From 211f3a99446708ea81b6d49977de6e1a52ae8ac7 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 6 Nov 2026 15:00:00 +0000 Subject: [PATCH 1/2] docs(skills): objectstack-api teaches the recycle bin a by-id delete keeps The data-API table, the derived-verb note and the DELETE pitfall said a delete is hard and there is no recycle bin. A by-id delete of a business object now keeps its rows in sys_recycle_bin (30 days by default); multi deletes, platform rows and rows deleted before the bin existed are not in it, and no restore or purge door is exposed yet. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01J8VVAnsTJVz6nCb7n8NUJs --- .changeset/api-skill-delete-recycle-bin.md | 8 ++++++++ skills/objectstack-api/SKILL.md | 14 +++++++------- 2 files changed, 15 insertions(+), 7 deletions(-) create mode 100644 .changeset/api-skill-delete-recycle-bin.md diff --git a/.changeset/api-skill-delete-recycle-bin.md b/.changeset/api-skill-delete-recycle-bin.md new file mode 100644 index 00000000000..23da3e6e908 --- /dev/null +++ b/.changeset/api-skill-delete-recycle-bin.md @@ -0,0 +1,8 @@ +--- +'@objectstack/skills': patch +--- + +docs(skills): objectstack-api no longer teaches that `DELETE` is a hard delete with no recycle bin: a by-id delete keeps a business object's rows in `sys_recycle_bin` (30 days by default; not `multi: true` deletes, platform rows or rows deleted before the bin existed), and restore is not exposed yet + +Clause-②: no +Metadata-protocol: none diff --git a/skills/objectstack-api/SKILL.md b/skills/objectstack-api/SKILL.md index ee551eb0d46..9751f4007fb 100644 --- a/skills/objectstack-api/SKILL.md +++ b/skills/objectstack-api/SKILL.md @@ -44,7 +44,7 @@ GET /api/v1/data/{object} # List records (with filter, sort, paginat GET /api/v1/data/{object}/:id # Get single record POST /api/v1/data/{object} # Create record PATCH /api/v1/data/{object}/:id # Update record -DELETE /api/v1/data/{object}/:id # Delete record (hard delete) +DELETE /api/v1/data/{object}/:id # Delete record (kept in the recycle bin) POST /api/v1/data/{object}/query # Complex queries + aggregation (QueryAST in body) POST /api/v1/data/{object}/batch # Per-object batch operations POST /api/v1/batch # Cross-object atomic batch @@ -265,8 +265,8 @@ eight extra verbs are never declared in `apiMethods`: | `export` | `list` | `GET /data/{object}/export` | `history` (from `get` ∧ `trackHistory`) gates only. `restore` / `purge` never -derive — the trash surface is retired. Declaring any derived verb in -`apiMethods` is stripped at parse with a FROM → TO warning. +derive: the recycle bin has no restore or purge door yet. Declaring any +derived verb in `apiMethods` is stripped at parse with a FROM → TO warning. `POST /data/{object}/import` takes `mapping` as `{ Column: field }` or as `FieldMappingEntry[]` (`api/export.zod.ts`); only the entry form carries @@ -413,10 +413,10 @@ keys mean the run produced none — never invent an empty. read. Sending neither skips the check; a mismatch answers **409 `CONCURRENT_UPDATE`**; the quoted-empty entity-tag (`""`) is refused **400 `VALIDATION_FAILED`**, not treated as omitted. -2. **Assuming `DELETE` is recoverable.** ObjectStack `DELETE` is a hard - delete — there is no recycle bin (the dead `enable.trash` flag was removed - in 16.x). For recoverability, use per-field `trackHistory` (audit - trail) or a `lifecycle` archive policy instead of custom soft-delete logic. +2. **Treating `DELETE` as final, or as restorable today.** A by-id delete + keeps a business object's rows in the recycle bin (`sys_recycle_bin`, 30 + days by default; never `multi: true` deletes, platform rows or rows deleted + before the bin existed). Restore is not exposed yet; build no soft-delete. --- From 9a449ed96a21307612ff086b0a18990e56dc637d Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 6 Nov 2026 16:16:12 +0000 Subject: [PATCH 2/2] docs(skills): objectstack-api scopes the recycle bin to business objects and updates eval case 5 The DELETE route comment names the condition (business-object rows), the pitfall says nothing lists or restores the bin over the API yet (sys_recycle_bin is apiEnabled: false), and eval case 5 expects the recycle-bin teaching instead of a hard delete with trackHistory or a lifecycle archive. