@dainamite/billing 0.20.0 → 0.21.0

package/dist/modules/billing/api/payment-imports/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/billing/api/payment-imports/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  organizationScopeRequiredResponse,\n  resolveActiveOrganizationId,\n} from '@open-mercato/shared/lib/auth/organizationScope'\nimport { buildQueryParams } from '@open-mercato/shared/lib/crud/query-params'\nimport { billingPaymentImportListQuerySchema } from '../../data/validators'\n\n/** `GET /api/billing/payment-imports` \u2014 CSV upload batches, newest first (Spec C, C-D4). */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.payment.view'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const organizationId = resolveActiveOrganizationId(auth)\n    if (!organizationId) return organizationScopeRequiredResponse()\n    const query = billingPaymentImportListQuerySchema.parse(buildQueryParams(new URL(req.url).searchParams))\n    const em = (container.resolve('em') as EntityManager).fork()\n    const where = ['tenant_id = ?', 'organization_id = ?', 'deleted_at IS NULL']\n    const params: unknown[] = [auth.tenantId, organizationId]\n    if (query.id) {\n      where.push('id = ?')\n      params.push(query.id)\n    }\n    const totalRows = (await em.execute(`SELECT COUNT(*)::int AS total FROM billing_payment_imports WHERE ${where.join(' AND ')}`, params)) as unknown as Array<{ total: number }>\n    const total = totalRows?.[0]?.total ?? 0\n    const items = await em.execute(\n      `SELECT id, file_name, row_count, counts, user_id, created_at\n         FROM billing_payment_imports WHERE ${where.join(' AND ')}\n        ORDER BY created_at DESC LIMIT ? OFFSET ?`,\n      [...params, query.pageSize, (query.page - 1) * query.pageSize],\n    )\n    return NextResponse.json({ items, total, page: query.page, pageSize: query.pageSize, totalPages: total === 0 ? 1 : Math.ceil(total / query.pageSize) })\n  } catch (err) {\n    console.error('[billing/payment-imports.GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'List payment import batches',\n      description: 'CSV uploads with counts per outcome (allocated, partially_allocated, matched, unmatched, duplicate, rejected).',\n      query: billingPaymentImportListQuerySchema,\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,2CAA2C;AAI7C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG,UAAM,iBAAiB,4BAA4B,IAAI;AACvD,QAAI,CAAC,eAAgB,QAAO,kCAAkC;AAC9D,UAAM,QAAQ,oCAAoC,MAAM,iBAAiB,IAAI,IAAI,IAAI,GAAG,EAAE,YAAY,CAAC;AACvG,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,QAAQ,CAAC,iBAAiB,uBAAuB,oBAAoB;AAC3E,UAAM,SAAoB,CAAC,KAAK,UAAU,cAAc;AACxD,QAAI,MAAM,IAAI;AACZ,YAAM,KAAK,QAAQ;AACnB,aAAO,KAAK,MAAM,EAAE;AAAA,IACtB;AACA,UAAM,YAAa,MAAM,GAAG,QAAQ,oEAAoE,MAAM,KAAK,OAAO,CAAC,IAAI,MAAM;AACrI,UAAM,QAAQ,YAAY,CAAC,GAAG,SAAS;AACvC,UAAM,QAAQ,MAAM,GAAG;AAAA,MACrB;AAAA,8CACwC,MAAM,KAAK,OAAO,CAAC;AAAA;AAAA,MAE3D,CAAC,GAAG,QAAQ,MAAM,WAAW,MAAM,OAAO,KAAK,MAAM,QAAQ;AAAA,IAC/D;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,MAAM,MAAM,UAAU,MAAM,UAAU,YAAY,UAAU,IAAI,IAAI,KAAK,KAAK,QAAQ,MAAM,QAAQ,EAAE,CAAC;AAAA,EACxJ,SAAS,KAAK;AACZ,YAAQ,MAAM,iCAAiC,GAAG;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,IACT;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/payments/[id]/route.js

@@ -0,0 +1,60 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import {
+  organizationScopeRequiredResponse,
+  resolveActiveOrganizationId
+} from "@open-mercato/shared/lib/auth/organizationScope";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["billing.payment.view"] }
+};
+async function GET(req, { params }) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const organizationId = resolveActiveOrganizationId(auth);
+    if (!organizationId) return organizationScopeRequiredResponse();
+    const { id } = await params;
+    const em = container.resolve("em").fork();
+    const rows = await em.execute(
+      `SELECT p.*, a.name AS bill_account_name, a.billing_mode AS bill_account_mode
+         FROM billing_payments p
+         LEFT JOIN billing_accounts a ON a.id = p.bill_account_id AND a.tenant_id = p.tenant_id
+        WHERE p.id = ? AND p.tenant_id = ? AND p.organization_id = ? AND p.deleted_at IS NULL`,
+      [id, auth.tenantId, organizationId]
+    );
+    if (!rows?.length) return NextResponse.json({ error: "Payment not found" }, { status: 404 });
+    const allocations = await em.execute(
+      `SELECT al.id, al.invoice_id, i.number AS invoice_number, i.document_type, i.status AS invoice_status,
+              al.amount, al.currency_code, al.allocated_by, al.user_id, al.created_at
+         FROM billing_allocations al
+         LEFT JOIN billing_invoices i ON i.id = al.invoice_id
+        WHERE al.source_type = 'payment' AND al.source_id = ? AND al.tenant_id = ? AND al.organization_id = ?
