../lib/rest-api-errors.js'
 import { transformSimplifiedToJsonApi } from '../lib/querying-writing/simplified-helpers.js'
+import { normalizeRelationshipIdentifiers } from '../lib/querying-writing/resource-id-normalization.js'
 import { createEnhancedLogger } from '../../../lib/enhanced-logger.js'
 import { unwrapQueryBuilderState } from '../lib/querying/query-builder-utils.js'
 
@@ -296,16 +297,20 @@ export const validateResourceAttributesBeforeWrite = async ({
     context.originalInputAttributes = { ...(context.inputRecord.data.attributes || {}) }
   }
 
+  const schemaStructure = context.schemaInfo.schemaStructure || {}
+  const hasLogicalIdField = Object.hasOwn(schemaStructure, 'id')
+  const resourceId = context.inputRecord?.data?.id
+
   // Merge belongsTo updates with attributes for validation
   const attributesToValidate = {
     ...context.inputRecord.data.attributes,
-    ...belongsToUpdates
+    ...belongsToUpdates,
+    ...(hasLogicalIdField && resourceId !== undefined ? { id: resourceId } : {})
   }
 
   // Extract computed fields and foreign key fields before validation
   const computedFields = {}
   const foreignKeyFields = {}
-  const schemaStructure = context.schemaInfo.schemaStructure || {}
   Object.entries(attributesToValidate).forEach(([key, value]) => {
     const fieldDef = schemaStructure[key]
     // Computed fields should be stripped from input
@@ -375,12 +380,13 @@ export const validateResourceAttributesBeforeWrite = async ({
   const { validatedObject, errors } = await schema[validationMethod](attributesForValidation)
 
   if (Object.keys(errors).length > 0) {
-    // --- START OF MODIFICATION ---
-    const schemaStructure = context.schemaInfo.schemaInstance.structure // Get the schema structure for lookup
-
     const violations = Object.entries(errors).map(([field, error]) => {
       let fieldPath = `data.attributes.${field}` // Default path for attributes
 
+      if (field === 'id' && hasLogicalIdField) {
+        fieldPath = 'data.id'
+      }
+
       // Check if this field is a foreign key that has an 'as' alias
       const fieldDef = schemaStructure[field]
       if (fieldDef && fieldDef.belongsTo && fieldDef.as) {
@@ -400,7 +406,6 @@ export const validateResourceAttributesBeforeWrite = async ({
         message: error.message
       }
     })
-    // --- END OF MODIFICATION ---
 
     throw new RestApiValidationError(
       'Schema validation failed for resource attributes',
@@ -411,9 +416,14 @@ export const validateResourceAttributesBeforeWrite = async ({
     )
   }
 
+  if (Object.hasOwn(validatedObject, 'id')) {
+    context.inputRecord.data.id = validatedObject.id
+  }
+  const { id: _validatedId, ...validatedAttributes } = validatedObject
+
   // Update attributes with validated values
   // Virtual fields have now been validated and cast properly
-  context.inputRecord.data.attributes = validatedObject
+  context.inputRecord.data.attributes = validatedAttributes
 
   await runHooks(`afterSchemaValidate${methodSpecificHookSuffix}`)
   await runHooks('afterSchemaValidate')
@@ -434,8 +444,16 @@ export const validateRelationshipAccess = async (context, inputRecord, helpers,
   for (const [relName, relData] of Object.entries(inputRecord.data.relationships)) {
     if (!relData?.data) continue
 
+    const normalizedRelationshipData = normalizeRelationshipIdentifiers(relData.data, { api })
+    inputRecord.data.relationships[relName] = {
+      ...relData,
+      data: normalizedRelationshipData
+    }
+
     // Handle both single and array relationships
-    const relatedItems = Array.isArray(relData.data) ? relData.data : [relData.data]
+    const relatedItems = Array.isArray(normalizedRelationshipData)
+      ? normalizedRelationshipData
+      : [normalizedRelationshipData]
 
     for (const item of relatedItems) {
       // Get the scope for the related resource
@@ -667,7 +685,7 @@ export const findRelationshipDefinition = (schemaInfo, relationshipName) => {
   }
 
