@blamejs/blamejs-shop 0.4.120 → 0.4.121

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.121 (2026-06-26) — **Vendor-invoice reconciliation values each PO line at its own cost, and a vendor's invoices must share one currency.** Two fixes to vendor-invoice reconciliation and reporting. When the same SKU appeared on more than one purchase order at different unit costs, reconcileAgainstPOs summed the received quantity across the POs but valued all of it at the LAST PO's unit cost, inflating the PO received value and corrupting the over-billing variance the operator relies on to catch a vendor over-bill before paying. Each PO line is now valued at its own unit cost and accumulated, so the received value and the variance are exact, and the per-unit figure shown in the line variance is a true weighted mean. Separately, a vendor's invoices may now only be recorded in one currency: the accounts-payable aging report and the vendor scorecard sum amounts per vendor into a single figure, which is meaningless across currencies, so an invoice whose currency differs from the vendor's existing invoices is refused at write time rather than silently producing an incommensurable total. **Fixed:** *PO reconciliation values each purchase-order line at its own unit cost* — reconcileAgainstPOs aggregated purchase-order lines per SKU, accumulating the received quantity across POs but overwriting the unit cost with each successive PO's — so when the same SKU was received on two POs at different prices, the received value was computed as the combined quantity times the last PO's cost. That inflated po_received_value_minor and the variance the operator uses to spot a vendor over-bill before payment. Each PO line is now valued at its own unit cost and the values accumulated, so the received value and variance are exact; the line-variance's per-unit cost is reported as the true weighted mean of the received value. · *A vendor's invoices must all be recorded in the same currency* — The accounts-payable aging report and the vendor scorecard sum each vendor's invoice amounts into a single figure, which is only meaningful within one currency — mixing currencies produced an incommensurable total with no currency tag to unwind it. Recording an invoice whose currency differs from the vendor's existing invoices is now refused with a clear error, so those per-vendor totals stay within a single currency by construction.
+
 - v0.4.120 (2026-06-26) — **Splitting a discount across order lines no longer rounds a line's share negative.** When an order-level discount is allocated across the order's lines (proportionally, equally, or by quantity), each line's share was rounded independently with half-even rounding. Independently rounded shares can sum to MORE than the discount, which drove the leftover remainder negative and produced a negative discount on one line — and the checkout recorder, which rejects a negative share, then dropped the whole allocation breakdown, leaving nothing for a later per-line partial refund to draw on. Reversing an allocation for a refund had the same flaw and could persist a negative per-line refund (a charge-back on that line). The split now composes the framework's largest-remainder allocator: it floors each share and hands out the non-negative leftover one minor unit at a time, so every line's share is non-negative, the shares sum to the discount (or the refund) exactly, and no breakdown is dropped. The only visible change is which line absorbs a leftover cent — now the line with the largest fractional remainder rather than the highest subtotal. **Fixed:** *Per-line discount and refund shares are floored and distributed, never rounded negative* — The per-line discount split rounded each share half-even and independently, so the rounded shares could sum above the discount, send the remainder negative, and assign a negative discount to one line; the checkout path then dropped the breakdown (its recorder refuses a negative share), so a subsequent per-line refund had no recorded allocation to subtract. The reverse path likewise could persist a negative per-line refund. Both now compose the framework's largest-remainder allocator, which floors each share and distributes the non-negative leftover one minor unit at a time to the largest remainders — every share is non-negative, the shares sum exactly to the total, and the allocation is recorded. The leftover cent now lands on the largest-remainder line instead of the highest-subtotal line.
 
 - v0.4.119 (2026-06-26) — **Vendored framework refreshed to 0.15.32.** Updates the vendored blamejs framework to 0.15.32, taking in the 0.15.31 and 0.15.32 upstream releases. Both are internal test-suite tooling only: they extend the framework's guard suite with a re-verification gate that retires renamed suppression-marker tokens (so a re-verified suppression class can't inherit a stale approval) and update the matching in-source marker comments. No runtime code, public API, or wire format changed upstream, so there is no runtime or behavior change for this storefront and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.32* — Refreshes the vendored blamejs framework to 0.15.32 (taking in 0.15.31 and 0.15.32), upstream releases scoped to test-suite tooling — a re-verification gate for renamed suppression markers and the matching marker-comment updates. The shipped framework runtime, public API, and wire format are unchanged, so no operator action is required.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.120",
+  "version": "0.4.121",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/vendor-invoices.js

