@dainamite/billing 0.19.0 → 0.21.0

package/dist/modules/billing/api/export/account/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/billing/api/export/account/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  BillingAccount,\n  BillingAccountBalance,\n  BillingAccountTransaction,\n  BillingAccountUsage,\n  BillingItem,\n  BillingStatement,\n  BillingTopup,\n  BillRunOutcome,\n  DraftInvoiceEdit,\n} from '../../../../data/entities'\n\n/**\n * `GET /api/billing/export/account/[id]` \u2014 GDPR portability dump.\n *\n * Returns a full JSON serialization of a single Billing Account\n * including:\n *   - The account row itself.\n *   - Every active + soft-deleted `BillingItem` for the account.\n *   - Every `BillingAccountUsage` record.\n *   - Every `BillRunOutcome` row referencing the account.\n *   - Every `core/sales` invoice the engine emitted for the account\n *     (matched via `metadata->>'bill_account_id'`).\n *   - Every `DraftInvoiceEdit` audit row for those invoices.\n *\n * Scope: the caller's auth tenant/organization is the authority \u2014 a\n * 404 is returned even for valid UUIDs that belong to a different\n * tenant (no cross-tenant leak).\n *\n * Soft-deleted rows are included on purpose: GDPR portability is\n * about the data we still hold, not just the data the UI shows.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.account.view'] },\n}\n\nexport async function GET(\n  req: Request,\n  { params }: { params: Promise<{ id: string }> },\n) {\n  let container: Awaited<ReturnType<typeof createRequestContainer>> | null = null\n  try {\n    container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const tenantId = auth.tenantId\n    const organizationId = (auth as { orgId?: string }).orgId ?? null\n    if (!organizationId) {\n      return NextResponse.json(\n        { error: 'Organization scope required' },\n        { status: 403 },\n      )\n    }\n\n    const { id: accountId } = await params\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const account = await em.findOne(BillingAccount, {\n      id: accountId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!account) {\n      return NextResponse.json({ error: 'Account not found' }, { status: 404 })\n    }\n\n    // Time-window cap for usage records, run outcomes and invoices.\n    //\n    // Scale note: a telco account can carry millions of usage rows.\n    // Returning everything would OOM on the export path. We default\n    // to the last 12 months and let the caller override via `since` /\n    // `until` for full GDPR-compliance dumps (a regulator request that\n    // legitimately needs the lifetime export should set `since=1970-01-01`).\n    // Each query is independently capped by `EXPORT_HARD_LIMIT` so a\n    // single year of pathological volume still returns rather than\n    // hanging.\n    const url = new URL(req.url)\n    const since = parseDate(url.searchParams.get('since'))\n      ?? defaultSince()\n    const until = parseDate(url.searchParams.get('until')) ?? new Date()\n\n    const [items, usage, outcomes, balance, transactions, topups, statements] = await Promise.all([\n      // Items are bounded by integration volume (typically <100 per\n      // account); no time-window needed \u2014 they often outlive a single\n      // export window and the operator needs to see active items\n      // regardless of when they were created.\n      em.find(\n        BillingItem,\n        { tenantId, organizationId, billAccountId: account.id } as never,\n        { limit: EXPORT_HARD_LIMIT },\n      ),\n      em.find(\n        BillingAccountUsage,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          periodEnd: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: 'DESC' } },\n      ),\n      em.find(\n        BillRunOutcome,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n      // SPEC-002 prepaid data \u2014 the balance row + the windowed money trail.\n      em.findOne(BillingAccountBalance, {\n        tenantId,\n        billAccountId: account.id,\n      } as never),\n      em.find(\n        BillingAccountTransaction,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n      em.find(\n        BillingTopup,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n      em.find(\n        BillingStatement,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          periodEnd: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: 'DESC' } },\n      ),\n    ])\n\n    // Invoices created in the window. The `metadata->>'bill_account_id'`\n    // predicate keeps non-billing core/sales invoices out.\n    const invoiceRows = (await em.execute(\n      `SELECT id, invoice_number, status, status_entry_id, issue_date, due_date,\n              currency_code, subtotal_net_amount, grand_total_net_amount,\n              grand_total_gross_amount, paid_total_amount, outstanding_amount,\n              metadata, created_at, updated_at, deleted_at\n       FROM sales_invoices\n       WHERE tenant_id = ?\n         AND organization_id = ?\n         AND deleted_at IS NULL\n         AND metadata->>'bill_account_id' = ?\n         AND created_at >= ?\n         AND created_at <= ?\n       ORDER BY created_at DESC\n       LIMIT ?`,\n      [tenantId, organizationId, account.id, since, until, EXPORT_HARD_LIMIT],\n    )) as unknown as Array<{ id: string }>\n\n    const invoiceIds = invoiceRows.map((r) => r.id)\n    const draftEdits =\n      invoiceIds.length > 0\n        ? await em.find(\n            DraftInvoiceEdit,\n            {\n              tenantId,\n              organizationId,\n              invoiceId: { $in: invoiceIds },\n            } as never,\n            { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n          )\n        : []\n\n    return NextResponse.json({\n      exportedAt: new Date().toISOString(),\n      // v2 adds prepaid balance / transactions / top-ups / statements (SPEC-002).\n      schemaVersion: 2,\n      tenantId,\n      organizationId,\n      window: {\n        since: since.toISOString(),\n        until: until.toISOString(),\n        hardLimit: EXPORT_HARD_LIMIT,\n      },\n      account,\n      items,\n      usage,\n      runOutcomes: outcomes,\n      invoices: invoiceRows,\n      draftInvoiceEdits: draftEdits,\n      // SPEC-002 prepaid section.\n      balance,\n      transactions,\n      topups,\n      statements,\n    })\n  } catch (err) {\n    console.error('[billing/export/account.GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\n/**\n * Per-collection cap to keep a single export bounded in size and time\n * even when the caller asks for `since=1970-01-01`. The full GDPR\n * lifetime dump for an outlier account requires a follow-up\n * background-job approach (chunked NDJSON to object storage) \u2014 out of\n * scope for the v1 admin export endpoint.\n */\nconst EXPORT_HARD_LIMIT = 50_000\n\n/**\n * Default time window for the export \u2014 last 12 months. Operators\n * pulling for routine GDPR requests almost always want a finite\n * window; the regulator-compliance \"lifetime\" case overrides via\n * `?since=1970-01-01`.\n */\nfunction defaultSince(): Date {\n  const d = new Date()\n  d.setUTCFullYear(d.getUTCFullYear() - 1)\n  return d\n}\n\nfunction parseDate(value: string | null | undefined): Date | null {\n  if (!value) return null\n  const d = new Date(value)\n  return Number.isNaN(d.getTime()) ? null : d\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Export a billing account (GDPR portability)',\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n        {\n          name: 'since',\n          in: 'query',\n          required: false,\n          description:\n            'ISO timestamp; lower bound for usage / outcomes / invoices windows. Defaults to today \u2212 12 months.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n        {\n          name: 'until',\n          in: 'query',\n          required: false,\n          description: 'ISO timestamp; upper bound. Defaults to now.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n      ],\n      description:\n        \"Returns a JSON dump of a single Billing Account: the account itself, every Billing Item (no time cap \u2014 items often outlive a single export window), and the Usage records / BillRunOutcomes / emitted core/sales invoices / DraftInvoiceEdit rows whose timestamps fall in the [since, until] window (defaults to the last 12 months). Each collection is independently capped by EXPORT_HARD_LIMIT = 50,000 rows. Lifetime dumps for outlier accounts need a follow-up chunked background-job approach \u2014 out of scope for this v1 endpoint.