Slingshot v0.3.5 — Postgres op.transition fix

Fixed

op.transition was a silent no-op on Postgres. transitionPostgres numbered its WHERE placeholders match-first ($3 = id, $4 = status) but pushed the bind values from-first, so every transition executed as:

UPDATE ... WHERE id = '<from-state>' AND status = '<uuid>'

That matches no row. The route answered HTTP 200 with a null body and wrote nothing — no error raised anywhere.

Postgres-only. The SQLite branch of the same file pushes match values before the from guard and was always correct, which is why the SQLite-backed test estate stayed green throughout. transitionPostgres had no test of its own; that is why it shipped.

Found in sgforum, where it meant no thread could ever be published — the dev database held 64 drafts and 1 published row, and that row had been inserted directly by the seed.

Regression coverage

packages/slingshot-entity/tests/unit/transitionPostgres.test.ts uses a fake pool that resolves $n placeholders positionally, rather than pattern-matching hardcoded SQL. A fake that matches the caller's own SQL strings cannot fail on a transposition — the same trap that let the notifications Postgres bug ship. It fails 3/4 against the old code.

Upgrading

@lastshotlabs/slingshot-entity is 0.2.5. Every package depending on it moved too, because workspace:* is rewritten to the exact version at publish time — a dependent left behind would keep pinning the broken build.