v5.0.0-beta.8

5.0.0-beta.8 (2026-10-28)

Bug Fixes

• sandbox the Content and Metadata the library delivers (#134) (27ff49e)

v5.0.0-beta.7

5.0.0-beta.7 (2026-10-21)

⚠ BREAKING CHANGES

• fileHandler and roCrateHandler are replaced by the
  required storage option: fileHandler becomes storage.content and
  roCrateHandler becomes storage.metadata. Each half is a single function
  replacing the separate head and get, and returns null where a handler
  returned false. The file result is now a path delivery, and accelPath
  (X-Accel-Redirect) is gone. The FileHandler, RoCrateHandler,
  GetFileHandler, HeadFileHandler, GetRoCrateHandler, HeadRoCrateHandler,
  FileResult, FileRedirectResult, FileStreamResult, FilePathResult and
  FileMetadata exports are removed.
• arocapi/opensearch and arocapi/postgres are removed
  with no aliases. Import OpenSearchBackend from arocapi/search/opensearch
  and PostgresBackend from arocapi/search/postgres instead.

Features

• deliver Metadata and Content through a StorageBackend (a2544d0)
• move search backends to arocapi/search/* subpaths (60a8457)
• resolve OCFL standard storage layouts 0002, 0003 and 0004 in OcflStorage (7087bf5), closes #129
• serve Metadata and Content from S3 with S3Storage (d7f8adb)
• serve Metadata from Entity.meta with EntityMetaMetadata (453e4bb)
• serve OCFL storage roots on LDaCA's layout with OcflStorage (b1729ad)

v5.0.0-beta.6

5.0.0-beta.6 (2026-10-21)

⚠ BREAKING CHANGES

• consumers must install fastify ^5.12.7 themselves.
• import OpenSearchBackend from 'arocapi/opensearch' and
  PostgresBackend from 'arocapi/postgres' instead of 'arocapi'. Consumers
  of OpenSearchBackend must install @opensearch-project/opensearch.
• searchVisibilityFilter OpenSearch query → the shared
  search visibility filter language (SearchVisibilityWhere).
• the opensearch, queryBuilderClass and
  queryBuilderOptions options are removed; pass
  search: OpenSearchBackend({ client, fields }) instead, declaring your
  search fields and creating the index with createIndex(). The
  OpensearchQueryBuilder export and its QueryBuilderOptions,
  FilterCapability, FacetCapability and SearchCapability types are
  removed; use field declarations, BackendSearchCapability and
  capabilitiesFromFields, or write your own SearchBackend.
• POST /search only accepts the filter keys and sorts
  the backend declares; the fixed id, name, createdAt and
  updatedAt sorts are replaced by declared sort fields. Facets are
  keyed by field name and present for every declared facet, and
  searchExtra is whatever the backend returns.
• GET /capabilities reports apiVersion 0.5.0, adding
  search.sorts, search.searchTypes and search.geo.
• arocapi requires PostgreSQL 18 or later; MySQL and
  MariaDB are no longer supported. Consumers must switch their Prisma
  datasource to postgresql and use @prisma/adapter-pg. MySQL users stay on
  4.x.
• @prisma/client 6 is no longer supported; upgrade to 7.10 or later.
• comma-separated entityType values on GET /entities are
  no longer split. Repeat the parameter for each type instead:
  ?entityType=A&entityType=B.

Features

• add field declarations and OpenSearchBackend indexing (06ec6d0)
• add the EntitySearch model and PostgresBackend indexing (4b3a80a)
• advanced queries on PostgresBackend (b3bc5bb)
• export checkSearchVisibility and VisibilityCondition for custom backends (f878471)
• export search backends from arocapi/opensearch and arocapi/postgres (5a86ece)
• make fastify a peer dependency (0973892)
• parse advanced queries into a tree for the search backend (65ef05a), closes #102
• range filters, year date facets, geo and highlights (d2a21b1)
• ranges, date facets and geo on PostgresBackend (3c4f235), closes #107
• refresh option on OpenSearchBackend, default false (32fdfea)
• run on Postgres 18 only (72b1947)
• search through a SearchBackend (0eccedf)
• search visibility filter language (07fef2d)
• search with PostgresBackend (70f87d4)