\",\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAuBA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IACpB,KACA,EAAE,OAAO,GACT;AACA,MAAI,YAAuE;AAC3E,MAAI;AACF,gBAAY,MAAM,uBAAuB;AACzC,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAkB,KAA4B,SAAS;AAC7D,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8BAA8B;AAAA,QACvC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,IAAI,UAAU,IAAI,MAAM;AAEhC,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,UAAU,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAYA,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAChD,aAAa;AAClB,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAAK,oBAAI,KAAK;AAEnE,UAAM,CAAC,OAAO,OAAO,UAAU,SAAS,cAAc,QAAQ,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,MAK5F,GAAG;AAAA,QACD;AAAA,QACA,EAAE,UAAU,gBAAgB,eAAe,QAAQ,GAAG;AAAA,QACtD,EAAE,OAAO,kBAAkB;AAAA,MAC7B;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA;AAAA,MAEA,GAAG,QAAQ,uBAAuB;AAAA,QAChC;AAAA,QACA,eAAe,QAAQ;AAAA,MACzB,CAAU;AAAA,MACV,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,IACF,CAAC;AAID,UAAM,cAAe,MAAM,GAAG;AAAA,MAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA,CAAC,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,iBAAiB;AAAA,IACxE;AAEA,UAAM,aAAa,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE;AAC9C,UAAM,aACJ,WAAW,SAAS,IAChB,MAAM,GAAG;AAAA,MACP;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,WAAW,EAAE,KAAK,WAAW;AAAA,MAC/B;AAAA,MACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC7D,IACA,CAAC;AAEP,WAAO,aAAa,KAAK;AAAA,MACvB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA;AAAA,MAEnC,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,OAAO,MAAM,YAAY;AAAA,QACzB,OAAO,MAAM,YAAY;AAAA,QACzB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,UAAU;AAAA,MACV,mBAAmB;AAAA;AAAA,MAEnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,gCAAgC,GAAG;AACjD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AASA,MAAM,oBAAoB;AAQ1B,SAAS,eAAqB;AAC5B,QAAM,IAAI,oBAAI,KAAK;AACnB,IAAE,eAAe,EAAE,eAAe,IAAI,CAAC;AACvC,SAAO;AACT;AAEA,SAAS,UAAU,OAA+C;AAChE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,IAAI,KAAK,KAAK;AACxB,SAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,IAAI,OAAO;AAC5C;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aACE;AAAA,UACF,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,MACF;AAAA,MACA,aACE;AAAA,IACJ;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  BillingAccount,\n  BillingAccountBalance,\n  BillingAccountTransaction,\n  BillingAccountUsage,\n  BillingItem,\n  BillingStatement,\n  BillingTopup,\n  BillingRunOutcome,\n  BillingDraftInvoiceEdit,\n} from '../../../../data/entities'\n\n/**\n * `GET /api/billing/export/account/[id]` \u2014 GDPR portability dump.\n *\n * Returns a full JSON serialization of a single Billing Account\n * including:\n *   - The account row itself.\n *   - Every active + soft-deleted `BillingItem` for the account.\n *   - Every `BillingAccountUsage` record.\n *   - Every `BillingRunOutcome` row referencing the account.\n *   - Every billing document (`billing_invoices`) of the account.\n *   - Every `BillingDraftInvoiceEdit` audit row for those invoices.\n *\n * Scope: the caller's auth tenant/organization is the authority \u2014 a\n * 404 is returned even for valid UUIDs that belong to a different\n * tenant (no cross-tenant leak).\n *\n * Soft-deleted rows are included on purpose: GDPR portability is\n * about the data we still hold, not just the data the UI shows.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.account.view'] },\n}\n\nexport async function GET(\n  req: Request,\n  { params }: { params: Promise<{ id: string }> },\n) {\n  let container: Awaited<ReturnType<typeof createRequestContainer>> | null = null\n  try {\n    container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const tenantId = auth.tenantId\n    const organizationId = (auth as { orgId?: string }).orgId ?? null\n    if (!organizationId) {\n      return NextResponse.json(\n        { error: 'Organization scope required' },\n        { status: 403 },\n      )\n    }\n\n    const { id: accountId } = await params\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const account = await em.findOne(BillingAccount, {\n      id: accountId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!account) {\n      return NextResponse.json({ error: 'Account not found' }, { status: 404 })\n    }\n\n    // Time-window cap for usage records, run outcomes and invoices.\n    //\n    // Scale note: a telco account can carry millions of usage rows.\n    // Returning everything would OOM on the export path. We default\n    // to the last 12 months and let the caller override via `since` /\n    // `until` for full GDPR-compliance dumps (a regulator request that\n    // legitimately needs the lifetime export should set `since=1970-01-01`).\n    // Each query is independently capped by `EXPORT_HARD_LIMIT` so a\n    // single year of pathological volume still returns rather than\n    // hanging.\n    const url = new URL(req.url)\n    const since = parseDate(url.searchParams.get('since'))\n      ?? defaultSince()\n    const until = parseDate(url.searchParams.get('until')) ?? new Date()\n\n    const [items, usage, outcomes, balance, transactions, topups, statements] = await Promise.all([\n      // Items are bounded by integration volume (typically <100 per\n      // account); no time-window needed \u2014 they often outlive a single\n      // export window and the operator needs to see active items\n      // regardless of when they were created.\n      em.find(\n        BillingItem,\n        { tenantId, organizationId, billAccountId: account.id } as never,\n        { limit: EXPORT_HARD_LIMIT },\n      ),\n      em.find(\n        BillingAccountUsage,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          periodEnd: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: 'DESC' } },\n      ),\n      em.find(\n        BillingRunOutcome,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n      // SPEC-002 prepaid data \u2014 the balance row + the windowed money trail.\n      em.findOne(BillingAccountBalance, {\n        tenantId,\n        billAccountId: account.id,\n      } as never),\n      em.find(\n        BillingAccountTransaction,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n      em.find(\n        BillingTopup,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          createdAt: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n      ),\n      em.find(\n        BillingStatement,\n        {\n          tenantId,\n          organizationId,\n          billAccountId: account.id,\n          periodEnd: { $gte: since, $lte: until },\n        } as never,\n        { limit: EXPORT_HARD_LIMIT, orderBy: { periodEnd: 'DESC' } },\n      ),\n    ])\n\n    // Billing documents created in the window (Spec 0: billing_invoices).\n    const invoiceRows = (await em.execute(\n      `SELECT id, number, document_type, series, status, test_run, bill_run_id, bill_date,\n              period_start, period_end, issue_date, due_date, posted_at, currency_code,\n              subtotal_net, tax_total, total_gross, paid_total, credited_total, outstanding,\n              corrects_invoice_id, correction_reason, topup_id, buyer_snapshot, seller_snapshot,\n              metadata, created_at, updated_at\n       FROM billing_invoices\n       WHERE tenant_id = ?\n         AND organization_id = ?\n         AND deleted_at IS NULL\n         AND bill_account_id = ?\n         AND created_at >= ?\n         AND created_at <= ?\n       ORDER BY created_at DESC\n       LIMIT ?`,\n      [tenantId, organizationId, account.id, since, until, EXPORT_HARD_LIMIT],\n    )) as unknown as Array<{ id: string }>\n\n    const invoiceIds = invoiceRows.map((r) => r.id)\n    const draftEdits =\n      invoiceIds.length > 0\n        ? await em.find(\n            BillingDraftInvoiceEdit,\n            {\n              tenantId,\n              organizationId,\n              invoiceId: { $in: invoiceIds },\n            } as never,\n            { limit: EXPORT_HARD_LIMIT, orderBy: { createdAt: 'DESC' } },\n          )\n        : []\n\n    return NextResponse.json({\n      exportedAt: new Date().toISOString(),\n      // v2 adds prepaid balance / transactions / top-ups / statements (SPEC-002).\n      // v3 (Spec 0): invoices come from billing_invoices with billing field names.\n      // v4 (Spec B): items carry taxRate; the account carries paymentTermsDays /\n      // autoSendInvoice; invoice metadata may carry draft_number / deliveries.\n      schemaVersion: 4,\n      tenantId,\n      organizationId,\n      window: {\n        since: since.toISOString(),\n        until: until.toISOString(),\n        hardLimit: EXPORT_HARD_LIMIT,\n      },\n      account,\n      items,\n      usage,\n      runOutcomes: outcomes,\n      invoices: invoiceRows,\n      draftInvoiceEdits: draftEdits,\n      // SPEC-002 prepaid section.\n      balance,\n      transactions,\n      topups,\n      statements,\n    })\n  } catch (err) {\n    console.error('[billing/export/account.GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\n/**\n * Per-collection cap to keep a single export bounded in size and time\n * even when the caller asks for `since=1970-01-01`. The full GDPR\n * lifetime dump for an outlier account requires a follow-up\n * background-job approach (chunked NDJSON to object storage) \u2014 out of\n * scope for the v1 admin export endpoint.\n */\nconst EXPORT_HARD_LIMIT = 50_000\n\n/**\n * Default time window for the export \u2014 last 12 months. Operators\n * pulling for routine GDPR requests almost always want a finite\n * window; the regulator-compliance \"lifetime\" case overrides via\n * `?since=1970-01-01`.\n */\nfunction defaultSince(): Date {\n  const d = new Date()\n  d.setUTCFullYear(d.getUTCFullYear() - 1)\n  return d\n}\n\nfunction parseDate(value: string | null | undefined): Date | null {\n  if (!value) return null\n  const d = new Date(value)\n  return Number.isNaN(d.getTime()) ? null : d\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Export a billing account (GDPR portability)',\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n        {\n          name: 'since',\n          in: 'query',\n          required: false,\n          description:\n            'ISO timestamp; lower bound for usage / outcomes / invoices windows. Defaults to today \u2212 12 months.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n        {\n          name: 'until',\n          in: 'query',\n          required: false,\n          description: 'ISO timestamp; upper bound. Defaults to now.',\n          schema: { type: 'string', format: 'date-time' },\n        },\n      ],\n      description:\n        \"Returns a JSON dump of a single Billing Account: the account itself, every Billing Item (no time cap \u2014 items often outlive a single export window), and the Usage records / BillRunOutcomes / emitted core/sales invoices / BillingDraftInvoiceEdit rows whose timestamps fall in the [since, until] window (defaults to the last 12 months). Each collection is independently capped by EXPORT_HARD_LIMIT = 50,000 rows. Lifetime dumps for outlier accounts need a follow-up chunked background-job approach \u2014 out of scope for this v1 endpoint.