diff --git a/.changeset/api-skill-delete-recycle-bin.md b/.changeset/api-skill-delete-recycle-bin.md new file mode 100644 index 00000000000..069019b0383 --- /dev/null +++ b/.changeset/api-skill-delete-recycle-bin.md @@ -0,0 +1,8 @@ +--- +'@objectstack/skills': patch +--- + +docs(skills): objectstack-api no longer teaches that `DELETE` is a hard delete with no recycle bin: a by-id delete keeps a business object's rows in `sys_recycle_bin` (30 days by default; not `multi: true` deletes, platform rows or rows deleted before the bin existed), and nothing lists or restores it over the API yet; eval case 5 expects that teaching instead of a hard delete + +Clause-②: no +Metadata-protocol: none diff --git a/skills/objectstack-api/SKILL.md b/skills/objectstack-api/SKILL.md index 2012bb558ce..e0fee90e945 100644 --- a/skills/objectstack-api/SKILL.md +++ b/skills/objectstack-api/SKILL.md @@ -45,7 +45,7 @@ GET /api/v1/data/{object} # List records (with filter, sort, paginat GET /api/v1/data/{object}/:id # Get single record POST /api/v1/data/{object} # Create record PATCH /api/v1/data/{object}/:id # Update record -DELETE /api/v1/data/{object}/:id # Delete record (hard delete) +DELETE /api/v1/data/{object}/:id # Delete record (business-object rows → recycle bin) POST /api/v1/data/{object}/query # Complex queries + aggregation (QueryAST in body) POST /api/v1/data/{object}/batch # Per-object batch operations POST /api/v1/batch # Cross-object atomic batch @@ -269,8 +269,8 @@ eight extra verbs are never declared in `apiMethods`: | `export` | `list` | `GET /data/{object}/export` | `history` (from `get` ∧ `trackHistory`) gates only. `restore` / `purge` never -derive — the trash surface is retired. Declaring any derived verb in -`apiMethods` is stripped at parse with a FROM → TO warning. +derive: the recycle bin has no restore or purge door yet. Declaring any +derived verb in `apiMethods` is stripped at parse with a FROM → TO warning. `POST /data/{object}/import` takes `mapping` as `{ Column: field }` or as `FieldMappingEntry[]` (`api/export.zod.ts`); only the entry form carries @@ -408,10 +408,10 @@ keys mean the run produced none — never invent an empty. read. Sending neither skips the check; a mismatch answers **409 `CONCURRENT_UPDATE`**; the quoted-empty entity-tag (`""`) is refused **400 `VALIDATION_FAILED`**, not treated as omitted. -2. **Assuming `DELETE` is recoverable.** ObjectStack `DELETE` is a hard - delete — there is no recycle bin. - For recoverability, use per-field `trackHistory` (audit - trail) or a `lifecycle` archive policy instead of custom soft-delete logic. +2. **Treating `DELETE` as final or as restorable.** A by-id delete keeps a + business object's rows in the recycle bin (`sys_recycle_bin`, 30 days by + default; not `multi: true` deletes, platform rows or rows deleted before the + bin existed); nothing lists or restores it over the API yet. No soft-delete. --- diff --git a/skills/objectstack-api/evals/endpoints-auth-routes.json b/skills/objectstack-api/evals/endpoints-auth-routes.json index b49417304ed..318636c3bdd 100644 --- a/skills/objectstack-api/evals/endpoints-auth-routes.json +++ b/skills/objectstack-api/evals/endpoints-auth-routes.json @@ -44,10 +44,10 @@ { "id": 5, "prompt": "Lock the `invoice` object's API down to read, list, search and export; add a `/bulk` route for imports and a `restore` operation so deleted invoices can be undeleted.", - "expected_output": "Authors only the primitives: `apiMethods: ['get', 'list']` — `search` and `export` derive from `list` automatically and are never declared (a declared derived verb is stripped with a warning). Explains there is no `/bulk` route (batch writes go through `POST /api/v1/data/{object}/batch`) and that `restore` / `purge` never derive because DELETE is a hard delete; recoverability is per-field `trackHistory` or a `lifecycle` archive policy.", + "expected_output": "Authors only the primitives: `apiMethods: ['get', 'list']` — `search` and `export` derive from `list` automatically and are never declared (a declared derived verb is stripped with a warning). Explains there is no `/bulk` route (batch writes go through `POST /api/v1/data/{object}/batch`) and that `restore` / `purge` never derive: a by-id delete of a business object already keeps its rows in the recycle bin (`sys_recycle_bin`), but nothing lists or restores them over the API yet, so there is no restore operation to add and no custom soft-delete to build.", "files": [], "assertions": { - "must_contain": ["apiMethods", "/batch", "trackHistory", "lifecycle"], + "must_contain": ["apiMethods", "/batch", "sys_recycle_bin", "recycle bin"], "must_not_contain": ["'search'", "'restore'"] } },