@dainamite/billing 0.17.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dainamite Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,77 @@
+# @dainamite/billing
+
+Lightweight recurring-billing engine for Open Mercato applications.
+
+Collects items to charge (`one_time`, `recurring`, `usage`), runs a scheduled
+**Bill Run** that calculates totals and produces **draft invoices** in
+`@open-mercato/core/sales`, and waits for human approval before posting. It
+does **not** replace your accounting system — it prepares billing data and
+hands drafts to a human.
+
+## Status
+
+**Built — publishing soon.** Schema, ACL, tenant setup, the Bill Run engine,
+usage rating, the full admin UI, and the `@dainamite/cpq-billing-connector`
+companion are all in place. The package is not yet on npm; until it publishes
+it is available inside the `dainamite-core` monorepo.
+
+See [`specs/implementation/xd-249-billing-spec.md`](../../specs/implementation/xd-249-billing-spec.md)
+for the full implementation plan.
+
+## What's inside
+
+- **Billing Items** — the charge backlog (`one_time`, `recurring`, `usage`),
+  each scoped to a Billing Account with a bill start/end window.
+- **Bill Runs** — a background worker (`@open-mercato/queue`) that, on a
+  schedule or on demand, rates usage, sums the due items for the period, and
+  writes **draft invoices into `@open-mercato/core/sales`**. Runs are
+  idempotent and tenant-locked; stale runs are reaped by a worker.
+- **Draft invoice approval** — invoices land in `draft`; a human reviews and
+  **posts** them (a guarded ACL action) before they leave draft.
+- **Usage rating** — metered items are rated at run time from ingested usage.
+- **Admin UI** under `/backend/billing/*` — Accounts, Items, Bill Runs,
+  Invoices (list + detail pages).
+- **Commands** for every write (accounts / items / runs / invoices / usage),
+  validated with Zod.
+
+## Installation
+
+`@dainamite/billing` is an Open Mercato module. Install it and register it in
+your host app's `src/modules.ts`:
+
+```bash
+yarn mercato module add @dainamite/billing   # installs + registers (once published to npm)
+# …or: yarn add @dainamite/billing  then add { id: 'billing', from: '@dainamite/billing' }
+```
+
+```bash
+yarn generate
+yarn mercato db migrate
+```
+
+### Required Open Mercato modules
+
+`sales` (draft invoices are written there), `@open-mercato/queue` (Bill Run
+worker), and `@open-mercato/events` (lifecycle events consumed by the
+connector). Engines: **Node ≥ 24**.
+
+## CPQ integration
+
+To bill subscriptions sold through CPQ, add
+[`@dainamite/cpq-billing-connector`](../cpq-billing-connector) — it subscribes
+to CPQ subscription lifecycle events and creates/updates Billing Accounts and
+Items automatically. Register it **after** both `cpq` and `billing`.
+
+## Distribution rules (per SPEC-001)
+
+- **`peerDependencies`, never `dependencies`** for `@open-mercato/*` and
+  sibling `@dainamite/*` — one shared instance in `node_modules`.
+- **No ORM relations across packages** — cross-module references are FK
+  strings; draft invoices are created through the sales service / events, not
+  a direct relation.
+- **Ships its own migrations** under `src/modules/billing/migrations/`.
+- Ships `src/` (types) + `dist/` (runtime JS); no `.d.ts` emitted.
+
+## License
+
+MIT.

package/dist/modules/billing/acl.js

@@ -0,0 +1,20 @@
+const features = [
+  { id: "billing.account.manage", title: "Manage Billing Accounts", module: "billing" },
+  { id: "billing.account.view", title: "View Billing Accounts", module: "billing" },
+  { id: "billing.item.manage", title: "Manage Billing Items", module: "billing" },
+  { id: "billing.item.view", title: "View Billing Items", module: "billing" },
+  { id: "billing.usage.ingest", title: "Ingest Usage Records", module: "billing" },
+  { id: "billing.usage.view", title: "View Usage Records", module: "billing" },
+  { id: "billing.run.trigger", title: "Trigger Bill Run", module: "billing" },
+  { id: "billing.run.dry_run", title: "Trigger Bill Run (dry-run)", module: "billing" },
+  { id: "billing.run.view", title: "View Bill Run History", module: "billing" },
+  { id: "billing.invoice.post", title: "Post Draft Invoice", module: "billing" },
+  { id: "billing.invoice.edit_draft", title: "Edit Draft Invoice", module: "billing" },
+  { id: "billing.invoice.view", title: "View Billing Invoices", module: "billing" }
+];
+var acl_default = features;
+export {
+  acl_default as default,
+  features
+};
+//# sourceMappingURL=acl.js.map

package/dist/modules/billing/acl.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/billing/acl.ts"],
