@arcforgelabs/flow 2026.10.29 → 2026.10.32-beta.1

package/README.md

@@ -37,8 +37,10 @@ run a lab.
 | `docs/INVOICING_RULES.md` | The invoicing rules that draft a job's invoice, and the two ways an invoice goes to Xero |
 | `docs/INVOICE_RULES.md` | Invoice rules a lab builds (When, If, Then) that make a ready job wait or never draft |
 | `docs/INVOICE_SENDING.md` | Drafts, Problem and Ready invoices, Mark ready, and Send all ready to the accounting system |
+| `docs/ALERTS.md` | Quiet alerts: the slim line on a page when something there needs a person, and how a person dismisses it |
 | `docs/AUTOMATIONS.md` | Automations: Flow routines that mark jobs ready to invoice and draft them, each on or off |
 | `docs/LINE_MAPPING.md` | Line mapping: how each work system line finds its price item, and Price codes in Settings |
+| `docs/PRICE_LIST.md` | The price list: Flow's own codes and prices, their links to Xero items and Seazona products, and the price check |
 | `docs/RELEASING.md` | Versions and channels, the release workflows, how to cut and roll back a release, and the one-time setup |
 | `docs/SELF_HOSTING.md` | Running a Flow release with Docker, Node or Replit, the update notice, and Clerk sign-in |
 | `docs/REPLIT.md` | A Replit workspace of this repository that follows a release channel (`FLOW_DEPLOY_REF`) |