   // Then check schema fields for belongsTo relationships with matching 'as' property
-  for (const [fieldName, fieldDef] of Object.entries(schemaInfo.schemaStructure || {})) {
+  for (const [, fieldDef] of Object.entries(schemaInfo.schemaStructure || {})) {
     if (fieldDef.as === relationshipName && fieldDef.belongsTo) {
       return fieldDef
     }

package/plugins/core/rest-api-plugin-methods/delete-relationship.js

@@ -1,5 +1,9 @@
 import { RestApiResourceError, RestApiValidationError, RestApiPayloadError } from '../../../lib/rest-api-errors.js'
 import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
+import {
+  normalizeRelationshipIdentifiers,
+  requireExistingResourceId
+} from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
  * DELETE RELATIONSHIP
@@ -11,9 +15,13 @@ import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
  * @param {array} relationshipData - Array of resource identifiers to remove
  * @returns {Promise<void>} 204 No Content
  */
-export default async function deleteRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api, log }) {
+export default async function deleteRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api, log }) {
   context.method = 'deleteRelationship'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
   context.schemaInfo = scopes[scopeName].vars.schemaInfo
 
@@ -43,6 +51,7 @@ export default async function deleteRelationshipMethod ({ params, context, vars,
     if (!Array.isArray(params.relationshipData)) {
       throw new RestApiPayloadError('DELETE from relationship requires array of resource identifiers')
     }
+    params.relationshipData = normalizeRelationshipIdentifiers(params.relationshipData, { api })
 
     // Check permissions
     await runHooks('checkPermissions')

package/plugins/core/rest-api-plugin-methods/delete.js

@@ -1,5 +1,6 @@
 import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
 import { handleWriteMethodError } from './common.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
  * DELETE
@@ -26,7 +27,11 @@ export default async function deleteMethod ({
   context.method = 'delete'
 
   // Set the ID in context
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
 
   // Set scopeName in context (needed for broadcasting)
   context.scopeName = scopeName

package/plugins/core/rest-api-plugin-methods/get-related.js

@@ -1,6 +1,7 @@
 import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
 import { findRelationshipDefinition } from './common.js'
 import { buildRelationshipUrl } from '../lib/querying/url-helpers.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
  * GET RELATED
@@ -12,9 +13,13 @@ import { buildRelationshipUrl } from '../lib/querying/url-helpers.js'
  * @param {object} queryParams - Standard query parameters
  * @returns {Promise<object>} Related resources with full data
  */
-export default async function getRelatedMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api }) {
+export default async function getRelatedMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api }) {
   context.method = 'getRelated'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
   context.queryParams = params.queryParams || {}
   context.schemaInfo = scopes[scopeName].vars.schemaInfo

package/plugins/core/rest-api-plugin-methods/get-relationship.js

@@ -1,6 +1,7 @@
 import { RestApiResourceError } from '../../../lib/rest-api-errors.js'
 import { findRelationshipDefinition } from './common.js'
 import { buildRelationshipUrl } from '../lib/querying/url-helpers.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
  * GET RELATIONSHIP
@@ -11,9 +12,13 @@ import { buildRelationshipUrl } from '../lib/querying/url-helpers.js'
  * @param {string} relationshipName - The name of the relationship
  * @returns {Promise<object>} Relationship linkage with links
  */
-export default async function getRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api }) {
+export default async function getRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api }) {
   context.method = 'getRelationship'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
   context.schemaInfo = scopes[scopeName].vars.schemaInfo
 

package/plugins/core/rest-api-plugin-methods/get.js

@@ -3,6 +3,7 @@ import { normalizeRecordAttributes } from '../lib/querying-writing/database-valu
 import { getRequestedComputedFields } from '../lib/querying-writing/knex-field-helpers.js'
 import { transformJsonApiToSimplified } from '../lib/querying-writing/simplified-helpers.js'
 import { getRequestContracts, validateRequestContractOrThrow } from '../lib/querying-writing/request-contracts.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 import { cascadeConfig } from './common.js'
 
