We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
docs(api-contract): document POST /api/invoices/auto-itemize/merge-lines endpoint Adds the previously-undocumented fourth auto-itemize sibling endpoint (Story #1797, PR #1803) to the EPIC-15 section: request/response shapes, field tables, and error codes sourced from the route JSON schema (mergeLinesSchema), the MergeLinesRequest/Response shared types, and the mergeLines service. Surgical single-endpoint insertion, no other edits. References issue #1821 and Story #1797. Note: the older vendor-contacts and subsidy-programs legacy documentation gaps found during the #1821 audit are out of scope here and are follow-up candidates for a separate legacy-audit issue. Co-Authored-By: Claude product-architect (Opus 4.6) <noreply@anthropic.com>
docs(api-contract): fix VAT_RATE row column alignment Fixes #1807 Co-Authored-By: Claude backend-developer (Haiku 4.5) <noreply@anthropic.com>
docs(api-contract): document VAT_RATE config for GET /api/config Fixes #1807 Co-Authored-By: Claude backend-developer (Haiku 4.5) <noreply@anthropic.com>
docs(api-contract): document GET /api/backups/scheduler-status endpoint Adds the scheduler-status endpoint (response shape, error codes) and the new BackupSchedulerLastRun/BackupSchedulerStatus/BackupSchedulerStatusResponse type definitions, introduced by the node-cron 4.5 adoption work (#1804). Co-Authored-By: Claude backend-developer (Haiku 4.5) <noreply@anthropic.com>
docs: sync wiki with latest epics (auto-itemize, mobile, budget, security) Updates API contract, schema, security audit, style guide, architecture, and multiple ADRs to reflect changes merged through the current beta state.
docs(api): document vendorId reassignment field for PATCH invoice (#1736) Add the optional body vendorId field to PATCH /api/vendors/:vendorId/invoices/:invoiceId. Clarify source (path) vs target (body) vendor semantics, document the 404 'Vendor not found' case when the target vendor does not exist (invoice unchanged), and the backward-compatible omit behavior. Harmonize the status enum to include 'quotation'. Co-Authored-By: Claude product-architect (Opus 4.6) <noreply@anthropic.com>
docs(api): document /api/orientations endpoints with name-or-description search Backfills the orientations CRUD surface omitted by PR #1676 and documents the expanded search semantics (name OR description) from PR #1725 (Issue #1723). Co-Authored-By: Claude product-architect (Opus 4.6) <noreply@anthropic.com>
docs(adr-033): note hide()-inside-modal caveat + isPositioned pattern Amend ADR-033 to record two implementation-validated deviations from the original integration sketch: hide() middleware removed (regressed dropdown visibility inside modal overflow:hidden, caught by tablet E2E) and the isPositioned visibility gate (suppresses first-frame top:0 flash). Adds an Implementation Notes section and a Deviation Log entry so future floating-UI consumers do not repeat the hide() mistake. Co-Authored-By: Claude product-architect (Opus 4.6) <noreply@anthropic.com>
docs(adr): add ADR-033 Floating UI for floating-element positioning (#1708) Co-Authored-By: Claude product-architect (Sonnet) <noreply@anthropic.com>
docs(security): add PR #1676 review entry (Story #1674 orientations + mobile photo upload)
docs(security): mark findings #29 and #30 resolved; add PR #1681 review entry Co-Authored-By: Claude security-engineer (Sonnet 4.6) <noreply@anthropic.com>
docs: design Paperless-first invoice creation (ADR-032, API contract for #1679) Co-Authored-By: Claude product-architect (Opus 4.6) <noreply@anthropic.com>
docs(api-contract): add autoItemizeEnabled to GET /api/config response shape Add autoItemizeEnabled boolean field to the GET /api/config response table and JSON example. Document all six LLM env vars (LLM_BASE_URL, LLM_API_KEY, LLM_MODEL, LLM_REQUEST_TIMEOUT_MS, LLM_MAX_TOKENS, LLM_PROVIDER) in the environment variable table. Add clarifying notes that the API key is never returned to the client and that the feature is default-off. Addresses API Contract drift introduced by PR #1628 (EPIC-16 Story #1546). See ADR-031 for full LLM integration design.
