@dainamite/billing 0.17.0 → 0.19.0

package/dist/modules/billing/api/export/account/[id]/route.js

@@ -3,8 +3,12 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import {
   BillingAccount,
+  BillingAccountBalance,
+  BillingAccountTransaction,
   BillingAccountUsage,
   BillingItem,
+  BillingStatement,
+  BillingTopup,
   BillRunOutcome,
   DraftInvoiceEdit
 } from "../../../../data/entities.js";
@@ -41,7 +45,7 @@ async function GET(req, { params }) {
     const url = new URL(req.url);
     const since = parseDate(url.searchParams.get("since")) ?? defaultSince();
     const until = parseDate(url.searchParams.get("until")) ?? /* @__PURE__ */ new Date();
-    const [items, usage, outcomes] = await Promise.all([
+    const [items, usage, outcomes, balance, transactions, topups, statements] = await Promise.all([
       // Items are bounded by integration volume (typically <100 per
       // account); no time-window needed — they often outlive a single
       // export window and the operator needs to see active items
@@ -70,6 +74,41 @@ async function GET(req, { params }) {
           createdAt: { $gte: since, $lte: until }
         },
         { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: "DESC" } }
+      ),
+      // SPEC-002 prepaid data — the balance row + the windowed money trail.
+      em.findOne(BillingAccountBalance, {
+        tenantId,
+        billAccountId: account.id
+      }),
+      em.find(
+        BillingAccountTransaction,
+        {
+          tenantId,
+          organizationId,
+          billAccountId: account.id,
+          createdAt: { $gte: since, $lte: until }
+        },
+        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: "DESC" } }
+      ),
+      em.find(
+        BillingTopup,
+        {
+          tenantId,
+          organizationId,
+          billAccountId: account.id,
+          createdAt: { $gte: since, $lte: until }
+        },
+        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: "DESC" } }
+      ),
+      em.find(
+        BillingStatement,
+        {
+          tenantId,
+          organizationId,
+          billAccountId: account.id,
+          periodEnd: { $gte: since, $lte: until }
+        },
+        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: "DESC" } }
       )
     ]);
     const invoiceRows = await em.execute(
@@ -100,7 +139,8 @@ async function GET(req, { params }) {
     ) : [];
     return NextResponse.json({
       exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      schemaVersion: 1,
+      // v2 adds prepaid balance / transactions / top-ups / statements (SPEC-002).
+      schemaVersion: 2,
       tenantId,
       organizationId,
       window: {
@@ -113,7 +153,12 @@ async function GET(req, { params }) {
       usage,
       runOutcomes: outcomes,
       invoices: invoiceRows,
-      draftInvoiceEdits: draftEdits
+      draftInvoiceEdits: draftEdits,
+      // SPEC-002 prepaid section.
+      balance,
+      transactions,
+      topups,
+      statements
     });
   } catch (err) {
     console.error("[billing/export/account.GET]", err);

package/dist/modules/billing/api/export/account/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/billing/api/export/account/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  BillingAccount,\n  BillingAccountUsage,\n  BillingItem,\n  BillRunOutcome,\n  DraftInvoiceEdit,\n} from '../../../../data/entities'\n\n/**\n * `GET /api/billing/export/account/[id]` \u2014 GDPR portability dump.\n *\n * Returns a full JSON serialization of a single Billing Account\n * including:\n *   - The account row itself.\n *   - Every active + soft-deleted `BillingItem` for the account.\n *   - Every `BillingAccountUsage` record.\n *   - Every `BillRunOutcome` row referencing the account.\n *   - Every `core/sales` invoice the engine emitted for the account\n *     (matched via `metadata->>'bill_account_id'`).\n *   - Every `DraftInvoiceEdit` audit row for those invoices.\n *\n * Scope: the caller's auth tenant/organization is the authority \u2014 a\n * 404 is returned even for valid UUIDs that belong to a different\n * tenant (no cross-tenant leak).\n *\n * Soft-deleted rows are included on purpose: GDPR portability is\n * about the data we still hold, not just the data the UI shows.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.account.view'] },\n}\n\nexport async function GET(\n  req: Request,\n  { params }: { params: Promise<{ id: string }> },\n) {\n  let container: Awaited<ReturnType<typeof createRequestContainer>> | null = null\n  try {\n    container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const tenantId = auth.tenantId\n    const organizationId = (auth as { orgId?: string }).orgId ?? null\n    if (!organizationId) {\n      return NextResponse.json(\n        { error: 'Organization scope required' },\n        { status: 403 },\n      )\n    }\n\n    const { id: accountId } = await params\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const account = await em.findOne(BillingAccount, {\n      id: accountId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!account) {\n      return NextResponse.json({ error: 'Account not found' }, { status: 404 })\n    }\n\n    // Time-window cap for usage records, run outcomes and invoices.\n    //\n    // Scale note: a telco account can carry millions of usage rows.\n    // Returning everything would OOM on the export path. We default\n    // to the last 12 months and let the caller override via `since` /\n    // `until` for full GDPR-compliance dumps (a regulator request that\n    // legitimately needs the lifetime export should set `since=1970-01-01`).\n    // Each query is independently capped by `EXPORT_HARD_LIMIT` so a\n    // single year of pathological volume still returns rather than\n    // hanging.\n    const url = new URL(req.url)\n    const since = parseDate(url.searchParams.get('since'))\n      ?? defaultSince()\n    const until = parseDate(url.searchParams.get('until')) ?? new Date()\n\n    const [items, usage, outcomes] = await Promise.all([\n      // Items are bounded by integration volume (typically <100 per\n      // account); no time-window needed \u2014 they often outlive a single\n      // export window and the operator needs to see active items\n      // regardless of when they were created.\n      em.find(\n        BillingItem,\n        { tenantId, organizationId, billAccountId: account.id } as never,\n        { limit: EXPORT_HARD_LIMIT },\n      ),\n      em.find(\n        BillingAccountUsage,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          periodEnd: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: 'DESC' } },\n      ),\n      em.find(\n        BillRunOutcome,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n    ])\n\n    // Invoices created in the window. The `metadata->>'bill_account_id'`\n    // predicate keeps non-billing core/sales invoices out.