+  "sourcesContent": ["export const features = [\n  { id: 'billing.account.manage', title: 'Manage Billing Accounts', module: 'billing' },\n  { id: 'billing.account.view', title: 'View Billing Accounts', module: 'billing' },\n  { id: 'billing.item.manage', title: 'Manage Billing Items', module: 'billing' },\n  { id: 'billing.item.view', title: 'View Billing Items', module: 'billing' },\n  { id: 'billing.usage.ingest', title: 'Ingest Usage Records', module: 'billing' },\n  { id: 'billing.usage.view', title: 'View Usage Records', module: 'billing' },\n  { id: 'billing.run.trigger', title: 'Trigger Bill Run', module: 'billing' },\n  { id: 'billing.run.dry_run', title: 'Trigger Bill Run (dry-run)', module: 'billing' },\n  { id: 'billing.run.view', title: 'View Bill Run History', module: 'billing' },\n  { id: 'billing.invoice.post', title: 'Post Draft Invoice', module: 'billing' },\n  { id: 'billing.invoice.edit_draft', title: 'Edit Draft Invoice', module: 'billing' },\n  { id: 'billing.invoice.view', title: 'View Billing Invoices', module: 'billing' },\n] as const\n\nexport default features\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,0BAA0B,OAAO,2BAA2B,QAAQ,UAAU;AAAA,EACpF,EAAE,IAAI,wBAAwB,OAAO,yBAAyB,QAAQ,UAAU;AAAA,EAChF,EAAE,IAAI,uBAAuB,OAAO,wBAAwB,QAAQ,UAAU;AAAA,EAC9E,EAAE,IAAI,qBAAqB,OAAO,sBAAsB,QAAQ,UAAU;AAAA,EAC1E,EAAE,IAAI,wBAAwB,OAAO,wBAAwB,QAAQ,UAAU;AAAA,EAC/E,EAAE,IAAI,sBAAsB,OAAO,sBAAsB,QAAQ,UAAU;AAAA,EAC3E,EAAE,IAAI,uBAAuB,OAAO,oBAAoB,QAAQ,UAAU;AAAA,EAC1E,EAAE,IAAI,uBAAuB,OAAO,8BAA8B,QAAQ,UAAU;AAAA,EACpF,EAAE,IAAI,oBAAoB,OAAO,yBAAyB,QAAQ,UAAU;AAAA,EAC5E,EAAE,IAAI,wBAAwB,OAAO,sBAAsB,QAAQ,UAAU;AAAA,EAC7E,EAAE,IAAI,8BAA8B,OAAO,sBAAsB,QAAQ,UAAU;AAAA,EACnF,EAAE,IAAI,wBAAwB,OAAO,yBAAyB,QAAQ,UAAU;AAClF;AAEA,IAAO,cAAQ;",
+  "names": []
+}

package/dist/modules/billing/api/accounts/route.js

@@ -0,0 +1,182 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { withScopedPayload } from "@open-mercato/shared/lib/api/scoped";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { BillingAccount } from "../../data/entities.js";
+import { billingEntityIds } from "../../data/entityIds.js";
+import {
+  billingAccountCreateSchema,
+  billingAccountListQuerySchema,
+  billingAccountUpdateSchema
+} from "../../data/validators.js";
+import {
+  createBillingCrudOpenApi,
+  createPagedListResponseSchema,
+  defaultCreateResponseSchema,
+  defaultOkResponseSchema
+} from "../openapi.js";
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ["billing.account.view"] },
+  POST: { requireAuth: true, requireFeatures: ["billing.account.manage"] },
+  PUT: { requireAuth: true, requireFeatures: ["billing.account.manage"] },
+  DELETE: { requireAuth: true, requireFeatures: ["billing.account.manage"] }
+};
+const metadata = routeMetadata;
+const billingAccountListItemSchema = z.object({
+  id: z.string().uuid(),
+  customer_id: z.string(),
+  name: z.string(),
+  currency_code: z.string(),
+  bill_cycle: z.string(),
+  bill_cycle_anchor: z.string(),
+  invoice_email: z.string(),
+  invoice_language: z.string(),
+  tax_id: z.string().nullable(),
+  invoice_address: z.record(z.string(), z.unknown()),
+  next_bill_date: z.string(),
+  last_bill_date: z.string().nullable(),
+  is_active: z.boolean(),
+  organization_id: z.string().uuid(),
+  tenant_id: z.string().uuid(),
+  created_at: z.string(),
+  updated_at: z.string()
+});
+const rawBodySchema = z.object({}).passthrough();
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: BillingAccount,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId",
+    softDeleteField: "deletedAt"
+  },
+  list: {
+    schema: billingAccountListQuerySchema,
+    entityId: billingEntityIds.account,
+    fields: [
+      "id",
+      "customer_id",
+      "name",
+      "currency_code",
+      "bill_cycle",
+      "bill_cycle_anchor",
+      "invoice_email",
+      "invoice_language",
+      "tax_id",
+      "invoice_address",
+      "next_bill_date",
+      "last_bill_date",
+      "is_active",
+      "organization_id",
+      "tenant_id",
+      "created_at",
+      "updated_at"
+    ],
+    sortFieldMap: {
+      name: "name",
+      createdAt: "created_at",
+      updatedAt: "updated_at",
+      nextBillDate: "next_bill_date"
+    },
+    buildFilters: async (query) => {
+      const filters = {};
+      if (typeof query.id === "string" && query.id) {
+        filters.id = { $eq: query.id };
+      }
+      if (typeof query.customerId === "string" && query.customerId) {
+        filters.customer_id = { $eq: query.customerId };
+      }
+      if (typeof query.currencyCode === "string" && query.currencyCode) {
+        filters.currency_code = { $eq: query.currencyCode.toUpperCase() };
+      }
+      if (typeof query.billCycle === "string" && query.billCycle) {
+        filters.bill_cycle = { $eq: query.billCycle };
+      }
+      if (typeof query.isActive === "boolean") {
+        filters.is_active = { $eq: query.isActive };
+      }
+      if (typeof query.search === "string" && query.search.trim()) {
+        const pattern = `%${query.search.trim().replace(/[%_]/g, (m) => `\\${m}`)}%`;
+        filters.name = { $ilike: pattern };
+      }
+      return filters;
+    }
+  },
+  actions: {
+    create: {
+      commandId: "billing.accounts.create",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        const scoped = withScopedPayload(raw ?? {}, ctx, translate);
+        return billingAccountCreateSchema.parse(scoped);
+      },
+      response: ({ result }) => ({ id: result?.id ?? null }),
+      status: 201
+    },
+    update: {
+      commandId: "billing.accounts.update",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        const scoped = withScopedPayload(raw ?? {}, ctx, translate);
+        return billingAccountUpdateSchema.parse(scoped);
+      },
+      response: () => ({ ok: true })
+    },
+    delete: {
+      commandId: "billing.accounts.delete",