@@ -435,6 +435,33 @@ function create(opts) {
       }
     }
 
+    // Single currency per vendor: the AP aging report and the vendor
+    // scorecard sum amount_minor / paid_minor per vendor into one scalar,
+    // which is only meaningful within a single currency — mixing currencies
+    // would yield an incommensurable total with no currency tag to unwind it.
+    // Refuse a mismatched currency at write time rather than silently record
+    // one that corrupts those reports.
+    // Reject if ANY existing invoice for this vendor is in a different
+    // currency — not just a sampled one. An upgraded store may already hold
+    // mixed-currency rows (earlier releases allowed them); sampling a single
+    // row could match the new currency and let the mix grow, so probe for any
+    // `currency <> this` row. A vendor already carrying a mix is locked until
+    // the operator resolves it, which is the fail-closed behaviour the
+    // single-currency report invariant requires.
+    var mismatchCur = await query(
+      "SELECT currency FROM vendor_invoices WHERE vendor_slug = ?1 AND currency <> ?2 LIMIT 1",
+      [vendorSlug, currency],
+    );
+    if (mismatchCur.rows.length) {
+      var curErr = new Error(
+        "vendor-invoices.recordInvoice: vendor " + JSON.stringify(vendorSlug) +
+        " has an existing invoice in " + mismatchCur.rows[0].currency + "; this invoice is " +
+        currency + " — a vendor's invoices must share one currency",
+      );
+      curErr.code = "VENDOR_INVOICE_CURRENCY_MISMATCH";
+      throw curErr;
+    }
+
     var id = b.uuid.v7();
     var ts = _now();
 
@@ -745,16 +772,34 @@ function create(opts) {
       for (var k = 0; k < po.lines.length; k += 1) {
         var pl = po.lines[k];
         if (!poBySku[pl.sku]) {
-          poBySku[pl.sku] = { received_qty: 0, unit_cost_minor: pl.unit_cost_minor, currency: pl.currency };
+          poBySku[pl.sku] = { received_qty: 0, received_value_minor: 0, unit_cost_minor: 0, currency: pl.currency };
         }
-        poBySku[pl.sku].received_qty += Number(pl.quantity_received);
-        // If multiple POs cost differently for the same SKU, keep the
-        // weighted mean (operator-visible signal that the vendor
-        // changed pricing across orders).
-        poBySku[pl.sku].unit_cost_minor = pl.unit_cost_minor;
+        var recvQty = Number(pl.quantity_received);
+        poBySku[pl.sku].received_qty += recvQty;
+        // Value each PO line at its OWN unit cost and ACCUMULATE. The same
+        // SKU can legitimately appear on multiple POs at different prices, so
+        // a single per-SKU unit cost cannot represent the received value —
+        // the prior code summed quantity across POs but overwrote unit_cost
+        // with the last PO's, inflating the received value and corrupting the
+        // over-billing variance. The operator-visible weighted-mean unit cost
+        // is derived from this accumulated value below.
+        poBySku[pl.sku].received_value_minor += recvQty * pl.unit_cost_minor;
       }
     }
 
+    // Derive each SKU's operator-visible unit cost as the true weighted mean
+    // of its received value across all matched POs (floored to a whole minor
+    // unit). The VALUE math downstream uses received_value_minor directly so
+    // it stays exact; this per-unit figure is only for the line-variance
+    // display.
+    var poBucketKeys = Object.keys(poBySku);
+    for (var wm = 0; wm < poBucketKeys.length; wm += 1) {
+      var wmBucket = poBySku[poBucketKeys[wm]];
+      wmBucket.unit_cost_minor = wmBucket.received_qty > 0
+        ? Math.floor(wmBucket.received_value_minor / wmBucket.received_qty)
+        : 0;
+    }
+
     // Map invoice lines onto PO buckets. A line item without an `sku`
     // (service-line, freight) lands in unmatched_invoice_lines so the
     // operator can decide whether that bill component is a separate
@@ -796,7 +841,7 @@ function create(opts) {
         po_unit_cost:       poBucket.unit_cost_minor,
         qty_variance:       il.quantity - poBucket.received_qty,
         unit_cost_variance: il.unit_cost_minor - poBucket.unit_cost_minor,
-        total_variance:     il.total_minor - (poBucket.received_qty * poBucket.unit_cost_minor),
+        total_variance:     il.total_minor - poBucket.received_value_minor,
       });
     }
 
@@ -817,8 +862,7 @@ function create(opts) {
 
     var poReceivedValueMinor = 0;
     for (var s = 0; s < poBySkuKeys.length; s += 1) {
-      var bucket = poBySku[poBySkuKeys[s]];
-      poReceivedValueMinor += bucket.received_qty * bucket.unit_cost_minor;
+      poReceivedValueMinor += poBySku[poBySkuKeys[s]].received_value_minor;
     }
 
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.120",
+  "version": "0.4.121",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {