Changelog

Release history for Hopak packages, with links to each upgrade guide.

Release notes for Hopak packages. Each section links to the relevant upgrade guide.

Current versions

1.0.1 — fixes from a full end-to-end pass

Every 1.0 feature was exercised against a real scaffolded project on all three dialects. What that turned up:

• Plugin field types now actually store their values. A registered field produced a table column that Drizzle didn’t know about, so writes were silently dropped (or failed outright when the column was NOT NULL). ctx.registerField now takes { storage, schema } — pick text / integer / real / boolean / timestamp / json and Hopak wires the column and DDL for all three dialects.
• model.tableName — the physical table name (post → posts) is now on the model, so raw SQL and migration DDL don’t have to guess it. The docs previously showed FROM post, which never matched a real table.
• hashPassword in @hopak/auth — idempotent hashing. A model that hashes in beforeCreate and credentialsSignup would both hash, and the double hash never matched at login.
• createTestServer({ plugins }) — a project using plugin field types could not be booted by the test server at all.
• crud.* builds validation schemas lazily, so route modules can be imported before plugin setup runs.
• ctx.setHeader reaches every response — static files, 404s, 405s, errors, and responses a handler builds itself.
• Boot warns about unapplied migrations instead of letting the first request die on a missing table.

1.0.0 — plugins, model hooks, OpenAPI, realtime (breaking)

All five packages move to 1.0.0 as one coordinated release.

New surface — each behind one explicit gesture, invisible until you reach for it:

• Plugins — hopak().use(plugin): custom field types (ctx.registerField + a FieldBuilder subclass), plugin middleware, onBoot hooks. Built-in fields register through the same registry.
• Model lifecycle hooks — model(name, fields, { hooks }): beforeCreate / afterCreate / beforeUpdate / afterUpdate / beforeDelete / afterDelete around single-row writes; password hashing becomes one hook.
• OpenAPI — hopak openapi emits an OpenAPI 3.1 document from models + routes; CRUD operations come out fully typed, response schemas strip sensitive fields.
• WebSockets — export const WS = defineWebSocket({...}) in a route file; upgrade passes through before middleware, so auth gates sockets too.
• SSE — sse() route-handler helper with stream.send / stream.closed.
• rateLimit() — fixed-window in-process limiter with Retry-After.
• Request body limit — server.maxRequestBodyBytes (default 16 MiB → 413).
• Typed CRUD — crud.read(post) is a RouteDefinition<Post>; new WithIncluded<Row, Relations> helper types include results; builder() is typed on dialect factories.
• OAuth PKCE — cookie-bound code verifier; on by default for Google, opt-in for GitHub. GitHub private emails resolve via /user/emails.

Hardening:

• Static files, 404s and 405s now flow through global middleware — access logs and guards see every request.
• Headers set via ctx.setHeader survive onto error responses (X-Request-Id, Retry-After).
• Conditional requests on static files: If-None-Match / If-Modified-Since → 304.
• Concurrent SQLite transactions are queued instead of colliding on the shared connection.
• ?limit=abc on CRUD lists → 400 instead of NaN reaching SQL.
• hopak migrate up --to <unknown-id> errors instead of silently applying everything.
• credentialsLogin verifies against a fallback hash when the user doesn’t exist — response timing no longer leaks account existence.

Breaking:

• db.execute() removed from the public Database interface (deprecated since 0.5). ctx.execute inside migrations stays.
• OAuth callbacks (githubCallback / googleCallback) now require callbackUrl — same parameter set for both providers.
• @hopak/testing declares @hopak/core / @hopak/common as peer dependencies.

→ Upgrade from 0.5 to 1.0

0.5.0 — db.sql, db.builder(), deprecated db.execute() (breaking)

• New primitive: db.sql — tagged-template SQL for the ~5% of queries .model() doesn’t cover. Interpolations become driver-native placeholders (? / $N); values never reach the SQL text, so ${attacker} is safe by construction.
• Driver-native on every dialect: SQLite routes through bun:sqlite.prepare().all(), Postgres through postgres.js sql.unsafe(), MySQL through mysql2 pool.execute(). No Drizzle on the raw-SQL read path.
• db.raw() → db.builder(). Same return type (the dialect’s Drizzle client), clearer name. Breaking rename, mechanical search-and-replace.
• db.execute(sql, params?) is @deprecated — kept as a thin forwarder so existing migration files keep compiling. New code should use db.sql. (Actually removed in 1.0.0.)
• MigrationContext gets ctx.sql alongside ctx.execute (also deprecated). hopak migrate new scaffolds ctx.sql by default.
• Framework internals (tracker.ts, introspect.ts) migrated off the db.raw() as { all?, execute? } cast hack onto db.sql.

→ Upgrade from 0.4 to 0.5

0.4.9 — Prototype-pollution hygiene in deepMerge

• deepMerge in @hopak/common drops __proto__, constructor, and prototype keys from merged sources, so a JSON-parsed payload can no longer swap the result’s prototype chain. First regression tests for the common package.
• Algorithm pinning on JWT verification in @hopak/auth: the verifier no longer accepts a token signed with a different algorithm from the one configured — closes the algorithm-confusion attack.
• Static-file handler re-uses a cached canonical root path (realpath) per handler instance; a symlink that resolves outside the public root still fails cleanly.
• FileField.maxSize(n) now actually constrains the Valibot schema at validation time, not just at config-write time.

0.4.0 — Valibot, safer validation

• Validation runtime swapped from Zod to Valibot: ~10× smaller bundle, ~2–3× faster parse.
• validate() and buildModelSchema() keep the same API; model-driven validation is untouched.
• RouteSchemas.body | query | params are now v.GenericSchema instead of z.ZodType.
• @hopak/core no longer depends on zod.
• ZodFieldSchema type export renamed to FieldSchema.

→ Upgrade from 0.3 to 0.4

0.3.0 — Migrations

• New hopak migrate subcommands: init, new, up, down, status.
• hopak sync becomes the dev-bootstrap path; it refuses to run once app/migrations/ has files.
• hopak dev skips boot-time db.sync() when migrations exist — the runtime never alters the schema on its own.
• hopak sync now prints a drift warning when models declare columns the live DB doesn’t have.
• .index() on a field now actually creates CREATE INDEX IF NOT EXISTS during sync (previously silently ignored).
• New public API: ctx.db.execute(sql, params?) for raw SQL.

→ Upgrade from 0.2 to 0.3

0.2.0 — Scaffolded CRUD (breaking)

• CRUD endpoints move from runtime generation to CLI scaffolding via hopak generate crud <model>.
• { crud: true } on models is removed; route files become real .ts you can read and edit.
• Dev HTTPS certs require hopak generate cert — boot no longer invokes openssl behind your back.
• @hopak/testing drops withCrud: true; wire routes via the new crud.* helpers or pass rootDir for end-to-end tests.
• Removed unused model options: owner, publicRead, auth, softDelete.

→ Upgrade from 0.1.x

0.1.0 — Initial release

• Models, relations, query ergonomics, validation, serialization, typed errors.
• Runtime-generated CRUD via { crud: true }, runtime-generated dev certs for server.https.enabled.
• First pass at the CLI: hopak new, hopak use, hopak sync, hopak check, hopak dev.