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        const envelope = raw ?? {};
+        const body = envelope.body ?? {};
+        const query = envelope.query ?? {};
+        const scoped = withScopedPayload(body, ctx, translate);
+        const id = typeof body.id === "string" && body.id || typeof query.id === "string" && query.id || null;
+        if (!id) {
+          throw new Error("id is required");
+        }
+        return {
+          id,
+          tenantId: scoped.tenantId,
+          organizationId: scoped.organizationId
+        };
+      },
+      response: () => ({ ok: true })
+    }
+  }
+});
+const { POST, PUT, DELETE } = crud;
+const GET = crud.GET;
+const openApi = createBillingCrudOpenApi({
+  resourceName: "BillingAccount",
+  pluralName: "BillingAccounts",
+  querySchema: billingAccountListQuerySchema,
+  listResponseSchema: createPagedListResponseSchema(billingAccountListItemSchema),
+  create: {
+    schema: billingAccountCreateSchema,
+    responseSchema: defaultCreateResponseSchema,
+    description: "Creates a new billing account for a customer."
+  },
+  update: {
+    schema: billingAccountUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description: "Updates a billing account. `currencyCode` and `customerId` are immutable."
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description: "Soft-deletes a billing account (sets `deleted_at`)."
+  }
+});
+export {
+  DELETE,
+  GET,
+  POST,
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/accounts/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/billing/api/accounts/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { BillingAccount } from '../../data/entities'\nimport { billingEntityIds } from '../../data/entityIds'\nimport {\n  billingAccountCreateSchema,\n  billingAccountListQuerySchema,\n  billingAccountUpdateSchema,\n} from '../../data/validators'\nimport {\n  createBillingCrudOpenApi,\n  createPagedListResponseSchema,\n  defaultCreateResponseSchema,\n  defaultOkResponseSchema,\n} from '../openapi'\n\n// \u2500\u2500\u2500 Auth / RBAC \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.account.view'] },\n  POST: { requireAuth: true, requireFeatures: ['billing.account.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['billing.account.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['billing.account.manage'] },\n}\n\nexport const metadata = routeMetadata\n\n// \u2500\u2500\u2500 List response item shape (informational \u2014 used by OpenAPI) \u2500\u2500\n\n// The list endpoint projects raw column names \u2014 snake_case.\nconst billingAccountListItemSchema = z.object({\n  id: z.string().uuid(),\n  customer_id: z.string(),\n  name: z.string(),\n  currency_code: z.string(),\n  bill_cycle: z.string(),\n  bill_cycle_anchor: z.string(),\n  invoice_email: z.string(),\n  invoice_language: z.string(),\n  tax_id: z.string().nullable(),\n  invoice_address: z.record(z.string(), z.unknown()),\n  next_bill_date: z.string(),\n  last_bill_date: z.string().nullable(),\n  is_active: z.boolean(),\n  organization_id: z.string().uuid(),\n  tenant_id: z.string().uuid(),\n  created_at: z.string(),\n  updated_at: z.string(),\n})\n\nconst rawBodySchema = z.object({}).passthrough()\n\n// \u2500\u2500\u2500 CRUD route \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: BillingAccount,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  list: {\n    schema: billingAccountListQuerySchema,\n    entityId: billingEntityIds.account,\n    fields: [\n      'id',\n      'customer_id',\n      'name',\n      'currency_code',\n      'bill_cycle',\n      'bill_cycle_anchor',\n      'invoice_email',\n      'invoice_language',\n      'tax_id',\n      'invoice_address',\n      'next_bill_date',\n      'last_bill_date',\n      'is_active',\n      'organization_id',\n      'tenant_id',\n      'created_at',\n      'updated_at',\n    ],\n    sortFieldMap: {\n      name: 'name',\n      createdAt: 'created_at',\n      updatedAt: 'updated_at',\n      nextBillDate: 'next_bill_date',\n    },\n    buildFilters: async (query) => {\n      const filters: Record<string, unknown> = {}\n      // `?id=<uuid>` narrows the list to one row \u2014 the detail page\n      // reads a single account through this filter.\n      if (typeof query.id === 'string' && query.id) {\n        filters.id = { $eq: query.id }\n      }\n      if (typeof query.customerId === 'string' && query.customerId) {\n        filters.customer_id = { $eq: query.customerId }\n      }\n      if (typeof query.currencyCode === 'string' && query.currencyCode) {\n        filters.currency_code = { $eq: query.currencyCode.toUpperCase() }\n      }\n      if (typeof query.billCycle === 'string' && query.billCycle) {\n        filters.bill_cycle = { $eq: query.billCycle }\n      }\n      if (typeof query.isActive === 'boolean') {\n        filters.is_active = { $eq: query.isActive }\n      }\n      if (typeof query.search === 'string' && query.search.trim()) {\n        const pattern = `%${query.search.trim().replace(/[%_]/g, (m) => `\\\\${m}`)}%`\n        filters.name = { $ilike: pattern }\n      }\n      return filters\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'billing.accounts.