+          AND al.deleted_at IS NULL
+        ORDER BY al.created_at ASC`,
+      [id, auth.tenantId, organizationId]
+    );
+    return NextResponse.json({ payment: rows[0], allocations });
+  } catch (err) {
+    console.error("[billing/payments/[id].GET]", err);
+    return NextResponse.json({ error: "Internal error" }, { status: 500 });
+  }
+}
+const openApi = {
+  methods: {
+    GET: {
+      tags: ["Billing"],
+      summary: "Get a billing payment",
+      description: "The payment (incl. match reason, account, top-up link) and its active allocations.",
+      responses: [{ status: 200, description: "`{ payment, allocations[] }`" }],
+      errors: [{ status: 404, description: "Payment not found in this organization" }]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/payments/[id]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/payments/%5Bid%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  organizationScopeRequiredResponse,\n  resolveActiveOrganizationId,\n} from '@open-mercato/shared/lib/auth/organizationScope'\n\n/**\n * `GET /api/billing/payments/[id]` \u2014 one payment with its active\n * allocations (invoice number, amount, who / how allocated) \u2014 Spec C.\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.payment.view'] },\n}\n\nexport async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const organizationId = resolveActiveOrganizationId(auth)\n    if (!organizationId) return organizationScopeRequiredResponse()\n    const { id } = await params\n    const em = (container.resolve('em') as EntityManager).fork()\n    const rows = (await em.execute(\n      `SELECT p.*, a.name AS bill_account_name, a.billing_mode AS bill_account_mode\n         FROM billing_payments p\n         LEFT JOIN billing_accounts a ON a.id = p.bill_account_id AND a.tenant_id = p.tenant_id\n        WHERE p.id = ? AND p.tenant_id = ? AND p.organization_id = ? AND p.deleted_at IS NULL`,\n      [id, auth.tenantId, organizationId],\n    )) as unknown as Array<Record<string, unknown>>\n    if (!rows?.length) return NextResponse.json({ error: 'Payment not found' }, { status: 404 })\n    const allocations = await em.execute(\n      `SELECT al.id, al.invoice_id, i.number AS invoice_number, i.document_type, i.status AS invoice_status,\n              al.amount, al.currency_code, al.allocated_by, al.user_id, al.created_at\n         FROM billing_allocations al\n         LEFT JOIN billing_invoices i ON i.id = al.invoice_id\n        WHERE al.source_type = 'payment' AND al.source_id = ? AND al.tenant_id = ? AND al.organization_id = ?\n          AND al.deleted_at IS NULL\n        ORDER BY al.created_at ASC`,\n      [id, auth.tenantId, organizationId],\n    )\n    return NextResponse.json({ payment: rows[0], allocations })\n  } catch (err) {\n    console.error('[billing/payments/[id].GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'Get a billing payment',\n      description: 'The payment (incl. match reason, account, top-up link) and its active allocations.',\n      responses: [{ status: 200, description: '`{ payment, allocations[] }`' }],\n      errors: [{ status: 404, description: 'Payment not found in this organization' }],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAOA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAAwC;AACvF,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG,UAAM,iBAAiB,4BAA4B,IAAI;AACvD,QAAI,CAAC,eAAgB,QAAO,kCAAkC;AAC9D,UAAM,EAAE,GAAG,IAAI,MAAM;AACrB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,OAAQ,MAAM,GAAG;AAAA,MACrB;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,IAAI,KAAK,UAAU,cAAc;AAAA,IACpC;AACA,QAAI,CAAC,MAAM,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC3F,UAAM,cAAc,MAAM,GAAG;AAAA,MAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,CAAC,IAAI,KAAK,UAAU,cAAc;AAAA,IACpC;AACA,WAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,YAAY,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,YAAQ,MAAM,+BAA+B,GAAG;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,+BAA+B,CAAC;AAAA,MACxE,QAAQ,CAAC,EAAE,QAAQ,KAAK,aAAa,yCAAyC,CAAC;AAAA,IACjF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/payments/allocate/route.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { runCommandRoute } from "../../../lib/commandRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.payment.manage"] }
+};