\",\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAsBA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IACpB,KACA,EAAE,OAAO,GACT;AACA,MAAI,YAAuE;AAC3E,MAAI;AACF,gBAAY,MAAM,uBAAuB;AACzC,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAkB,KAA4B,SAAS;AAC7D,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8BAA8B;AAAA,QACvC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,IAAI,UAAU,IAAI,MAAM;AAEhC,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,UAAU,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAYA,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAChD,aAAa;AAClB,UAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC,KAAK,oBAAI,KAAK;AAEnE,UAAM,CAAC,OAAO,OAAO,UAAU,SAAS,cAAc,QAAQ,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,MAK5F,GAAG;AAAA,QACD;AAAA,QACA,EAAE,UAAU,gBAAgB,eAAe,QAAQ,GAAG;AAAA,QACtD,EAAE,OAAO,kBAAkB;AAAA,MAC7B;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA;AAAA,MAEA,GAAG,QAAQ,uBAAuB;AAAA,QAChC;AAAA,QACA,eAAe,QAAQ;AAAA,MACzB,CAAU;AAAA,MACV,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,MACA,GAAG;AAAA,QACD;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,QAAQ;AAAA,UACvB,WAAW,EAAE,MAAM,OAAO,MAAM,MAAM;AAAA,QACxC;AAAA,QACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7D;AAAA,IACF,CAAC;AAGD,UAAM,cAAe,MAAM,GAAG;AAAA,MAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAcA,CAAC,UAAU,gBAAgB,QAAQ,IAAI,OAAO,OAAO,iBAAiB;AAAA,IACxE;AAEA,UAAM,aAAa,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE;AAC9C,UAAM,aACJ,WAAW,SAAS,IAChB,MAAM,GAAG;AAAA,MACP;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,WAAW,EAAE,KAAK,WAAW;AAAA,MAC/B;AAAA,MACA,EAAE,OAAO,mBAAmB,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC7D,IACA,CAAC;AAEP,WAAO,aAAa,KAAK;AAAA,MACvB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,MAKnC,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,OAAO,MAAM,YAAY;AAAA,QACzB,OAAO,MAAM,YAAY;AAAA,QACzB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,UAAU;AAAA,MACV,mBAAmB;AAAA;AAAA,MAEnB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,gCAAgC,GAAG;AACjD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AASA,MAAM,oBAAoB;AAQ1B,SAAS,eAAqB;AAC5B,QAAM,IAAI,oBAAI,KAAK;AACnB,IAAE,eAAe,EAAE,eAAe,IAAI,CAAC;AACvC,SAAO;AACT;AAEA,SAAS,UAAU,OAA+C;AAChE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,IAAI,KAAK,KAAK;AACxB,SAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,IAAI,OAAO;AAC5C;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aACE;AAAA,UACF,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,QAChD;AAAA,MACF;AAAA,MACA,aACE;AAAA,IACJ;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/billing/api/invoices/[id]/memos/route.js

@@ -0,0 +1,54 @@
+import { z } from "zod";
+import { readRequestBody, runCommandRoute } from "../../../../lib/commandRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.invoice.correct"] }
+};
+const lineSchema = z.object({
+  correctsLineId: z.string().uuid().optional(),
+  description: z.string().trim().min(1).max(500),
+  quantity: z.coerce.number().positive(),
+  unitPriceNet: z.coerce.number().nonnegative(),
+  taxRate: z.coerce.number().min(0).max(100).optional()
+});
+const bodySchema = z.object({
+  invoiceId: z.string().uuid(),
+  type: z.enum(["credit_memo", "debit_memo"]),
+  reason: z.string().trim().min(1).max(1e3),
+  lines: z.array(lineSchema).max(200).optional()
+});
+async function POST(req, { params }) {
+  const { id } = await params;
+  const raw = await readRequestBody(req);
+  return runCommandRoute(
+    req,
+    {
+      commandId: "billing.invoices.create_memo",
+      bodySchema,
+      resourceKind: "billing.invoice",
+      resourceId: (body) => body.invoiceId,
+      logLabel: "billing/invoices/[id]/memos.POST"
+    },
+    { ...raw && typeof raw === "object" ? raw : {}, invoiceId: id }
+  );
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Create a credit or debit memo",
+      description: "Creates a draft memo for a posted / partially paid / paid invoice (a fully credited invoice accepts debit memos only). `reason` is required and printed. Credit memo without `lines` = full credit of every original line; lines with `correctsLineId` keep the original VAT rate; new lines default to the organization rate. Amounts are positive \u2014 the document type gives the sign.",
+      requestBody: { schema: bodySchema.omit({ invoiceId: true }) },
+      responses: [{ status: 200, description: "`{ memoId, number, documentType, totalGross }`" }],
+      errors: [
+        { status: 409, description: "`billing.memo.invalid_original` / `billing.memo.exceeds_invoice`" },
+        { status: 400, description: "`billing.memo.invalid_line`" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/invoices/[id]/memos/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/billing/api/invoices/%5Bid%5D/memos/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { readRequestBody, runCommandRoute } from '../../../../lib/commandRoute'\n\n/**\n * `POST /api/billing/invoices/[id]/memos` \u2014 create a DRAFT credit or debit\n * memo correcting a posted billing invoice (Spec D). Post it with\n * `POST /api/billing/invoices/post`.\n */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.invoice.correct'] },\n}\n\nconst lineSchema = z.object({\n  correctsLineId: z.string().uuid().optional(),\n  description: z.string().trim().min(1).max(500),\n  quantity: z.coerce.number().positive(),\n  unitPriceNet: z.coerce.number().nonnegative(),\n  taxRate: z.coerce.number().min(0).max(100).optional(),\n})\n\nconst bodySchema = z.object({\n  invoiceId: z.string().uuid(),\n  type: z.enum(['credit_memo', 'debit_memo']),\n  reason: z.string().trim().min(1).max(1000),\n  lines: z.array(lineSchema).max(200).optional(),\n})\n\nexport async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {\n  const { id } = await params\n  const raw = (await readRequestBody(req)) as Record<string, unknown>\n  return runCommandRoute(\n    req,\n    {\n      commandId: 'billing.invoices.create_memo',\n      bodySchema,\n      resourceKind: 'billing.invoice',\n      resourceId: (body) => body.invoiceId,\n      logLabel: 'billing/invoices/[id]/memos.POST',\n    },\n    { ...(raw && typeof raw === 'object' ? raw : {}), invoiceId: id },\n  )\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Create a credit or debit memo',\n      description:\n        'Creates a draft memo for a posted / partially paid / paid invoice (a fully credited invoice ' +\n        'accepts debit memos only). `reason` is required and printed. Credit memo without `lines` = full ' +\n        'credit of every original line; lines with `correctsLineId` keep the original VAT rate; new lines ' +\n        'default to the organization rate. Amounts are positive \u2014 the document type gives the sign.',\n      requestBody: { schema: bodySchema.omit({ invoiceId: true }) },\n      responses: [{ status: 200, description: '`{ memoId, number, documentType, totalGross }`' }],\n      errors: [\n        { status: 409, description: '`billing.memo.invalid_original` / `billing.memo.exceeds_invoice`' },\n        { status: 400, description: '`billing.memo.invalid_line`' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,iBAAiB,uBAAuB;AAQ1C,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC1E;AAEA,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,UAAU,EAAE,OAAO,OAAO,EAAE,SAAS;AAAA,EACrC,cAAc,EAAE,OAAO,OAAO,EAAE,YAAY;AAAA,EAC5C,SAAS,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACtD,CAAC;AAED,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,MAAM,EAAE,KAAK,CAAC,eAAe,YAAY,CAAC;AAAA,EAC1C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,EACzC,OAAO,EAAE,MAAM,UAAU,EAAE,IAAI,GAAG,EAAE,SAAS;AAC/C,CAAC;AAED,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAwC;AACxF,QAAM,EAAE,GAAG,IAAI,MAAM;AACrB,QAAM,MAAO,MAAM,gBAAgB,GAAG;AACtC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,WAAW;AAAA,MACX;AAAA,MACA,cAAc;AAAA,MACd,YAAY,CAAC,SAAS,KAAK;AAAA,MAC3B,UAAU;AAAA,IACZ;AAAA,IACA,EAAE,GAAI,OAAO,OAAO,QAAQ,WAAW,MAAM,CAAC,GAAI,WAAW,GAAG;AAAA,EAClE;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aACE;AAAA,MAIF,aAAa,EAAE,QAAQ,WAAW,KAAK,EAAE,WAAW,KAAK,CAAC,EAAE;AAAA,MAC5D,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iDAAiD,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mEAAmE;AAAA,QAC/F,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/invoices/[id]/pdf/route.js

@@ -0,0 +1,69 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { BillingInvoice } from "../../../../data/entities.js";
+import { getInvoicePdf } from "../../../../lib/pdf/invoicePdf.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["billing.invoice.view"] }
+};
+async function GET(req, { params }) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const organizationId = auth.orgId ?? null;
+    if (!organizationId) {
+      return NextResponse.json({ error: "Organization scope required" }, { status: 403 });
+    }
+    const { id } = await params;
+    const em = container.resolve("em").fork();
+    const invoice = await em.findOne(BillingInvoice, {
+      id,
+      tenantId: auth.tenantId,
+      organizationId,
+      deletedAt: null
+    });
+    if (!invoice) {
+      return NextResponse.json({ error: "Invoice not found" }, { status: 404 });
+    }
+    const pdf = await getInvoicePdf(em, invoice);
+    const download = new URL(req.url).searchParams.get("download") === "1";
+    return new NextResponse(Buffer.from(pdf.bytes), {
+      status: 200,
+      headers: {
+        "Content-Type": "application/pdf",
+        "Content-Length": String(pdf.bytes.byteLength),
+        "Content-Disposition": `${download ? "attachment" : "inline"}; filename="${pdf.fileName}"`,
+        // Drafts change with every edit; frozen documents never do.