 /**
@@ -62,10 +63,15 @@ export default async function getMethod ({
     includeDepthLimit: vars.includeDepthLimit,
     sortableFields: vars.sortableFields
   })
+  const normalizedId = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   const validatedRequest = validateRequestContractOrThrow(
     requestContracts.get,
     {
-      id: params.id,
+      id: normalizedId,
       queryParams: context.queryParams
     },
     'GET request parameters are invalid'

package/plugins/core/rest-api-plugin-methods/patch-relationship.js

@@ -1,3 +1,6 @@
+import { handleWriteMethodError } from './common.js'
+import { requireExistingResourceId } from '../lib/querying-writing/resource-id-normalization.js'
+
 /**
  * PATCH RELATIONSHIP
  * Completely replaces a relationship
@@ -8,9 +11,13 @@
  * @param {object|array} relationshipData - New relationship data
  * @returns {Promise<void>} 204 No Content
  */
-export default async function patchRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api }) {
+export default async function patchRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api, log }) {
   context.method = 'patchRelationship'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
 
   // Transaction handling
@@ -50,6 +57,6 @@ export default async function patchRelationshipMethod ({ params, context, vars,
 
     // 204 No Content
   } catch (error) {
-    await handleWriteMethodError(error, context, 'PATCH_RELATIONSHIP', scopeName, log)
+    await handleWriteMethodError(error, context, 'PATCH_RELATIONSHIP', scopeName, log, runHooks)
   }
 }

package/plugins/core/rest-api-plugin-methods/patch.js

@@ -3,6 +3,10 @@ import { processRelationships } from '../lib/writing/relationship-processor.js'
 import { updateManyToManyRelationship } from '../lib/writing/many-to-many-manipulations.js'
 import { ERROR_SUBTYPES } from '../lib/querying-writing/knex-constants.js'
 import { getRequestContracts, validateRequestContractOrThrow } from '../lib/querying-writing/request-contracts.js'
+import {
+  requireDocumentResourceId,
+  requireExistingResourceId
+} from '../lib/querying-writing/resource-id-normalization.js'
 import {
   setupCommonRequest,
   validateResourceAttributesBeforeWrite,
@@ -59,14 +63,37 @@ export default async function patchMethod ({
       includeDepthLimit: vars.includeDepthLimit,
       sortableFields: vars.sortableFields
     })
+    const normalizedPathId = params.id === undefined
+      ? null
+      : requireExistingResourceId(params.id, {
+        scopeOptions,
+        vars,
+        scopeName
+      })
+
+    if (normalizedPathId && !context.inputRecord?.data?.id) {
+      context.inputRecord = {
+        ...context.inputRecord,
+        data: {
+          ...(context.inputRecord?.data || {}),
+          id: normalizedPathId
+        }
+      }
+    }
+
     context.inputRecord = validateRequestContractOrThrow(
       requestContracts.patch,
       context.inputRecord,
       'PATCH request body is invalid'
     )
-    if (params.id && String(params.id) !== String(context.inputRecord.data.id)) {
+    const normalizedBodyId = requireDocumentResourceId(context.inputRecord.data.id, {
+      scopeOptions,
+      vars
+    })
+
+    if (normalizedPathId && normalizedPathId !== normalizedBodyId) {
       throw new RestApiValidationError(
-        `ID mismatch. URL path ID '${params.id}' does not match request body ID '${context.inputRecord.data.id}'`,
+        `ID mismatch. URL path ID '${normalizedPathId}' does not match request body ID '${normalizedBodyId}'`,
         {
           fields: ['data.id'],
           violations: [{
@@ -77,7 +104,8 @@ export default async function patchMethod ({
         }
       )
     }
-    context.id = params.id || context.inputRecord.data.id
+    context.inputRecord.data.id = normalizedBodyId
+    context.id = normalizedPathId || normalizedBodyId
 
     // Validate that user has read access to all related resources
     // This ensures users can only create relationships to resources they can access

package/plugins/core/rest-api-plugin-methods/post-relationship.js

@@ -1,6 +1,10 @@
 import { RestApiResourceError, RestApiValidationError, RestApiPayloadError } from '../../../lib/rest-api-errors.js'
 import { findRelationshipDefinition, handleWriteMethodError } from './common.js'
 import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
+import {
+  normalizeRelationshipIdentifiers,
+  requireExistingResourceId
+} from '../lib/querying-writing/resource-id-normalization.js'
 
