seahaven-ap/packages/api/docs/index.md

# Sea Haven AP API

HTTP API for Sea Haven accounts payable. Local server is `http://127.0.0.1:8787`.

Liveness is `GET /api/health` (`{ stage, sha }`) with no auth and no database
ping. Readiness is optional `GET /api/ready`. Errors use
`{ error: { code, message, correlationId } }`.
feat(api): stand up Hono Drizzle foundation with auth and Redocly (AP-14) (#12) * feat(api): stand up Hono Drizzle foundation with auth and Redocly * fix(api): bump drizzle-orm and hono node-server past audit highs * fix(api): harden auth upsert and Cognito token verification 2026-08-10 20:10:49 -04:00			`# Sea Haven AP API`

feat(api): portal contract, cookie auth, and domain stubs (AP-51) (#64) * feat(api): serve portal-shaped health and error envelope Move liveness to GET /api/health { stage, sha } with a Node 24 image on 8080 so ALB probes and deploy verify do not need auth or a database ping. * feat(api): switch live auth to host cookie BFF Replace Bearer as the documented session path with Cognito hosted UI plus __Host-ap_* cookies so the SPA can call /api with credentials include. * feat(web): add unused cookie SPA API client Land a credentials-include fetch helper and hand-synced health/me types without wiring pages or domain hooks, so mocks stay the default data path. * feat(api): add master-data OpenAPI and Hono stubs * feat(api): add invoice, line, and document stubs * feat(api): add approval policy, inbox, and activity stubs * test(web): fix SPA client fetch mock types * test(web): cast fetch mock call args for tsc * fix(api): do not default DEV_AUTH_BYPASS outside local migrate * fix(api): replace invoice lines in a single transaction * fix(api): create invoices and lines in one transaction * fix(api): inline GIT_SHA from the image build arg * fix(api): stop PATCH from skipping the approval workflow * fix(api): address review feedback * fix(ci): format upsert-user test * fix(api): document only the auth statuses the routes return * fix(api): drop health 400 responses the routes never return 2026-09-25 22:43:44 +00:00			HTTP API for Sea Haven accounts payable. Local server is `http://127.0.0.1:8787`.
feat(api): stand up Hono Drizzle foundation with auth and Redocly (AP-14) (#12) * feat(api): stand up Hono Drizzle foundation with auth and Redocly * fix(api): bump drizzle-orm and hono node-server past audit highs * fix(api): harden auth upsert and Cognito token verification 2026-08-10 20:10:49 -04:00
feat(api): portal contract, cookie auth, and domain stubs (AP-51) (#64) * feat(api): serve portal-shaped health and error envelope Move liveness to GET /api/health { stage, sha } with a Node 24 image on 8080 so ALB probes and deploy verify do not need auth or a database ping. * feat(api): switch live auth to host cookie BFF Replace Bearer as the documented session path with Cognito hosted UI plus __Host-ap_* cookies so the SPA can call /api with credentials include. * feat(web): add unused cookie SPA API client Land a credentials-include fetch helper and hand-synced health/me types without wiring pages or domain hooks, so mocks stay the default data path. * feat(api): add master-data OpenAPI and Hono stubs * feat(api): add invoice, line, and document stubs * feat(api): add approval policy, inbox, and activity stubs * test(web): fix SPA client fetch mock types * test(web): cast fetch mock call args for tsc * fix(api): do not default DEV_AUTH_BYPASS outside local migrate * fix(api): replace invoice lines in a single transaction * fix(api): create invoices and lines in one transaction * fix(api): inline GIT_SHA from the image build arg * fix(api): stop PATCH from skipping the approval workflow * fix(api): address review feedback * fix(ci): format upsert-user test * fix(api): document only the auth statuses the routes return * fix(api): drop health 400 responses the routes never return 2026-09-25 22:43:44 +00:00			Liveness is `GET /api/health` (`{ stage, sha }`) with no auth and no database
			ping. Readiness is optional `GET /api/ready`. Errors use
			`{ error: { code, message, correlationId } }`.