\n    const invoiceRows = (await em.execute(\n      `SELECT id, invoice_number, status, status_entry_id, issue_date, due_date,\n              currency_code, subtotal_net_amount, grand_total_net_amount,\n              grand_total_gross_amount, paid_total_amount, outstanding_amount,\n              metadata, created_at, updated_at, deleted_at\n       FROM sales_invoices\n       WHERE tenant_id = ?\n         AND organization_id = ?\n         AND deleted_at IS NULL\n         AND metadata->>'bill_account_id' = ?\n         AND created_at >= ?\n         AND created_at <= ?\n       ORDER BY created_at DESC\n       LIMIT ?`,\n      [tenantId, organizationId, account.id, since, until, EXPORT_HARD_LIMIT],\n    )) as unknown as Array<{ id: string }>\n\n    const invoiceIds = invoiceRows.map((r) => r.id)\n    const draftEdits =\n      invoiceIds.length > 0\n        ? await em.find(\n            DraftInvoiceEdit,\n            {\n              tenantId,\n              organizationId,\n              invoiceId: { $in: invoiceIds },\n            } as never,\n            { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n          )\n        : []\n\n    return NextResponse.json({\n      exportedAt: new Date().toISOString(),\n      schemaVersion: 1,\n      tenantId,\n      organizationId,\n      window: {\n        since: since.toISOString(),\n        until: until.toISOString(),\n        hardLimit: EXPORT_HARD_LIMIT,\n      },\n      account,\n      items,\n      usage,\n      runOutcomes: outcomes,\n      invoices: invoiceRows,\n      draftInvoiceEdits: draftEdits,\n    })\n  } catch (err) {\n    console.error('[billing/export/account.GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\n/**\n * Per-collection cap to keep a single export bounded in size and time\n * even when the caller asks for `since=1970-01-01`. The full GDPR\n * lifetime dump for an outlier account requires a follow-up\n * background-job approach (chunked NDJSON to object storage) \u2014 out of\n * scope for the v1 admin export endpoint.\n */\nconst EXPORT_HARD_LIMIT = 50_000\n\n/**\n * Default time window for the export \u2014 last 12 months. Operators\n * pulling for routine GDPR requests almost always want a finite\n * window; the regulator-compliance \"lifetime\" case overrides via\n * `?since=1970-01-01`.\n */\nfunction defaultSince(): Date {\n  const d = new Date()\n  d.setUTCFullYear(d.getUTCFullYear() - 1)\n  return d\n}\n\nfunction parseDate(value: string | null | undefined): Date | null {\n  if (!value) return null\n  const d = new Date(value)\n  return Number.isNaN(d.getTime()) ? null : d\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Export a billing account (GDPR portability)',\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n        {\n          name: 'since',\n          in: 'query',\n          required: false,\n          description:\n            'ISO timestamp; lower bound for usage / outcomes / invoices windows. Defaults to today \u2212 12 months.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n        {\n          name: 'until',\n          in: 'query',\n          required: false,\n          description: 'ISO timestamp; upper bound. Defaults to now.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n      ],\n      description:\n        \"Returns a JSON dump of a single Billing Account: the account itself, every Billing Item (no time cap \u2014 items often outlive a single export window), and the Usage records / BillRunOutcomes / emitted core/sales invoices / DraftInvoiceEdit rows whose timestamps fall in the [since, until] window (defaults to the last 12 months). Each collection is independently capped by EXPORT_HARD_LIMIT = 50,000 rows. Lifetime dumps for outlier accounts need a follow-up chunked background-job approach \u2014 out of scope for this v1 endpoint.\",\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAuBA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IACpB,KACA,EAAE,OAAO,GACT;AACA,MAAI,YAAuE;AAC3E,MAAI;AACF,gBAAY,MAAM,uBAAuB;AACzC,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAkB,KAA4B,SAAS;AAC7D,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8BAA8B;AAAA,QACvC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,IAAI,UAAU,IAAI,MAAM;AAEhC,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,UAAU,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAYA,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAChD,aAAa;AAClB,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAAK,oBAAI,KAAK;AAEnE,UAAM,CAAC,OAAO,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjD,GAAG;AAAA,QACD;AAAA,QACA,EAAE,UAAU,gBAAgB,eAAe,QAAQ,GAAG;AAAA,QACtD,EAAE,OAAO,kBAAkB;AAAA,MAC7B;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,IACF,CAAC;AAID,UAAM,cAAe,MAAM,GAAG;AAAA,MAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA,CAAC,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,iBAAiB;AAAA,IACxE;AAEA,UAAM,aAAa,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE;AAC9C,UAAM,aACJ,WAAW,SAAS,IAChB,MAAM,GAAG;AAAA,MACP;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,WAAW,EAAE,KAAK,WAAW;AAAA,MAC/B;AAAA,MACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC7D,IACA,CAAC;AAEP,WAAO,aAAa,KAAK;AAAA,MACvB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,OAAO,MAAM,YAAY;AAAA,QACzB,OAAO,MAAM,YAAY;AAAA,QACzB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,UAAU;AAAA,MACV,mBAAmB;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,gCAAgC,GAAG;AACjD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AASA,MAAM,oBAAoB;AAQ1B,SAAS,eAAqB;AAC5B,QAAM,IAAI,oBAAI,KAAK;AACnB,IAAE,eAAe,EAAE,eAAe,IAAI,CAAC;AACvC,SAAO;AACT;AAEA,SAAS,UAAU,OAA+C;AAChE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,IAAI,KAAK,KAAK;AACxB,SAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,IAAI,OAAO;AAC5C;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aACE;AAAA,UACF,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,MACF;AAAA,MACA,aACE;AAAA,IACJ;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  BillingAccount,\n  BillingAccountBalance,\n  BillingAccountTransaction,\n  BillingAccountUsage,\n  BillingItem,\n  BillingStatement,\n  BillingTopup,\n  BillRunOutcome,\n  DraftInvoiceEdit,\n} from '../../../../data/entities'\n\n/**\n * `GET /api/billing/export/account/[id]` \u2014 GDPR portability dump.\n *\n * Returns a full JSON serialization of a single Billing Account\n * including:\n *   - The account row itself.\n *   - Every active + soft-deleted `BillingItem` for the account.\n *   - Every `BillingAccountUsage` record.\n *   - Every `BillRunOutcome` row referencing the account.\n *   - Every `core/sales` invoice the engine emitted for the account\n *     (matched via `metadata->>'bill_account_id'`).\n *   - Every `DraftInvoiceEdit` audit row for those invoices.\n *\n * Scope: the caller's auth tenant/organization is the authority \u2014 a\n * 404 is returned even for valid UUIDs that belong to a different\n * tenant (no cross-tenant leak).\n *\n * Soft-deleted rows are included on purpose: GDPR portability is\n * about the data we still hold, not just the data the UI shows.