+        "Cache-Control": pdf.frozen ? "private, max-age=300" : "no-store",
+        "X-Content-Type-Options": "nosniff"
+      }
+    });
+  } catch (err) {
+    console.error("[billing/invoices/[id]/pdf.GET]", err);
+    return NextResponse.json({ error: "Internal error" }, { status: 500 });
+  }
+}
+const openApi = {
+  methods: {
+    GET: {
+      tags: ["Billing"],
+      summary: "Download a billing document PDF",
+      parameters: [
+        { name: "id", in: "path", required: true, schema: { type: "string", format: "uuid" } },
+        { name: "download", in: "query", required: false, schema: { type: "string", enum: ["1"] } }
+      ],
+      description: "`application/pdf`. Posted documents return the PDF frozen at post (an attachment); drafts and test documents are rendered live with a DRAFT / TEST watermark and never stored. Labels follow the account invoice language (en / pl).",
+      responses: [{ status: 200, description: "PDF document (`application/pdf`)" }],
+      errors: [{ status: 404, description: "Invoice not found in this organization" }]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/invoices/[id]/pdf/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/billing/api/invoices/%5Bid%5D/pdf/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { BillingInvoice } from '../../../../data/entities'\nimport { getInvoicePdf } from '../../../../lib/pdf/invoicePdf'\n\n/**\n * `GET /api/billing/invoices/[id]/pdf` \u2014 the document PDF (Spec B).\n *\n * Posted documents: the frozen attachment (rendered and frozen on first\n * request if freezing failed at post). Drafts / test documents: a live\n * render with a DRAFT / TEST watermark, never stored. `?download=1` forces\n * an attachment disposition; otherwise the browser shows it inline.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.invoice.view'] },\n}\n\nexport async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const organizationId = (auth as { orgId?: string }).orgId ?? null\n    if (!organizationId) {\n      return NextResponse.json({ error: 'Organization scope required' }, { status: 403 })\n    }\n    const { id } = await params\n    const em = (container.resolve('em') as EntityManager).fork()\n    const invoice = await em.findOne(BillingInvoice, {\n      id,\n      tenantId: auth.tenantId,\n      organizationId,\n      deletedAt: null,\n    } as never)\n    if (!invoice) {\n      return NextResponse.json({ error: 'Invoice not found' }, { status: 404 })\n    }\n    const pdf = await getInvoicePdf(em, invoice)\n    const download = new URL(req.url).searchParams.get('download') === '1'\n    return new NextResponse(Buffer.from(pdf.bytes), {\n      status: 200,\n      headers: {\n        'Content-Type': 'application/pdf',\n        'Content-Length': String(pdf.bytes.byteLength),\n        'Content-Disposition': `${download ? 'attachment' : 'inline'}; filename=\"${pdf.fileName}\"`,\n        // Drafts change with every edit; frozen documents never do.\n        'Cache-Control': pdf.frozen ? 'private, max-age=300' : 'no-store',\n        'X-Content-Type-Options': 'nosniff',\n      },\n    })\n  } catch (err) {\n    console.error('[billing/invoices/[id]/pdf.GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Download a billing document PDF',\n      parameters: [\n        { name: 'id', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } },\n        { name: 'download', in: 'query', required: false, schema: { type: 'string', enum: ['1'] } },\n      ],\n      description:\n        '`application/pdf`. Posted documents return the PDF frozen at post (an attachment); drafts ' +\n        'and test documents are rendered live with a DRAFT / TEST watermark and never stored. ' +\n        'Labels follow the account invoice language (en / pl).',\n      responses: [{ status: 200, description: 'PDF document (`application/pdf`)' }],\n      errors: [{ status: 404, description: 'Invoice not found in this organization' }],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAC/B,SAAS,qBAAqB;AAWvB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAAwC;AACvF,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,iBAAkB,KAA4B,SAAS;AAC7D,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpF;AACA,UAAM,EAAE,GAAG,IAAI,MAAM;AACrB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,UAAU,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAC/C;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA,WAAW;AAAA,IACb,CAAU;AACV,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AACA,UAAM,MAAM,MAAM,cAAc,IAAI,OAAO;AAC3C,UAAM,WAAW,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,IAAI,UAAU,MAAM;AACnE,WAAO,IAAI,aAAa,OAAO,KAAK,IAAI,KAAK,GAAG;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,kBAAkB,OAAO,IAAI,MAAM,UAAU;AAAA,QAC7C,uBAAuB,GAAG,WAAW,eAAe,QAAQ,eAAe,IAAI,QAAQ;AAAA;AAAA,QAEvF,iBAAiB,IAAI,SAAS,yBAAyB;AAAA,QACvD,0BAA0B;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,mCAAmC,GAAG;AACpD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,YAAY;AAAA,QACV,EAAE,MAAM,MAAM,IAAI,QAAQ,UAAU,MAAM,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO,EAAE;AAAA,QACrF,EAAE,MAAM,YAAY,IAAI,SAAS,UAAU,OAAO,QAAQ,EAAE,MAAM,UAAU,MAAM,CAAC,GAAG,EAAE,EAAE;AAAA,MAC5F;AAAA,MACA,aACE;AAAA,MAGF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mCAAmC,CAAC;AAAA,MAC5E,QAAQ,CAAC,EAAE,QAAQ,KAAK,aAAa,yCAAyC,CAAC;AAAA,IACjF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/invoices/[id]/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { daysOverdueSql, isoDay } from "../../../lib/overdue.js";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["billing.invoice.view"] }
 };
@@ -20,40 +21,59 @@ async function GET(req, { params }) {
     }
     const { id: invoiceId } = await params;
     const em = container.resolve("em").fork();
+    const today = isoDay(/* @__PURE__ */ new Date());
     const invoiceRows = await em.execute(
-      `SELECT id, invoice_number, status, status_entry_id, currency_code,
-              issue_date, due_date,
-              subtotal_net_amount, subtotal_gross_amount,
-              discount_total_amount, tax_total_amount,
-              grand_total_net_amount, grand_total_gross_amount,
-              paid_total_amount, outstanding_amount,
-              metadata, created_at, updated_at
-       FROM sales_invoices
-       WHERE id = ?
-         AND tenant_id = ?
-         AND organization_id = ?
