39 Commits

Include renames

Author	SHA1	Message	Date
Claude Code	6f0157d1b7	fix(vuln): pnpm bump next@16.3.8 (Trivy HIGH) [auto]	2026-10-14 19:59:23 +02:00
admin	2ce59368d4	chore(deps): släpp pnpm-overrides — @siax/contracts ^0.11.1 + @siax/import-export ^0.2.2 + @siax/ui ^0.15.1 ... Overrides var kryckan så länge contracts 0.11.0/import-export 0.2.1 aldrig publicerats (release-infrastrukturbugg, DES1GN run 104822). Efter root-fixen (DES1GN #200) är 0.11.1/0.2.2 publika och ui 0.15.1 ships dem inline — overrides behövs inte längre. svit: 1187 passed · typecheck: OK · build: OK	2026-09-30 23:37:52 +02:00
admin	c00e042399	Merge branch 'main' into fix/cve-lockfile-2026-09-30	2026-09-30 20:52:17 +00:00
Claude CodeandClaude Sonnet 5.5	08fbbf3595	fix(deps): next 16.3.4 -> 16.3.6 (CRITICAL GHSA-vcvr-r3jv-pc5j, next/og RCE) ... Same-minor bump of the exact-pinned direct dependency next (16.3.4 and 16.3.5 are affected by the remote code execution in next/og ImageResponse; fixed in 16.3.6, published 2026-09-22). package.json next 16.3.4 -> 16.3.6 (exact pin) pnpm-lock.yaml next + @next/env + 8 @next/swc-* platform packages -> 16.3.6, baseline-browser-mapping 2.11.21 -> 2.11.23 (next's own dep) package-lock.json next + @next/env + 8 @next/swc-* -> 16.3.6 (targeted edit; this legacy lockfile is already out of sync with package.json and npm cannot regenerate it because of the workspace:* protocol, so only the next entries were touched) No other dependency changed. pnpm install --frozen-lockfile, typecheck, check:contrast, vitest (1154 passed / 184 skipped), next build and eslint (0 errors) all pass on Node 22. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-30 17:45:23 +02:00
admin	04813c34b0	feat(collab): order-anteckningar — @siax/collaboration-kernelns första produktkonsument (spår C) ... Kernel 0.3.0 används som capability, inte som paket-dekor: - lib/order-notes-store.ts: varje note ÄR en CollaborationOperation; nextLamportClock för nya klockor, mergeOperationLog/compareOperations för deterministisk listning; optimistisk version -> 409 vid stale skrivning. - lib/order-notes-client.ts: kernel-CollaborationTransport över host-API; offline = medvetet no-op + varning (ingen tyst förlust), 409 -> ConflictError. - app/api/admin/order-notes: requireRouteAuth (fail-closed 401), server-authoritative tenant-guard (403), AUD0-audit via hostens klient. - app/admin/notes: admin-yta med offline-växel, konflikt-banner + reload. - sql/016_order_notes.sql: persistens (DB-tabell, version + Lamport-klocka). Tester: API (happy/conflict 409/empty/400/401/403/404), klient-adapter (offline no-op utan fetch, 409-mappning, presence), SSR-render. 18 nya test.	2026-09-30 17:07:21 +02:00
admin	c1648c04a7	feat(orders): CSV-import admin-yta — första riktiga ImportWizard-värden (C8) ... Symmetrisk mot våg 3.4 CSV-export: POST /api/orders/import (validate | dry_run | execute) + /admin/import som renderar @siax/ui ImportWizard (0.14.0) över @siax/import-export runtime (0.2.0). - Servern är enda auktoritet: RFC4180-parse (ingen eval), omvalidering via frysta @siax/contracts-kerneln (validateRows) + hostregler, exekvering genom BEFINTLIG orderlogik (createOrder, tenant-guardad). - Fail-closed: 401 utan principal, 400 okänd header, 413 vid radtak (500), per-rad-atomsäkra inserts — felrad kan aldrig skada OK-rader. - Partiell import: OK-rader skapas, felrader rapporteras per rad (row/field/code). AUD0-audit via 0pts enda producer-boundary (durable outbox under DATABASE_URL). - Reload-persistens: efter execute läses /api/orders om och de nya raderna listas på sidan. - Tester: 12 route-test (happy, partial, auth fail-closed, tak, no-write validate, header, quoting, rad-fel mitt i batch) + 3 SSR-render-test av ImportWizard över runtime-storen. - Deps: @siax/ui ^0.14.0, @siax/charts ^0.5.0, @siax/import-export ^0.2.0; pnpm-overrides till contracts 0.10.0 / import-export 0.2.0 (ui 0.14.0 deklarerar 0.11.0/0.2.1 som ännu ej publicerats).	2026-09-30 15:36:02 +02:00