Bug Fixes

• accept repeated entityType parameters on GET /entities (596f272), closes #42
• declare the supported Node.js version (6ca7cb1)
• harden search visibility checking and cap geohash grids (d050c9e)
• reject a prisma option that isn't a Prisma 7 client with the arocapi models (f767660)
• require Prisma 7 as the @prisma/client peer (089d4bc)
• search edge cases across the route and both backends (2e924ef)
• ship only the library in the package (651cd84)
• ship the generated Prisma declarations and type the prisma option structurally (2f29088), closes #92

v5.0.0-beta.5

5.0.0-beta.5 (2026-10-16)

Bug Fixes

• accept only true or false for noRedirect on GET /file (cc32294), closes #67

v5.0.0-beta.4

5.0.0-beta.4 (2026-10-16)

Bug Fixes

• encode Content-Disposition filenames on GET /file (61d257d), closes #66

v5.0.0-beta.3

5.0.0-beta.3 (2026-10-16)

⚠ BREAKING CHANGES

• accessTransformer and fileAccessTransformer are replaced
  by access: (entity: BaseEntity, context) => { metadata, content, metadataAuthorizationUrl?, contentAuthorizationUrl? }. A file's access is
  its file entity's access. Replace AllPublicAccessTransformer and
  AllPublicFileAccessTransformer with AllPublicAccess. Requests a handler
  used to serve while the access flag was false are now Denied before the
  handler runs.
• hiddenResponse is replaced by isAuthenticated(context) and
  promptLoginForHidden. For the anonymous login prompt use
  promptLoginForHidden: true with isAuthenticated; a hidden entity can no
  longer get a 403.
• TransformerContext and FileHandlerContext are replaced by
  RequestContext, which has the same { request, fastify } shape.
• POST /search answers malformed queries with 422
  VALIDATION_ERROR instead of INVALID_REQUEST, and unexpected errors answer
  { error: { code: 'INTERNAL_ERROR', message: 'Internal server error' } }
  instead of { error: 'Internal Server Error', message }.
• entityVisibilityFilter and searchVisibilityFilter are now
  required; use AllVisibleEntityFilter and AllVisibleSearchFilter to keep
  every entity visible.

Features

• enforce access on Metadata and Content through one access function (d5688fa), closes #41
• export the error handler and error helpers (d85784f), closes #43
• hide entities with visibility filters (1e1f6de), closes #39

Bug Fixes

• don't crash the error handler on errors with a non-string code (fa51e02)
• keep error headers and status in the error handler (fca25bd)
• trust only safe 4xx errors and let routes rely on errorHandler (c8fcf46), closes #50

Code Refactoring

• rename TransformerContext to RequestContext (bb44756)
• replace hiddenResponse with isAuthenticated and promptLoginForHidden (0da1892)

v5.0.0-beta.2

5.0.0-beta.2 (2026-10-12)

Features

• serve GET /capabilities (294d4e1), closes #37

v5.0.0-beta.1

5.0.0-beta.1 (2026-10-12)

⚠ BREAKING CHANGES

• arocapi no longer sets CORS headers and the
  disableCors option is removed. To keep the previous behaviour, register
  @fastify/cors on the root instance before arocapi:

  fastify.register(cors);
  fastify.register(arocapi, options);

• GET and HEAD /entity/:id/rocrate have been renamed to
  /entity/:id/metadata. Clients must use the new path; the old path now
  returns 404.

• the arocapi/express entry point has been removed and
  express is no longer a dependency. To mount the API in Express, register
  the plugin on a Fastify instance and forward requests with
  fastify.routing(req, res); see "Using with Express" in the README.

Features

• remove Express adapter (5b0799a)
• stop registering CORS (67b6f61)

Bug Fixes

• rename /rocrate endpoint to /metadata (19b65fc)
• rename endpoint rocrate to metadata (af3fd91)

v4.0.1

4.0.1 (2026-05-10)

Bug Fixes

• add type ReadableStream to supported file stream (#22) (3178ac7)

v4.0.0

4.0.0 (2026-04-29)

⚠ BREAKING CHANGES

• arocapi no longer decorates fastify.prisma or
  fastify.opensearch; consumers must close over their own client
  references. Arocapi no longer calls
  prisma.$connect()/$disconnect() or opensearch.ping()/close() —
  consumers now own connecting before registration and closing on
  shutdown.

Features

• replace decoration with options-based dependency injection (#20) (aa5c6b7)

Bug Fixes

• files: filter by entity.memberOf instead of entity.id (#21) (a6f27bd)