+const bodySchema = z.object({ paymentId: z.string().uuid(), allocations: z.array(z.object({ invoiceId: z.string().uuid(), amount: z.coerce.number().positive() })).min(1).max(100) });
+async function POST(req) {
+  return runCommandRoute(req, {
+    commandId: "billing.payments.allocate",
+    bodySchema,
+    resourceKind: "billing.payment",
+    resourceId: (body) => body.paymentId,
+    logLabel: "billing/payments/allocate.POST"
+  });
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Allocate a payment to invoices",
+      description: "Allocates amounts of a payment to open invoices / debit memos of its account. Invoice paid / outstanding / status are recomputed from allocations.",
+      requestBody: { schema: bodySchema },
+      responses: [{ status: 200, description: "Updated payment state" }],
+      errors: [
+        { status: 409, description: "`billing.allocation.exceeds_outstanding` / `insufficient_unallocated` / `account_mismatch` / `currency_mismatch` / `invoice_not_open`" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/payments/allocate/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/payments/allocate/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { runCommandRoute } from '../../../lib/commandRoute'\n\n/** `POST /api/billing/payments/allocate` \u2014 allocate a payment to invoices (Spec C). */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.payment.manage'] },\n}\n\nconst bodySchema = z.object({ paymentId: z.string().uuid(), allocations: z.array(z.object({ invoiceId: z.string().uuid(), amount: z.coerce.number().positive() })).min(1).max(100) })\n\nexport async function POST(req: Request) {\n  return runCommandRoute(req, {\n    commandId: 'billing.payments.allocate',\n    bodySchema,\n    resourceKind: 'billing.payment',\n    resourceId: (body) => body.paymentId,\n    logLabel: 'billing/payments/allocate.POST',\n  })\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Allocate a payment to invoices',\n      description: 'Allocates amounts of a payment to open invoices / debit memos of its account. Invoice paid / outstanding / status are recomputed from allocations.',\n      requestBody: { schema: bodySchema },\n      responses: [{ status: 200, description: 'Updated payment state' }],\n      errors: [\n        { status: 409, description: '`billing.allocation.exceeds_outstanding` / `insufficient_unallocated` / `account_mismatch` / `currency_mismatch` / `invoice_not_open`' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,uBAAuB;AAIzB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACzE;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,QAAQ,EAAE,OAAO,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC;AAEpL,eAAsB,KAAK,KAAc;AACvC,SAAO,gBAAgB,KAAK;AAAA,IAC1B,WAAW;AAAA,IACX;AAAA,IACA,cAAc;AAAA,IACd,YAAY,CAAC,SAAS,KAAK;AAAA,IAC3B,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,WAAW;AAAA,MAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,CAAC;AAAA,MACjE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wIAAwI;AAAA,MACtK;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/payments/assign/route.js

@@ -0,0 +1,36 @@
+import { z } from "zod";
+import { runCommandRoute } from "../../../lib/commandRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.payment.manage"] }
+};
+const bodySchema = z.object({ paymentId: z.string().uuid(), billAccountId: z.string().uuid() });
+async function POST(req) {
+  return runCommandRoute(req, {
+    commandId: "billing.payments.assign",
+    bodySchema,
+    resourceKind: "billing.payment",
+    resourceId: (body) => body.paymentId,
+    logLabel: "billing/payments/assign.POST"
+  });
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Assign a payment to a billing account",
+      description: "Assigns an unmatched payment to a postpaid account (status \u2192 matched) and applies it as credit to the account's open invoices, oldest due first.",
+      requestBody: { schema: bodySchema },
+      responses: [{ status: 200, description: "Updated payment state" }],
+      errors: [
+        { status: 404, description: "Payment or account not found" },