Claude CodeandClaude Sonnet 5.5	ab051b3bca	fix(deps): patch HIGH advisories in brace-expansion (pnpm-lock.yaml) ... Lockfile-only bump of the transitive dev dependency brace-expansion, within the ranges requested by its parents (minimatch@3 -> ^1.1.7, minimatch@10 -> ^5.x): brace-expansion 1.1.16 -> 1.1.21 brace-expansion 5.0.8 -> 5.0.12 Clears CVE-2026-102276, CVE-2026-102278, CVE-2026-69152 (HIGH, both lines), CVE-2026-14257 (HIGH, 1.1.x) and CVE-2026-102277 (MEDIUM). Resolves to the same versions/integrity hashes package-lock.json already pins. package.json is untouched; no direct dependency changed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-30 11:23:48 +02:00
admin	9d28b26490	feat(charts): recharts → @siax/charts — Product Firewall fullbordad i 0pt (våg 2.4)	2026-09-30 00:43:44 +02:00
admin	bcc5c7feb5	build: @siax/ui 0.12.0-kanarie — dist-läge, transpilePackages bort för ui [C1]	2026-09-29 23:20:31 +02:00
admin	a49bc148fc	feat(admin): authz-pilot — server-renderad advance-resolution + ActionGate (ADR-0001) ... GET /api/orders returnerar per order frozen advance_action (resolveAction ur lib/order-flow); admin renderar via ActionGate — policy i serverlagret, presentation i klienten (DoD §21). Terminala/okända statusar → read_only med varför-text i stället för missvisande 'klar'. tests/order-flow.test.ts 3/3; full svit 1138 godkända; typecheck grön.	2026-09-29 12:21:02 +02:00
admin	bdca3c3305	build: @siax/ui ^0.11.0 — kanonalignering (adoption-förberedelse) ... 0.4.1 → 0.11.1 (låst): InboxList, ActionGate, authz-ux/entitlement-kontrakt nu tillgängliga för pilotkoppling. Full svit: 1138 godkända / 0 fel. ActionGate-piloten kräver först en permissions-resolutionsendpoint (requireOrderOwner är server-side; policy-input får inte hittas på — DoD §15) — designen står i minnet/PR-kommentaren.	2026-09-29 12:01:41 +02:00
admin	b205406ff6	build: kanoniska kernel-versioner — cmdk 1.1.1, sonner ^2.0.6 (våg 2) ... Alignar 0pt mot @siax/ui:s kanon (DES1GN #156): cmdk 1.0.4→1.1.1, sonner ^1.7.4→^2.0.6 (låst 2.0.8). Wrapper-API:erna (Toaster/toast, CommandMenu) är oförändrade. Full svit: 1138 godkända / 0 fel.	2026-09-28 22:33:02 +02:00
Claude CodeandClaude Sonnet 5	07158099ee	feat(ingestion): VehIQ OLTP -> ClickHouse watermark extractor (P070) ... Implements Simon's specified pattern (dealer_stock_entry/deal -> watermark/updated_at -> 0pt ingestion -> ClickHouse) as a P061 connector pair (PostgresWatermarkConnector, PostgresKeyedLookupConnector) plugged into the existing P062 IngestionRunner, writing to opt_dataset_projection via SiaxAnalyticsEngine.ingestProjection. Built here, not in admin/vehiq: that repo's own ADR-0035 (decisions 1/2/10, CI-enforced by validate_engine_firewall.py) forbids VehIQ code from ever holding a ClickHouse credential or hammering OLTP directly for analytics. See docs/P070_VEHIQ_OLTP_EXTRACTOR.md for the full rationale. Also corrects a real schema mismatch found while building this: production has no generic `updated_at` on any of the three target tables (verified live, read-only, 2026-09-25). dealer_stock_entry/deal use listed_at/ created_at as insert-time watermarks instead (documented caveat: in-place updates are not caught without a schema change); app.listing has no timestamp column at all and is deliberately not covered yet. Vehicle dimension lookup is narrow by construction: keyed on exactly the vehicle_id set referenced by the batch just read, never a scan of the 98M-row vehiq.vehicle table (connector-level validate() refuses that table by name; runner-level tests assert the query only ever touches referenced IDs). Verified: fixture-backed connector/runner tests (watermark+limit, same-timestamp tie at a page boundary, crash/resume, empty-table case, narrow-lookup query-count assertions) + a real disposable Postgres container (caught two real Date-handling bugs fixtures could not) + a read-only proof against actual production (server10, vehiq-db): the extractor's exact SQL returns zero rows, no error, confirming it is safe to schedule with zero current effect. .gitea/workflows/vehiq-oltp-ingest.yml is present, cron-scheduled, and defaults to VEHIQ_INGEST_MODE=preview (read-only, never writes) with no secrets configured — safe to merge with zero production effect until explicitly activated per the doc's "what activating this requires". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-25 19:11:15 +02:00
admin	f3658e2577	fix(FAS 36): ER-decision-importen via workspace-paketet @siax/0pt-decision (relativ path utanför root bröt Turbopack-builden — pre-existerande bugg från fc1a62b, exponerad av färsk pnpm-install i worktree)	2026-09-23 03:07:57 +02:00
Claude Code	fc1a62bb81	feat: decision-plane wiring — ER-pair decision.match tie-break (@siax/0pt-decision) ... - packages/decision: erMatchDecision (0pt.er.pair_match mot siax-decision :4600) - comparePair async + borderline-band (±0.05 av review_threshold) → decision.match (D1 advisory) — deterministisk status GÄLLER om decision abstainar - OPT_DECISION_ER_ENABLED=1-gate (off tills kalibrering) - tests async-anpassade (await generateCandidates/rejects.toThrowError) - typecheck: 13 fel = pre-existing extraction-route (main-paritet), 0 nya fel - tester: 1108 passed | 184 skipped	2026-09-23 00:15:27 +02:00
admin	946baef843	fix(deps): js-yaml 4.3.0 -> 4.3.2 (CVE-2026-84375 HIGH, DoS i YAML — transitive via des1gn-m0-vågen; trivy-gaten blockerade annars main)	2026-09-15 15:24:56 +02:00
admin	0b53c4bfd5	fix(deps): lockfile för des1gn-m0-mergen — @siax/ui 0.4.1 saknades i pnpm-lock (parallellsessionens merge tog package.json utan lås-regenerering; ERR_PNPM_OUTDATED_LOCKFILE bröt quality/integration/release-chain)	2026-09-15 15:11:52 +02:00
admin	38bf3520cd	Merge PR #63 (renovate: postcss 8.5.28) — lockfile semantiskt löst (main:s autoprefixer 10.5.5 + postcss uppdaterad i range), frozen-lockfile grön	2026-09-15 05:24:14 +02:00
admin	094d6e87e0	Merge branch 'main' into renovate/dev-dependencies-(non-major)	2026-09-15 03:17:49 +00:00
admin	dd28b52e49	Merge branch 'main' into renovate/autoprefixer-10.x-lockfile	2026-09-15 03:17:38 +00:00
Renovate	d8835d6e21	chore(deps): update dependency postcss to v8.5.28	2026-09-15 03:01:21 +00:00
Renovate	08b057f08e	chore(deps): update dependency autoprefixer to v10.5.5	2026-09-15 03:01:15 +00:00
Renovate	53e2d39ce7	chore(deps): update dependency @types/react-dom to v19.2.7	2026-09-15 03:01:09 +00:00
admin	d2a42a449f	Merge pull request 'fix(deps): update dependency next to v16.3.4' (#47) from renovate/web-stack into main	2026-09-08 20:48:57 +00:00
Renovate	e080cae785	fix(deps): update dependency next to v16.3.4	2026-09-08 03:01:43 +00:00
Renovate	e70f01ae7e	chore(deps): update react monorepo to v19.2.18	2026-09-08 03:01:37 +00:00
Renovate	45a59ca3aa	fix(deps): update web-stack	2026-09-06 03:01:40 +00:00
Renovate	ae5841dfe9	chore(deps): update dependency autoprefixer to v10.5.4	2026-09-05 03:01:43 +00:00
admin	9f0de72456	chore(deps): update dependency @tailwindcss/postcss to v4.3.3 (#12)	2026-08-31 14:54:56 +00:00
admin	6be9992cad	chore(deps): update dev-dependencies (non-major) (#14)	2026-08-31 14:54:54 +00:00