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.29",
+  "version": "2026.10.32-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arcforgelabs/flow",
-      "version": "2026.10.29",
+      "version": "2026.10.32-beta.1",
       "license": "MIT",
       "dependencies": {
         "@clerk/backend": "3.23.2",
@@ -25,6 +25,7 @@
         "drizzle-orm": "0.45.3",
         "express": "5.3.0",
         "express-rate-limit": "8.7.0",
+        "pdfkit": "0.20.2",
         "pg": "8.23.1"
       },
       "bin": {
@@ -656,6 +657,30 @@
       "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
       "license": "MIT"
     },
+    "node_modules/@noble/ciphers": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-1.3.0.tgz",
+      "integrity": "sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw==",
+      "license": "MIT",
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+      "license": "MIT",
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/@opentelemetry/api": {
       "version": "1.9.1",
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz",
@@ -1100,6 +1125,15 @@
       "integrity": "sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==",
       "license": "MIT"
     },
+    "node_modules/@swc/helpers": {
+      "version": "0.5.23",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.8.0"
+      }
+    },
     "node_modules/@tanstack/query-core": {
       "version": "5.104.4",
       "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.104.4.tgz",
@@ -1132,6 +1166,26 @@
         "node": "18 || 20 || >=22"
       }
     },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/body-parser": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
@@ -1168,6 +1222,15 @@
         "node": "20 || >=22"
       }
     },
+    "node_modules/brotli": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/brotli/-/brotli-1.3.3.tgz",
+      "integrity": "sha512-oTKjJdShmDuGW94SyyaoQvAjf30dZaHnjJ8uAF+u2/vGJkJbJPJAT1gDiOJP5v1Zb6f9KEyW/1HpuaWIXtGHPg==",
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.1.2"
+      }
+    },
     "node_modules/buffer-from": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
@@ -1213,6 +1276,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/clone": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/clone/-/clone-2.1.2.tgz",
+      "integrity": "sha512-3Pe/CF1Nn94hyhIYpjtiLhdCoEoz0DqQ+988E9gmeEdQZlojxnOb74wctFyuwWQHzqyf9X7C7MG8juUpqBJT8w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
     "node_modules/content-disposition": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
@@ -1292,6 +1364,12 @@
         "node": ">=6"
       }
     },
+    "node_modules/dfa": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/dfa/-/dfa-1.2.0.tgz",
+      "integrity": "sha512-ED3jP8saaweFTjeGX8HQPjeC1YYyZs98jGNZx6IiBvxW7JG5v492kamAQB3m2wop07CvU/RQmzcKr6bgcC5D/Q==",
+      "license": "MIT"
+    },
     "node_modules/dotenv": {
       "version": "17.4.2",
       "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
@@ -1627,12 +1705,24 @@
         "express": ">= 4.11"
       }
     },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "license": "MIT"
+    },
     "node_modules/fast-sha256": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/fast-sha256/-/fast-sha256-1.3.0.tgz",
       "integrity": "sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==",
       "license": "Unlicense"
     },
+    "node_modules/fflate": {
+      "version": "0.8.3",
+      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz",
+      "integrity": "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==",
+      "license": "MIT"
+    },
     "node_modules/finalhandler": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
@@ -1654,6 +1744,23 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/fontkit": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/fontkit/-/fontkit-2.0.4.tgz",
+      "integrity": "sha512-syetQadaUEDNdxdugga9CpEYVaQIxOwk7GlwZWWZ19//qW4zE5bknOKeMBDYAASwnpaSHKJITRLMF9m1fp3s6g==",
+      "license": "MIT",
+      "dependencies": {
+        "@swc/helpers": "^0.5.12",
+        "brotli": "^1.3.2",
+        "clone": "^2.1.2",
+        "dfa": "^1.2.0",
+        "fast-deep-equal": "^3.1.3",
+        "restructure": "^3.0.0",
+        "tiny-inflate": "^1.0.3",
+        "unicode-properties": "^1.4.0",
+        "unicode-trie": "^2.0.0"
+      }
+    },
     "node_modules/forwarded": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
@@ -1886,6 +1993,25 @@
       "integrity": "sha512-yeJd4aNAdYZQjaon2bpD/Gb0B/omw7HQOsynXXcOiWVCacbBcPlgn8S/d1X6blFSaHao7ozqtW7NZW19xpCtIw==",