-         AND deleted_at IS NULL
-         AND jsonb_exists(metadata, 'bill_run_id')`,
-      [invoiceId, auth.tenantId, organizationId]
+      `SELECT i.id, i.number, i.document_type, i.series, i.status, i.test_run, i.bill_account_id,
+              a.name AS bill_account_name, i.bill_run_id, i.bill_date, i.period_start, i.period_end,
+              i.issue_date, i.due_date, i.posted_at, i.currency_code, i.subtotal_net, i.tax_total,
+              i.total_gross, i.paid_total, i.credited_total, i.outstanding, i.corrects_invoice_id,
+              i.correction_reason, i.corrects_invoice_number, i.corrects_issue_date,
+              i.buyer_snapshot, i.seller_snapshot, i.topup_id, i.metadata,
+              i.pdf_attachment_id, ${daysOverdueSql("i")}::int AS days_overdue,
+              i.created_at, i.updated_at
+       FROM billing_invoices i
+       LEFT JOIN billing_accounts a ON a.id = i.bill_account_id AND a.tenant_id = i.tenant_id
+       WHERE i.id = ? AND i.tenant_id = ? AND i.organization_id = ? AND i.deleted_at IS NULL`,
+      [today, today, invoiceId, auth.tenantId, organizationId]
     );
     if (!invoiceRows || invoiceRows.length === 0) {
       return NextResponse.json({ error: "Invoice not found" }, { status: 404 });
     }
     const invoice = invoiceRows[0];
     const lineRows = await em.execute(
-      `SELECT id, line_number, kind, description, quantity, currency_code,
-              unit_price_net, unit_price_gross, tax_rate, tax_amount,
-              total_net_amount, total_gross_amount, metadata
-       FROM sales_invoice_lines
-       WHERE invoice_id = ?
-         AND tenant_id = ?
-         AND organization_id = ?
+      `SELECT id, line_number, billing_item_id, billing_type, description, quantity,
+              unit_price_net, tax_rate, net_amount, tax_amount, gross_amount,
+              service_period_start, service_period_end, corrects_line_id, metadata
+       FROM billing_invoice_lines
+       WHERE invoice_id = ? AND tenant_id = ? AND organization_id = ? AND deleted_at IS NULL
        ORDER BY line_number ASC`,
       [invoiceId, auth.tenantId, organizationId]
     );
+    const allocations = await em.execute(
+      `SELECT al.id, al.source_type, al.source_id, al.amount, al.currency_code, al.allocated_by, al.created_at,
+              CASE WHEN al.source_type = 'payment' THEN COALESCE(p.reference, p.payer_name)
+                   ELSE m.number END AS source_label,
+              p.received_at AS payment_received_at
+         FROM billing_allocations al
+         LEFT JOIN billing_payments p ON al.source_type = 'payment' AND p.id = al.source_id
+         LEFT JOIN billing_invoices m ON al.source_type = 'credit_memo' AND m.id = al.source_id
+        WHERE al.invoice_id = ? AND al.tenant_id = ? AND al.organization_id = ? AND al.deleted_at IS NULL
+        ORDER BY al.created_at ASC`,
+      [invoiceId, auth.tenantId, organizationId]
+    );
+    const corrections = await em.execute(
+      `SELECT id, number, document_type, status, total_gross, outstanding, currency_code, correction_reason, created_at
+         FROM billing_invoices
+        WHERE corrects_invoice_id = ? AND tenant_id = ? AND organization_id = ? AND deleted_at IS NULL
+        ORDER BY created_at ASC`,
+      [invoiceId, auth.tenantId, organizationId]
+    );
     return NextResponse.json({
+      corrections,
+      allocations,
       invoice,
-      lines: lineRows
+      // Lines carry the document currency for display convenience.
+      lines: lineRows.map((line) => ({ ...line, currency_code: invoice.currency_code }))
     });
   } catch (err) {
     console.error("[billing/invoices/[id].GET]", err);
@@ -64,8 +84,8 @@ const openApi = {
   methods: {
     GET: {
       tags: ["Billing"],
-      summary: "Get a billing-managed invoice (with lines)",
-      description: "Returns the `core/sales` invoice + every line, scoped to billing-managed invoices (`metadata.bill_run_id` set). Non-billing invoices return 404 even when the UUID resolves at `/api/sales/invoices/[id]`.",
+      summary: "Get a billing document (with lines)",
+      description: "Returns one billing document from `billing_invoices` (invoice, memo or receipt) with its lines, the frozen buyer / seller snapshots, `bill_account_name` and `allocations[]` (Spec C: payments / credit memos that settled it, with `source_label`) and `corrections[]` (Spec D memos). 404 outside the caller's organization.",
       parameters: [
         {
           name: "id",

package/dist/modules/billing/api/invoices/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/billing/api/invoices/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\n\n/**\n * `GET /api/billing/invoices/[id]` \u2014 billing-invoice detail.\n *\n * Returns the `core/sales` invoice row + its lines, but only if the\n * invoice is billing-managed (carries `metadata.bill_run_id`). Other\n * `core/sales` invoices return 404 here even though the same UUID\n * resolves at `/api/sales/invoices/[id]` \u2014 this endpoint is the\n * billing operator's surface, scoped to the billing universe.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.invoice.view'] },\n}\n\ntype InvoiceRow = {\n  id: string\n  invoice_number: string\n  status: string | null\n  status_entry_id: string | null\n  currency_code: string\n  issue_date: string | null\n  due_date: string | null\n  subtotal_net_amount: string\n  subtotal_gross_amount: string\n  discount_total_amount: string\n  tax_total_amount: string\n  grand_total_net_amount: string\n  grand_total_gross_amount: string\n  paid_total_amount: string\n  outstanding_amount: string\n  metadata: Record<string, unknown> | null\n  created_at: string\n  updated_at: string\n}\n\ntype InvoiceLineRow = {\n  id: string\n  line_number: number\n  kind: string\n  description: string | null\n  quantity: string\n  currency_code: string\n  unit_price_net: string\n  unit_price_gross: string\n  tax_rate: string\n  tax_amount: string\n  total_net_amount: string\n  total_gross_amount: string\n  metadata: Record<string, unknown> | null\n}\n\nexport async function GET(\n  req: Request,\n  { params }: { params: Promise<{ id: string }> },\n) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const organizationId = (auth as { orgId?: string }).orgId ?? null\n    if (!organizationId) {\n      return NextResponse.json(\n        { error: 'Organization scope required' },\n        { status: 403 },\n      )\n    }\n\n    const { id: invoiceId } = await params\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const invoiceRows = (await em.execute(\n      `SELECT id, invoice_number, status, status_entry_id, currency_code,\n              issue_date, due_date,\n              subtotal_net_amount, subtotal_gross_amount,\n              discount_total_amount, tax_total_amount,\n              grand_total_net_amount, grand_total_gross_amount,\n              paid_total_amount, outstanding_amount,\n              metadata, created_at, updated_at\n       FROM sales_invoices\n       WHERE id = ?\n         AND tenant_id = ?\n         AND organization_id = ?\n         AND deleted_at IS NULL\n         AND jsonb_exists(metadata, 'bill_run_id')`,\n      [invoiceId, auth.tenantId, organizationId],\n    )) as unknown as InvoiceRow[]\n\n    if (!invoiceRows || invoiceRows.length === 0) {\n      return NextResponse.json({ error: 'Invoice not found' }, { status: 404 })\n    }\n\n    const invoice = invoiceRows[0]\n\n    const lineRows = (await em.execute(\n      `SELECT id, line_number, kind, description, quantity, currency_code,\n              unit_price_net, unit_price_gross, tax_rate, tax_amount,\n              total_net_amount, total_gross_amount, metadata\n       FROM sales_invoice_lines\n       WHERE invoice_id = ?\n         AND tenant_id = ?\n         AND organization_id = ?\n       ORDER BY line_number ASC`,\n      [invoiceId, auth.tenantId, organizationId],\n    )) as unknown as InvoiceLineRow[]\n\n    return NextResponse.json({\n      invoice,\n      lines: lineRows,\n    })\n  } catch (err) {\n    console.error('[billing/invoices/[id].GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Get a billing-managed invoice (with lines)',\n      description:\n        'Returns the `core/sales` invoice + every line, scoped to ' +\n        \"billing-managed invoices (`metadata.bill_run_id` set). Non-\" +\n        'billing invoices return 404 even when the UUID resolves at ' +\n        '`/api/sales/invoices/[id]`.',\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAY5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAuCA,eAAsB,IACpB,KACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,iBAAkB,KAA4B,SAAS;AAC7D,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8BAA8B;AAAA,QACvC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,IAAI,UAAU,IAAI,MAAM;AAChC,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,cAAe,MAAM,GAAG;AAAA,MAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA,CAAC,WAAW,KAAK,UAAU,cAAc;AAAA,IAC3C;AAEA,QAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAEA,UAAM,UAAU,YAAY,CAAC;AAE7B,UAAM,WAAY,MAAM,GAAG;AAAA,MACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA,CAAC,WAAW,KAAK,UAAU,cAAc;AAAA,IAC3C;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,+BAA+B,GAAG;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aACE;AAAA,MAIF,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { daysOverdueSql, isoDay } from '../../../lib/overdue'\n\n/**\n * `GET /api/billing/invoices/[id]` \u2014 one billing document with its lines\n * (Spec 0: `billing_invoices` / `billing_invoice_lines`). Documents of other\n * modules are never reachable here.