cuibonobo · Sep 29, 2026 · Sep 26, 2026
diff --git a/.changeset/refuse-unrecognized-input.md b/.changeset/refuse-unrecognized-input.md
diff --git a/.changeset/wire-parsers-remaining-endpoints.md b/.changeset/wire-parsers-remaining-endpoints.md
diff --git a/packages/adapter-api/CHANGELOG.md b/packages/adapter-api/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @haverstack/adapter-api
 
+## 0.38.0
+
+### Minor Changes
+
+- Released for a breaking change in `@haverstack/core`, `@haverstack/wire-types`.
+
+### Patch Changes
+
+- Updated dependencies [[`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498), [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c)]:
+  - @haverstack/wire-types@0.38.0
+  - @haverstack/core@0.39.0
+
 ## 0.37.0
 
 ### Minor Changes

diff --git a/packages/adapter-api/package.json b/packages/adapter-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/adapter-api",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Remote server adapter for Haverstack",
   "type": "module",
   "exports": {

diff --git a/packages/adapter-conformance/CHANGELOG.md b/packages/adapter-conformance/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @haverstack/adapter-conformance
 
+## 0.8.0
+
+### Minor Changes
+
+- Released for a breaking change in `@haverstack/core`.
+
+### Patch Changes
+
+- Updated dependencies [[`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498), [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c)]:
+  - @haverstack/core@0.39.0
+
 ## 0.7.0
 
 ### Minor Changes

diff --git a/packages/adapter-conformance/package.json b/packages/adapter-conformance/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/adapter-conformance",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Runnable conformance suite for StackRecordAdapter/StackBlobAdapter implementers — the invariants docs/spec/adapters.md documents, as tests you point at your own adapter",
   "type": "module",
   "exports": {

diff --git a/packages/adapter-local/CHANGELOG.md b/packages/adapter-local/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @haverstack/adapter-local
 
+## 0.38.0
+
+### Minor Changes
+
+- Released for a breaking change in `@haverstack/blob-adapter-disk`, `@haverstack/core`, `@haverstack/record-adapter-sqlite`.
+
+### Patch Changes
+
+- Updated dependencies [[`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498), [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c)]:
+  - @haverstack/blob-adapter-disk@0.37.0
+  - @haverstack/record-adapter-sqlite@0.31.0
+  - @haverstack/core@0.39.0
+
 ## 0.37.0
 
 ### Minor Changes

diff --git a/packages/adapter-local/package.json b/packages/adapter-local/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/adapter-local",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Local (SQLite + disk) stack adapter for Haverstack",
   "type": "module",
   "engines": {

diff --git a/packages/blob-adapter-disk/CHANGELOG.md b/packages/blob-adapter-disk/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @haverstack/blob-adapter-disk
 
+## 0.37.0
+
+### Minor Changes
+
+- Released for a breaking change in `@haverstack/core`.
+
+### Patch Changes
+
+- Updated dependencies [[`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498), [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c)]:
+  - @haverstack/core@0.39.0
+
 ## 0.36.0
 
 ### Minor Changes

diff --git a/packages/blob-adapter-disk/package.json b/packages/blob-adapter-disk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/blob-adapter-disk",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Disk blob adapter for Haverstack",
   "type": "module",
   "exports": {

diff --git a/packages/blob-adapter-s3/CHANGELOG.md b/packages/blob-adapter-s3/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @haverstack/blob-adapter-s3
 
+## 0.25.0
+
+### Minor Changes
+
+- Released for a breaking change in `@haverstack/core`.
+
+### Patch Changes
+
+- Updated dependencies [[`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498), [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c)]:
+  - @haverstack/core@0.39.0
+
 ## 0.24.0
 
 ### Minor Changes

diff --git a/packages/blob-adapter-s3/package.json b/packages/blob-adapter-s3/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/blob-adapter-s3",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "S3 (and S3-compatible) blob adapter for Haverstack",
   "type": "module",
   "exports": {

diff --git a/packages/commons/CHANGELOG.md b/packages/commons/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @haverstack/commons
 
+## 0.33.0
+
+### Minor Changes
+
+- Released for a breaking change in `@haverstack/core`.
+
+### Patch Changes
+
+- Updated dependencies [[`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498), [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c)]:
+  - @haverstack/core@0.39.0
+
 ## 0.32.0
 
 ### Minor Changes

diff --git a/packages/commons/package.json b/packages/commons/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/commons",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Canonical Schema Commons type definitions for Haverstack — register commons types exactly as written",
   "type": "module",
   "exports": {

diff --git a/packages/conformance-fixtures/CHANGELOG.md b/packages/conformance-fixtures/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @haverstack/conformance-fixtures
 
+## 0.33.0
+
+### Minor Changes
+
+- [#353](https://github.com/haverstack/core/pull/353) [`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498) Thanks [@cuibonobo](https://github.com/cuibonobo)! - The `./wire` request parsers refuse input their endpoint does not define instead of ignoring it. `parseQueryParams()`, `parseChangeParams()` and `parseJournalParams()` throw `StackBadRequestError` for an unknown query param, a repeat of a param that names one value, or a boolean param other than `true`/`false`. `parseQueryBody()` does the same for an unknown key at any depth, a non-object body, a non-boolean `includeDeleted`/`includeUnlisted` or a non-string `cursor`. `createOptionsFromWireRecord()` refuses a key no wire record carries. The rule is specified in docs/spec/wire-format.md § Unrecognized input, and four new error fixtures cover it.
+
+- [#356](https://github.com/haverstack/core/pull/356) [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c) Thanks [@cuibonobo](https://github.com/cuibonobo)! - `@haverstack/core/wire` adds a parser for every remaining endpoint core specifies, so a server no longer keeps its own list of their param and field names: `parseAuthChallengeBody()`, `parseAuthTokenBody()`, `parseEntityPatchBody()`, `parseTypeBody()`, `parseMigrationBody()`, `parseDeleteParams()`, `parseDownloadParams()` and `parseAssociationParams()`. Each refuses an unknown name or a malformed boolean with `StackBadRequestError`, and a known body field of the wrong type with `StackValidationError`. Two error fixtures pin a non-boolean `purge` and an unknown key on `POST /auth/token`.
+
+  `Stack` refuses an association, permission or grant-target element carrying a key its kind does not define, at every depth, with `StackBadRequestError`. This applies on every write that takes an element, on a `relatedTo` filter target, and on `grantType()`, `revokeType()` and `listTypeGrants()`. A `_grant` record's `grantee` is held to the same keys and refused with `StackValidationError`. A new error fixture pins an unknown key on a permission grantee.
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @haverstack/wire-types@0.38.0
+
 ## 0.32.0
 