+        { status: 409, description: "`billing.payment.not_unmatched` / `prepaid_account` / `currency_mismatch`" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/payments/assign/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/payments/assign/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { runCommandRoute } from '../../../lib/commandRoute'\n\n/** `POST /api/billing/payments/assign` \u2014 assign a payment to a billing account (Spec C). */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.payment.manage'] },\n}\n\nconst bodySchema = z.object({ paymentId: z.string().uuid(), billAccountId: z.string().uuid() })\n\nexport async function POST(req: Request) {\n  return runCommandRoute(req, {\n    commandId: 'billing.payments.assign',\n    bodySchema,\n    resourceKind: 'billing.payment',\n    resourceId: (body) => body.paymentId,\n    logLabel: 'billing/payments/assign.POST',\n  })\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Assign a payment to a billing account',\n      description: 'Assigns an unmatched payment to a postpaid account (status \u2192 matched) and applies it as credit to the account\\'s open invoices, oldest due first.',\n      requestBody: { schema: bodySchema },\n      responses: [{ status: 200, description: 'Updated payment state' }],\n      errors: [\n        { status: 404, description: 'Payment or account not found' },\n        { status: 409, description: '`billing.payment.not_unmatched` / `prepaid_account` / `currency_mismatch`' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,uBAAuB;AAIzB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACzE;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE9F,eAAsB,KAAK,KAAc;AACvC,SAAO,gBAAgB,KAAK;AAAA,IAC1B,WAAW;AAAA,IACX;AAAA,IACA,cAAc;AAAA,IACd,YAAY,CAAC,SAAS,KAAK;AAAA,IAC3B,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,WAAW;AAAA,MAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,CAAC;AAAA,MACjE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,+BAA+B;AAAA,QAC3D,EAAE,QAAQ,KAAK,aAAa,4EAA4E;AAAA,MAC1G;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/payments/convert-to-topup/route.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { runCommandRoute } from "../../../lib/commandRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.payment.manage", "billing.topup.create"] }
+};
+const bodySchema = z.object({ paymentId: z.string().uuid(), billAccountId: z.string().uuid() });
+async function POST(req) {
+  return runCommandRoute(req, {
+    commandId: "billing.payments.convert_to_topup",
+    bodySchema,
+    resourceKind: "billing.payment",
+    resourceId: (body) => body.paymentId,
+    logLabel: "billing/payments/convert-to-topup.POST"
+  });
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Convert a payment into a prepaid top-up",
+      description: "Turns an unmatched payment into a captured top-up of a prepaid account (balance credit, transaction and VAT receipt). Terminal; idempotent per payment.",
+      requestBody: { schema: bodySchema },
+      responses: [{ status: 200, description: "Updated payment state" }],
+      errors: [
+        { status: 409, description: "`billing.payment.not_prepaid` / `currency_mismatch` / `not_convertible`" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/payments/convert-to-topup/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/payments/convert-to-topup/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { runCommandRoute } from '../../../lib/commandRoute'\n\n/** `POST /api/billing/payments/convert-to-topup` \u2014 convert a payment into a prepaid top-up (Spec C). */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.payment.manage', 'billing.topup.create'] },\n}\n\nconst bodySchema = z.object({ paymentId: z.string().uuid(), billAccountId: z.string().uuid() })\n\nexport async function POST(req: Request) {\n  return runCommandRoute(req, {\n    commandId: 'billing.payments.convert_to_topup',\n    bodySchema,\n    resourceKind: 'billing.payment',\n    resourceId: (body) => body.paymentId,\n    logLabel: 'billing/payments/convert-to-topup.POST',\n  })\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Convert a payment into a prepaid top-up',\n      description: 'Turns an unmatched payment into a captured top-up of a prepaid account (balance credit, transaction and VAT receipt). Terminal; idempotent per payment.',\n      requestBody: { schema: bodySchema },\n      responses: [{ status: 200, description: 'Updated payment state' }],\n      errors: [\n        { status: 409, description: '`billing.payment.not_prepaid` / `currency_mismatch` / `not_convertible`' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,uBAAuB;AAIzB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,sBAAsB,EAAE;AACjG;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,GAAG,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE9F,eAAsB,KAAK,KAAc;AACvC,SAAO,gBAAgB,KAAK;AAAA,IAC1B,WAAW;AAAA,IACX;AAAA,IACA,cAAc;AAAA,IACd,YAAY,CAAC,SAAS,KAAK;AAAA,IAC3B,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,WAAW;AAAA,MAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,CAAC;AAAA,MACjE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0EAA0E;AAAA,MACxG;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/payments/ignore/route.