|
- Expanded docs/api.md from 83 lines to full coverage: all 58 registered
routes documented with method, both /api/ and /api/v1/ path aliases,
request/response JSON schemas, status codes, and curl examples
- Added Authentication section: Bearer token vs session cookie, auth
precedence in RequireSession middleware, first-time bootstrap flow
- Added API Versioning section: /api/ (legacy/web) vs /api/v1/ (stable
contract), handleBoth convention, recommendation for mobile clients
- Added Error Envelope section: {error: ...} documented once with full
status code table
- Added Token Lifecycle subsection: minting (one-time plaintext), expiry
enforcement, last_used_at semantics, and revocation behaviour
- Added Range header support documentation for streaming endpoints
- Added Quick Reference table mapping every route to its auth level
- Updated AGENTS.md with two new sections: Bearer-or-cookie unified
middleware pattern in RequireSession, and handleBoth route registration
convention to prevent multi-client contract drift
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