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const scoped = withScopedPayload(raw ?? {}, ctx, translate)\n        return billingAccountCreateSchema.parse(scoped)\n      },\n      response: ({ result }) => ({ id: result?.id ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'billing.accounts.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const scoped = withScopedPayload(raw ?? {}, ctx, translate)\n        return billingAccountUpdateSchema.parse(scoped)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'billing.accounts.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        // The factory hands delete a `{ body, query }` envelope \u2014 the\n        // id may arrive in either, depending on the caller.\n        const envelope = (raw ?? {}) as {\n          body?: Record<string, unknown>\n          query?: Record<string, unknown>\n        }\n        const body = envelope.body ?? {}\n        const query = envelope.query ?? {}\n        const scoped = withScopedPayload(body, ctx, translate)\n        const id =\n          (typeof body.id === 'string' && body.id) ||\n          (typeof query.id === 'string' && query.id) ||\n          null\n        if (!id) {\n          throw new Error('id is required')\n        }\n        return {\n          id,\n          tenantId: (scoped as { tenantId?: string }).tenantId,\n          organizationId: (scoped as { organizationId?: string }).organizationId,\n        }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nconst { POST, PUT, DELETE } = crud\nexport { POST, PUT, DELETE }\nexport const GET = crud.GET\n\nexport const openApi = createBillingCrudOpenApi({\n  resourceName: 'BillingAccount',\n  pluralName: 'BillingAccounts',\n  querySchema: billingAccountListQuerySchema,\n  listResponseSchema: createPagedListResponseSchema(billingAccountListItemSchema),\n  create: {\n    schema: billingAccountCreateSchema,\n    responseSchema: defaultCreateResponseSchema,\n    description: 'Creates a new billing account for a customer.',\n  },\n  update: {\n    schema: billingAccountUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a billing account. `currencyCode` and `customerId` are immutable.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes a billing account (sets `deleted_at`).',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,yBAAyB;AAClC,SAAS,2BAA2B;AACpC,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AAAA,EACpE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAAA,EACvE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAAA,EACtE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAC3E;AAEO,MAAM,WAAW;AAKxB,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO;AAAA,EACtB,MAAM,EAAE,OAAO;AAAA,EACf,eAAe,EAAE,OAAO;AAAA,EACxB,YAAY,EAAE,OAAO;AAAA,EACrB,mBAAmB,EAAE,OAAO;AAAA,EAC5B,eAAe,EAAE,OAAO;AAAA,EACxB,kBAAkB,EAAE,OAAO;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,iBAAiB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO;AAAA,EACzB,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,QAAQ;AAAA,EACrB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO;AACvB,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAI/C,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,iBAAiB;AAAA,IAC3B,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,WAAW;AAAA,MACX,WAAW;AAAA,MACX,cAAc;AAAA,IAChB;AAAA,IACA,cAAc,OAAO,UAAU;AAC7B,YAAM,UAAmC,CAAC;AAG1C,UAAI,OAAO,MAAM,OAAO,YAAY,MAAM,IAAI;AAC5C,gBAAQ,KAAK,EAAE,KAAK,MAAM,GAAG;AAAA,MAC/B;AACA,UAAI,OAAO,MAAM,eAAe,YAAY,MAAM,YAAY;AAC5D,gBAAQ,cAAc,EAAE,KAAK,MAAM,WAAW;AAAA,MAChD;AACA,UAAI,OAAO,MAAM,iBAAiB,YAAY,MAAM,cAAc;AAChE,gBAAQ,gBAAgB,EAAE,KAAK,MAAM,aAAa,YAAY,EAAE;AAAA,MAClE;AACA,UAAI,OAAO,MAAM,cAAc,YAAY,MAAM,WAAW;AAC1D,gBAAQ,aAAa,EAAE,KAAK,MAAM,UAAU;AAAA,MAC9C;AACA,UAAI,OAAO,MAAM,aAAa,WAAW;AACvC,gBAAQ,YAAY,EAAE,KAAK,MAAM,SAAS;AAAA,MAC5C;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,KAAK,GAAG;AAC3D,cAAM,UAAU,IAAI,MAAM,OAAO,KAAK,EAAE,QAAQ,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AACzE,gBAAQ,OAAO,EAAE,QAAQ,QAAQ;AAAA,MACnC;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,kBAAkB,OAAO,CAAC,GAAG,KAAK,SAAS;AAC1D,eAAO,2BAA2B,MAAM,MAAM;AAAA,MAChD;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,MAAM,KAAK;AAAA,MACpD,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,kBAAkB,OAAO,CAAC,GAAG,KAAK,SAAS;AAC1D,eAAO,2BAA2B,MAAM,MAAM;AAAA,MAChD;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAGhD,cAAM,WAAY,OAAO,CAAC;AAI1B,cAAM,OAAO,SAAS,QAAQ,CAAC;AAC/B,cAAM,QAAQ,SAAS,SAAS,CAAC;AACjC,cAAM,SAAS,kBAAkB,MAAM,KAAK,SAAS;AACrD,cAAM,KACH,OAAO,KAAK,OAAO,YAAY,KAAK,MACpC,OAAO,MAAM,OAAO,YAAY,MAAM,MACvC;AACF,YAAI,CAAC,IAAI;AACP,gBAAM,IAAI,MAAM,gBAAgB;AAAA,QAClC;AACA,eAAO;AAAA,UACL;AAAA,UACA,UAAW,OAAiC;AAAA,UAC5C,gBAAiB,OAAuC;AAAA,QAC1D;AAAA,MACF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,MAAM,EAAE,MAAM,KAAK,OAAO,IAAI;AAEvB,MAAM,MAAM,KAAK;AAEjB,MAAM,UAAU,yBAAyB;AAAA,EAC9C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,4BAA4B;AAAA,EAC9E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "names": []
+}

package/dist/modules/billing/api/export/account/[id]/route.js

@@ -0,0 +1,170 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import {
+  BillingAccount,
+  BillingAccountUsage,
+  BillingItem,
+  BillRunOutcome,
+  DraftInvoiceEdit
+} from "../../../../data/entities.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["billing.account.view"] }
+};
+async function GET(req, { params }) {
