Brings the developer-facing API and MCP docs back in line with origin/main
(audit 2026-08-26). Docs only; no runtime behaviour changes.
- Tool counts: the server registers 153 tools; docs said 90+/100+/120.
All now say "150+" (connect-claude, gnubok-mcp README, plugin README,
mcp-server rules, CLAUDE.md, registry entry with refreshed updatedAt).
Not derived from the tools array: lib/ must not import @/extensions/.
- REST changelog: backfilled the additive 2026-08 changes (#1909 report
date ranges + PDFs, #1864 POST /companies, #1773 vat-declarations,
#1405 PATCH settings, #1724/#1788 customer personal_number, #1809
cash_account_id filter). API version date unchanged.
- Version headers: Gnubok-Deprecation is planned, not emitted; the
Gnubok-Version request header is not read today (version.ts comment,
versioning page, conventions overlay, regenerated skills/accounted-api).
- connect-claude Path A documents lazy auth (connector works before an
account exists; sign-in on the first company-scoped call).
- MCP server README: real Anthropic SDK call sites, real resource URIs,
pending-operations widget, public-tools/tasks/origin-guard/pii-guard.
Rules file gains Lazy auth + feedback/tasks paragraphs.
- api-routes endpoint map regenerated from the filesystem (560 routes,
55 families incl. v1, agent, reconciliation account-keyed, dimensions,
peppol, rot-rut, webshop-orders, mileage, billing, skatteverket,
receipt-hunt).
- gnubok-mcp/accounted-mcp: /settings?tab=api is the pre-redesign URL;
now /settings/api (README + help hints, no version bump).
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(skatteverket): expose filed VAT declarations and decisions via the v1 API
Add GET /api/v1/companies/:companyId/skatteverket/vat-declarations, returning
a period's momsdeklaration as Skatteverket has it on file: the submitted
declaration (SKV /inlamnat) and Skatteverket's beslut (SKV /beslutat), either
individually via ?state= or both.
- Auth: compliance:read scope; member-visibility read model per #1673
(resolveReadAuth: caller's token, any member's active token, or system
credentials with a verified ombud grant).
- Architecture: core reaches the Skatteverket extension through the
registry-resolved services channel (contract in
lib/skatteverket/declaration-status.ts), so core never imports from
@/extensions/.
- New structured error SKATTEVERKET_API_ERROR (502) for upstream SKV
failures; 404 from SKV maps to submitted/decided = null with HTTP 200.
- 19 new tests (route: auth, validation, extension-disabled, happy path;
extension service: auth resolution, state filtering, SKV error mapping).
Fixes#1663
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(skatteverket): address review findings on the vat-declarations read API
Consolidated fixes for PR #1773 review round:
- apiskill sync (core-build Checks): map the new skatteverket endpoint
group into the periods.md reference and regenerate skills/accounted-api
(124 -> 125 operations).
- CodeRabbit: parse the SKV 2xx body before writing the audit row, so an
unreadable body is audited as skv_error and returns the structured
SKATTEVERKET_API_ERROR 502 instead of escaping as an internal 500;
regression test added.
- Compliance swarm (ISO A.8.12 / SOC2 CC6.1): stop forwarding the raw
upstream SKV response body to API consumers; the caller now gets the
status code and a generic Swedish message, the body is logged
server-side only.
- Compliance swarm (GDPR Art.30): add the moms.declaration_status_read
processing activity to .compliance/ropa.yaml (live read, no payload
persisted, audit-log metadata only).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(api): installable accounted-api agent skill + openapi-to-skill generator
Three layers, per the July/August 2026 agent-skills ecosystem (skills.sh /
npx skills add, as used by Stripe/Cloudflare/Supabase for their APIs):
- skills/openapi-to-skill/: generic, installable skill that turns any
OpenAPI spec into a consumer-side integration skill, with a portable
stdlib-only inventory/condenser tool and an output template + quality
checklist encoding the distill-not-restate methodology.
- skills/accounted-api/: the installable skill for our own API, rendered
deterministically by scripts/api-skill/generate.ts from the v1 endpoint
registry + hand-authored overlays (auth, conventions, domain gotchas).
CI gate: npm run apiskill:check (core-build.yml).
- lib/api/v1/registry.ts: generateOpenApiSpec now emits requestBody (incl.
multipart binary parts) and path parameters, and the Zod converter learned
.default()/z.record()/.pipe()/.transform(), so the public spec carries
request contracts instead of prose-only.
Docs: /docs/api landing + /llms.txt now point agents at the skill install;
corrected the stale test-key description in the landing (test keys read
real data and force dry-run writes; they are not sandbox-company bound).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(skills): escape backslashes in markdown table cells (CodeQL js/incomplete-sanitization)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Jakob Wennberg