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.invoice.view'] },\n}\n\ntype InvoiceRow = Record<string, unknown> & { id: string; bill_account_id: string }\ntype InvoiceLineRow = Record<string, unknown> & { id: string }\n\nexport async function GET(\n  req: Request,\n  { params }: { params: Promise<{ id: string }> },\n) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const organizationId = (auth as { orgId?: string }).orgId ?? null\n    if (!organizationId) {\n      return NextResponse.json(\n        { error: 'Organization scope required' },\n        { status: 403 },\n      )\n    }\n\n    const { id: invoiceId } = await params\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const today = isoDay(new Date())\n    const invoiceRows = (await em.execute(\n      `SELECT i.id, i.number, i.document_type, i.series, i.status, i.test_run, i.bill_account_id,\n              a.name AS bill_account_name, i.bill_run_id, i.bill_date, i.period_start, i.period_end,\n              i.issue_date, i.due_date, i.posted_at, i.currency_code, i.subtotal_net, i.tax_total,\n              i.total_gross, i.paid_total, i.credited_total, i.outstanding, i.corrects_invoice_id,\n              i.correction_reason, i.corrects_invoice_number, i.corrects_issue_date,\n              i.buyer_snapshot, i.seller_snapshot, i.topup_id, i.metadata,\n              i.pdf_attachment_id, ${daysOverdueSql('i')}::int AS days_overdue,\n              i.created_at, i.updated_at\n       FROM billing_invoices i\n       LEFT JOIN billing_accounts a ON a.id = i.bill_account_id AND a.tenant_id = i.tenant_id\n       WHERE i.id = ? AND i.tenant_id = ? AND i.organization_id = ? AND i.deleted_at IS NULL`,\n      [today, today, invoiceId, auth.tenantId, organizationId],\n    )) as unknown as InvoiceRow[]\n\n    if (!invoiceRows || invoiceRows.length === 0) {\n      return NextResponse.json({ error: 'Invoice not found' }, { status: 404 })\n    }\n\n    const invoice = invoiceRows[0]\n\n    const lineRows = (await em.execute(\n      `SELECT id, line_number, billing_item_id, billing_type, description, quantity,\n              unit_price_net, tax_rate, net_amount, tax_amount, gross_amount,\n              service_period_start, service_period_end, corrects_line_id, metadata\n       FROM billing_invoice_lines\n       WHERE invoice_id = ? AND tenant_id = ? AND organization_id = ? AND deleted_at IS NULL\n       ORDER BY line_number ASC`,\n      [invoiceId, auth.tenantId, organizationId],\n    )) as unknown as InvoiceLineRow[]\n\n    // Spec C: what settled this receivable (payments; Spec D adds credit memos).\n    const allocations = await em.execute(\n      `SELECT al.id, al.source_type, al.source_id, al.amount, al.currency_code, al.allocated_by, al.created_at,\n              CASE WHEN al.source_type = 'payment' THEN COALESCE(p.reference, p.payer_name)\n                   ELSE m.number END AS source_label,\n              p.received_at AS payment_received_at\n         FROM billing_allocations al\n         LEFT JOIN billing_payments p ON al.source_type = 'payment' AND p.id = al.source_id\n         LEFT JOIN billing_invoices m ON al.source_type = 'credit_memo' AND m.id = al.source_id\n        WHERE al.invoice_id = ? AND al.tenant_id = ? AND al.organization_id = ? AND al.deleted_at IS NULL\n        ORDER BY al.created_at ASC`,\n      [invoiceId, auth.tenantId, organizationId],\n    )\n\n    // Spec D: memos correcting this document.\n    const corrections = await em.execute(\n      `SELECT id, number, document_type, status, total_gross, outstanding, currency_code, correction_reason, created_at\n         FROM billing_invoices\n        WHERE corrects_invoice_id = ? AND tenant_id = ? AND organization_id = ? AND deleted_at IS NULL\n        ORDER BY created_at ASC`,\n      [invoiceId, auth.tenantId, organizationId],\n    )\n\n    return NextResponse.json({\n      corrections,\n      allocations,\n      invoice,\n      // Lines carry the document currency for display convenience.\n      lines: lineRows.map((line) => ({ ...line, currency_code: invoice.currency_code })),\n    })\n  } catch (err) {\n    console.error('[billing/invoices/[id].GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Get a billing document (with lines)',\n      description:\n        'Returns one billing document from `billing_invoices` (invoice, memo or receipt) with its ' +\n        'lines, the frozen buyer / seller snapshots, `bill_account_name` and `allocations[]` (Spec C: ' +\n        'payments / credit memos that settled it, with `source_label`) and `corrections[]` (Spec D memos). ' +\n        '404 outside the ' +\n        'caller\\'s organization.',\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,gBAAgB,cAAc;AAQhC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAKA,eAAsB,IACpB,KACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,iBAAkB,KAA4B,SAAS;AAC7D,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,8BAA8B;AAAA,QACvC,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,EAAE,IAAI,UAAU,IAAI,MAAM;AAChC,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,QAAQ,OAAO,oBAAI,KAAK,CAAC;AAC/B,UAAM,cAAe,MAAM,GAAG;AAAA,MAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAM+B,eAAe,GAAG,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKlD,CAAC,OAAO,OAAO,WAAW,KAAK,UAAU,cAAc;AAAA,IACzD;AAEA,QAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAEA,UAAM,UAAU,YAAY,CAAC;AAE7B,UAAM,WAAY,MAAM,GAAG;AAAA,MACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,CAAC,WAAW,KAAK,UAAU,cAAc;AAAA,IAC3C;AAGA,UAAM,cAAc,MAAM,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA,CAAC,WAAW,KAAK,UAAU,cAAc;AAAA,IAC3C;AAGA,UAAM,cAAc,MAAM,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,WAAW,KAAK,UAAU,cAAc;AAAA,IAC3C;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA;AAAA,MAEA,OAAO,SAAS,IAAI,CAAC,UAAU,EAAE,GAAG,MAAM,eAAe,QAAQ,cAAc,EAAE;AAAA,IACnF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,+BAA+B,GAAG;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aACE;AAAA,MAKF,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/billing/api/invoices/[id]/send/route.js

@@ -0,0 +1,107 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import {
+  organizationScopeRequiredResponse,
+  resolveActiveOrganizationId
+} from "@open-mercato/shared/lib/auth/organizationScope";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { bridgeLegacyGuard, runMutationGuards } from "@open-mercato/shared/lib/crud/mutation-guard-registry";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.invoice.send"] }
+};
+function userFeatures(auth) {
+  const features = auth?.features;
+  return Array.isArray(features) ? features.filter((value) => typeof value === "string") : [];
+}
+async function POST(req, { params }) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const organizationId = resolveActiveOrganizationId(auth);
+    if (!organizationId) return organizationScopeRequiredResponse();
+    const { id } = await params;
+    const ctx = {
+      container,
+      auth,
+      organizationScope: null,
+      selectedOrganizationId: organizationId,
+      organizationIds: [organizationId],
+      request: req
+    };
+    const guardInput = {
+      tenantId: auth.tenantId,
+      organizationId,
+      userId: auth.sub ?? "",
+      resourceKind: "billing.invoice",
+      resourceId: id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    };
+    const legacyGuard = bridgeLegacyGuard(container);
+    const guardResult = legacyGuard ? await runMutationGuards([legacyGuard], guardInput, { userFeatures: userFeatures(auth) }) : { ok: true, afterSuccessCallbacks: [] };
+    if (!guardResult.ok) {
+      return NextResponse.json(guardResult.errorBody ?? { error: "Operation blocked by guard" }, {
+        status: guardResult.errorStatus ?? 422
+      });
+    }
+    const commandBus = container.resolve("commandBus");
+    const response = await commandBus.execute("billing.invoices.send", {
+      input: { tenantId: auth.tenantId, organizationId, invoiceId: id },
+      ctx
+    });
+    const result = response.result;
+    for (const callback of guardResult.afterSuccessCallbacks) {
+      if (!callback.guard.afterSuccess) continue;
+      try {
+        await callback.guard.afterSuccess({ ...guardInput, metadata: callback.metadata ?? null });
+      } catch (err) {
+        console.error("[billing/invoices/[id]/send.POST] guard afterSuccess failed", err);
+      }
+    }
+    return NextResponse.json(result ?? { invoiceId: id, status: "failed", error: null });
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    console.error("[billing/invoices/[id]/send.POST]", err);