+  let container = null;
+  try {
+    container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const tenantId = auth.tenantId;
+    const organizationId = auth.orgId ?? null;
+    if (!organizationId) {
+      return NextResponse.json(
+        { error: "Organization scope required" },
+        { status: 403 }
+      );
+    }
+    const { id: accountId } = await params;
+    const em = container.resolve("em").fork();
+    const account = await em.findOne(BillingAccount, {
+      id: accountId,
+      tenantId,
+      organizationId,
+      deletedAt: null
+    });
+    if (!account) {
+      return NextResponse.json({ error: "Account not found" }, { status: 404 });
+    }
+    const url = new URL(req.url);
+    const since = parseDate(url.searchParams.get("since")) ?? defaultSince();
+    const until = parseDate(url.searchParams.get("until")) ?? /* @__PURE__ */ new Date();
+    const [items, usage, outcomes] = await Promise.all([
+      // Items are bounded by integration volume (typically <100 per
+      // account); no time-window needed — they often outlive a single
+      // export window and the operator needs to see active items
+      // regardless of when they were created.
+      em.find(
+        BillingItem,
+        { tenantId, organizationId, billAccountId: account.id },
+        { limit: EXPORT_HARD_LIMIT }
+      ),
+      em.find(
+        BillingAccountUsage,
+        {
+          tenantId,
+          organizationId,
+          billAccountId: account.id,
+          periodEnd: { $gte: since, $lte: until }
+        },
+        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: "DESC" } }
+      ),
+      em.find(
+        BillRunOutcome,
+        {
+          tenantId,
+          organizationId,
+          billAccountId: account.id,
+          createdAt: { $gte: since, $lte: until }
+        },
+        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: "DESC" } }
+      )
+    ]);
+    const invoiceRows = await em.execute(
+      `SELECT id, invoice_number, status, status_entry_id, issue_date, due_date,
+              currency_code, subtotal_net_amount, grand_total_net_amount,
+              grand_total_gross_amount, paid_total_amount, outstanding_amount,
+              metadata, created_at, updated_at, deleted_at
+       FROM sales_invoices
+       WHERE tenant_id = ?
+         AND organization_id = ?
+         AND deleted_at IS NULL
+         AND metadata->>'bill_account_id' = ?
+         AND created_at >= ?
+         AND created_at <= ?
+       ORDER BY created_at DESC
+       LIMIT ?`,
+      [tenantId, organizationId, account.id, since, until, EXPORT_HARD_LIMIT]
+    );
+    const invoiceIds = invoiceRows.map((r) => r.id);
+    const draftEdits = invoiceIds.length > 0 ? await em.find(
+      DraftInvoiceEdit,
+      {
+        tenantId,
+        organizationId,
+        invoiceId: { $in: invoiceIds }
+      },
+      { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: "DESC" } }
+    ) : [];
+    return NextResponse.json({
+      exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      schemaVersion: 1,
+      tenantId,
+      organizationId,
+      window: {
+        since: since.toISOString(),
+        until: until.toISOString(),
+        hardLimit: EXPORT_HARD_LIMIT
+      },
+      account,
+      items,
+      usage,
+      runOutcomes: outcomes,
+      invoices: invoiceRows,
+      draftInvoiceEdits: draftEdits
+    });
+  } catch (err) {
+    console.error("[billing/export/account.GET]", err);
+    return NextResponse.json({ error: "Internal error" }, { status: 500 });
+  }
+}
+const EXPORT_HARD_LIMIT = 5e4;
+function defaultSince() {
+  const d = /* @__PURE__ */ new Date();
+  d.setUTCFullYear(d.getUTCFullYear() - 1);
+  return d;
+}
+function parseDate(value) {
+  if (!value) return null;
+  const d = new Date(value);
+  return Number.isNaN(d.getTime()) ? null : d;
+}
+const openApi = {
+  methods: {
+    GET: {
+      tags: ["Billing"],
+      summary: "Export a billing account (GDPR portability)",
+      parameters: [
+        {
+          name: "id",
+          in: "path",
+          required: true,
+          schema: { type: "string", format: "uuid" }
+        },
+        {
+          name: "since",
+          in: "query",
+          required: false,
+          description: "ISO timestamp; lower bound for usage / outcomes / invoices windows. Defaults to today \u2212 12 months.",
+          schema: { type: "string", format: "date-time" }
+        },
+        {
+          name: "until",
+          in: "query",
+          required: false,
+          description: "ISO timestamp; upper bound. Defaults to now.",
+          schema: { type: "string", format: "date-time" }
+        }
+      ],
+      description: "Returns a JSON dump of a single Billing Account: the account itself, every Billing Item (no time cap \u2014 items often outlive a single export window), and the Usage records / BillRunOutcomes / emitted core/sales invoices / DraftInvoiceEdit rows whose timestamps fall in the [since, until] window (defaults to the last 12 months). Each collection is independently capped by EXPORT_HARD_LIMIT = 50,000 rows. Lifetime dumps for outlier accounts need a follow-up chunked background-job approach \u2014 out of scope for this v1 endpoint."