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.account.view'] },\n}\n\nexport async function GET(\n  req: Request,\n  { params }: { params: Promise<{ id: string }> },\n) {\n  let container: Awaited<ReturnType<typeof createRequestContainer>> | null = null\n  try {\n    container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const tenantId = auth.tenantId\n    const organizationId = (auth as { orgId?: string }).orgId ?? null\n    if (!organizationId) {\n      return NextResponse.json(\n        { error: 'Organization scope required' },\n        { status: 403 },\n      )\n    }\n\n    const { id: accountId } = await params\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const account = await em.findOne(BillingAccount, {\n      id: accountId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!account) {\n      return NextResponse.json({ error: 'Account not found' }, { status: 404 })\n    }\n\n    // Time-window cap for usage records, run outcomes and invoices.\n    //\n    // Scale note: a telco account can carry millions of usage rows.\n    // Returning everything would OOM on the export path. We default\n    // to the last 12 months and let the caller override via `since` /\n    // `until` for full GDPR-compliance dumps (a regulator request that\n    // legitimately needs the lifetime export should set `since=1970-01-01`).\n    // Each query is independently capped by `EXPORT_HARD_LIMIT` so a\n    // single year of pathological volume still returns rather than\n    // hanging.\n    const url = new URL(req.url)\n    const since = parseDate(url.searchParams.get('since'))\n      ?? defaultSince()\n    const until = parseDate(url.searchParams.get('until')) ?? new Date()\n\n    const [items, usage, outcomes, balance, transactions, topups, statements] = await Promise.all([\n      // Items are bounded by integration volume (typically <100 per\n      // account); no time-window needed \u2014 they often outlive a single\n      // export window and the operator needs to see active items\n      // regardless of when they were created.\n      em.find(\n        BillingItem,\n        { tenantId, organizationId, billAccountId: account.id } as never,\n        { limit: EXPORT_HARD_LIMIT },\n      ),\n      em.find(\n        BillingAccountUsage,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          periodEnd: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: 'DESC' } },\n      ),\n      em.find(\n        BillRunOutcome,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n      // SPEC-002 prepaid data \u2014 the balance row + the windowed money trail.\n      em.findOne(BillingAccountBalance, {\n        tenantId,\n        billAccountId: account.id,\n      } as never),\n      em.find(\n        BillingAccountTransaction,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n      em.find(\n        BillingTopup,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n      em.find(\n        BillingStatement,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          periodEnd: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: 'DESC' } },\n      ),\n    ])\n\n    // Invoices created in the window. The `metadata->>'bill_account_id'`\n    // predicate keeps non-billing core/sales invoices out.\n    const invoiceRows = (await em.execute(\n      `SELECT id, invoice_number, status, status_entry_id, issue_date, due_date,\n              currency_code, subtotal_net_amount, grand_total_net_amount,\n              grand_total_gross_amount, paid_total_amount, outstanding_amount,\n              metadata, created_at, updated_at, deleted_at\n       FROM sales_invoices\n       WHERE tenant_id = ?\n         AND organization_id = ?\n         AND deleted_at IS NULL\n         AND metadata->>'bill_account_id' = ?\n         AND created_at >= ?\n         AND created_at <= ?\n       ORDER BY created_at DESC\n       LIMIT ?`,\n      [tenantId, organizationId, account.id, since, until, EXPORT_HARD_LIMIT],\n    )) as unknown as Array<{ id: string }>\n\n    const invoiceIds = invoiceRows.map((r) => r.id)\n    const draftEdits =\n      invoiceIds.length > 0\n        ? await em.find(\n            DraftInvoiceEdit,\n            {\n              tenantId,\n              organizationId,\n              invoiceId: { $in: invoiceIds },\n            } as never,\n            { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n          )\n        : []\n\n    return NextResponse.json({\n      exportedAt: new Date().toISOString(),\n      // v2 adds prepaid balance / transactions / top-ups / statements (SPEC-002).\n      schemaVersion: 2,\n      tenantId,\n      organizationId,\n      window: {\n        since: since.toISOString(),\n        until: until.toISOString(),\n        hardLimit: EXPORT_HARD_LIMIT,\n      },\n      account,\n      items,\n      usage,\n      runOutcomes: outcomes,\n      invoices: invoiceRows,\n      draftInvoiceEdits: draftEdits,\n      // SPEC-002 prepaid section.\n      balance,\n      transactions,\n      topups,\n      statements,\n    })\n  } catch (err) {\n    console.error('[billing/export/account.GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\n/**\n * Per-collection cap to keep a single export bounded in size and time\n * even when the caller asks for `since=1970-01-01`. The full GDPR\n * lifetime dump for an outlier account requires a follow-up\n * background-job approach (chunked NDJSON to object storage) \u2014 out of\n * scope for the v1 admin export endpoint.\n */\nconst EXPORT_HARD_LIMIT = 50_000\n\n/**\n * Default time window for the export \u2014 last 12 months. Operators\n * pulling for routine GDPR requests almost always want a finite\n * window; the regulator-compliance \"lifetime\" case overrides via\n * `?since=1970-01-01`.\n */\nfunction defaultSince(): Date {\n  const d = new Date()\n  d.setUTCFullYear(d.getUTCFullYear() - 1)\n  return d\n}\n\nfunction parseDate(value: string | null | undefined): Date | null {\n  if (!value) return null\n  const d = new Date(value)\n  return Number.isNaN(d.getTime()) ? null : d\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Export a billing account (GDPR portability)',\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n        {\n          name: 'since',\n          in: 'query',\n          required: false,\n          description:\n            'ISO timestamp; lower bound for usage / outcomes / invoices windows. Defaults to today \u2212 12 months.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n        {\n          name: 'until',\n          in: 'query',\n          required: false,\n          description: 'ISO timestamp; upper bound. Defaults to now.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n      ],\n      description:\n        \"Returns a JSON dump of a single Billing Account: the account itself, every Billing Item (no time cap \u2014 items often outlive a single export window), and the Usage records / BillRunOutcomes / emitted core/sales invoices / DraftInvoiceEdit rows whose timestamps fall in the [since, until] window (defaults to the last 12 months). Each collection is independently capped by EXPORT_HARD_LIMIT = 50,000 rows. Lifetime dumps for outlier accounts need a follow-up chunked background-job approach \u2014 out of scope for this v1 endpoint.