+    return NextResponse.json({ error: "Internal error" }, { status: 500 });
+  }
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Email a posted billing document",
+      parameters: [{ name: "id", in: "path", required: true, schema: { type: "string", format: "uuid" } }],
+      description: 'Sends the frozen PDF to the billing account invoice email through the platform email transport. Each attempt is appended to `metadata.deliveries` and emits `billing.invoice.sent` / `billing.invoice.send_failed`. Transport failures return 200 with `status: "failed"` and the error.',
+      responses: [
+        {
+          status: 200,
+          description: "Delivery attempted",
+          schema: z.object({
+            invoiceId: z.string().uuid(),
+            to: z.string(),
+            status: z.enum(["sent", "failed"]),
+            error: z.string().nullable()
+          })
+        }
+      ],
+      errors: [
+        { status: 409, description: "`billing.invoice.not_posted` \u2014 drafts and test documents cannot be sent" },
+        { status: 422, description: "`billing.invoice.email_invalid` \u2014 placeholder or malformed invoice email" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/invoices/[id]/send/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/billing/api/invoices/%5Bid%5D/send/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  organizationScopeRequiredResponse,\n  resolveActiveOrganizationId,\n} from '@open-mercato/shared/lib/auth/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { bridgeLegacyGuard, runMutationGuards } from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport type { SendInvoiceResult } from '../../../../lib/invoiceDelivery'\n\n/**\n * `POST /api/billing/invoices/[id]/send` \u2014 emails a posted billing document\n * with its frozen PDF to the account's invoice email (Spec B), via the\n * `billing.invoices.send` command.\n *\n * 200 `{ invoiceId, to, status: 'sent' | 'failed', error }` \u2014 a transport\n * failure is a recorded `failed` delivery, not an HTTP error.\n * 409 `billing.invoice.not_posted` (draft / test). 422\n * `billing.invoice.email_invalid` (placeholder or malformed address).\n */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.invoice.send'] },\n}\n\nfunction userFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  return Array.isArray(features) ? features.filter((value): value is string => typeof value === 'string') : []\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const organizationId = resolveActiveOrganizationId(auth)\n    if (!organizationId) return organizationScopeRequiredResponse()\n    const { id } = await params\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: null,\n      selectedOrganizationId: organizationId,\n      organizationIds: [organizationId],\n      request: req,\n    }\n    // Custom write route \u2192 run the shared mutation guards (record locks etc.)\n    // as `update` on the invoice before sending.\n    const guardInput = {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'billing.invoice',\n      resourceId: id,\n      operation: 'update' as const,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    }\n    const legacyGuard = bridgeLegacyGuard(container)\n    const guardResult = legacyGuard\n      ? await runMutationGuards([legacyGuard], guardInput, { userFeatures: userFeatures(auth) })\n      : { ok: true as const, afterSuccessCallbacks: [] }\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n        status: guardResult.errorStatus ?? 422,\n      })\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const response = await commandBus.execute('billing.invoices.send', {\n      input: { tenantId: auth.tenantId, organizationId, invoiceId: id },\n      ctx,\n    })\n    const result = (response as { result?: SendInvoiceResult }).result\n    for (const callback of guardResult.afterSuccessCallbacks) {\n      if (!callback.guard.afterSuccess) continue\n      try {\n        await callback.guard.afterSuccess({ ...guardInput, metadata: callback.metadata ?? null })\n      } catch (err) {\n        console.error('[billing/invoices/[id]/send.POST] guard afterSuccess failed', err)\n      }\n    }\n    return NextResponse.json(result ?? { invoiceId: id, status: 'failed', error: null })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    console.error('[billing/invoices/[id]/send.POST]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Email a posted billing document',\n      parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } }],\n      description:\n        'Sends the frozen PDF to the billing account invoice email through the platform email ' +\n        'transport. Each attempt is appended to `metadata.deliveries` and emits ' +\n        '`billing.invoice.sent` / `billing.invoice.send_failed`. Transport failures return ' +\n        '200 with `status: \"failed\"` and the error.',\n      responses: [\n        {\n          status: 200,\n          description: 'Delivery attempted',\n          schema: z.object({\n            invoiceId: z.string().uuid(),\n            to: z.string(),\n            status: z.enum(['sent', 'failed']),\n            error: z.string().nullable(),\n          }),\n        },\n      ],\n      errors: [\n        { status: 409, description: '`billing.invoice.not_posted` \u2014 drafts and test documents cannot be sent' },\n        { status: 422, description: '`billing.invoice.email_invalid` \u2014 placeholder or malformed invoice email' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB;AAChC,SAAS,mBAAmB,yBAAyB;AAc9C,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEA,SAAS,aAAa,MAAyB;AAC7C,QAAM,WAAY,MAAiC;AACnD,SAAO,MAAM,QAAQ,QAAQ,IAAI,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAAI,CAAC;AAC7G;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAwC;AACxF,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,iBAAiB,4BAA4B,IAAI;AACvD,QAAI,CAAC,eAAgB,QAAO,kCAAkC;AAC9D,UAAM,EAAE,GAAG,IAAI,MAAM;AACrB,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,CAAC,cAAc;AAAA,MAChC,SAAS;AAAA,IACX;AAGA,UAAM,aAAa;AAAA,MACjB,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB;AACA,UAAM,cAAc,kBAAkB,SAAS;AAC/C,UAAM,cAAc,cAChB,MAAM,kBAAkB,CAAC,WAAW,GAAG,YAAY,EAAE,cAAc,aAAa,IAAI,EAAE,CAAC,IACvF,EAAE,IAAI,MAAe,uBAAuB,CAAC,EAAE;AACnD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,QACzF,QAAQ,YAAY,eAAe;AAAA,MACrC,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,WAAW,MAAM,WAAW,QAAQ,yBAAyB;AAAA,MACjE,OAAO,EAAE,UAAU,KAAK,UAAU,gBAAgB,WAAW,GAAG;AAAA,MAChE;AAAA,IACF,CAAC;AACD,UAAM,SAAU,SAA4C;AAC5D,eAAW,YAAY,YAAY,uBAAuB;AACxD,UAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAI;AACF,cAAM,SAAS,MAAM,aAAa,EAAE,GAAG,YAAY,UAAU,SAAS,YAAY,KAAK,CAAC;AAAA,MAC1F,SAAS,KAAK;AACZ,gBAAQ,MAAM,+DAA+D,GAAG;AAAA,MAClF;AAAA,IACF;AACA,WAAO,aAAa,KAAK,UAAU,EAAE,WAAW,IAAI,QAAQ,UAAU,OAAO,KAAK,CAAC;AAAA,EACrF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,YAAQ,MAAM,qCAAqC,GAAG;AACtD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,YAAY,CAAC,EAAE,MAAM,MAAM,IAAI,QAAQ,UAAU,MAAM,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO,EAAE,CAAC;AAAA,MACnG,aACE;AAAA,MAIF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,YAC3B,IAAI,EAAE,OAAO;AAAA,YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,YACjC,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,UAC7B,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+EAA0E;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gFAA2E;AAAA,MACzG;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/invoices/add-line/route.js

@@ -2,10 +2,10 @@ import { z } from "zod";
 import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
 import { withScopedPayload } from "@open-mercato/shared/lib/api/scoped";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
-import { SalesInvoice } from "@open-mercato/core/modules/sales/data/entities";
 import { billingEntityIds } from "../../../data/entityIds.js";
 import { billingInvoiceAddLineSchema } from "../../../data/validators.js";
 import { createBillingCrudOpenApi } from "../../openapi.js";
+import { BillingInvoice } from "../../../data/entities.js";
 const routeMetadata = {
   POST: { requireAuth: true, requireFeatures: ["billing.invoice.edit_draft"] }
 };
@@ -19,7 +19,7 @@ const rawBodySchema = z.object({}).passthrough();
 const crud = makeCrudRoute({
   metadata: routeMetadata,
   orm: {
-    entity: SalesInvoice,
+    entity: BillingInvoice,
     idField: "id",
     orgField: "organizationId",
     tenantField: "tenantId",
@@ -58,7 +58,7 @@ const openApi = createBillingCrudOpenApi({
   create: {
     schema: billingInvoiceAddLineSchema,
     responseSchema: addLineResponseSchema,
-    description: "Appends a new line to a draft invoice (e.g. operator adds a one-off adjustment). Writes a `DraftInvoiceEdit` audit row (action=`line_added`, `before_json=null`). Recomputes invoice totals. Refuses non-draft invoices."
+    description: "Appends a new line to a draft invoice (e.g. operator adds a one-off adjustment). Writes a `BillingDraftInvoiceEdit` audit row (action=`line_added`, `before_json=null`). Recomputes invoice totals. Refuses non-draft invoices."