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { runCommandRoute } from "../../../lib/commandRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.payment.manage"] }
+};
+const bodySchema = z.object({ paymentId: z.string().uuid() });
+async function POST(req) {
+  return runCommandRoute(req, {
+    commandId: "billing.payments.ignore",
+    bodySchema,
+    resourceKind: "billing.payment",
+    resourceId: (body) => body.paymentId,
+    logLabel: "billing/payments/ignore.POST"
+  });
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Ignore a payment",
+      description: "Excludes an unallocated payment from matching and credit (fees, misdirected transfers). Reversible with restore.",
+      requestBody: { schema: bodySchema },
+      responses: [{ status: 200, description: "Updated payment state" }],
+      errors: [
+        { status: 409, description: "`billing.payment.has_allocations`" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/payments/ignore/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/payments/ignore/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { runCommandRoute } from '../../../lib/commandRoute'\n\n/** `POST /api/billing/payments/ignore` \u2014 ignore a payment (Spec C). */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.payment.manage'] },\n}\n\nconst bodySchema = z.object({ paymentId: z.string().uuid() })\n\nexport async function POST(req: Request) {\n  return runCommandRoute(req, {\n    commandId: 'billing.payments.ignore',\n    bodySchema,\n    resourceKind: 'billing.payment',\n    resourceId: (body) => body.paymentId,\n    logLabel: 'billing/payments/ignore.POST',\n  })\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Ignore a payment',\n      description: 'Excludes an unallocated payment from matching and credit (fees, misdirected transfers). Reversible with restore.',\n      requestBody: { schema: bodySchema },\n      responses: [{ status: 200, description: 'Updated payment state' }],\n      errors: [\n        { status: 409, description: '`billing.payment.has_allocations`' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,uBAAuB;AAIzB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACzE;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE5D,eAAsB,KAAK,KAAc;AACvC,SAAO,gBAAgB,KAAK;AAAA,IAC1B,WAAW;AAAA,IACX;AAAA,IACA,cAAc;AAAA,IACd,YAAY,CAAC,SAAS,KAAK;AAAA,IAC3B,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,WAAW;AAAA,MAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,CAAC;AAAA,MACjE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oCAAoC;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/payments/import/route.js

@@ -0,0 +1,63 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { PAYMENT_IMPORT_MAX_BYTES } from "../../../data/validators.js";
+import { readRequestBody, runCommandRoute } from "../../../lib/commandRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.payment.import"] }
+};
+const bodySchema = z.object({
+  fileName: z.string().trim().min(1).max(255),
+  content: z.string().max(PAYMENT_IMPORT_MAX_BYTES)
+});
+async function readUpload(req) {
+  const declared = Number(req.headers.get("content-length") ?? "0");
+  if (declared > PAYMENT_IMPORT_MAX_BYTES + 64 * 1024) {
+    return NextResponse.json({ error: "The file is larger than 2 MB", code: "billing.payment_import.too_large" }, { status: 413 });
+  }
+  if ((req.headers.get("content-type") ?? "").includes("multipart/form-data")) {
+    const form = await req.formData();
+    const file = form.get("file");
+    if (!file || typeof file === "string") return { fileName: "", content: "" };
+    if (file.size > PAYMENT_IMPORT_MAX_BYTES) {
+      return NextResponse.json({ error: "The file is larger than 2 MB", code: "billing.payment_import.too_large" }, { status: 413 });