       "license": "MIT"
     },
+    "node_modules/linebreak": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/linebreak/-/linebreak-1.1.0.tgz",
+      "integrity": "sha512-MHp03UImeVhB7XZtjd0E4n6+3xr5Dq/9xI/5FptGk5FrbDR3zagPa2DS6U8ks/3HjbKWG9Q1M2ufOzxV2qLYSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "0.0.8",
+        "unicode-trie": "^2.0.0"
+      }
+    },
+    "node_modules/linebreak/node_modules/base64-js": {
+      "version": "0.0.8",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-0.0.8.tgz",
+      "integrity": "sha512-3XSA2cR/h/73EzlXXdU6YNycmYI7+kicTxks4eJg2g39biHR84slg2+des+p7iHYhbRg/udIS4TD53WabcOUkw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/lru-cache": {
       "version": "11.5.3",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
@@ -2078,6 +2204,12 @@
         "@oxc-parser/binding-win32-x64-msvc": "0.152.0"
       }
     },
+    "node_modules/pako": {
+      "version": "0.2.9",
+      "resolved": "https://registry.npmjs.org/pako/-/pako-0.2.9.tgz",
+      "integrity": "sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA==",
+      "license": "MIT"
+    },
     "node_modules/parseurl": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
@@ -2113,6 +2245,20 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/pdfkit": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/pdfkit/-/pdfkit-0.20.2.tgz",
+      "integrity": "sha512-Q/w03ICAQyXfHNfTsg1udp0ADerdBN0s7a6XSPL7J7Ro6ABnafoBOCDBstIO9U02mvzHEV8HrvFIw5iV5ejIRA==",
+      "license": "MIT",
+      "dependencies": {
+        "@noble/ciphers": "^1.3.0",
+        "@noble/hashes": "^1.8.0",
+        "fflate": "^0.8.3",
+        "fontkit": "^2.0.4",
+        "linebreak": "^1.1.0",
+        "png-js": "^2.0.0"
+      }
+    },
     "node_modules/pg": {
       "version": "8.23.1",
       "resolved": "https://registry.npmjs.org/pg/-/pg-8.23.1.tgz",
@@ -2202,6 +2348,14 @@
         "split2": "^4.1.0"
       }
     },
+    "node_modules/png-js": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/png-js/-/png-js-2.0.0.tgz",
+      "integrity": "sha512-GdzJuUMc6ZSpxFJWVxtOH1bzYHym+TOnveqUjb+VJIbZWbZzyiRGFiKhbiielfpYbgMlhHVhsJ0FTazfuRFkMA==",
+      "dependencies": {
+        "fflate": "^0.8.2"
+      }
+    },
     "node_modules/postgres-array": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
@@ -2312,6 +2466,12 @@
         "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
       }
     },
+    "node_modules/restructure": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/restructure/-/restructure-3.0.2.tgz",
+      "integrity": "sha512-gSfoiOEA0VPE6Tukkrr7I0RBdE0s7H1eFCDBk05l1KIQT1UIKNc5JZy6jdyW6eYH3aR3g5b3PuL77rq0hvwtAw==",
+      "license": "MIT"
+    },
     "node_modules/router": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
@@ -2533,6 +2693,12 @@
         "url": "https://github.com/chalk/supports-color?sponsor=1"
       }
     },
+    "node_modules/tiny-inflate": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/tiny-inflate/-/tiny-inflate-1.0.3.tgz",
+      "integrity": "sha512-pkY1fj1cKHb2seWDy0B16HeWyczlJA9/WW3u3c4z/NiWDsO3DOU5D7nhTLE9CF0yXv/QZFY7sEJmj24dK+Rrqw==",
+      "license": "MIT"
+    },
     "node_modules/toidentifier": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
@@ -3069,6 +3235,26 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/unicode-properties": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/unicode-properties/-/unicode-properties-1.4.1.tgz",
+      "integrity": "sha512-CLjCCLQ6UuMxWnbIylkisbRj31qxHPAurvena/0iwSVbQ2G1VY5/HjV0IRabOEbDHlzZlRdCrD4NhB0JtU40Pg==",
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.0",
+        "unicode-trie": "^2.0.0"
+      }
+    },
+    "node_modules/unicode-trie": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-trie/-/unicode-trie-2.0.0.tgz",
+      "integrity": "sha512-x7bc76x0bm4prf1VLg79uhAzKw8DVboClSN5VxJuQ+LKDOVEW9CdH+VY7SP+vX7xCYQqzzgQpFqz15zeLvAtZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "pako": "^0.2.5",
+        "tiny-inflate": "^1.0.0"
+      }
+    },
     "node_modules/unpipe": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.10.29",
+  "version": "2026.10.32-beta.1",
   "description": "Invoicing, bill entry and a financial dashboard for labs, with Seazona and Xero integrations.",
   "license": "MIT",
   "repository": {
@@ -51,6 +51,7 @@
     "drizzle-orm": "0.45.3",
     "express": "5.3.0",
     "express-rate-limit": "8.7.0",
+    "pdfkit": "0.20.2",
     "pg": "8.23.1"
   },
   "devDependencies": {