   }
 });
 export {

package/dist/modules/billing/api/invoices/add-line/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/billing/api/invoices/add-line/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { SalesInvoice } from '@open-mercato/core/modules/sales/data/entities'\nimport { billingEntityIds } from '../../../data/entityIds'\nimport { billingInvoiceAddLineSchema } from '../../../data/validators'\nimport { createBillingCrudOpenApi } from '../../openapi'\n\nconst routeMetadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.invoice.edit_draft'] },\n}\n\nexport const metadata = routeMetadata\n\nconst addLineResponseSchema = z.object({\n  invoiceId: z.string().uuid(),\n  invoiceLineId: z.string().uuid(),\n  auditId: z.string().uuid(),\n})\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: SalesInvoice,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  list: {\n    schema: z.object({}).passthrough(),\n    entityId: billingEntityIds.draftInvoiceEdit,\n    fields: ['id'],\n    buildFilters: async () => ({}),\n  },\n  actions: {\n    create: {\n      commandId: 'billing.invoices.add_draft_line',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const scoped = withScopedPayload(raw ?? {}, ctx, translate)\n        return billingInvoiceAddLineSchema.parse(scoped)\n      },\n      response: ({ result }) => ({\n        invoiceId: result?.invoiceId ?? null,\n        invoiceLineId: result?.invoiceLineId ?? null,\n        auditId: result?.auditId ?? null,\n      }),\n      status: 201,\n    },\n  },\n})\n\nexport const POST = crud.POST\n\nexport const openApi = createBillingCrudOpenApi({\n  resourceName: 'BillingInvoiceLineAdd',\n  pluralName: 'BillingInvoiceLineAdds',\n  querySchema: z.object({}).passthrough(),\n  listResponseSchema: z.object({ items: z.array(z.unknown()) }),\n  create: {\n    schema: billingInvoiceAddLineSchema,\n    responseSchema: addLineResponseSchema,\n    description:\n      'Appends a new line to a draft invoice (e.g. operator adds a ' +\n      'one-off adjustment). Writes a `DraftInvoiceEdit` audit row ' +\n      '(action=`line_added`, `before_json=null`). Recomputes invoice ' +\n      'totals. Refuses non-draft invoices.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,yBAAyB;AAClC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,gCAAgC;AAEzC,MAAM,gBAAgB;AAAA,EACpB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEO,MAAM,WAAW;AAExB,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,IACjC,UAAU,iBAAiB;AAAA,IAC3B,QAAQ,CAAC,IAAI;AAAA,IACb,cAAc,aAAa,CAAC;AAAA,EAC9B;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,kBAAkB,OAAO,CAAC,GAAG,KAAK,SAAS;AAC1D,eAAO,4BAA4B,MAAM,MAAM;AAAA,MACjD;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO;AAAA,QACzB,WAAW,QAAQ,aAAa;AAAA,QAChC,eAAe,QAAQ,iBAAiB;AAAA,QACxC,SAAS,QAAQ,WAAW;AAAA,MAC9B;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAEM,MAAM,OAAO,KAAK;AAElB,MAAM,UAAU,yBAAyB;AAAA,EAC9C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,EACtC,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC5D,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EAIJ;AACF,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { billingEntityIds } from '../../../data/entityIds'\nimport { billingInvoiceAddLineSchema } from '../../../data/validators'\nimport { createBillingCrudOpenApi } from '../../openapi'\nimport { BillingInvoice } from '../../../data/entities'\n\nconst routeMetadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.invoice.edit_draft'] },\n}\n\nexport const metadata = routeMetadata\n\nconst addLineResponseSchema = z.object({\n  invoiceId: z.string().uuid(),\n  invoiceLineId: z.string().uuid(),\n  auditId: z.string().uuid(),\n})\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: BillingInvoice,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  list: {\n    schema: z.object({}).passthrough(),\n    entityId: billingEntityIds.draftInvoiceEdit,\n    fields: ['id'],\n    buildFilters: async () => ({}),\n  },\n  actions: {\n    create: {\n      commandId: 'billing.invoices.add_draft_line',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const scoped = withScopedPayload(raw ?? {}, ctx, translate)\n        return billingInvoiceAddLineSchema.parse(scoped)\n      },\n      response: ({ result }) => ({\n        invoiceId: result?.invoiceId ?? null,\n        invoiceLineId: result?.invoiceLineId ?? null,\n        auditId: result?.auditId ?? null,\n      }),\n      status: 201,\n    },\n  },\n})\n\nexport const POST = crud.POST\n\nexport const openApi = createBillingCrudOpenApi({\n  resourceName: 'BillingInvoiceLineAdd',\n  pluralName: 'BillingInvoiceLineAdds',\n  querySchema: z.object({}).passthrough(),\n  listResponseSchema: z.object({ items: z.array(z.unknown()) }),\n  create: {\n    schema: billingInvoiceAddLineSchema,\n    responseSchema: addLineResponseSchema,\n    description:\n      'Appends a new line to a draft invoice (e.g. operator adds a ' +\n      'one-off adjustment). Writes a `BillingDraftInvoiceEdit` audit row ' +\n      '(action=`line_added`, `before_json=null`). Recomputes invoice ' +\n      'totals. Refuses non-draft invoices.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,yBAAyB;AAClC,SAAS,2BAA2B;AACpC,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAE/B,MAAM,gBAAgB;AAAA,EACpB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEO,MAAM,WAAW;AAExB,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,MAAM;AAAA,IACJ,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,IACjC,UAAU,iBAAiB;AAAA,IAC3B,QAAQ,CAAC,IAAI;AAAA,IACb,cAAc,aAAa,CAAC;AAAA,EAC9B;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,kBAAkB,OAAO,CAAC,GAAG,KAAK,SAAS;AAC1D,eAAO,4BAA4B,MAAM,MAAM;AAAA,MACjD;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO;AAAA,QACzB,WAAW,QAAQ,aAAa;AAAA,QAChC,eAAe,QAAQ,iBAAiB;AAAA,QACxC,SAAS,QAAQ,WAAW;AAAA,MAC9B;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AACF,CAAC;AAEM,MAAM,OAAO,KAAK;AAElB,MAAM,UAAU,yBAAyB;AAAA,EAC9C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA,EACtC,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC5D,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EAIJ;AACF,CAAC;",
   "names": []
 }

package/dist/modules/billing/api/invoices/delete-draft/route.js

@@ -0,0 +1,33 @@
+import { z } from "zod";
+import { runCommandRoute } from "../../../lib/commandRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.invoice.correct"] }
+};
+const bodySchema = z.object({ invoiceId: z.string().uuid() });
+async function POST(req) {
+  return runCommandRoute(req, {
+    commandId: "billing.invoices.delete_draft",
+    bodySchema,
+    resourceKind: "billing.invoice",
+    resourceId: (body) => body.invoiceId,
+    logLabel: "billing/invoices/delete-draft.POST"
+  });
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Delete a draft memo",
+      description: "Deletes a draft credit or debit memo with its lines. Posted documents are never deleted (no void).",
+      requestBody: { schema: bodySchema },
+      responses: [{ status: 200, description: "`{ deleted: true }`" }],
+      errors: [{ status: 409, description: "`billing.memo.not_draft`" }]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/invoices/delete-draft/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/invoices/delete-draft/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { runCommandRoute } from '../../../lib/commandRoute'\n\n/** `POST /api/billing/invoices/delete-draft` \u2014 delete a DRAFT credit / debit memo (Spec D, D-D7). */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.invoice.correct'] },\n}\n\nconst bodySchema = z.object({ invoiceId: z.string().uuid() })\n\nexport async function POST(req: Request) {\n  return runCommandRoute(req, {\n    commandId: 'billing.invoices.delete_draft',\n    bodySchema,\n    resourceKind: 'billing.invoice',\n    resourceId: (body) => body.invoiceId,\n    logLabel: 'billing/invoices/delete-draft.POST',\n  })\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Delete a draft memo',\n      description: 'Deletes a draft credit or debit memo with its lines. Posted documents are never deleted (no void).',\n      requestBody: { schema: bodySchema },\n      responses: [{ status: 200, description: '`{ deleted: true }`' }],\n      errors: [{ status: 409, description: '`billing.memo.not_draft`' }],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,uBAAuB;AAIzB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC1E;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE5D,eAAsB,KAAK,KAAc;AACvC,SAAO,gBAAgB,KAAK;AAAA,IAC1B,WAAW;AAAA,IACX;AAAA,IACA,cAAc;AAAA,IACd,YAAY,CAAC,SAAS,KAAK;AAAA,IAC3B,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,WAAW;AAAA,MAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,CAAC;AAAA,MAC/D,QAAQ,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,CAAC;AAAA,IACnE;AAAA,EACF;AACF;",
+  "names": []
+}