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/export/account/[id]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/billing/api/export/account/%5Bid%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  BillingAccount,\n  BillingAccountUsage,\n  BillingItem,\n  BillRunOutcome,\n  DraftInvoiceEdit,\n} from '../../../../data/entities'\n\n/**\n * `GET /api/billing/export/account/[id]` \u2014 GDPR portability dump.\n *\n * Returns a full JSON serialization of a single Billing Account\n * including:\n *   - The account row itself.\n *   - Every active + soft-deleted `BillingItem` for the account.\n *   - Every `BillingAccountUsage` record.\n *   - Every `BillRunOutcome` row referencing the account.\n *   - Every `core/sales` invoice the engine emitted for the account\n *     (matched via `metadata->>'bill_account_id'`).\n *   - Every `DraftInvoiceEdit` audit row for those invoices.\n *\n * Scope: the caller's auth tenant/organization is the authority \u2014 a\n * 404 is returned even for valid UUIDs that belong to a different\n * tenant (no cross-tenant leak).\n *\n * Soft-deleted rows are included on purpose: GDPR portability is\n * about the data we still hold, not just the data the UI shows.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.account.view'] },\n}\n\nexport async function GET(\n  req: Request,\n  { params }: { params: Promise<{ id: string }> },\n) {\n  let container: Awaited<ReturnType<typeof createRequestContainer>> | null = null\n  try {\n    container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const tenantId = auth.tenantId\n    const organizationId = (auth as { orgId?: string }).orgId ?? null\n    if (!organizationId) {\n      return NextResponse.json(\n        { error: 'Organization scope required' },\n        { status: 403 },\n      )\n    }\n\n    const { id: accountId } = await params\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const account = await em.findOne(BillingAccount, {\n      id: accountId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!account) {\n      return NextResponse.json({ error: 'Account not found' }, { status: 404 })\n    }\n\n    // Time-window cap for usage records, run outcomes and invoices.\n    //\n    // Scale note: a telco account can carry millions of usage rows.\n    // Returning everything would OOM on the export path. We default\n    // to the last 12 months and let the caller override via `since` /\n    // `until` for full GDPR-compliance dumps (a regulator request that\n    // legitimately needs the lifetime export should set `since=1970-01-01`).\n    // Each query is independently capped by `EXPORT_HARD_LIMIT` so a\n    // single year of pathological volume still returns rather than\n    // hanging.\n    const url = new URL(req.url)\n    const since = parseDate(url.searchParams.get('since'))\n      ?? defaultSince()\n    const until = parseDate(url.searchParams.get('until')) ?? new Date()\n\n    const [items, usage, outcomes] = await Promise.all([\n      // Items are bounded by integration volume (typically <100 per\n      // account); no time-window needed \u2014 they often outlive a single\n      // export window and the operator needs to see active items\n      // regardless of when they were created.\n      em.find(\n        BillingItem,\n        { tenantId, organizationId, billAccountId: account.id } as never,\n        { limit: EXPORT_HARD_LIMIT },\n      ),\n      em.find(\n        BillingAccountUsage,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          periodEnd: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: 'DESC' } },\n      ),\n      em.find(\n        BillRunOutcome,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n    ])\n\n    // Invoices created in the window. The `metadata->>'bill_account_id'`\n    // predicate keeps non-billing core/sales invoices out.\n    const invoiceRows = (await em.execute(\n      `SELECT id, invoice_number, status, status_entry_id, issue_date, due_date,\n              currency_code, subtotal_net_amount, grand_total_net_amount,\n              grand_total_gross_amount, paid_total_amount, outstanding_amount,\n              metadata, created_at, updated_at, deleted_at\n       FROM sales_invoices\n       WHERE tenant_id = ?\n         AND organization_id = ?\n         AND deleted_at IS NULL\n         AND metadata->>'bill_account_id' = ?\n         AND created_at >= ?\n         AND created_at <= ?\n       ORDER BY created_at DESC\n       LIMIT ?`,\n      [tenantId, organizationId, account.id, since, until, EXPORT_HARD_LIMIT],\n    )) as unknown as Array<{ id: string }>\n\n    const invoiceIds = invoiceRows.map((r) => r.id)\n    const draftEdits =\n      invoiceIds.length > 0\n        ? await em.find(\n            DraftInvoiceEdit,\n            {\n              tenantId,\n              organizationId,\n              invoiceId: { $in: invoiceIds },\n            } as never,\n            { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n          )\n        : []\n\n    return NextResponse.json({\n      exportedAt: new Date().toISOString(),\n      schemaVersion: 1,\n      tenantId,\n      organizationId,\n      window: {\n        since: since.toISOString(),\n        until: until.toISOString(),\n        hardLimit: EXPORT_HARD_LIMIT,\n      },\n      account,\n      items,\n      usage,\n      runOutcomes: outcomes,\n      invoices: invoiceRows,\n      draftInvoiceEdits: draftEdits,\n    })\n  } catch (err) {\n    console.error('[billing/export/account.GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\n/**\n * Per-collection cap to keep a single export bounded in size and time\n * even when the caller asks for `since=1970-01-01`. The full GDPR\n * lifetime dump for an outlier account requires a follow-up\n * background-job approach (chunked NDJSON to object storage) \u2014 out of\n * scope for the v1 admin export endpoint.