docs(api): add origin to BreakdownBudgetLine (#1551)
docs(api): document optional invoicePatch field on auto-itemize commit Issue #1564: dedicated auto-itemize page lets the user edit invoice metadata alongside line items. To avoid a partial-success window between two sequential calls (PATCH invoice + POST auto-itemize commit), extend the existing commit payload with an optional invoicePatch field applied in the same DB transaction as line creation. Vendor and status are deliberately excluded from invoicePatch — vendor changes carry side effects that need a deliberate decision (out of scope for this story). Co-Authored-By: Claude product-architect (Opus 4.6) <noreply@anthropic.com>
docs(api-contract): add system-linked document filter endpoint
docs(api): remove 409 BUDGET_LINE_ALREADY_LINKED from invoice budget-lines PATCH endpoint
docs(security): add PR #1554 review findings (move fields minLength, minProperties)
docs: update API Contract for invoice budget line PATCH endpoint - Change HTTP method from PUT to PATCH - Document full EditAndMoveBudgetLineRequest schema with all fields - Add error codes for NOT_FOUND and BUDGET_LINE_ALREADY_LINKED - Add notes about transaction atomicity and response shape - Update work item and household item budget PATCH endpoints to clarify cross-table moves require invoice endpoint
docs(api): POST /api/invoices/:invoiceId/auto-itemize (#1547)
docs(security): PR #1550 auto-itemize route audit — 2 informational findings (OCR cap confirmed unaddressed, lines maxItems missing)
docs(security): PR #1549 — BudgetExtractionService LLM integration audit (4 informational findings) Co-Authored-By: Claude security-engineer (Sonnet 4.6) <noreply@anthropic.com>
docs(adr): ADR-031 Outbound LLM Provider Integration via OpenAI-Compatible Gateway (#1546)
docs(#1545): add ADR-030 for orphan budget lines + fix duplicate API contract shape - New ADR-030: Orphan Budget Lines via Nullable Parent FK + 'origin' Discriminator - ADR-Index updated - POST /api/budget-lines/:id/assign — remove duplicate stale InvoiceBudgetLineDetailResponse shape, reference canonical shape
docs: document nullable work_item_id, origin column, and POST /api/budget-lines/:id/assign (#1545)
docs(security): add PR #1548 findings — unassigned budget lines & one-shot parent assignment Three informational findings: 1. assignToWorkItem operates outside a transaction (code consistency, not exploitable) 2. computeUsedAmount does not exclude orphan rows (latent gap before Story #1547) 3. targetId and id route param lack minLength: 1 (consistent with codebase pattern) Co-Authored-By: Claude security-engineer (Sonnet 4.6) <noreply@anthropic.com>
docs(style): update Photo Annotator pattern — a11y audit (Story #1478) - min-height instead of height on ToolPalette to prevent overflow clipping - active button must use --color-primary-active border (3:1 contrast requirement) - color swatch padding technique for 44px touch target - complete live-region announcement table for all shape operations - keyboard navigation spec (roving tabindex, Escape ownership, arrow key scope) - screen reader requirements: selection state, undo/redo, delete announcements - dark mode: inline input must use var(--color-text-inverse) not literal white - SVG shape visual table updated with freehand/measurement/callout handle counts
docs(security): add photo annotator endpoint audit findings (Story #1478) Four new findings from the PUT /api/photos/:id/annotation security audit: - [LOW] Missing MIME-type validation on annotation upload - [INFORMATIONAL] File-size limit returns 400 instead of 413 - [INFORMATIONAL] Hard multipart 50MB cap maps to 500 instead of 413 - [INFORMATIONAL] :id param lacks UUID format constraint (not exploitable) Co-Authored-By: Claude security-engineer (Sonnet 4.6) <noreply@anthropic.com>
docs(api,schema): document photo annotation endpoints and annotated_at column - API-Contract.md: new "Photo Endpoints" section with Photo response shape (incl. annotatedAt) and PUT/DELETE /api/photos/:id/annotation plus the variant query param on GET /api/photos/:id/file. - Schema.md: new "Photo Annotations" section covering photos.annotated_at and migration 0034_photo_annotations.sql. Co-Authored-By: Claude product-architect (Opus 4.6) <noreply@anthropic.com>
docs(style): add Photo Annotator component pattern section