admin	328f8a46cb	docs+chore: repo hygiene -- v2.0 manifests, ADRs, changelog, doctor, guides ... BACKLOG P1-1: siax.repo.json/siax.config.json rewritten to be schema-valid against sax3l/siax-standard's actual v2.0 schemas (lifecycle, operationalState, gitHost, domains-as-objects, consumedBy, children, contracts -- validated with jsonschema, not just eyeballed). config.json restructured to the real deploy-descriptor shape (framework/build/start/ port/healthcheck/environments) instead of duplicating repo.json's identity fields, which the schema doesn't allow. BACKLOG P1-2: 3 ADRs for decisions already made and evidenced elsewhere in this repo (Coolify-not-Vercel, Zitadel-not-NextAuth, Iceberg-format pointer to n0d ADR-0030) -- retroactive documentation, not new decisions. The Stripe/Revolut and services/scrapers/* questions are explicitly NOT written as ADRs here; both are account-owner-gated or actively under review elsewhere (see docs/architecture/decisions/README.md). BACKLOG P1-3: CHANGELOG.md from real git log history (no tags/releases exist yet -- this doesn't invent version numbers that were never cut). BACKLOG P1-19: `pnpm siax:doctor` (scripts/siax-doctor.mjs, AGENT-04) -- zero-dependency, checks required files + manifest shape, prints control-IDs. .devcontainer/devcontainer.json (DX-03). compose.dev.yaml (DX-02 -- UNVERIFIED, no Docker available in this environment to smoke-test, flagged in the file itself). All 4 prompts + the index rewritten to AGENT-03 shape (goal/context/prerequisites/scope/contract/acceptance-criteria/ control-ID/forbidden-actions). BACKLOG P1-20: docs/architecture/ARCHITECTURE.md migrated to the v2.0 9-heading template -- new §5 "Ytor och paritet" (capability x API/CLI/MCP/console coverage table, grounded in the same registry facts docs/02-architecture.md already established), §6-9 renumbered from the old §5-8 (all internal cross-references fixed, CLAUDE.md's own §-numbers left untouched). docs/api/ added (points at contracts/openapi.yaml as the one SSOT instead of duplicating it as drift-prone prose). BACKLOG P1-21: packages/schemas now has a real package.json (was loose JSON files with no package -- pnpm-workspace.yaml's packages/* glob matched an empty package). Verified `pnpm install --frozen-lockfile` and the full typecheck/test/build suite still pass with 2 real workspace projects. apps/ restructuring explicitly NOT attempted (BACKLOG's own effort estimate is "L" / large -- moving the whole app tree is a bigger, riskier change than belongs in this pass). Import-boundary check added via dependency-cruiser (ARK-14) -- installed for real, config tested against this codebase (179 modules, 310 deps, 0 violations), wired as `pnpm run deps:check` (advisory, not yet a CI gate). BACKLOG P2-5: docs/02-architecture.md's "Hosting" section marked SUPERSEDED (the Vercel plan was superseded by the Coolify deploy.target flip, 2026-08-09 -- ADR-0001). README.md/.env.example were checked and are already accurately framed (live-on-Vercel vs. config-target-is-Coolify) -- not touched. BACKLOG P3-5: 2 stale github.com/sax3l/0pt/pull/3 links removed (the PR merged long ago, .env.example is real and current) -- docs/09-build-plan.md, docs/08-infrastructure.md. The "two diverged remotes, unresolved which is canonical" language elsewhere (CLAUDE.md, AGENTS.md, SECURITY.md, etc.) is deliberately NOT touched -- that's a live, correctly-flagged, account-owner- owned open question per the Gitea-exclusivity mandate, not a stale link. BACKLOG P6 (19 items): concrete artifacts for the ones that are actually a file (.editorconfig, dependency-cruiser, deprecation policy, K8s reference manifest, .actrc, Makefile, ONBOARDING.md); docs/guides/P6-GUIDES.md for the rest (CLI-13, DOC-18, UI-30, IAM-19, PAY-11, AI-18, OBS-21, TEST-20, NET-19, SCALE-13, OSS-10, AGENT-13) -- each grounded in this repo's actual code/gaps, not generic advice. NOT attempted (out of this task's scope, noted for the record): - P2-1 (cl0ud app-registry.ts mismatch) -- lives in a different repo (sax3l/cl0ud), not cloned/authorized for this task's single-repo PR flow. - The CI "doctor step" half of P1-15 -- deliberately left out of this PR's .gitea/workflows/ci.yml to avoid a 3-way merge conflict with ci/security-headers-and-scanning, which already restructured that file; add it as a follow-up once that PR merges. This branch was authored independently of, but shares docs/architecture/ ARCHITECTURE.md and docs/slo.md with, fix/honest-health-check and ci/security-headers-and-scanning -- expect a small, normal merge conflict if this is rebased after either of those merge first (both already rebased cleanly against each other and against main as of this commit).	2026-08-11 14:18:00 +02:00