package/server/api/alerts.js

@@ -0,0 +1,49 @@
+import express from 'express';
+import { ALERT_PAGES, alertForBrowser, alertsFor, dismissAlert } from '../core/alerts.js';
+import { FlowError } from '../core/errors.js';
+import { resolveOrganisation } from './invoicing.js';
+
+// Quiet alerts for signed-in people (server/core/alerts.js, docs/ALERTS.md).
+//
+//   GET  /api/alerts?page=invoices[&scope=][&organisationId=]   what needs this person on that page;
+//        `scope` names one part of it (an integration id on page integrations)
+//   POST /api/alerts/dismiss { key[, organisationId] }  hide one alert for this person
+//
+// `sources` maps each page to the functions that find its alerts.
+export function createAlertsRouter({ db, personAuth, sources, log = console }) {
+  const router = express.Router();
+  router.use(express.json({ limit: '8kb' }));
+
+  const handle = (fn) => async (req, res) => {
+    try {
+      await fn(req, res);
+    } catch (error) {
+      if (!(error instanceof FlowError)) {
+        log.error?.(`[alerts] ${error.message}`);
+        return res.status(500).json({ ok: false, code: 'internal', error: 'Something went wrong.' });
+      }
+      const status = { not_found: 404, organisation_required: 409 }[error.code] ?? 400;
+      return res.status(status).json({ ok: false, code: error.code, error: error.message });
+    }
+  };
+
+  router.get('/', personAuth.requireSession, handle(async (req, res) => {
+    const page = typeof req.query.page === 'string' ? req.query.page : '';
+    if (!ALERT_PAGES.includes(page)) throw new FlowError('invalid', `page must be one of ${ALERT_PAGES.join(', ')}`);
+    const organisationId = await resolveOrganisation(db, req.query.organisationId);
+    const scope = typeof req.query.scope === 'string' && req.query.scope ? req.query.scope : null;
+    if (scope && !/^[a-z][a-z0-9-]{1,31}$/.test(scope)) throw new FlowError('invalid', 'scope must be an integration id');
+    const alerts = await alertsFor(db, organisationId, req.person, { page, scope, sources, withHidden: true });
+    res.set('Cache-Control', 'no-store');
+    // `danger`: an alert of that tone is open, even one this person hid.
+    res.json({ ok: true, alerts: alerts.filter((a) => !a.hidden).map(alertForBrowser), danger: alerts.some((a) => a.tone === 'danger') });
+  }));
+
+  router.post('/dismiss', personAuth.requireSession, handle(async (req, res) => {
+    const organisationId = await resolveOrganisation(db, req.body?.organisationId ?? req.query.organisationId);
+    const result = await dismissAlert(db, organisationId, req.person, { key: req.body?.key, sources });
+    res.json({ ok: true, ...result });
+  }));
+
+  return router;
+}

package/server/api/invoicing.js

@@ -13,10 +13,15 @@ import {
 } from '../core/line-mapping.js';
 import {
   effectiveSettings, INVOICING_DEFAULTS, readCustomerBilling, readInvoicingSettings,
-  saveCustomerBilling, saveInvoicingSettings,
+  saveCustomerBilling, saveInvoicingSettings, sendModeSummary,
 } from '../core/invoicing-rules.js';
 import { boardJobs, describeObligations } from '../core/job-board.js';
+import {
+  acceptFindings, archivePriceItem, checkPrices, createPriceItem, linkPriceItem, readCatalogues, readPriceList, unlinkPriceItem, updatePriceItem,
+} from '../core/price-list.js';
 import { draftInvoiceForObligation, explainObligation, listObligations, setReady } from '../core/ledger.js';
+import { isHistoryHeld } from '../core/history.js';
+import { invoicePdfDocument, pdfFields, pdfFilename, renderInvoicePdf } from '../core/invoice-pdf.js';
 import { invoiceView, invoiceViews, markNotReady, markReady, sendAgain, sendAllReady } from '../core/sending.js';
 import {
   billingObligations, contacts, invoices, INVOICE_STATUSES, organisations, priceItems, TAX_CODES,
@@ -34,6 +39,9 @@ import {
 //                                     accounting system { issueDate }
 //   POST  /invoices/send-again        owner or admin: queue failed sends again { invoiceIds? }
 //   GET   /invoices/:id               one invoice: lines, contact, job, issued versions
+//   GET   /invoices/:id/pdf?version=  the invoice as a PDF, drawn by Flow (server/core/invoice-pdf.js),
+//                                     with the accounting system's number and dates once it holds it;
+//                                     no accounting system calls
 //   POST  /invoices                   a new draft
 //   PATCH /invoices/:id               change a draft
 //   POST  /invoices/:id/issue         owner or admin: number it and keep the document as sent
@@ -58,6 +66,15 @@ import {
 //   POST  /line-mappings              owner or admin: a new mapping
 //   PUT   /line-mappings/:id          owner or admin: change some of a mapping
 //   DELETE /line-mappings/:id         owner or admin
+//   GET   /price-list                 the price list with its links, the connected systems' records with
+//                                     no link, and what differs (server/core/price-list.js)
+//   POST  /price-list/check           owner or admin: run the price check now (no calls to other systems)
+//   POST  /price-items                owner or admin: a new price item { code, name, unitAmountCents, taxCode, ... }
+//   PUT   /price-items/:id            owner or admin: change some of a price item
+//   POST  /price-items/:id/archive    owner or admin: { archived } archive it, or bring it back
+//   POST  /price-items/:id/links      owner or admin: { system, externalId } link a record of a system's list
+//   POST  /price-items/:id/resolve    owner or admin: Mark resolved: check again, accept what still differs
+//   DELETE /price-links/:id           owner or admin: remove a link
 //   GET   /automations?place=         Flow's routines, each on or off (server/core/automations.js)
 //   PUT   /automations/:key           owner or admin: { enabled, config }
 //   GET   /work-statuses              the work system's job statuses, with job counts
@@ -240,7 +257,7 @@ async function invoiceDetail(db, organisationId, invoiceId, accounting = null) {
 }
 