\n */\nconst EXPORT_HARD_LIMIT = 50_000\n\n/**\n * Default time window for the export \u2014 last 12 months. Operators\n * pulling for routine GDPR requests almost always want a finite\n * window; the regulator-compliance \"lifetime\" case overrides via\n * `?since=1970-01-01`.\n */\nfunction defaultSince(): Date {\n  const d = new Date()\n  d.setUTCFullYear(d.getUTCFullYear() - 1)\n  return d\n}\n\nfunction parseDate(value: string | null | undefined): Date | null {\n  if (!value) return null\n  const d = new Date(value)\n  return Number.isNaN(d.getTime()) ? null : d\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Export a billing account (GDPR portability)',\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n        {\n          name: 'since',\n          in: 'query',\n          required: false,\n          description:\n            'ISO timestamp; lower bound for usage / outcomes / invoices windows. Defaults to today \u2212 12 months.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n        {\n          name: 'until',\n          in: 'query',\n          required: false,\n          description: 'ISO timestamp; upper bound. Defaults to now.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n      ],\n      description:\n        \"Returns a JSON dump of a single Billing Account: the account itself, every Billing Item (no time cap \u2014 items often outlive a single export window), and the Usage records / BillRunOutcomes / emitted core/sales invoices / DraftInvoiceEdit rows whose timestamps fall in the [since, until] window (defaults to the last 12 months). Each collection is independently capped by EXPORT_HARD_LIMIT = 50,000 rows. Lifetime dumps for outlier accounts need a follow-up chunked background-job approach \u2014 out of scope for this v1 endpoint.\",\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAuBA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IACpB,KACA,EAAE,OAAO,GACT;AACA,MAAI,YAAuE;AAC3E,MAAI;AACF,gBAAY,MAAM,uBAAuB;AACzC,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAkB,KAA4B,SAAS;AAC7D,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8BAA8B;AAAA,QACvC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,IAAI,UAAU,IAAI,MAAM;AAEhC,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,UAAU,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAYA,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAChD,aAAa;AAClB,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAAK,oBAAI,KAAK;AAEnE,UAAM,CAAC,OAAO,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjD,GAAG;AAAA,QACD;AAAA,QACA,EAAE,UAAU,gBAAgB,eAAe,QAAQ,GAAG;AAAA,QACtD,EAAE,OAAO,kBAAkB;AAAA,MAC7B;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,IACF,CAAC;AAID,UAAM,cAAe,MAAM,GAAG;AAAA,MAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA,CAAC,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,iBAAiB;AAAA,IACxE;AAEA,UAAM,aAAa,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE;AAC9C,UAAM,aACJ,WAAW,SAAS,IAChB,MAAM,GAAG;AAAA,MACP;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,WAAW,EAAE,KAAK,WAAW;AAAA,MAC/B;AAAA,MACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC7D,IACA,CAAC;AAEP,WAAO,aAAa,KAAK;AAAA,MACvB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,OAAO,MAAM,YAAY;AAAA,QACzB,OAAO,MAAM,YAAY;AAAA,QACzB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,UAAU;AAAA,MACV,mBAAmB;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,gCAAgC,GAAG;AACjD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AASA,MAAM,oBAAoB;AAQ1B,SAAS,eAAqB;AAC5B,QAAM,IAAI,oBAAI,KAAK;AACnB,IAAE,eAAe,EAAE,eAAe,IAAI,CAAC;AACvC,SAAO;AACT;AAEA,SAAS,UAAU,OAA+C;AAChE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,IAAI,KAAK,KAAK;AACxB,SAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,IAAI,OAAO;AAC5C;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aACE;AAAA,UACF,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,MACF;AAAA,MACA,aACE;AAAA,IACJ;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/invoices/[id]/route.js

@@ -0,0 +1,85 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["billing.invoice.view"] }
+};
+async function GET(req, { params }) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const organizationId = auth.orgId ?? null;
+    if (!organizationId) {
+      return NextResponse.json(
+        { error: "Organization scope required" },
+        { status: 403 }
+      );
+    }
+    const { id: invoiceId } = await params;
+    const em = container.resolve("em").fork();
+    const invoiceRows = await em.execute(
+      `SELECT id, invoice_number, status, status_entry_id, currency_code,
+              issue_date, due_date,
+              subtotal_net_amount, subtotal_gross_amount,
+              discount_total_amount, tax_total_amount,
+              grand_total_net_amount, grand_total_gross_amount,
+              paid_total_amount, outstanding_amount,
+              metadata, created_at, updated_at
+       FROM sales_invoices
+       WHERE id = ?
+         AND tenant_id = ?
+         AND organization_id = ?
+         AND deleted_at IS NULL
+         AND jsonb_exists(metadata, 'bill_run_id')`,
+      [invoiceId, auth.tenantId, organizationId]
+    );
+    if (!invoiceRows || invoiceRows.length === 0) {
+      return NextResponse.json({ error: "Invoice not found" }, { status: 404 });
+    }
+    const invoice = invoiceRows[0];
+    const lineRows = await em.execute(
+      `SELECT id, line_number, kind, description, quantity, currency_code,
+              unit_price_net, unit_price_gross, tax_rate, tax_amount,
+              total_net_amount, total_gross_amount, metadata
+       FROM sales_invoice_lines
+       WHERE invoice_id = ?