admin	9888c0078c	feat(contract): OpenAPI 3.1 SSOT (orders/estimates/enrich/resolve/provenance) + AR-4 fixes (drop @vercel/analytics + next/font/google -> self-hosted fontsource) + repo hygiene	2026-08-10 04:10:30 +02:00
Claude (SIAX platform session)andClaude Opus 5	bcf285f057	merge: unify GitHub main into Gitea main (0pt) ... Merges github/main (6 commits: 17-bug audit fix, CI quality gate, .env.example + .gitignore fix, missing platform clients + registry services, docs accuracy overhaul) into gitea/main (8 commits: Iceberg write boundary + live ST0RE verification, lakehouse mapping routes, Waves 1-4 foundational hardening). 16 conflicts. Both sides had independently written the four src/clients/*.ts and the two registry services, so those are combined rather than picked: - st0re-client.ts: GitHub's endpoint wins on evidence. POST goes to /v1/st0re/artifacts/register, not /v1/st0re/artifacts -- verified in sax3l/st0re src/api/routes/artifacts.ts, where the bare path is a GET-only list route. Gitea's URL normalisation, error-body text and mock kept. - n0d-client.ts: field is `status`, not `state`, with N0D's real 13-state union -- verified in sax3l/n0d packages/schemas/n0d.job.schema.json, which says explicitly not to add "succeeded". Gitea's mock echo, URL normalisation and error-body text kept. - cl0ud-client.ts: Gitea's fail-closed HTTP normalisation kept (a 200 with no `decision` reads as "deny", not as a silent allow). GitHub's PolicyDecision/PolicyDecisionValue naming kept; PolicyResult retained as an alias. - aud0-client.ts: permissive union of both input types (optional payload/metadata/correlation_id), GitHub's echo return, Gitea's URL normalisation and error-body text, plus a JSON-parse fallback so a successful POST with an empty body does not throw. - dataset-service.ts / source-service.ts: GitHub's record/DTO split and event naming (0pt.source_created / 0pt.create_source, which the merged docs already reference) plus Gitea's name validation, description / created_by fields and actor_id derivation. List filters are the union. - lakehouse mapping routes: GitHub's shared lakehouse-mapping-registry singletons (without which every write 400'd "mapping not found") AND Gitea's Zod parseBody validation. Both, not either. - src/types/source.ts, src/types/dataset.ts: unions of both vocabularies; GitHub's `access` legal-sourcing field kept. - .env.example: GitHub's audited inventory plus Gitea's Zitadel / AUTH_ENFORCE block. - CLAUDE.md, docs/ICEBERG_WRITE_BOUNDARY.md: GitHub's corrections kept, Gitea's live-verification kept and marked as superseding the "would 400 outright" finding (Gitea had already added the required X-Tenant-Id/X-Actor-Id headers). - pnpm-lock.yaml: regenerated with pnpm 9.15.9, not merged. Also corrects CLAUDE.md's claim that the banned services/scrapers stack was "since removed" -- the removal PR is open, not merged, and this branch inherits that code from Gitea main. Nothing here resurrects, extends or re-wires any of it; services/scrapers/ is byte-identical to Gitea main. Verified on the merged tree: typecheck (src/ + tests/) clean; 17 test files, 121 passed, 1 skipped (the realinfra test skipping honestly on ST0RE HTTP 401), 0 failures. Gitea main baseline was the same 121/1; GitHub main baseline could not even `pnpm install` ("packages field missing or empty") -- Gitea's pnpm-workspace.yaml fix resolves that. Whole-repo `typecheck:app` reports 9 errors, an identical set to Gitea main's baseline, so it is advisory in both CI workflows rather than deleted. Lint: 16 problems, identical to Gitea baseline. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-28 12:38:01 +02:00
