Add delivery and supplier HTTP APIs with expanded response docs.

Wire store-backed CRUD for goods receipts and suppliers, and teach the API doc generator to expand $ref/allOf/array samples so route markdown shows full JSON shapes.

docs/api/routes/article/add-image.md

@@ -30,7 +30,21 @@ Image stored and linked
 
 ```json
 {
-  "image": { … }
+  "image": {
+    "picId": 1,
+    "sort": 1,
+    "full": {
+      "w": 1,
+      "h": 1,
+      "size": 1
+    },
+    "thumb": {
+      "w": 1,
+      "h": 1
+    },
+    "hash": "…",
+    "thumbHash": "…"
+  }
 }
 ```
 

docs/api/routes/article/create.md

@@ -25,7 +25,12 @@ Created
 
 ```json
 {
-  "article": { … }
+  "article": {
+    "id": 1,
+    "parentId": 1,
+    "name": "…",
+    "sku": "…"
+  }
 }
 ```
 

docs/api/routes/article/get.md

@@ -18,7 +18,7 @@ Article detail
 
 ```json
 {
-  "article": { … }
+  "article": {}
 }
 ```
 

docs/api/routes/article/order-images.md

@@ -35,7 +35,9 @@ New order
 
 ```json
 {
-  "fullHashes": []
+  "fullHashes": [
+    "…"
+  ]
 }
 ```
 

docs/api/routes/article/set-brand.md

@@ -32,7 +32,7 @@ Updated article detail
 
 ```json
 {
-  "article": { … }
+  "article": {}
 }
 ```
 

docs/api/routes/article/set-categories.md

@@ -36,7 +36,7 @@ Updated article detail
 
 ```json
 {
-  "article": { … }
+  "article": {}
 }
 ```
 

docs/api/routes/article/set-eans.md

@@ -34,7 +34,7 @@ Updated article detail
 
 ```json
 {
-  "article": { … }
+  "article": {}
 }
 ```
 

docs/api/routes/article/set-prices.md

@@ -43,7 +43,7 @@ Updated article detail
 
 ```json
 {
-  "article": { … }
+  "article": {}
 }
 ```
 

docs/api/routes/article/set-weight.md

@@ -32,7 +32,7 @@ Updated article detail
 
 ```json
 {
-  "article": { … }
+  "article": {}
 }
 ```
 

docs/api/routes/article/update.md

@@ -33,7 +33,7 @@ Updated article detail
 
 ```json
 {
-  "article": { … }
+  "article": {}
 }
 ```
 

docs/api/routes/articleIndex.md

@@ -15,7 +15,19 @@ Search index
 
 ```json
 {
-  "articles": []
+  "articles": [
+    {
+      "id": 1,
+      "sku": "…",
+      "name": "…",
+      "eans": [
+        "…"
+      ],
+      "categoryIds": [
+        1
+      ]
+    }
+  ]
 }
 ```
 

docs/api/routes/auth/login.md

@@ -24,7 +24,12 @@ Login successful; `token` cookie set
 ```json
 {
   "message": "Login successful",
-  "user": { … }
+  "user": {
+    "id": 1,
+    "email": "user@example.com",
+    "selectedCompanyId": 1,
+    "picture": "…"
+  }
 }
 ```
 

docs/api/routes/auth/me.md

@@ -15,7 +15,12 @@ Authenticated
 
 ```json
 {
-  "user": { … },
+  "user": {
+    "id": 1,
+    "email": "user@example.com",
+    "selectedCompanyId": 1,
+    "picture": "…"
+  },
   "googleClientId": "…"
 }
 ```

docs/api/routes/auth/selected-company.md

@@ -20,7 +20,12 @@ Updated user
 
 ```json
 {
-  "user": { … }
+  "user": {
+    "id": 1,
+    "email": "user@example.com",
+    "selectedCompanyId": 1,
+    "picture": "…"
+  }
 }
 ```
 