\",\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAuBA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IACpB,KACA,EAAE,OAAO,GACT;AACA,MAAI,YAAuE;AAC3E,MAAI;AACF,gBAAY,MAAM,uBAAuB;AACzC,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAkB,KAA4B,SAAS;AAC7D,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8BAA8B;AAAA,QACvC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,IAAI,UAAU,IAAI,MAAM;AAEhC,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,UAAU,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAYA,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAChD,aAAa;AAClB,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAAK,oBAAI,KAAK;AAEnE,UAAM,CAAC,OAAO,OAAO,UAAU,SAAS,cAAc,QAAQ,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,MAK5F,GAAG;AAAA,QACD;AAAA,QACA,EAAE,UAAU,gBAAgB,eAAe,QAAQ,GAAG;AAAA,QACtD,EAAE,OAAO,kBAAkB;AAAA,MAC7B;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA;AAAA,MAEA,GAAG,QAAQ,uBAAuB;AAAA,QAChC;AAAA,QACA,eAAe,QAAQ;AAAA,MACzB,CAAU;AAAA,MACV,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,IACF,CAAC;AAID,UAAM,cAAe,MAAM,GAAG;AAAA,MAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA,CAAC,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,iBAAiB;AAAA,IACxE;AAEA,UAAM,aAAa,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE;AAC9C,UAAM,aACJ,WAAW,SAAS,IAChB,MAAM,GAAG;AAAA,MACP;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,WAAW,EAAE,KAAK,WAAW;AAAA,MAC/B;AAAA,MACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC7D,IACA,CAAC;AAEP,WAAO,aAAa,KAAK;AAAA,MACvB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA;AAAA,MAEnC,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,OAAO,MAAM,YAAY;AAAA,QACzB,OAAO,MAAM,YAAY;AAAA,QACzB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,UAAU;AAAA,MACV,mBAAmB;AAAA;AAAA,MAEnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,gCAAgC,GAAG;AACjD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AASA,MAAM,oBAAoB;AAQ1B,SAAS,eAAqB;AAC5B,QAAM,IAAI,oBAAI,KAAK;AACnB,IAAE,eAAe,EAAE,eAAe,IAAI,CAAC;AACvC,SAAO;AACT;AAEA,SAAS,UAAU,OAA+C;AAChE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,IAAI,KAAK,KAAK;AACxB,SAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,IAAI,OAAO;AAC5C;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aACE;AAAA,UACF,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,MACF;AAAA,MACA,aACE;AAAA,IACJ;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/billing/api/statements/generate/route.js

@@ -0,0 +1,68 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { withScopedPayload } from "@open-mercato/shared/lib/api/scoped";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { BillingStatement } from "../../../data/entities.js";
+import { billingEntityIds } from "../../../data/entityIds.js";
+import { billingStatementGenerateSchema } from "../../../data/validators.js";
+import { createBillingCrudOpenApi } from "../../openapi.js";
+const routeMetadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.statement.generate"] }
+};
+const metadata = routeMetadata;
+const generateResponseSchema = z.object({
+  statementId: z.string().uuid().nullable(),
+  billRunId: z.string().uuid(),
+  status: z.string()
+});
+const rawBodySchema = z.object({}).passthrough();
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: BillingStatement,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId"
+  },
+  list: {
+    schema: z.object({}).passthrough(),
+    entityId: billingEntityIds.statement,
+    fields: ["id"],
+    buildFilters: async () => ({})
+  },
+  actions: {
+    create: {
+      commandId: "billing.statements.generate",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        const scoped = withScopedPayload(raw ?? {}, ctx, translate);
+        return billingStatementGenerateSchema.parse(scoped);
+      },
+      response: ({ result }) => ({
+        statementId: result?.statementId ?? null,
+        billRunId: result?.billRunId ?? null,
+        status: result?.status ?? null
+      }),
+      status: 201
+    }
+  }
+});
+const POST = crud.POST;
+const openApi = createBillingCrudOpenApi({
+  resourceName: "BillingStatementGenerate",
+  pluralName: "BillingStatementGenerations",
+  querySchema: z.object({}).passthrough(),
+  listResponseSchema: z.object({ items: z.array(z.unknown()) }),
+  create: {
+    schema: billingStatementGenerateSchema,
+    responseSchema: generateResponseSchema,
+    description: "Generates a consumption statement for a prepaid account by running the period close (recurring charges \u2192 balance + statement) scoped to that account. Returns the statement id (null when the account is not due)."
+  }
+});
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/statements/generate/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/statements/generate/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { BillingStatement } from '../../../data/entities'\nimport { billingEntityIds } from '../../../data/entityIds'\nimport { billingStatementGenerateSchema } from '../../../data/validators'\nimport { createBillingCrudOpenApi } from '../../openapi'\n\n/**\n * `POST /api/billing/statements/generate` (SPEC-002 P3) \u2014 manual statement\n * generation for a prepaid account. Reuses the Bill Run engine scoped to the\n * one account (same recurring-charge + anti-duplicate machinery).\n */\n\nconst routeMetadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.statement.generate'] },\n}\n\nexport const metadata = routeMetadata\n\nconst generateResponseSchema = z.object({\n  statementId: z.string().uuid().nullable(),\n  billRunId: z.string().uuid(),\n  status: z.string(),\n})\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: BillingStatement,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n  },\n  list: {\n    schema: z.object({}).passthrough(),\n    entityId: billingEntityIds.statement,\n    fields: ['id'],\n    buildFilters: async () => ({}),\n  },\n  actions: {\n    create: {\n      commandId: 'billing.statements.generate',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const scoped = withScopedPayload(raw ?? {}, ctx, translate)\n        return billingStatementGenerateSchema.parse(scoped)\n      },\n      response: ({ result }) => ({\n        statementId: result?.statementId ?? null,\n        billRunId: result?.billRunId ?? null,\n        status: result?.status ?? null,\n      }),\n      status: 201,\n    },\n  },\n})\n\nexport const POST = crud.POST\n\nexport const openApi = createBillingCrudOpenApi({\n  resourceName: 'BillingStatementGenerate',\n  pluralName: 'BillingStatementGenerations',\n  querySchema: z.object({}).passthrough(),\n  listResponseSchema: z.object({ items: z.array(z.unknown()) }),\n  create: {\n    schema: billingStatementGenerateSchema,\n    responseSchema: generateResponseSchema,\n    description:\n      'Generates a consumption statement