v5.0.0-beta.3

5.0.0-beta.3 (2026-10-16)

⚠ BREAKING CHANGES

• accessTransformer and fileAccessTransformer are replaced
  by access: (entity: BaseEntity, context) => { metadata, content, metadataAuthorizationUrl?, contentAuthorizationUrl? }. A file's access is
  its file entity's access. Replace AllPublicAccessTransformer and
  AllPublicFileAccessTransformer with AllPublicAccess. Requests a handler
  used to serve while the access flag was false are now Denied before the
  handler runs.
• hiddenResponse is replaced by isAuthenticated(context) and
  promptLoginForHidden. For the anonymous login prompt use
  promptLoginForHidden: true with isAuthenticated; a hidden entity can no
  longer get a 403.
• TransformerContext and FileHandlerContext are replaced by
  RequestContext, which has the same { request, fastify } shape.
• POST /search answers malformed queries with 422
  VALIDATION_ERROR instead of INVALID_REQUEST, and unexpected errors answer
  { error: { code: 'INTERNAL_ERROR', message: 'Internal server error' } }
  instead of { error: 'Internal Server Error', message }.
• entityVisibilityFilter and searchVisibilityFilter are now
  required; use AllVisibleEntityFilter and AllVisibleSearchFilter to keep
  every entity visible.

Features

• enforce access on Metadata and Content through one access function (d5688fa), closes #41
• export the error handler and error helpers (d85784f), closes #43
• hide entities with visibility filters (1e1f6de), closes #39

Bug Fixes

• don't crash the error handler on errors with a non-string code (fa51e02)
• keep error headers and status in the error handler (fca25bd)
• trust only safe 4xx errors and let routes rely on errorHandler (c8fcf46), closes #50

Code Refactoring

• rename TransformerContext to RequestContext (bb44756)
• replace hiddenResponse with isAuthenticated and promptLoginForHidden (0da1892)