 export function createInvoicingRouter({
-  db, personAuth, log = console, liveCheckFor = () => null, accounting = () => null, work = () => [],
+  db, personAuth, log = console, liveCheckFor = () => null, accounting = () => null, work = () => [], priceSystems = () => [],
 }) {
   const router = express.Router();
   router.use(express.json({ limit: '64kb' }));
@@ -302,6 +319,7 @@ export function createInvoicingRouter({
       })),
       counts,
       sendsTo: accounting()?.name ?? null,
+      sendMode: accounting() ? { ...(await sendModeSummary(db, organisationId)), ...(await accounting().capabilities.sendStatus({ organisationId })) } : null,
     });
   }));
 
@@ -349,6 +367,22 @@ export function createInvoicingRouter({
     res.json({ ok: true, invoice: await invoiceDetail(db, organisationId, invoiceId, accounting()) });
   }));
 
+  router.get('/invoices/:id/pdf', ...signedIn, handle(log, async (req, res) => {
+    const invoiceId = pathId(req.params.id, 'invoice');
+    const organisationId = await organisationOf(req);
+    const version = req.query.version === undefined ? null : Number(req.query.version);
+    if (version !== null && !(Number.isSafeInteger(version) && version > 0)) throw invalid('version must be a whole number above 0');
+    const source = await invoicePdfDocument(db, organisationId, invoiceId, { version, accounting: accounting() });
+    const bytes = await renderInvoicePdf(source);
+    res.set({
+      'Content-Type': 'application/pdf',
+      'Content-Disposition': `inline; filename="${pdfFilename(pdfFields(source))}"`,
+      'Cache-Control': 'no-store',
+      'X-Content-Type-Options': 'nosniff',
+    });
+    res.end(bytes);
+  }));
+
   router.post('/invoices', ...signedIn, handle(log, async (req, res) => {
     const organisationId = await organisationOf(req);
     const body = req.body ?? {};
@@ -427,8 +461,13 @@ export function createInvoicingRouter({
     const view = text(req.query.view);
     if (view && !VIEWS.includes(view)) throw invalid(`view must be one of ${VIEWS.join(', ')}`);
     const limit = limitOf(req.query.limit, 200, 500);
-    const all = await listObligations(db, organisationId, { accounting: Boolean(liveCheckFor(organisationId)) });
+    const listedAll = await listObligations(db, organisationId, { accounting: Boolean(liveCheckFor(organisationId)) });
+    // Held history jobs (core/history.js) are left out unless asked for: they
+    // are past work, listed in the history import's own reconciliation.
+    const withHistory = req.query.history === 'include';
+    const all = withHistory ? listedAll : listedAll.filter((entry) => !isHistoryHeld(entry.obligation));
     const counts = Object.fromEntries(VIEWS.map((v) => [v, 0]));
+    counts.history = listedAll.length - listedAll.filter((entry) => !isHistoryHeld(entry.obligation)).length;
     for (const entry of all) counts[entry.view] += 1;
     const listed = (view ? all.filter((entry) => entry.view === view) : all).slice(0, limit);
     res.json({ ok: true, jobs: await describeObligations(db, organisationId, listed, { accounting: accounting() }), counts });
@@ -602,6 +641,74 @@ export function createInvoicingRouter({
     res.json({ ok: true });
   }));
 