for a prepaid account by running the ' +\n      'period close (recurring charges \u2192 balance + statement) scoped to that ' +\n      'account. Returns the statement id (null when the account is not due).',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,yBAAyB;AAClC,SAAS,2BAA2B;AACpC,SAAS,wBAAwB;AACjC,SAAS,wBAAwB;AACjC,SAAS,sCAAsC;AAC/C,SAAS,gCAAgC;AAQzC,MAAM,gBAAgB;AAAA,EACpB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEO,MAAM,WAAW;AAExB,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,EAAE,OAAO;AACnB,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,IACjC,UAAU,iBAAiB;AAAA,IAC3B,QAAQ,CAAC,IAAI;AAAA,IACb,cAAc,aAAa,CAAC;AAAA,EAC9B;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,kBAAkB,OAAO,CAAC,GAAG,KAAK,SAAS;AAC1D,eAAO,+BAA+B,MAAM,MAAM;AAAA,MACpD;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO;AAAA,QACzB,aAAa,QAAQ,eAAe;AAAA,QACpC,WAAW,QAAQ,aAAa;AAAA,QAChC,QAAQ,QAAQ,UAAU;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAEM,MAAM,OAAO,KAAK;AAElB,MAAM,UAAU,yBAAyB;AAAA,EAC9C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,EACtC,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC5D,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EAGJ;AACF,CAAC;",
+  "names": []
+}

package/dist/modules/billing/api/statements/route.js

@@ -0,0 +1,110 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { BillingStatement } from "../../data/entities.js";
+import { billingEntityIds } from "../../data/entityIds.js";
+import { billingStatementListQuerySchema } from "../../data/validators.js";
+import {
+  createBillingCrudOpenApi,
+  createPagedListResponseSchema
+} from "../openapi.js";
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ["billing.statement.view"] }
+};
+const metadata = routeMetadata;
+const billingStatementListItemSchema = z.object({
+  id: z.string().uuid(),
+  bill_account_id: z.string().uuid(),
+  bill_run_id: z.string().uuid().nullable(),
+  period_start: z.string(),
+  period_end: z.string(),
+  currency_code: z.string(),
+  opening_balance: z.string(),
+  total_topups: z.string(),
+  total_usage: z.string(),
+  total_recurring: z.string(),
+  total_adjustments: z.string(),
+  closing_balance: z.string(),
+  debit_breakdown: z.record(z.string(), z.unknown()).nullable(),
+  status: z.string(),
+  organization_id: z.string().uuid(),
+  tenant_id: z.string().uuid(),
+  created_at: z.string(),
+  updated_at: z.string()
+});
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: BillingStatement,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId"
+  },
+  list: {
+    schema: billingStatementListQuerySchema,
+    entityId: billingEntityIds.statement,
+    fields: [
+      "id",
+      "bill_account_id",
+      "bill_run_id",
+      "period_start",
+      "period_end",
+      "currency_code",
+      "opening_balance",
+      "total_topups",
+      "total_usage",
+      "total_recurring",
+      "total_adjustments",
+      "closing_balance",
+      "debit_breakdown",
+      "status",
+      "organization_id",
+      "tenant_id",
+      "created_at",
+      "updated_at"
+    ],
+    sortFieldMap: {
+      periodEnd: "period_end",
+      periodStart: "period_start",
+      createdAt: "created_at"
+    },
+    buildFilters: async (query) => {
+      const filters = {};
+      if (typeof query.id === "string" && query.id) {
+        filters.id = { $eq: query.id };
+      }
+      if (typeof query.billAccountId === "string" && query.billAccountId) {
+        filters.bill_account_id = { $eq: query.billAccountId };
+      }
+      if (typeof query.status === "string" && query.status) {
+        filters.status = { $eq: query.status };
+      }
+      if (query.periodEndFrom instanceof Date) {
+        filters.period_end = Object.assign(
+          filters.period_end ?? {},
+          { $gte: query.periodEndFrom }
+        );
+      }
+      if (query.periodEndTo instanceof Date) {
+        filters.period_end = Object.assign(
+          filters.period_end ?? {},
+          { $lte: query.periodEndTo }
+        );
+      }
+      return filters;
+    }
+  },
+  actions: {}
+});
+const GET = crud.GET;
+const openApi = createBillingCrudOpenApi({
+  resourceName: "BillingStatement",
+  pluralName: "BillingStatements",
+  querySchema: billingStatementListQuerySchema,
+  listResponseSchema: createPagedListResponseSchema(billingStatementListItemSchema)
+});
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/statements/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/billing/api/statements/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { BillingStatement } from '../../data/entities'\nimport { billingEntityIds } from '../../data/entityIds'\nimport { billingStatementListQuerySchema } from '../../data/validators'\nimport {\n  createBillingCrudOpenApi,\n  createPagedListResponseSchema,\n} from '../openapi'\n\n/**\n * `GET /api/billing/statements` \u2014 paged consumption statements (SPEC-002 P3).\n * Filter by account, status, and a `period_end` window. `?id=` narrows to one\n * row for the detail page. Generation goes through\n * POST /api/billing/statements/generate.\n */\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.statement.view'] },\n}\n\nexport const metadata = routeMetadata\n\nconst billingStatementListItemSchema = z.object({\n  id: z.string().uuid(),\n  bill_account_id: z.string().uuid(),\n  bill_run_id: z.string().uuid().nullable(),\n  period_start: z.string(),\n  period_end: z.string(),\n  currency_code: z.string(),\n  opening_balance: z.string(),\n  total_topups: z.string(),\n  total_usage: z.string(),\n  total_recurring: z.string(),\n  total_adjustments: z.string(),\n  closing_balance: z.string(),\n  debit_breakdown: z.record(z.string(), z.unknown()).nullable(),\n  status: z.string(),\n  organization_id: z.string().uuid(),\n  tenant_id: z.string().uuid(),\n  created_at: z.string(),\n  updated_at: z.string(),\n})\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: BillingStatement,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n  },\n  list: {\n    schema: billingStatementListQuerySchema,\n    entityId: billingEntityIds.statement,\n    fields: [\n      'id',\n      'bill_account_id',\n      'bill_run_id',\n      'period_start',\n      'period_end',\n      'currency_code',\n      'opening_balance',\n      'total_topups',\n      'total_usage',\n      'total_recurring',\n      'total_adjustments',\n      'closing_balance',\n      'debit_breakdown',\n      'status',\n      'organization_id',\n      'tenant_id',\n      'created_at',\n      'updated_at',\n    ],\n    sortFieldMap: {\n      periodEnd: 'period_end',\n      periodStart: 'period_start',\n      createdAt: 'created_at',\n    },\n    buildFilters: async (query) => {\n      const filters: Record<string, unknown> = {}\n      if (typeof query.id === 'string' && query.id) {\n        filters.id = { $eq: query.id }\n      }\n      if (typeof query.billAccountId === 'string' && query.billAccountId) {\n        filters.bill_account_id = { $eq: query.billAccountId }\n      }\n      if (typeof