 /**
    * POST RELATIONSHIP
@@ -12,9 +16,13 @@ import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js
    * @param {array} relationshipData - Array of resource identifiers to add
    * @returns {Promise<void>} 204 No Content
   */
-export default async function postRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeName, api, log }) {
+export default async function postRelationshipMethod ({ params, context, vars, helpers, scope, scopes, runHooks, scopeOptions, scopeName, api, log }) {
   context.method = 'postRelationship'
-  context.id = params.id
+  context.id = requireExistingResourceId(params.id, {
+    scopeOptions,
+    vars,
+    scopeName
+  })
   context.relationshipName = params.relationshipName
   context.schemaInfo = scopes[scopeName].vars.schemaInfo
 
@@ -45,6 +53,7 @@ export default async function postRelationshipMethod ({ params, context, vars, h
     if (!Array.isArray(params.relationshipData)) {
       throw new RestApiPayloadError('POST to relationship requires array of resource identifiers')
     }
+    params.relationshipData = normalizeRelationshipIdentifiers(params.relationshipData, { api })
 
     // Check permissions
     await runHooks('checkPermissions')

package/plugins/core/rest-api-plugin-methods/post.js

@@ -1,6 +1,7 @@
 import { processRelationships } from '../lib/writing/relationship-processor.js'
 import { getRequestContracts, validateRequestContractOrThrow } from '../lib/querying-writing/request-contracts.js'
 import { createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
+import { requireDocumentResourceId } from '../lib/querying-writing/resource-id-normalization.js'
 import {
   setupCommonRequest,
   validateResourceAttributesBeforeWrite,
@@ -62,6 +63,13 @@ export default async function postMethod ({
       'POST request body is invalid'
     )
 
+    if (context.inputRecord?.data?.id !== undefined) {
+      context.inputRecord.data.id = requireDocumentResourceId(context.inputRecord.data.id, {
+        scopeOptions,
+        vars
+      })
+    }
+
     // Validate that user has read access to all related resources
     // This ensures users can only create relationships to resources they can access
     await validateRelationshipAccess(context, context.inputRecord, helpers, api)

package/plugins/core/rest-api-plugin-methods/put.js

@@ -3,6 +3,10 @@ import { processRelationships } from '../lib/writing/relationship-processor.js'
 import { updateManyToManyRelationship, createPivotRecords } from '../lib/writing/many-to-many-manipulations.js'
 import { ERROR_SUBTYPES } from '../lib/querying-writing/knex-constants.js'
 import { getRequestContracts, validateRequestContractOrThrow } from '../lib/querying-writing/request-contracts.js'
+import {
+  requireDocumentResourceId,
+  requireExistingResourceId
+} from '../lib/querying-writing/resource-id-normalization.js'
 import {
   setupCommonRequest,
   validateCompleteReplacePayload,
@@ -61,14 +65,37 @@ export default async function putMethod ({
       includeDepthLimit: vars.includeDepthLimit,
       sortableFields: vars.sortableFields
     })
+    const normalizedPathId = params.id === undefined
+      ? null
+      : requireExistingResourceId(params.id, {
+        scopeOptions,
+        vars,
+        scopeName
+      })
+
+    if (normalizedPathId && !context.inputRecord?.data?.id) {
+      context.inputRecord = {
+        ...context.inputRecord,
+        data: {
+          ...(context.inputRecord?.data || {}),
+          id: normalizedPathId
+        }
+      }
+    }
+
     context.inputRecord = validateRequestContractOrThrow(
       requestContracts.put,
       context.inputRecord,
       'PUT request body is invalid'
     )
-    if (params.id && String(params.id) !== String(context.inputRecord.data.id)) {
+    const normalizedBodyId = requireDocumentResourceId(context.inputRecord.data.id, {
+      scopeOptions,
+      vars
+    })
+
+    if (normalizedPathId && normalizedPathId !== normalizedBodyId) {
       throw new RestApiValidationError(
-        `ID mismatch. URL path ID '${params.id}' does not match request body ID '${context.inputRecord.data.id}'`,
+        `ID mismatch. URL path ID '${normalizedPathId}' does not match request body ID '${normalizedBodyId}'`,
         {
           fields: ['data.id'],
           violations: [{
@@ -79,7 +106,8 @@ export default async function putMethod ({
         }
       )
     }
-    context.id = params.id || context.inputRecord.data.id
+    context.inputRecord.data.id = normalizedBodyId
+    context.id = normalizedPathId || normalizedBodyId
 