SIAX Foundation BotandClaude Opus 4.8	1d76d50f3d	feat(auth,foundation): Wave 2 flag-gated Zitadel JWT verify + validation + eslint + tests ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-25 14:32:34 +02:00
SIAX Foundation Bot	844220d9f5	feat(foundation): Wave 3 integrity/persistence/build fixes	2026-07-25 13:54:36 +02:00
Simon AxelssonandClaude Opus 5	01cc225ffc	fix: add missing 0pt platform clients + registry services, wire test/typecheck scripts ... The 0pt data-engine build has been broken on main since 2026-07-08 (commit c897311). document-capture-service.ts, document-extraction-service.ts, source-query-service.ts, external-writeback-service.ts (and, more recently, dataset-iceberg-mapping-service.ts, iceberg-write-service.ts, source-rate-policy-service.ts) all import six platform client modules and two registry services that were never committed: src/clients/{aud0,cl0ud,n0d, st0re}-client.ts, src/services/{dataset,source}-service.ts, plus src/types/{dataset,source}.ts. `next build` failed with 17 "Module not found" errors, and every route under app/api/0pt/* returned HTTP 500 in dev with the Turbopack compile error leaked straight into the JSON response body. This adds the missing files, following the same fetch-based client shape already established by src/clients/st0re-lakehouse-client.ts (thin interface, HTTP implementation, deterministic in-memory mock used when no base URL is configured) and the same "pure core, thin in-memory registry, AUD0-evented mutation" shape the existing SourceRatePolicyService/DatasetIcebergMappingService already use for DatasetService/SourceService. Each new client mock is documented as a mock/degrade path, never a fabricated success, per this repo's CLAUDE.md honesty doctrine. Also wires up "typecheck" and "test" npm scripts (tsc --noEmit / vitest run) and adds vitest as a devDependency -- previously `pnpm test` failed immediately with ERR_PNPM_NO_SCRIPT even though 13 test files (~89 cases) already existed under tests/p0/. Verified: `pnpm run typecheck` clean, `pnpm run test` 88 passed / 1 todo (pre-existing live-ST0RE-only skip), `pnpm run build` exits 0 (39/39 routes compiled, only the pre-existing intentional optional `mssql` import warning remains). Re-verified live on port 4097: GET /api/0pt/sources/rate-policies, GET /api/0pt/lakehouse/mappings, POST /api/0pt/documents/capture, GET /api/0pt/documents/[id]/extraction, and both GET/POST /api/0pt/sources/[id]/query now return real application responses (200/400/405) instead of HTTP 500 with a leaked compile error. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-14 01:16:50 +02:00
adminandClaude Opus 4.8	ba96566c14	feat(infra): payments (Stripe), auth scaffold, engine bridge, embeds, .env.example ... Env-guarded so build stays green: /api/payments/[order_id]/deposit+release + /api/webhooks/stripe (lazy Stripe, 50/50 escrow, 501 until keys); /api/auth login|me|logout (HMAC signed-session scaffold, guarded dev login); lib/engine bridges edge->FastAPI (estimates defers to ENGINE_URL when set); components/embed for NocoDB/Metabase signed URLs; .env.example full inventory. tsc 0, build green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-24 21:19:29 +02:00
adminandClaude Opus 4.8	0b09ee5795	feat(api): order persistence (Postgres or in-memory fallback) + orders API ... lib/db (env-guarded postgres-js), lib/orders-store (createOrder/getOrder/listOrders/setStatus, DB-or-memory), /api/orders (POST create+estimate, GET list), /api/orders/[id] (GET, PATCH status with escrow-safe state machine). Activates fully on DATABASE_URL/POSTGRES_URL. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-24 18:11:34 +02:00
v0agent	5e53a6d71c	Add README.md	2026-06-24 14:51:57 +00:00