uql-orm 0.84.0 → 0.86.0

package/dist/http/handler.d.ts

@@ -44,8 +44,11 @@ export type HookContext<E extends object, Ctx = unknown> = {
 export type Hook<Ctx = unknown> = <E extends object>(ctx: HookContext<E, Ctx>) => void | Promise<void>;
 export type ResponseHook<Ctx = unknown> = <E extends object>(ctx: HookContext<E, Ctx>, envelope: RequestSuccessResponse<unknown>) => void | Promise<void>;
 export type RequestHandlerOptions<Ctx = unknown> = {
-    include?: Type<object>[];
-    exclude?: Type<object>[];
+    /**
+     * The entities served, and the only ones a request reaches, through a relation too: nothing is served
+     * by being defined, so an entity holding secrets (a session's token) stays off the wire unless named.
+     */
+    include: readonly Type<object>[];
     /** The URL segment an entity is addressed by, its kebab-cased class name by default; the browser client takes the same option. */
     entityPath?: (entity: Type<unknown>) => string;
     /**

package/dist/http/handler.js

@@ -1,5 +1,5 @@
 import { withContext } from '../context/context.js';
-import { getEntities, getMeta, soleIdOf } from '../entity/index.js';
+import { getMeta, soleIdOf } from '../entity/index.js';
 import { whereIds, whereWith } from '../util/dialect.util.js';
 import { UqlUsageError } from '../util/uqlError.js';
 import { CRUD_ROUTES, entityPath, matchRoute, } from './contract.js';
@@ -10,14 +10,11 @@ function tableOf(entity) {
     return `${entity.name} (${meta.schema ? `${meta.schema}.${meta.name}` : meta.name})`;
 }
 export function createRequestHandler(opts) {
-    const { include, exclude, pre, preSave, preFilter, post, getContext, pool } = opts;
+    const { include: entities, pre, preSave, preFilter, post, getContext, pool } = opts;
     const pathOf = opts.entityPath ?? entityPath;
-    let entities = include ?? getEntities();
-    if (exclude) {
-        entities = entities.filter((entity) => !exclude.includes(entity));
-    }
-    if (!entities.length) {
-        throw new UqlUsageError('no entities for the uql middleware');
+    // Refused rather than defaulted to every entity defined, which would serve whatever one registers.
+    if (!entities?.length) {
+        throw new UqlUsageError("name the entities the handler serves in 'include': it serves those alone");
     }
     // All of them at once, so fixing the first collision does not just reveal the next.
     const byPath = Map.groupBy(entities, pathOf);

package/package.json

@@ -3,7 +3,7 @@
   "homepage": "https://uql-orm.dev",
   "description": "JSON-native TypeScript ORM for Bun, Browsers, Edge, Deno, Node, Workers. Supports PostgreSQL, PGlite, MySQL, MariaDB, SQLite, CockroachDB, SQL Server, Turso, Neon, Cloudflare D1 and MongoDB. Queries are plain JSON, typed to the leaf.",
   "license": "MIT",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "type": "module",
   "engines": {
     "node": ">=24"

package/skills/uql-orm/SKILL.md

@@ -119,7 +119,8 @@ const users = await pool.findMany(User, {
 - A result is narrowed to what the query selected and populated: reading an unselected field is a compile error.
   Name that shape with `QueryFindResult<User, 'id' | 'email'>` rather than widening the query.
 - `$populate` loads relations in the same statement. Nothing is lazy: a relation not populated is not there.
-- A query is plain data, so it can be built dynamically, stored, or sent from a browser to `uql-orm/http`.
+- A query is plain data, so it can be built dynamically, stored, or sent from a browser to `uql-orm/http`,
+  whose handler serves only the entities its required `include` names.
 - Methods: `findMany`, `findOne`, `findOneById`, `findManyAndCount`, `findManyStream`, `count`, `exists`,
   `aggregate`, `insertOne`, `insertMany`, `updateOneById`, `updateMany`, `saveOne`, `saveMany`, `upsertOne`,
   `upsertMany`, `deleteOneById`, `deleteMany`. Each takes the entity class first.