neoorm 0.7.0 → 0.7.2

package/docs/cli.md

@@ -90,6 +90,8 @@ Options:
 - `-H, --host <host>` — host to bind (default: `127.0.0.1`)
 - `--open` — open the docs site in your default browser
 
+The sidebar includes a search box with live results across all documentation pages.
+
 ## `neoorm db push`
 
 Push the current snapshot schema to the database without going through the migration ledger.

package/docs/examples.md

@@ -367,19 +367,20 @@ const rows = await db.sql`
 
 ## API responses (`strip`)
 
-Fetch sensitive fields for auth, then strip before sending JSON:
+Hidden columns are omitted from default queries. For login, use `includeHidden: true`, verify, then strip before sending JSON:
 
 ```ts
 const user = await db.users.findFirst({
   where: { email: input.email },
+  includeHidden: true,
 });
 
 if (!user || !verifyPassword(input.password, user.password)) {
   throw new Error("Invalid credentials");
 }
 
-return user.strip(); // removes .hidden() columns (e.g. password)
-return user.strip({ email: true }); // hidden + extra fields
+return user.strip(); // plain object without password
+return user.strip({ refreshToken: true }); // hidden + extra fields
 ```
 
 `.strip()` is non-enumerable and returns a plain object. See [Queries → API responses](queries.md#api-responses-strip).

package/docs/queries.md

@@ -330,9 +330,7 @@ const users = await db.users.findMany({
 // users[0].posts[0].title is string; .body is excluded from the type
 ```
 
-### API responses (`strip`)
-
-Use query `omit` when you do not want a column fetched from the database. Use `strip` when you need the full row internally (for example login) but want a safe object for the response.
+### Sensitive columns (`.hidden()`) and API responses (`strip`)
 
 Mark sensitive columns in the schema with `.hidden()`:
 
@@ -340,21 +338,38 @@ Mark sensitive columns in the schema with `.hidden()`:
 password: text().notNull().hidden(),
 ```
 
-Every row returned from queries includes a non-enumerable `.strip()` method:
+By default, queries **omit** hidden columns from the result (root table and nested `with` includes). Pass `includeHidden: true` when the app needs them (for example password verification on login):
 
 ```ts
-const user = await db.users.findById(id);
-if (!user) return null;
-return user.strip();
-// hidden fields removed; nested `with` relations stripped too
+const user = await db.users.findFirst({
+  where: { email: input.email },
+  includeHidden: true,
+});
+```
 
-const users = await db.users.findMany();
-return users.map((user) => user.strip());
+Nested includes follow the same rule:
+
+```ts
+const posts = await db.posts.findMany({
+  with: { author: true }, // author.password omitted
+});
+
+const posts = await db.posts.findMany({
+  with: { author: { includeHidden: true } },
+});
+```
+
+You can still use `select` to fetch a subset that includes hidden columns. Use query `omit` to skip non-hidden columns you do not want fetched. Use `.strip()` when you fetched sensitive fields internally but want a safe object for the response:
+
+```ts
+const user = await db.users.findById(id, { includeHidden: true });
+if (!user) return null;
+return user.strip(); // plain object without password
 
 return user.strip({ refreshToken: true }); // hidden + extra column keys
 ```
 
-`strip()` returns a plain object (no `.strip` method) suitable for JSON responses. `null` and `undefined` pass through unchanged when using the underlying strip helper directly.
+Every row returned from queries includes a non-enumerable `.strip()` method. `strip()` recurses into nested `with` relations. It returns a plain object (no `.strip` method) suitable for JSON responses.
 
 ## Cursor pagination
 

package/docs/schema.md

@@ -51,7 +51,7 @@ Column field names use camelCase in TypeScript. By default SQL column names are
 
 All column builders support `.notNull()`, `.unique()`, `.default(value)`, `.primary()`, `.map(name)`, `.hidden()`, `.index()`, and `.check("sql expression")`.
 
-`.hidden()` marks a column as sensitive for API responses. Query results expose `.strip()` on each row to remove hidden fields before returning data.
+`.hidden()` marks a column as sensitive. It is omitted from default query output on the root table and on nested `with` includes. Pass `includeHidden: true` when the app needs the value (for example password verification on login). Use `.strip()` to remove any remaining sensitive fields before JSON responses.
 
 ### Audit timestamps
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "neoorm",
-	"version": "0.7.0",
+	"version": "0.7.2",
 	"description": "TypeScript-first PostgreSQL and SQLite ORM with schema DSL, codegen, and typed relations",
 	"license": "MIT",
 	"repository": {