Reid's second review flagged that the old web/ files still had:
- XSS vulnerability (no DOMPurify)
- CSS typo (landascape)
- API endpoint mismatches
All fix: delete web/ entirely. The correct, sanitized, fixed versions
already live in frontend/src/.
- Add mobile/ directory with Expo React Native project
- Create API client with JWT auth and token refresh using AsyncStorage
- Implement AuthContext for login/register/logout flow
- Add screens: Login, Register, Library, Search, Settings
- Set up React Navigation with AuthStack and MainTabs
- Create packages/shared/ with shared types and utilities
- Add shared validation utilities (email, password strength)
- Update root package.json workspaces to include mobile + shared
- Add spec document docs/backend/009-expo-integration.md
- Backend: Django REST Framework API with Bookmark and Note models
- ViewSets with user-scoped querysets and select_related for N+1 prevention
- Create/List/Detail/Update/Delete endpoints
- Batch delete operations
- Unique constraint on user+book+page for bookmarks
- IsOwner permission class for object-level access control
- Full serializer validation (page > 0, non-empty content, duplicate check)
- 30+ pytest-django tests covering CRUD, auth, filtering, edge cases
- Frontend: React TypeScript components
- AnnotationsContext with useReducer for state management
- BookmarkList, NoteList, AddAnnotationForm, AnnotationsDashboard
- Inline note editing with immediate save
- Batch delete support
- API client with JWT auto-refresh interceptors
- Paginated query hook for infinite scroll support
- Responsive CSS with loading/empty states
- Infrastructure: Django project with custom User model, JWT auth, CORS
- PostgreSQL database models with proper FK and indexes
- Django admin configuration for all models
Marko (Hermes Implementer)