 ### Minor Changes

diff --git a/packages/conformance-fixtures/package.json b/packages/conformance-fixtures/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/conformance-fixtures",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Request/response fixtures for the Stack API wire protocol, shared between adapter-api and server implementations",
   "type": "module",
   "exports": {

diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @haverstack/core
 
+## 0.39.0
+
+### Minor Changes
+
+- [#353](https://github.com/haverstack/core/pull/353) [`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498) Thanks [@cuibonobo](https://github.com/cuibonobo)! - The `./wire` request parsers refuse input their endpoint does not define instead of ignoring it. `parseQueryParams()`, `parseChangeParams()` and `parseJournalParams()` throw `StackBadRequestError` for an unknown query param, a repeat of a param that names one value, or a boolean param other than `true`/`false`. `parseQueryBody()` does the same for an unknown key at any depth, a non-object body, a non-boolean `includeDeleted`/`includeUnlisted` or a non-string `cursor`. `createOptionsFromWireRecord()` refuses a key no wire record carries. The rule is specified in docs/spec/wire-format.md § Unrecognized input, and four new error fixtures cover it.
+
+- [#356](https://github.com/haverstack/core/pull/356) [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c) Thanks [@cuibonobo](https://github.com/cuibonobo)! - `@haverstack/core/wire` adds a parser for every remaining endpoint core specifies, so a server no longer keeps its own list of their param and field names: `parseAuthChallengeBody()`, `parseAuthTokenBody()`, `parseEntityPatchBody()`, `parseTypeBody()`, `parseMigrationBody()`, `parseDeleteParams()`, `parseDownloadParams()` and `parseAssociationParams()`. Each refuses an unknown name or a malformed boolean with `StackBadRequestError`, and a known body field of the wrong type with `StackValidationError`. Two error fixtures pin a non-boolean `purge` and an unknown key on `POST /auth/token`.
+
+  `Stack` refuses an association, permission or grant-target element carrying a key its kind does not define, at every depth, with `StackBadRequestError`. This applies on every write that takes an element, on a `relatedTo` filter target, and on `grantType()`, `revokeType()` and `listTypeGrants()`. A `_grant` record's `grantee` is held to the same keys and refused with `StackValidationError`. A new error fixture pins an unknown key on a permission grantee.
+
 ## 0.38.0
 
 ### Minor Changes

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/core",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Core library for Haverstack — portable personal data stack",
   "type": "module",
   "exports": {

diff --git a/packages/record-adapter-do-sqlite/CHANGELOG.md b/packages/record-adapter-do-sqlite/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @haverstack/record-adapter-do-sqlite
 
+## 0.24.0
+
+### Minor Changes
+
+- Released for a breaking change in `@haverstack/core`.
+
+### Patch Changes
+
+- Updated dependencies [[`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498), [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c)]:
+  - @haverstack/core@0.39.0
+
 ## 0.23.0
 
 ### Minor Changes

diff --git a/packages/record-adapter-do-sqlite/package.json b/packages/record-adapter-do-sqlite/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/record-adapter-do-sqlite",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Cloudflare Durable Objects (SQLite storage) StackRecordAdapter for Haverstack — Workers, FTS5, single-writer by construction",
   "type": "module",
   "exports": {

diff --git a/packages/record-adapter-sqlite/CHANGELOG.md b/packages/record-adapter-sqlite/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @haverstack/record-adapter-sqlite
 
+## 0.31.0
+
+### Minor Changes
+
+- Released for a breaking change in `@haverstack/core`.
+
+### Patch Changes
+
+- Updated dependencies [[`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498), [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c)]:
+  - @haverstack/core@0.39.0
+
 ## 0.30.0
 
 ### Minor Changes

diff --git a/packages/record-adapter-sqlite/package.json b/packages/record-adapter-sqlite/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/record-adapter-sqlite",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "Native SQLite (node:sqlite) record adapter for Haverstack — Node's built-in engine, no native compilation",
   "type": "module",
   "engines": {

diff --git a/packages/wire-types/CHANGELOG.md b/packages/wire-types/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @haverstack/wire-types
 
+## 0.38.0
+
+### Minor Changes
+
+- Released for a breaking change in `@haverstack/core`.
+
+### Patch Changes
+
+- Updated dependencies [[`a431168`](https://github.com/haverstack/core/commit/a43116869768b7f6e7f7a7bb9712d6821d831498), [`4a3bc8e`](https://github.com/haverstack/core/commit/4a3bc8e86f69296ce18413e2225e6f35557a3b1c)]:
+  - @haverstack/core@0.39.0
+
 ## 0.37.0
 
 ### Minor Changes

diff --git a/packages/wire-types/package.json b/packages/wire-types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@haverstack/wire-types",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "HTTP wire types and serialization for Haverstack",
   "type": "module",
   "exports": {