docs/api/routes/brand/list.md

@@ -12,7 +12,13 @@ Brand list
 
 ```json
 {
-  "brands": []
+  "brands": [
+    {
+      "id": 1,
+      "name": "…",
+      "gsprpinfo": "…"
+    }
+  ]
 }
 ```
 

docs/api/routes/brand/upsert.md

@@ -22,7 +22,11 @@ Upserted brand
 
 ```json
 {
-  "brand": { … }
+  "brand": {
+    "id": 1,
+    "name": "…",
+    "gsprpinfo": "…"
+  }
 }
 ```
 

docs/api/routes/category/add-image.md

@@ -30,7 +30,12 @@ Image stored and linked
 
 ```json
 {
-  "category": { … }
+  "category": {
+    "id": 1,
+    "thumbW": 1,
+    "thumbH": 1,
+    "thumbHash": "…"
+  }
 }
 ```
 

docs/api/routes/category/articles.md

@@ -18,7 +18,9 @@ Articles list
 
 ```json
 {
-  "articles": []
+  "articles": [
+    {}
+  ]
 }
 ```
 

docs/api/routes/category/create.md

@@ -25,7 +25,12 @@ Created
 
 ```json
 {
-  "category": { … }
+  "category": {
+    "id": 1,
+    "parentId": 1,
+    "sort": 1,
+    "name": "…"
+  }
 }
 ```
 

docs/api/routes/category/delete-image.md

@@ -24,7 +24,12 @@ Image removed
 
 ```json
 {
-  "category": { … }
+  "category": {
+    "id": 1,
+    "thumbW": 1,
+    "thumbH": 1,
+    "thumbHash": "…"
+  }
 }
 ```
 

docs/api/routes/category/order.md

@@ -34,7 +34,9 @@ New sibling order
 
 ```json
 {
-  "categoryIds": []
+  "categoryIds": [
+    1
+  ]
 }
 ```
 

docs/api/routes/category/tree.md

@@ -13,8 +13,12 @@ Tree and articles for the selected company
 ```json
 {
   "languageId": 1,
-  "tree": [],
-  "articles": []
+  "tree": [
+    {}
+  ],
+  "articles": [
+    {}
+  ]
 }
 ```
 

docs/api/routes/category/update.md

@@ -34,7 +34,13 @@ Updated category (renamed and/or moved)
 
 ```json
 {
-  "category": { … }
+  "category": {
+    "id": 1,
+    "name": "…",
+    "slug": "…",
+    "parentId": 1,
+    "sort": 1
+  }
 }
 ```
 

docs/api/routes/company/create.md

@@ -23,8 +23,19 @@ Created; selected company updated
 
 ```json
 {
-  "company": { … },
-  "user": { … }
+  "company": {
+    "id": 1,
+    "iso639": "…",
+    "name": "…",
+    "taxrate": 1,
+    "reducedtaxrate": 1
+  },
+  "user": {
+    "id": 1,
+    "email": "user@example.com",
+    "selectedCompanyId": 1,
+    "picture": "…"
+  }
 }
 ```
 

docs/api/routes/company/list.md

@@ -12,7 +12,15 @@ Company list
 
 ```json
 {
-  "companies": []
+  "companies": [
+    {
+      "id": 1,
+      "iso639": "…",
+      "name": "…",
+      "taxrate": 1,
+      "reducedtaxrate": 1
+    }
+  ]
 }
 ```
 

docs/api/routes/company/update.md

@@ -29,7 +29,13 @@ Updated
 
 ```json
 {
-  "company": { … }
+  "company": {
+    "id": 1,
+    "iso639": "…",
+    "name": "…",
+    "taxrate": 1,
+    "reducedtaxrate": 1
+  }
 }
 ```
 