     // Validate that user has read access to all related resources
     // This ensures users can only create relationships to resources they can access

package/plugins/core/rest-api-plugin-methods/release.js

@@ -1,5 +1,3 @@
-import { ValidationError } from 'hooked-api'
-
 /**
  * release
  * Runs the hook that tells plugins to release resources

package/plugins/core/rest-api-plugin.js

@@ -27,6 +27,7 @@ import postRelationshipMethod from './rest-api-plugin-methods/post-relationship.
 import getRelationshipMethod from './rest-api-plugin-methods/get-relationship.js'
 import patchRelationshipMethod from './rest-api-plugin-methods/patch-relationship.js'
 import deleteRelationshipMethod from './rest-api-plugin-methods/delete-relationship.js'
+import { defaultNormalizeResourceId } from './lib/querying-writing/resource-id-normalization.js'
 
 export const RestApiPlugin = {
   name: 'rest-api',
@@ -66,6 +67,9 @@ export const RestApiPlugin = {
       : true // Default true for better DX in programmatic API
 
     vars.idProperty = restApiOptions.idProperty || 'id'
+    vars.normalizeId = typeof restApiOptions.normalizeId === 'function'
+      ? restApiOptions.normalizeId
+      : defaultNormalizeResourceId
 
     // Return full record configuration for API and Transport
     // Support values: 'no', 'minimal', 'full'

package/plugins/core/rest-api-positioning-plugin.js

@@ -1,8 +1,6 @@
 import {
   calculatePosition,
   getInitialPosition,
-  isValidPosition,
-  assignInitialPositions,
 } from './lib/fractional-positioning.js'
 import { createStorageAdapter } from './lib/storage/storage-adapter.js'
 
@@ -167,7 +165,7 @@ export const PositioningPlugin = {
           fieldExists = true
         } else {
           // Check if it's a relationship name (as property)
-          for (const [fieldName, fieldDef] of Object.entries(schema)) {
+          for (const [, fieldDef] of Object.entries(schema)) {
             if (fieldDef.as === filterField) {
               fieldExists = true
               break
@@ -419,7 +417,6 @@ export const PositioningPlugin = {
       log.debug('*** Position filter conditions', { scopeName, filterConditions })
 
       // Query existing items in the same position group
-      const knex = api.knex.instance
       const tableName = adapter.getTableName()
       const idProperty = schemaInfo.idProperty
       const idColumn = adapter.getIdColumn()

package/plugins/core/socketio-plugin.js

@@ -393,7 +393,6 @@ export const SocketIOPlugin = {
     let io
 
     api.startSocketServer = async (server, startOptions = {}) => {
-      const transportConfig = { ...config.transport, ...startOptions.transport }
       const authConfig = { ...config.auth, ...(startOptions.auth || {}) }
       const redisConfig = startOptions.redis ?? pluginOptions.redis ?? null
 

package/plugins/storage/local-storage.js

@@ -92,7 +92,7 @@ export class LocalStorage {
     return filename
       // Remove path traversal attempts
       .replace(/\.\./g, '')
-      .replace(/[\/\\]/g, '')
+      .replace(/[/\\]/g, '')
       // Remove control characters and special chars
       .replace(/[^\w\s.-]/g, '_')
       // Remove leading/trailing dots and spaces

package/plugins/storage/s3-storage.js

@@ -100,13 +100,16 @@ export class S3Storage {
    * @returns {Promise<void>}
    */
   async delete (url) {
-    // Extract key from URL
     const urlObj = new URL(url)
-    const key = urlObj.pathname.substring(1) // Remove leading /
 
     if (this.mockMode) {
       // Mock mode - just simulate deletion
       await new Promise(resolve => setTimeout(resolve, 50))
+      return
+    }
+
+    if (urlObj.pathname.length === 0) {
+      throw new Error('Invalid S3 object URL')
     }
 
     // Real S3 delete would go here

package/quickTest.js

@@ -70,6 +70,7 @@ const harperResult = await api.resources.publishers.post({
     name: 'HarperCollins'
   }
 })
+console.log('Created second publisher:', inspect(harperResult))
 
 // Method 3: Full JSON:API mode (standards compliant)
 const oxfordResult = await api.resources.publishers.post({