Dziennik zmian

Co się zmieniło i kiedy.

Notatki o wydaniach są przechowywane w repozytorium i publikowane tutaj. Zmiany API podlegają polityce zgodności: tylko dodatki w ramach /api/v1, zmiany łamiące wyłącznie jako nowa wersja z wyprzedzeniem.

  1. Webhook scope and pre-deploy hardening

    • `webhooks` API-key scope. Managing webhook endpoints (/api/v1/webhooks*, /api/v1/webhook-outbox*) now requires a key with the webhooks scope; every key that existed before this change was granted it automatically, so nothing running breaks. Choose scopes when creating a key in Developer settings.
    • Same-day fix. The automatic webhooks grant did not apply on the production database at the first deploy (keys created earlier briefly received 403 on webhook management). Corrected in the follow-up deploy; every key created before that deploy now carries the scope.
    • Analyze page stops waiting for a stalled server. If no progress arrives for four minutes the analysis is cancelled with a clear message instead of spinning forever. Nothing is retried automatically.
    • Reduced-accuracy notice. When the text-recognition service is unavailable the result says so, instead of only hiding text highlighting.
    • Changelog in production. The /changelog page reads its entries inside the container build (they were left out of the image).

  2. Launch-readiness pass

    • Security page. /security is now a page, not a redirect: encryption, authentication, isolation, retention, deletion, subprocessors and open items, each marked verified, provider-stated or open. /.well-known/security.txt published.
    • API errors carry the request id. Every error envelope on /api/v1/* now includes request_id (also the X-Request-ID header); unhandled server errors return the same envelope with INTERNAL_ERROR. Every 429 carries Retry-After.
    • Capabilities advertise rate limits. GET /api/v1/capabilities gained rate_limits, so clients stop hardcoding them.
    • Docs. /docs opens with a three-language quickstart for the async job lane; the scope needed to read a job result is documented correctly (extract is enough). Compatibility policy published (docs/API_COMPATIBILITY_POLICY.md).
    • Demo pages. Unknown demo slugs render an HTML 404 with links to the real demos; a failed sample load is reported in the demo header; demo result JSON is cacheable.
    • MCP. The /mcp page shows install commands again (@synairodocai/docai-mcp@next, beta.6 on npm).
    • Changelog. This page.

  3. MCP beta.5 and beta.6

    • docai_get_usage tool: remaining page budget for the configured key, free to call.
    • GET /api/v1/capabilities is unauthenticated; GET /api/v1/usage reports both the page allowance and the key's monthly window.
    • extract-only keys can read their own job results.
    • Error envelopes pass through error.reason (for example api_key_monthly vs page_allowance).

  4. Scan to PDF

    • New Scan to PDF mode in the analyze screen and POST /api/v1/scan: repair phone photos (edge detection, perspective correction, enhancement) and merge them into a PDF. No OCR, no AI, no pages charged.
    • Camera-photo cleanup runs at every upload boundary so OCR, AI vision and the on-page overlays all see the same image.
    • Landing and pricing layout fixes on mobile.

  5. MCP for coding agents

    • Public /mcp page and the @synairodocai/docai-mcp stdio server: capabilities, integration guide, extract a workspace file, fetch a job result. Installer and doctor for Codex CLI, Claude Code and Gemini CLI.
    • Agent-facing API surface: GET /api/v1/capabilities, Idempotency-Key on POST /api/v1/jobs bound to the request payload (409 on conflict), stable error.code envelope.

  6. Feedback and measurement

    • Result feedback widget on every analysis; retention configurable by the operator.
    • Consent-gated, first-party product analytics bus with optional PostHog and GA4 adapters (off by default). Privacy, legal and consent copy discloses providers only when they are configured.
    • First-value milestone recorded server-side when your own document completes.

  7. Public site

    • Landing page split from the app (/analyze), three live demos (/demo/vat-invoice, /demo/receipt-photo, /demo/ksef-xml), /ksef page for Polish e-invoices, /benchmarks with dated OCR and split-detection numbers.
    • Self-hosted fonts and a strict, nonce-based Content-Security-Policy.