+  // The price list (server/core/price-list.js). Every read is from Flow's own
+  // copies of the connected systems' lists.
+  const catalogues = (organisationId) => readCatalogues(organisationId, priceSystems(), { log });
+
+  router.get('/price-list', ...signedIn, handle(log, async (req, res) => {
+    const organisationId = await organisationOf(req);
+    res.json({ ok: true, ...(await readPriceList(db, organisationId, { catalogues: await catalogues(organisationId) })) });
+  }));
+
+  router.post('/price-list/check', ...manager, handle(log, async (req, res) => {
+    const organisationId = await organisationOf(req);
+    const summary = await checkPrices(db, organisationId, { catalogues: await catalogues(organisationId), actor: `person:${req.person.id}` });
+    res.json({ ok: true, summary });
+  }));
+
+  router.post('/price-items', ...manager, handle(log, async (req, res) => {
+    const organisationId = await organisationOf(req);
+    const { organisationId: _named, ...raw } = req.body ?? {};
+    const item = await createPriceItem(db, organisationId, raw, { personId: req.person.id });
+    log.info?.(`[invoicing] organisation ${organisationId}: person ${req.person.id} added price item ${item.id}`);
+    res.status(201).json({ ok: true, item });
+  }));
+
+  router.put('/price-items/:id', ...manager, handle(log, async (req, res) => {
+    const itemId = pathId(req.params.id, 'price item');
+    const organisationId = await organisationOf(req);
+    const { organisationId: _named, ...changes } = req.body ?? {};
+    const item = await updatePriceItem(db, organisationId, itemId, changes, { personId: req.person.id });
+    log.info?.(`[invoicing] organisation ${organisationId}: person ${req.person.id} changed price item ${item.id}`);
+    res.json({ ok: true, item });
+  }));
+
+  router.post('/price-items/:id/archive', ...manager, handle(log, async (req, res) => {
+    const itemId = pathId(req.params.id, 'price item');
+    const organisationId = await organisationOf(req);
+    const archived = req.body?.archived ?? true;
+    if (typeof archived !== 'boolean') throw invalid('archived must be true or false');
+    const item = await archivePriceItem(db, organisationId, itemId, { archived, personId: req.person.id });
+    log.info?.(`[invoicing] organisation ${organisationId}: person ${req.person.id} ${archived ? 'archived' : 'restored'} price item ${item.id}`);
+    res.json({ ok: true, item });
+  }));
+
+  router.post('/price-items/:id/links', ...manager, handle(log, async (req, res) => {
+    const itemId = pathId(req.params.id, 'price item');
+    const organisationId = await organisationOf(req);
+    const system = text(req.body?.system);
+    const externalId = text(req.body?.externalId);
+    if (!system || !externalId) throw invalid('system and externalId are required');
+    const link = await linkPriceItem(db, organisationId, itemId, { system, externalId }, { catalogues: await catalogues(organisationId), personId: req.person.id });
+    log.info?.(`[invoicing] organisation ${organisationId}: person ${req.person.id} linked price item ${itemId} to ${system}`);
+    res.status(201).json({ ok: true, link: { id: link.id, system: link.system, externalId: link.externalId, externalCode: link.externalCode, matchedBy: link.matchedBy } });
+  }));
+
+  router.post('/price-items/:id/resolve', ...manager, handle(log, async (req, res) => {
+    const itemId = pathId(req.params.id, 'price item');
+    const organisationId = await organisationOf(req);
+    const result = await acceptFindings(db, organisationId, itemId, { catalogues: await catalogues(organisationId), actor: `person:${req.person.id}` });
+    res.json({ ok: true, ...result });
+  }));
+
+  router.delete('/price-links/:id', ...manager, handle(log, async (req, res) => {
+    const linkId = pathId(req.params.id, 'link');
+    const organisationId = await organisationOf(req);
+    await unlinkPriceItem(db, organisationId, linkId);
+    log.info?.(`[invoicing] organisation ${organisationId}: person ${req.person.id} removed price link ${linkId}`);
+    res.json({ ok: true });
+  }));
+
   router.get('/settings', ...signedIn, handle(log, async (req, res) => {
     const organisationId = await organisationOf(req);
     res.json({ ok: true, settings: await readInvoicingSettings(db, organisationId), defaults: INVOICING_DEFAULTS });