query.status === 'string' && query.status) {\n        filters.status = { $eq: query.status }\n      }\n      if (query.periodEndFrom instanceof Date) {\n        filters.period_end = Object.assign(\n          (filters.period_end as Record<string, unknown>) ?? {},\n          { $gte: query.periodEndFrom },\n        )\n      }\n      if (query.periodEndTo instanceof Date) {\n        filters.period_end = Object.assign(\n          (filters.period_end as Record<string, unknown>) ?? {},\n          { $lte: query.periodEndTo },\n        )\n      }\n      return filters\n    },\n  },\n  actions: {},\n})\n\nexport const GET = crud.GET\n\nexport const openApi = createBillingCrudOpenApi({\n  resourceName: 'BillingStatement',\n  pluralName: 'BillingStatements',\n  querySchema: billingStatementListQuerySchema,\n  listResponseSchema: createPagedListResponseSchema(billingStatementListItemSchema),\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,wBAAwB;AACjC,SAAS,uCAAuC;AAChD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASP,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACxE;AAEO,MAAM,WAAW;AAExB,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,cAAc,EAAE,OAAO;AAAA,EACvB,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO;AAAA,EACxB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,cAAc,EAAE,OAAO;AAAA,EACvB,aAAa,EAAE,OAAO;AAAA,EACtB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,mBAAmB,EAAE,OAAO;AAAA,EAC5B,iBAAiB,EAAE,OAAO;AAAA,EAC1B,iBAAiB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC5D,QAAQ,EAAE,OAAO;AAAA,EACjB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO;AACvB,CAAC;AAED,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,iBAAiB;AAAA,IAC3B,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,WAAW;AAAA,MACX,aAAa;AAAA,MACb,WAAW;AAAA,IACb;AAAA,IACA,cAAc,OAAO,UAAU;AAC7B,YAAM,UAAmC,CAAC;AAC1C,UAAI,OAAO,MAAM,OAAO,YAAY,MAAM,IAAI;AAC5C,gBAAQ,KAAK,EAAE,KAAK,MAAM,GAAG;AAAA,MAC/B;AACA,UAAI,OAAO,MAAM,kBAAkB,YAAY,MAAM,eAAe;AAClE,gBAAQ,kBAAkB,EAAE,KAAK,MAAM,cAAc;AAAA,MACvD;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,QAAQ;AACpD,gBAAQ,SAAS,EAAE,KAAK,MAAM,OAAO;AAAA,MACvC;AACA,UAAI,MAAM,yBAAyB,MAAM;AACvC,gBAAQ,aAAa,OAAO;AAAA,UACzB,QAAQ,cAA0C,CAAC;AAAA,UACpD,EAAE,MAAM,MAAM,cAAc;AAAA,QAC9B;AAAA,MACF;AACA,UAAI,MAAM,uBAAuB,MAAM;AACrC,gBAAQ,aAAa,OAAO;AAAA,UACzB,QAAQ,cAA0C,CAAC;AAAA,UACpD,EAAE,MAAM,MAAM,YAAY;AAAA,QAC5B;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,SAAS,CAAC;AACZ,CAAC;AAEM,MAAM,MAAM,KAAK;AAEjB,MAAM,UAAU,yBAAyB;AAAA,EAC9C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,8BAA8B;AAClF,CAAC;",
+  "names": []
+}

package/dist/modules/billing/api/topups/route.js

@@ -0,0 +1,139 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { withScopedPayload } from "@open-mercato/shared/lib/api/scoped";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { BillingTopup } from "../../data/entities.js";
+import { billingEntityIds } from "../../data/entityIds.js";
+import {
+  billingTopupCreateSchema,
+  billingTopupListQuerySchema
+} from "../../data/validators.js";
+import {
+  createBillingCrudOpenApi,
+  createPagedListResponseSchema
+} from "../openapi.js";
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ["billing.topup.view"] },
+  POST: { requireAuth: true, requireFeatures: ["billing.topup.create"] }
+};
+const metadata = routeMetadata;
+const billingTopupListItemSchema = z.object({
+  id: z.string().uuid(),
+  bill_account_id: z.string().uuid(),
+  status: z.string(),
+  amount: z.string(),
+  currency_code: z.string(),
+  provider_key: z.string(),
+  payment_id: z.string().uuid(),
+  gateway_transaction_id: z.string().uuid().nullable(),
+  transaction_id: z.string().uuid().nullable(),
+  receipt_invoice_id: z.string().uuid().nullable(),
+  source_ref: z.string().nullable(),
+  metadata: z.record(z.string(), z.unknown()).nullable(),
+  organization_id: z.string().uuid(),
+  tenant_id: z.string().uuid(),
+  created_at: z.string(),
+  updated_at: z.string()
+});
+const topupCreateResponseSchema = z.object({
+  topupId: z.string().uuid(),
+  paymentId: z.string().uuid(),
+  status: z.string(),
+  transactionId: z.string().uuid().nullable(),
+  redirectUrl: z.string().nullable(),
+  clientSecret: z.string().nullable()
+});
+const rawBodySchema = z.object({}).passthrough();
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: BillingTopup,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId",
+    softDeleteField: "deletedAt"
+  },
+  list: {
+    schema: billingTopupListQuerySchema,
+    entityId: billingEntityIds.topup,
+    fields: [
+      "id",
+      "bill_account_id",
+      "status",
+      "amount",
+      "currency_code",
+      "provider_key",
+      "payment_id",
+      "gateway_transaction_id",
+      "transaction_id",
+      "receipt_invoice_id",
+      "source_ref",
+      "metadata",
+      "organization_id",
+      "tenant_id",
+      "created_at",
+      "updated_at"
+    ],
+    sortFieldMap: {
+      createdAt: "created_at",
+      updatedAt: "updated_at",
+      amount: "amount"
+    },
+    buildFilters: async (query) => {
+      const filters = {};
+      if (typeof query.id === "string" && query.id) {
+        filters.id = { $eq: query.id };
+      }
+      if (typeof query.billAccountId === "string" && query.billAccountId) {
+        filters.bill_account_id = { $eq: query.billAccountId };
+      }
+      if (typeof query.status === "string" && query.status) {
+        filters.status = { $eq: query.status };
+      }
+      if (typeof query.search === "string" && /^[0-9a-fA-F-]{36}$/.test(query.search.trim())) {
+        filters.id = { $eq: query.search.trim() };
+      }
+      return filters;
+    }
+  },
+  actions: {
+    create: {
+      commandId: "billing.topups.create",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        const scoped = withScopedPayload(raw ?? {}, ctx, translate);
+        return billingTopupCreateSchema.parse(scoped);
+      },
+      response: ({ result }) => ({
+        topupId: result?.topupId ?? null,
+        paymentId: result?.paymentId ?? null,
+        status: result?.status ?? null,
+        transactionId: result?.transactionId ?? null,
+        redirectUrl: result?.redirectUrl ?? null,
+        clientSecret: result?.clientSecret ?? null
+      }),
+      status: 201
+    }
+  }
+});
+const { POST } = crud;
+const GET = crud.GET;
+const openApi = createBillingCrudOpenApi({
+  resourceName: "BillingTopup",
+  pluralName: "BillingTopups",
+  querySchema: billingTopupListQuerySchema,
+  listResponseSchema: createPagedListResponseSchema(billingTopupListItemSchema),
+  create: {
+    schema: billingTopupCreateSchema,
+    responseSchema: topupCreateResponseSchema,
+    description: "Registers a prepaid top-up (status=pending) and opens a payment session via core/payment_gateways. The balance is credited only on `payment_gateways.payment.captured` (the capture subscriber issues the VAT receipt). Returns the topup id, the payment session redirect URL / client secret, and the gateway transaction id."