+         AND tenant_id = ?
+         AND organization_id = ?
+       ORDER BY line_number ASC`,
+      [invoiceId, auth.tenantId, organizationId]
+    );
+    return NextResponse.json({
+      invoice,
+      lines: lineRows
+    });
+  } catch (err) {
+    console.error("[billing/invoices/[id].GET]", err);
+    return NextResponse.json({ error: "Internal error" }, { status: 500 });
+  }
+}
+const openApi = {
+  methods: {
+    GET: {
+      tags: ["Billing"],
+      summary: "Get a billing-managed invoice (with lines)",
+      description: "Returns the `core/sales` invoice + every line, scoped to billing-managed invoices (`metadata.bill_run_id` set). Non-billing invoices return 404 even when the UUID resolves at `/api/sales/invoices/[id]`.",
+      parameters: [
+        {
+          name: "id",
+          in: "path",
+          required: true,
+          schema: { type: "string", format: "uuid" }
+        }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/invoices/[id]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/invoices/%5Bid%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\n\n/**\n * `GET /api/billing/invoices/[id]` \u2014 billing-invoice detail.\n *\n * Returns the `core/sales` invoice row + its lines, but only if the\n * invoice is billing-managed (carries `metadata.bill_run_id`). Other\n * `core/sales` invoices return 404 here even though the same UUID\n * resolves at `/api/sales/invoices/[id]` \u2014 this endpoint is the\n * billing operator's surface, scoped to the billing universe.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.invoice.view'] },\n}\n\ntype InvoiceRow = {\n  id: string\n  invoice_number: string\n  status: string | null\n  status_entry_id: string | null\n  currency_code: string\n  issue_date: string | null\n  due_date: string | null\n  subtotal_net_amount: string\n  subtotal_gross_amount: string\n  discount_total_amount: string\n  tax_total_amount: string\n  grand_total_net_amount: string\n  grand_total_gross_amount: string\n  paid_total_amount: string\n  outstanding_amount: string\n  metadata: Record<string, unknown> | null\n  created_at: string\n  updated_at: string\n}\n\ntype InvoiceLineRow = {\n  id: string\n  line_number: number\n  kind: string\n  description: string | null\n  quantity: string\n  currency_code: string\n  unit_price_net: string\n  unit_price_gross: string\n  tax_rate: string\n  tax_amount: string\n  total_net_amount: string\n  total_gross_amount: string\n  metadata: Record<string, unknown> | null\n}\n\nexport async function GET(\n  req: Request,\n  { params }: { params: Promise<{ id: string }> },\n) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const organizationId = (auth as { orgId?: string }).orgId ?? null\n    if (!organizationId) {\n      return NextResponse.json(\n        { error: 'Organization scope required' },\n        { status: 403 },\n      )\n    }\n\n    const { id: invoiceId } = await params\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const invoiceRows = (await em.execute(\n      `SELECT id, invoice_number, status, status_entry_id, currency_code,\n              issue_date, due_date,\n              subtotal_net_amount, subtotal_gross_amount,\n              discount_total_amount, tax_total_amount,\n              grand_total_net_amount, grand_total_gross_amount,\n              paid_total_amount, outstanding_amount,\n              metadata, created_at, updated_at\n       FROM sales_invoices\n       WHERE id = ?\n         AND tenant_id = ?\n         AND organization_id = ?\n         AND deleted_at IS NULL\n         AND jsonb_exists(metadata, 'bill_run_id')`,\n      [invoiceId, auth.tenantId, organizationId],\n    )) as unknown as InvoiceRow[]\n\n    if (!invoiceRows || invoiceRows.length === 0) {\n      return NextResponse.json({ error: 'Invoice not found' }, { status: 404 })\n    }\n\n    const invoice = invoiceRows[0]\n\n    const lineRows = (await em.execute(\n      `SELECT id, line_number, kind, description, quantity, currency_code,\n              unit_price_net, unit_price_gross, tax_rate, tax_amount,\n              total_net_amount, total_gross_amount, metadata\n       FROM sales_invoice_lines\n       WHERE invoice_id = ?\n         AND tenant_id = ?\n         AND organization_id = ?\n       ORDER BY line_number ASC`,\n      [invoiceId, auth.tenantId, organizationId],\n    )) as unknown as InvoiceLineRow[]\n\n    return NextResponse.json({\n      invoice,\n      lines: lineRows,\n    })\n  } catch (err) {\n    console.error('[billing/invoices/[id].GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Get a billing-managed invoice (with lines)',\n      description:\n        'Returns the `core/sales` invoice + every line, scoped to ' +\n        \"billing-managed invoices (`metadata.bill_run_id` set). Non-\" +\n        'billing invoices return 404 even when the UUID resolves at ' +\n        '`/api/sales/invoices/[id]`.',\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAY5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAuCA,eAAsB,IACpB,KACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,iBAAkB,KAA4B,SAAS;AAC7D,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8BAA8B;AAAA,QACvC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,IAAI,UAAU,IAAI,MAAM;AAChC,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,cAAe,MAAM,GAAG;AAAA,MAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA,CAAC,WAAW,KAAK,UAAU,cAAc;AAAA,IAC3C;AAEA,QAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAEA,UAAM,UAAU,YAAY,CAAC;AAE7B,UAAM,WAAY,MAAM,GAAG;AAAA,MACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA,CAAC,WAAW,KAAK,UAAU,cAAc;AAAA,IAC3C;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,+BAA+B,GAAG;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aACE;AAAA,MAIF,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}