chore(release): v1.28.2 — automatic AI document reading (opt-in)

One opt-in in AI settings reads every uploaded document with the configured
provider — no per-document tap. Off by default; the vault stays local-first
otherwise. Scanned PDFs and photos are read too (a PDF's pages are rendered to
images so an image-only provider can read them). The background indexer now
follows the same opt-in, so nothing leaves the machine automatically unless it
is enabled.

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [1.28.2] — 2026-07-09 — Automatic AI document reading (opt-in)
+
+One opt-in in AI settings: read every uploaded document automatically with your
+configured AI provider — no per-document tap, the same way a lab photo is read.
+Off by default; the vault stays local-first for everyone who does not turn it
+on. When on, scanned PDFs and photos are read too — a PDF's pages are rendered
+to images so a provider that only accepts images can still read them — and the
+turn-on records a standing consent entry. The background indexer now follows the
+same opt-in, so nothing leaves the machine automatically unless you enable it.
+
 ## [1.28.1] — 2026-07-09 — Document vault load fix
 
 Fixes documents failing to load — old and newly uploaded alike — on

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.28.1
+  version: 1.28.2
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 

knip.json

@@ -62,7 +62,8 @@
     "shadcn",
     "tailwindcss",
     "testcontainers",
-    "tw-animate-css"
+    "tw-animate-css",
+    "@napi-rs/canvas"
   ],
   "ignoreBinaries": ["docker", "docker-compose", "pg_isready", "tsx", "cosign"],
   "ignoreExportsUsedInFile": true,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.28.1",
+  "version": "1.28.2",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",

public/sw.js

@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.28.1";
+  /* @sw-version-fallback */ "v1.28.2";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`