+  }
+});
+export {
+  GET,
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/topups/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/billing/api/topups/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { BillingTopup } from '../../data/entities'\nimport { billingEntityIds } from '../../data/entityIds'\nimport {\n  billingTopupCreateSchema,\n  billingTopupListQuerySchema,\n} from '../../data/validators'\nimport {\n  createBillingCrudOpenApi,\n  createPagedListResponseSchema,\n} from '../openapi'\n\n/**\n * `/api/billing/topups` \u2014 GET (list registered top-ups) + POST (initiate).\n *\n * The nested, spec-faithful `POST /api/billing/accounts/{id}/topups` is a thin\n * wrapper that injects the path id as `billAccountId` and delegates here, so\n * all the RBAC / command-bus / side-effect plumbing lives in one place.\n */\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.topup.view'] },\n  POST: { requireAuth: true, requireFeatures: ['billing.topup.create'] },\n}\n\nexport const metadata = routeMetadata\n\nconst billingTopupListItemSchema = z.object({\n  id: z.string().uuid(),\n  bill_account_id: z.string().uuid(),\n  status: z.string(),\n  amount: z.string(),\n  currency_code: z.string(),\n  provider_key: z.string(),\n  payment_id: z.string().uuid(),\n  gateway_transaction_id: z.string().uuid().nullable(),\n  transaction_id: z.string().uuid().nullable(),\n  receipt_invoice_id: z.string().uuid().nullable(),\n  source_ref: z.string().nullable(),\n  metadata: z.record(z.string(), z.unknown()).nullable(),\n  organization_id: z.string().uuid(),\n  tenant_id: z.string().uuid(),\n  created_at: z.string(),\n  updated_at: z.string(),\n})\n\nconst topupCreateResponseSchema = z.object({\n  topupId: z.string().uuid(),\n  paymentId: z.string().uuid(),\n  status: z.string(),\n  transactionId: z.string().uuid().nullable(),\n  redirectUrl: z.string().nullable(),\n  clientSecret: z.string().nullable(),\n})\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: BillingTopup,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  list: {\n    schema: billingTopupListQuerySchema,\n    entityId: billingEntityIds.topup,\n    fields: [\n      'id',\n      'bill_account_id',\n      'status',\n      'amount',\n      'currency_code',\n      'provider_key',\n      'payment_id',\n      'gateway_transaction_id',\n      'transaction_id',\n      'receipt_invoice_id',\n      'source_ref',\n      'metadata',\n      'organization_id',\n      'tenant_id',\n      'created_at',\n      'updated_at',\n    ],\n    sortFieldMap: {\n      createdAt: 'created_at',\n      updatedAt: 'updated_at',\n      amount: 'amount',\n    },\n    buildFilters: async (query) => {\n      const filters: Record<string, unknown> = {}\n      if (typeof query.id === 'string' && query.id) {\n        filters.id = { $eq: query.id }\n      }\n      if (typeof query.billAccountId === 'string' && query.billAccountId) {\n        filters.bill_account_id = { $eq: query.billAccountId }\n      }\n      if (typeof query.status === 'string' && query.status) {\n        filters.status = { $eq: query.status }\n      }\n      if (typeof query.search === 'string' && /^[0-9a-fA-F-]{36}$/.test(query.search.trim())) {\n        filters.id = { $eq: query.search.trim() }\n      }\n      return filters\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'billing.topups.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const scoped = withScopedPayload(raw ?? {}, ctx, translate)\n        return billingTopupCreateSchema.parse(scoped)\n      },\n      response: ({ result }) => ({\n        topupId: result?.topupId ?? null,\n        paymentId: result?.paymentId ?? null,\n        status: result?.status ?? null,\n        transactionId: result?.transactionId ?? null,\n        redirectUrl: result?.redirectUrl ?? null,\n        clientSecret: result?.clientSecret ?? null,\n      }),\n      status: 201,\n    },\n  },\n})\n\nconst { POST } = crud\nexport { POST }\nexport const GET = crud.GET\n\nexport const openApi = createBillingCrudOpenApi({\n  resourceName: 'BillingTopup',\n  pluralName: 'BillingTopups',\n  querySchema: billingTopupListQuerySchema,\n  listResponseSchema: createPagedListResponseSchema(billingTopupListItemSchema),\n  create: {\n    schema: billingTopupCreateSchema,\n    responseSchema: topupCreateResponseSchema,\n    description:\n      'Registers a prepaid top-up (status=pending) and opens a payment ' +\n      'session via core/payment_gateways. The balance is credited only on ' +\n      '`payment_gateways.payment.captured` (the capture subscriber issues the ' +\n      'VAT receipt). Returns the topup id, the payment session redirect URL / ' +\n      'client secret, and the gateway transaction id.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,yBAAyB;AAClC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAUP,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EAClE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEO,MAAM,WAAW;AAExB,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,QAAQ,EAAE,OAAO;AAAA,EACjB,QAAQ,EAAE,OAAO;AAAA,EACjB,eAAe,EAAE,OAAO;AAAA,EACxB,cAAc,EAAE,OAAO;AAAA,EACvB,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrD,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO;AACvB,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,EAAE,OAAO;AAAA,EACjB,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,iBAAiB;AAAA,IAC3B,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,WAAW;AAAA,MACX,WAAW;AAAA,MACX,QAAQ;AAAA,IACV;AAAA,IACA,cAAc,OAAO,UAAU;AAC7B,YAAM,UAAmC,CAAC;AAC1C,UAAI,OAAO,MAAM,OAAO,YAAY,MAAM,IAAI;AAC5C,gBAAQ,KAAK,EAAE,KAAK,MAAM,GAAG;AAAA,MAC/B;AACA,UAAI,OAAO,MAAM,kBAAkB,YAAY,MAAM,eAAe;AAClE,gBAAQ,kBAAkB,EAAE,KAAK,MAAM,cAAc;AAAA,MACvD;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,QAAQ;AACpD,gBAAQ,SAAS,EAAE,KAAK,MAAM,OAAO;AAAA,MACvC;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,qBAAqB,KAAK,MAAM,OAAO,KAAK,CAAC,GAAG;AACtF,gBAAQ,KAAK,EAAE,KAAK,MAAM,OAAO,KAAK,EAAE;AAAA,MAC1C;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,kBAAkB,OAAO,CAAC,GAAG,KAAK,SAAS;AAC1D,eAAO,yBAAyB,MAAM,MAAM;AAAA,MAC9C;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO;AAAA,QACzB,SAAS,QAAQ,WAAW;AAAA,QAC5B,WAAW,QAAQ,aAAa;AAAA,QAChC,QAAQ,QAAQ,UAAU;AAAA,QAC1B,eAAe,QAAQ,iBAAiB;AAAA,QACxC,aAAa,QAAQ,eAAe;AAAA,QACpC,cAAc,QAAQ,gBAAgB;AAAA,MACxC;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAED,MAAM,EAAE,KAAK,IAAI;AAEV,MAAM,MAAM,KAAK;AAEjB,MAAM,UAAU,yBAAyB;AAAA,EAC9C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,0BAA0B;AAAA,EAC5E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EAKJ;AACF,CAAC;",