docs/api/routes/delivery/create.md

@@ -0,0 +1,70 @@
+# `POST /delivery`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Create delivery
+
+Creates a goods receipt with header and lines in one transaction.
+Each line requires `sku`, `amount`, `net`, and `tax` (rate).
+`rebate` defaults to `0`; `transactedAmount` defaults to `amount`.
+
+
+## Body (JSON)
+
+```json
+{
+  "number": "DHL-123",
+  "date": "2026-08-10",
+  "supplierId": 1,
+  "lines": [
+    {
+      "sku": "1",
+      "amount": 10,
+      "net": 99.5,
+      "tax": 19
+    }
+  ]
+}
+```
+
+## Response `201`
+
+Created delivery
+
+```json
+{
+  "delivery": {
+    "id": 1,
+    "number": "…",
+    "type": "delivery",
+    "supplierId": 1,
+    "date": "2026-08-10T00:00:00.000Z",
+    "lines": [
+      {
+        "id": 1,
+        "articleId": 1,
+        "sku": "…",
+        "amount": 1,
+        "net": 1,
+        "transactedAmount": 1,
+        "rebate": 1,
+        "tax": 1,
+        "comment": "…"
+      }
+    ]
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid delivery, invalid lines, or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company, supplier, or article not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/delivery/delete.md

@@ -0,0 +1,33 @@
+# `DELETE /delivery/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Delete delivery
+
+Deletes the goods receipt (`manifestarticle` rows cascade).
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Response `204`
+
+Deleted
+
+_No content_
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected or invalid id — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Delivery not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/delivery/get.md

@@ -0,0 +1,55 @@
+# `GET /delivery/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Get delivery
+
+Returns a goods receipt with lines for the selected company.
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Response `200`
+
+Delivery
+
+```json
+{
+  "delivery": {
+    "id": 1,
+    "number": "…",
+    "type": "delivery",
+    "supplierId": 1,
+    "date": "2026-08-10T00:00:00.000Z",
+    "lines": [
+      {
+        "id": 1,
+        "articleId": 1,
+        "sku": "…",
+        "amount": 1,
+        "net": 1,
+        "transactedAmount": 1,
+        "rebate": 1,
+        "tax": 1,
+        "comment": "…"
+      }
+    ]
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected or invalid id — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Delivery or company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/delivery/list.md

@@ -0,0 +1,40 @@
+# `GET /delivery`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+List deliveries
+
+Lists goods receipts (`manifest` rows with `type = 'delivery'`)
+for the authenticated user's selected company.
+
+
+## Response `200`
+
+Delivery list
+
+```json
+{
+  "deliveries": [
+    {
+      "id": 1,
+      "number": "…",
+      "type": "delivery",
+      "supplierId": 1,
+      "date": "2026-08-10T00:00:00.000Z"
+    }
+  ]
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/delivery/update.md

@@ -0,0 +1,66 @@
+# `PATCH /delivery/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Update delivery
+
+Patches header fields that are present. If `lines` is present, replaces
+all lines; if omitted, leaves lines unchanged. Returns the full delivery.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Body (JSON)
+
+```json
+{
+  "number": "DHL-124",
+  "lines": []
+}
+```
+
+## Response `200`
+
+Updated delivery
+
+```json
+{
+  "delivery": {
+    "id": 1,
+    "number": "…",
+    "type": "delivery",
+    "supplierId": 1,
+    "date": "2026-08-10T00:00:00.000Z",
+    "lines": [
+      {
+        "id": 1,
+        "articleId": 1,
+        "sku": "…",
+        "amount": 1,
+        "net": 1,
+        "transactedAmount": 1,
+        "rebate": 1,
+        "tax": 1,
+        "comment": "…"
+      }
+    ]
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid delivery, invalid lines, invalid id, or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Delivery, supplier, article, or company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/posterminal/list.md