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01J8VVAnsTJVz6nCb7n8NUJs --- .changeset/api-skill-delete-recycle-bin.md | 2 +- skills/objectstack-api/SKILL.md | 10 +++++----- .../objectstack-api/evals/endpoints-auth-routes.json | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.changeset/api-skill-delete-recycle-bin.md b/.changeset/api-skill-delete-recycle-bin.md index 23da3e6e908..069019b0383 100644 --- a/.changeset/api-skill-delete-recycle-bin.md +++ b/.changeset/api-skill-delete-recycle-bin.md @@ -2,7 +2,7 @@ '@objectstack/skills': patch --- -docs(skills): objectstack-api no longer teaches that `DELETE` is a hard delete with no recycle bin: a by-id delete keeps a business object's rows in `sys_recycle_bin` (30 days by default; not `multi: true` deletes, platform rows or rows deleted before the bin existed), and restore is not exposed yet +docs(skills): objectstack-api no longer teaches that `DELETE` is a hard delete with no recycle bin: a by-id delete keeps a business object's rows in `sys_recycle_bin` (30 days by default; not `multi: true` deletes, platform rows or rows deleted before the bin existed), and nothing lists or restores it over the API yet; eval case 5 expects that teaching instead of a hard delete Clause-②: no Metadata-protocol: none diff --git a/skills/objectstack-api/SKILL.md b/skills/objectstack-api/SKILL.md index 6bef3a39c03..e0fee90e945 100644 --- a/skills/objectstack-api/SKILL.md +++ b/skills/objectstack-api/SKILL.md @@ -45,7 +45,7 @@ GET /api/v1/data/{object} # List records (with filter, sort, paginat GET /api/v1/data/{object}/:id # Get single record POST /api/v1/data/{object} # Create record PATCH /api/v1/data/{object}/:id # Update record -DELETE /api/v1/data/{object}/:id # Delete record (kept in the recycle bin) +DELETE /api/v1/data/{object}/:id # Delete record (business-object rows → recycle bin) POST /api/v1/data/{object}/query # Complex queries + aggregation (QueryAST in body) POST /api/v1/data/{object}/batch # Per-object batch operations POST /api/v1/batch # Cross-object atomic batch @@ -408,10 +408,10 @@ keys mean the run produced none — never invent an empty. read. Sending neither skips the check; a mismatch answers **409 `CONCURRENT_UPDATE`**; the quoted-empty entity-tag (`""`) is refused **400 `VALIDATION_FAILED`**, not treated as omitted. -2. **Treating `DELETE` as final, or as restorable today.** A by-id delete - keeps a business object's rows in the recycle bin (`sys_recycle_bin`, 30 - days by default; never `multi: true` deletes, platform rows or rows deleted - before the bin existed). Restore is not exposed yet; build no soft-delete. +2. **Treating `DELETE` as final or as restorable.** A by-id delete keeps a + business object's rows in the recycle bin (`sys_recycle_bin`, 30 days by + default; not `multi: true` deletes, platform rows or rows deleted before the + bin existed); nothing lists or restores it over the API yet. No soft-delete. --- diff --git a/skills/objectstack-api/evals/endpoints-auth-routes.json b/skills/objectstack-api/evals/endpoints-auth-routes.json index b49417304ed..318636c3bdd 100644 --- a/skills/objectstack-api/evals/endpoints-auth-routes.json +++ b/skills/objectstack-api/evals/endpoints-auth-routes.json @@ -44,10 +44,10 @@ { "id": 5, "prompt": "Lock the `invoice` object's API down to read, list, search and export; add a `/bulk` route for imports and a `restore` operation so deleted invoices can be undeleted.", - "expected_output": "Authors only the primitives: `apiMethods: ['get', 'list']` — `search` and `export` derive from `list` automatically and are never declared (a declared derived verb is stripped with a warning). Explains there is no `/bulk` route (batch writes go through `POST /api/v1/data/{object}/batch`) and that `restore` / `purge` never derive because DELETE is a hard delete; recoverability is per-field `trackHistory` or a `lifecycle` archive policy.", + "expected_output": "Authors only the primitives: `apiMethods: ['get', 'list']` — `search` and `export` derive from `list` automatically and are never declared (a declared derived verb is stripped with a warning). Explains there is no `/bulk` route (batch writes go through `POST /api/v1/data/{object}/batch`) and that `restore` / `purge` never derive: a by-id delete of a business object already keeps its rows in the recycle bin (`sys_recycle_bin`), but nothing lists or restores them over the API yet, so there is no restore operation to add and no custom soft-delete to build.", "files": [], "assertions": { - "must_contain": ["apiMethods", "/batch", "trackHistory", "lifecycle"], + "must_contain": ["apiMethods", "/batch", "sys_recycle_bin", "recycle bin"], "must_not_contain": ["'search'", "'restore'"] } },