+  "names": []
+}

package/dist/modules/billing/api/transactions/adjust/route.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { withScopedPayload } from "@open-mercato/shared/lib/api/scoped";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { BillingAccountTransaction } from "../../../data/entities.js";
+import { billingEntityIds } from "../../../data/entityIds.js";
+import { billingTransactionAdjustSchema } from "../../../data/validators.js";
+import { createBillingCrudOpenApi } from "../../openapi.js";
+const routeMetadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.balance.adjust"] }
+};
+const metadata = routeMetadata;
+const adjustResponseSchema = z.object({
+  transactionId: z.string().uuid(),
+  balance: z.string(),
+  balanceStatus: z.enum(["ok", "low", "exhausted"]),
+  deduplicated: z.boolean()
+});
+const rawBodySchema = z.object({}).passthrough();
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: BillingAccountTransaction,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId",
+    softDeleteField: "deletedAt"
+  },
+  list: {
+    schema: z.object({}).passthrough(),
+    entityId: billingEntityIds.transaction,
+    fields: ["id"],
+    buildFilters: async () => ({})
+  },
+  actions: {
+    create: {
+      commandId: "billing.transactions.adjust",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        const scoped = withScopedPayload(raw ?? {}, ctx, translate);
+        return billingTransactionAdjustSchema.parse(scoped);
+      },
+      response: ({ result }) => ({
+        transactionId: result?.transactionId ?? null,
+        balance: result?.balance ?? null,
+        balanceStatus: result?.balanceStatus ?? null,
+        deduplicated: Boolean(result?.deduplicated)
+      }),
+      status: 201
+    }
+  }
+});
+const POST = crud.POST;
+const openApi = createBillingCrudOpenApi({
+  resourceName: "BillingBalanceAdjustment",
+  pluralName: "BillingBalanceAdjustments",
+  querySchema: z.object({}).passthrough(),
+  listResponseSchema: z.object({ items: z.array(z.unknown()) }),
+  create: {
+    schema: billingTransactionAdjustSchema,
+    responseSchema: adjustResponseSchema,
+    description: "Manually credits (amount > 0) or debits (amount < 0) a prepaid account's balance. Audited with the operator's user id. Non-fiscal \u2014 no receipt is issued. Returns the new balance + status."
+  }
+});
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/transactions/adjust/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/transactions/adjust/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { BillingAccountTransaction } from '../../../data/entities'\nimport { billingEntityIds } from '../../../data/entityIds'\nimport { billingTransactionAdjustSchema } from '../../../data/validators'\nimport { createBillingCrudOpenApi } from '../../openapi'\n\n/**\n * `POST /api/billing/transactions/adjust` (SPEC-002 P5) \u2014 manual balance\n * credit/debit (`type='adjustment'`), audited with the operator's `user_id`.\n */\n\nconst routeMetadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.balance.adjust'] },\n}\n\nexport const metadata = routeMetadata\n\nconst adjustResponseSchema = z.object({\n  transactionId: z.string().uuid(),\n  balance: z.string(),\n  balanceStatus: z.enum(['ok', 'low', 'exhausted']),\n  deduplicated: z.boolean(),\n})\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: BillingAccountTransaction,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  list: {\n    schema: z.object({}).passthrough(),\n    entityId: billingEntityIds.transaction,\n    fields: ['id'],\n    buildFilters: async () => ({}),\n  },\n  actions: {\n    create: {\n      commandId: 'billing.transactions.adjust',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const scoped = withScopedPayload(raw ?? {}, ctx, translate)\n        return billingTransactionAdjustSchema.parse(scoped)\n      },\n      response: ({ result }) => ({\n        transactionId: result?.transactionId ?? null,\n        balance: result?.balance ?? null,\n        balanceStatus: result?.balanceStatus ?? null,\n        deduplicated: Boolean(result?.deduplicated),\n      }),\n      status: 201,\n    },\n  },\n})\n\nexport const POST = crud.POST\n\nexport const openApi = createBillingCrudOpenApi({\n  resourceName: 'BillingBalanceAdjustment',\n  pluralName: 'BillingBalanceAdjustments',\n  querySchema: z.object({}).passthrough(),\n  listResponseSchema: z.object({ items: z.array(z.unknown()) }),\n  create: {\n    schema: billingTransactionAdjustSchema,\n    responseSchema: adjustResponseSchema,\n    description:\n      'Manually credits (amount > 0) or debits (amount < 0) a prepaid ' +\n      \"account's balance. Audited with the operator's user id. Non-fiscal \u2014 \" +\n      'no receipt is issued. Returns the new balance + status.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,yBAAyB;AAClC,SAAS,2BAA2B;AACpC,SAAS,iCAAiC;AAC1C,SAAS,wBAAwB;AACjC,SAAS,sCAAsC;AAC/C,SAAS,gCAAgC;AAOzC,MAAM,gBAAgB;AAAA,EACpB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACzE;AAEO,MAAM,WAAW;AAExB,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,SAAS,EAAE,OAAO;AAAA,EAClB,eAAe,EAAE,KAAK,CAAC,MAAM,OAAO,WAAW,CAAC;AAAA,EAChD,cAAc,EAAE,QAAQ;AAC1B,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,IACjC,UAAU,iBAAiB;AAAA,IAC3B,QAAQ,CAAC,IAAI;AAAA,IACb,cAAc,aAAa,CAAC;AAAA,EAC9B;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,kBAAkB,OAAO,CAAC,GAAG,KAAK,SAAS;AAC1D,eAAO,+BAA+B,MAAM,MAAM;AAAA,MACpD;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO;AAAA,QACzB,eAAe,QAAQ,iBAAiB;AAAA,QACxC,SAAS,QAAQ,WAAW;AAAA,QAC5B,eAAe,QAAQ,iBAAiB;AAAA,QACxC,cAAc,QAAQ,QAAQ,YAAY;AAAA,MAC5C;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAEM,MAAM,OAAO,KAAK;AAElB,MAAM,UAAU,yBAAyB;AAAA,EAC9C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,EACtC,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC5D,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EAGJ;AACF,CAAC;",
+  "names": []
+}