@@ -12,7 +12,9 @@ Posterminal list
 
 ```json
 {
-  "posterminals": []
+  "posterminals": [
+    {}
+  ]
 }
 ```
 

docs/api/routes/posterminal/setOff.md

@@ -20,7 +20,9 @@ Updated category IDs for this terminal
 ```json
 {
   "id": 1,
-  "categoryIds": []
+  "categoryIds": [
+    1
+  ]
 }
 ```
 

docs/api/routes/posterminal/setOffAll.md

@@ -19,7 +19,9 @@ Updated category IDs for this terminal
 ```json
 {
   "id": 1,
-  "categoryIds": []
+  "categoryIds": [
+    1
+  ]
 }
 ```
 

docs/api/routes/posterminal/setOn.md

@@ -20,7 +20,9 @@ Updated category IDs for this terminal
 ```json
 {
   "id": 1,
-  "categoryIds": []
+  "categoryIds": [
+    1
+  ]
 }
 ```
 

docs/api/routes/posterminal/setOnAll.md

@@ -21,7 +21,9 @@ Updated category IDs for this terminal
 ```json
 {
   "id": 1,
-  "categoryIds": []
+  "categoryIds": [
+    1
+  ]
 }
 ```
 

docs/api/routes/posterminal/upsert.md

@@ -22,7 +22,7 @@ Created posterminal with generated pairingpin
 
 ```json
 {
-  "posterminal": { … }
+  "posterminal": {}
 }
 ```
 

docs/api/routes/supplier/create.md

@@ -0,0 +1,44 @@
+# `POST /supplier`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Create supplier
+
+Creates a supplier in the company `Lieferanten` group (created on first use).
+
+
+## Body (JSON)
+
+```json
+{
+  "name": "Großhandel Müller"
+}
+```
+
+## Response `201`
+
+Created supplier
+
+```json
+{
+  "supplier": {
+    "id": 1,
+    "name": "…",
+    "createdAt": "2026-08-10T00:00:00.000Z",
+    "updatedAt": "2026-08-10T00:00:00.000Z"
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Name required or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/supplier/delete.md

@@ -0,0 +1,34 @@
+# `DELETE /supplier/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Delete supplier
+
+Deletes the supplier entity for the selected company.
+Related `entityhistory` cascades; `manifest.entity_id` is set null.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Response `204`
+
+Deleted
+
+_No content_
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected or invalid id — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Supplier not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/supplier/list.md

@@ -0,0 +1,39 @@
+# `GET /supplier`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+List suppliers
+
+Lists suppliers (`entity` rows in the company `Lieferanten` customergroup)
+for the authenticated user's selected company.
+
+
+## Response `200`
+
+Supplier list
+
+```json
+{
+  "suppliers": [
+    {
+      "id": 1,
+      "name": "…",
+      "createdAt": "2026-08-10T00:00:00.000Z",
+      "updatedAt": "2026-08-10T00:00:00.000Z"
+    }
+  ]
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/supplier/update.md

@@ -0,0 +1,49 @@
+# `PATCH /supplier/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Update supplier
+
+Renames a supplier for the selected company.
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Body (JSON)
+
+```json
+{
+  "name": "Großhandel Müller GmbH"
+}
+```
+
+## Response `200`
+
+Updated supplier
+
+```json
+{
+  "supplier": {
+    "id": 1,
+    "name": "…",
+    "createdAt": "2026-08-10T00:00:00.000Z",
+    "updatedAt": "2026-08-10T00:00:00.000Z"
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Name required, invalid id, or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Supplier or company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/unit/list.md

@@ -12,7 +12,15 @@ Unit list
 
 ```json
 {
-  "units": []
+  "units": [
+    {
+      "si": "…",
+      "basesi": "…",
+      "basesifactor": 1,
+      "symbol": "…",
+      "name": "…"
+    }
+  ]
 }
 ```
 

docs/api/routes/unit/upsert.md

@@ -26,7 +26,13 @@ Upserted unit
 
 ```json
 {
-  "unit": { … }
+  "unit": {
+    "si": "…",
+    "basesi": "…",
+    "basesifactor": 1,
+    "symbol": "…",
+    "name": "…"
+  }
 }
 ```