package/server/app.js

@@ -1,7 +1,10 @@
 import express from 'express';
+import { createAlertsRouter } from './api/alerts.js';
 import { createConnectorApi } from './api/connector.js';
 import { createInvoicingRouter } from './api/invoicing.js';
 import { createSignInRouter } from './auth/routes.js';
+import { integrationAlertsSource, invoiceProblemsSource, priceDifferencesSource } from './core/alerts.js';
+import { appliedMigrationCounts } from './db/doctor.js';
 import { deployedBuildStatus } from './deployed-build.js';
 import { integrationsHealth } from './integrations/health.js';
 import { createSetupRouter } from './integrations/setup.js';
@@ -27,10 +30,14 @@ import { createUiAssetsRouter } from './ui/routes.js';
 // each one (server/integrations/health.js). `defaultFamily` is the design
 // system every page starts on (FLOW_THEME, server/theme/themes.js). `log`
 // is the console, or the monitored log (server/core/monitoring.js) that also
-// sends each error to the installation's error service.
+// sends each error to the installation's error service. `schemaJournals` are
+// the migration journals this build ships (server/db/doctor.js): GET /health
+// reports how many of each the database has applied, so the workspace's
+// doctor can tell what Replit's publish step will offer (docs/REPLIT.md).
 export function createApp({
   build = deployedBuildStatus(),
   database = null,
+  schemaJournals = null,
   auth = null,
   updates = null,
   integrations = null,
@@ -59,6 +66,11 @@ export function createApp({
     // records). An integration problem does not fail the health check: Flow's
     // core works with no integration connected (VISION.md).
     const body = { ok, service: 'flow', database: databaseOk, build };
+    // Counts only: no table names and no data.
+    if (databaseOk && schemaJournals) {
+      body.schema = await appliedMigrationCounts(database.pool, schemaJournals)
+        .then((migrations) => ({ migrations }), () => null);
+    }
     if (integrations) body.integrations = await integrationsHealth(integrations);
     res.status(ok ? 200 : 503).json(body);
   });
@@ -116,7 +128,22 @@ export function createApp({
     const accounting = () => integrations?.with('pushInvoices')[0] ?? null;
     // The Jobs board: every enabled integration that lists its jobs (Seazona).
     const work = () => integrations?.with('listWork') ?? [];
-    app.use('/api/invoicing', createInvoicingRouter({ db: database.db, personAuth: auth.personAuth, log, liveCheckFor, accounting, work }));
+    // The price list: every enabled integration that keeps its own (Xero
+    // items, Seazona products).
+    const priceSystems = () => integrations?.with('listPriceItems') ?? [];
+    app.use('/api/invoicing', createInvoicingRouter({ db: database.db, personAuth: auth.personAuth, log, liveCheckFor, accounting, work, priceSystems }));
+    // Quiet alerts (server/core/alerts.js): what needs a person on each page.
+    // Integrations add their own through the `alerts` capability.
+    app.use('/api/alerts', createAlertsRouter({
+      db: database.db,
+      personAuth: auth.personAuth,
+      log,
+      sources: {
+        invoices: [invoiceProblemsSource(database.db, { accounting })],
+        'price-list': [priceDifferencesSource(database.db)],
+        integrations: [integrationAlertsSource(() => integrations?.with('alerts') ?? [])],
+      },
+    }));
   }
   // What a signed-in browser needs to report its errors and problems to the
   // installation's own error service (docs/SENTRY.md): the first integration