+    }
+    return { fileName: file.name || "payments.csv", content: await file.text() };
+  }
+  return readRequestBody(req);
+}
+async function POST(req) {
+  const body = await readUpload(req.clone());
+  if (body instanceof Response) return body;
+  return runCommandRoute(
+    req,
+    {
+      commandId: "billing.payments.import",
+      bodySchema,
+      resourceKind: "billing.payment_import",
+      resourceId: () => null,
+      logLabel: "billing/payments/import.POST"
+    },
+    body
+  );
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Import bank payments from CSV",
+      description: 'CSV header `date,amount,currency,reference,payer_name,payer_account` (UTF-8, comma separated, "." decimals, amount > 0, \u2264 5,000 rows, \u2264 2 MB). Each new row becomes a payment, matched by the invoice number in `reference`; re-uploaded lines are counted as duplicates. Send multipart `file` or JSON `{ fileName, content }`.',
+      requestBody: { schema: bodySchema },
+      responses: [{ status: 200, description: "`{ importId, fileName, rowCount, counts, errors[] }`" }],
+      errors: [
+        { status: 400, description: "`billing.payment_import.invalid_file` (header / empty / too many rows)" },
+        { status: 413, description: "`billing.payment_import.too_large`" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/payments/import/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/payments/import/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { PAYMENT_IMPORT_MAX_BYTES } from '../../../data/validators'\nimport { readRequestBody, runCommandRoute } from '../../../lib/commandRoute'\n\n/**\n * `POST /api/billing/payments/import` \u2014 bank CSV upload (Spec C, C-D4).\n * Accepts `multipart/form-data` (`file`) or JSON `{ fileName, content }`.\n * 413 over 2 MB. Returns the import summary (counts per outcome + row errors).\n */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.payment.import'] },\n}\n\nconst bodySchema = z.object({\n  fileName: z.string().trim().min(1).max(255),\n  content: z.string().max(PAYMENT_IMPORT_MAX_BYTES),\n})\n\nasync function readUpload(req: Request): Promise<unknown | Response> {\n  const declared = Number(req.headers.get('content-length') ?? '0')\n  if (declared > PAYMENT_IMPORT_MAX_BYTES + 64 * 1024) {\n    return NextResponse.json({ error: 'The file is larger than 2 MB', code: 'billing.payment_import.too_large' }, { status: 413 })\n  }\n  if ((req.headers.get('content-type') ?? '').includes('multipart/form-data')) {\n    const form = await req.formData()\n    const file = form.get('file')\n    if (!file || typeof file === 'string') return { fileName: '', content: '' }\n    if (file.size > PAYMENT_IMPORT_MAX_BYTES) {\n      return NextResponse.json({ error: 'The file is larger than 2 MB', code: 'billing.payment_import.too_large' }, { status: 413 })\n    }\n    return { fileName: file.name || 'payments.csv', content: await file.text() }\n  }\n  return readRequestBody(req)\n}\n\nexport async function POST(req: Request) {\n  const body = await readUpload(req.clone())\n  if (body instanceof Response) return body\n  return runCommandRoute(\n    req,\n    {\n      commandId: 'billing.payments.import',\n      bodySchema,\n      resourceKind: 'billing.payment_import',\n      resourceId: () => null,\n      logLabel: 'billing/payments/import.POST',\n    },\n    body,\n  )\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Import bank payments from CSV',\n      description:\n        'CSV header `date,amount,currency,reference,payer_name,payer_account` (UTF-8, comma separated, ' +\n        '\".\" decimals, amount > 0, \u2264 5,000 rows, \u2264 2 MB). Each new row becomes a payment, matched by the ' +\n        'invoice number in `reference`; re-uploaded lines are counted as duplicates. Send multipart `file` or ' +\n        'JSON `{ fileName, content }`.',\n      requestBody: { schema: bodySchema },\n      responses: [{ status: 200, description: '`{ importId, fileName, rowCount, counts, errors[] }`' }],\n      errors: [\n        { status: 400, description: '`billing.payment_import.invalid_file` (header / empty / too many rows)' },\n        { status: 413, description: '`billing.payment_import.too_large`' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,gCAAgC;AACzC,SAAS,iBAAiB,uBAAuB;AAQ1C,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACzE;AAEA,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,SAAS,EAAE,OAAO,EAAE,IAAI,wBAAwB;AAClD,CAAC;AAED,eAAe,WAAW,KAA2C;AACnE,QAAM,WAAW,OAAO,IAAI,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AAChE,MAAI,WAAW,2BAA2B,KAAK,MAAM;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,MAAM,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/H;AACA,OAAK,IAAI,QAAQ,IAAI,cAAc,KAAK,IAAI,SAAS,qBAAqB,GAAG;AAC3E,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE,UAAU,IAAI,SAAS,GAAG;AAC1E,QAAI,KAAK,OAAO,0BAA0B;AACxC,aAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,MAAM,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/H;AACA,WAAO,EAAE,UAAU,KAAK,QAAQ,gBAAgB,SAAS,MAAM,KAAK,KAAK,EAAE;AAAA,EAC7E;AACA,SAAO,gBAAgB,GAAG;AAC5B;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,WAAW,IAAI,MAAM,CAAC;AACzC,MAAI,gBAAgB,SAAU,QAAO;AACrC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,MACE,WAAW;AAAA,MACX;AAAA,MACA,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aACE;AAAA,MAIF,aAAa,EAAE,QAAQ,WAAW;AAAA,MAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,uDAAuD,CAAC;AAAA,MAChG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yEAAyE;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/payments/restore/route.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { runCommandRoute } from "../../../lib/commandRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.payment.manage"] }
+};
+const bodySchema = z.object({ paymentId: z.string().uuid() });
+async function POST(req) {
+  return runCommandRoute(req, {
+    commandId: "billing.payments.restore",
+    bodySchema,
+    resourceKind: "billing.payment",
+    resourceId: (body) => body.paymentId,
+    logLabel: "billing/payments/restore.POST"
+  });
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Restore an ignored payment",
+      description: "Restores an ignored payment to matched (credit applied again) or unmatched.",
+      requestBody: { schema: bodySchema },
+      responses: [{ status: 200, description: "Updated payment state" }],
+      errors: [
+        { status: 409, description: "`billing.payment.not_ignored`" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/payments/restore/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/payments/restore/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { runCommandRoute } from '../../../lib/commandRoute'\n\n/** `POST /api/billing/payments/restore` \u2014 restore an ignored payment (Spec C). */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.payment.manage'] },\n}\n\nconst bodySchema = z.object({ paymentId: z.string().uuid() })\n\nexport async function POST(req: Request) {\n  return runCommandRoute(req, {\n    commandId: 'billing.payments.restore',\n    bodySchema,\n    resourceKind: 'billing.payment',\n    resourceId: (body) => body.paymentId,\n    logLabel: 'billing/payments/restore.POST',\n  })\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Restore an ignored payment',\n      description: 'Restores an ignored payment to matched (credit applied again) or unmatched.',\n      requestBody: { schema: bodySchema },\n      responses: [{ status: 200, description: 'Updated payment state' }],\n      errors: [\n        { status: 409, description: '`billing.payment.not_ignored`' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,uBAAuB;AAIzB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACzE;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE5D,eAAsB,KAAK,KAAc;AACvC,SAAO,gBAAgB,KAAK;AAAA,IAC1B,WAAW;AAAA,IACX;AAAA,IACA,cAAc;AAAA,IACd,YAAY,CAAC,SAAS,KAAK;AAAA,IAC3B,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,WAAW;AAAA,MAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,CAAC;AAAA,MACjE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/payments/route.js

@@ -0,0 +1,114 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import {
+  organizationScopeRequiredResponse,
+  resolveActiveOrganizationId
+} from "@open-mercato/shared/lib/auth/organizationScope";
+import { buildQueryParams } from "@open-mercato/shared/lib/crud/query-params";
+import { billingPaymentListQuerySchema } from "../../data/validators.js";
+import { runCommandRoute } from "../../lib/commandRoute.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["billing.payment.view"] },
+  POST: { requireAuth: true, requireFeatures: ["billing.payment.manage"] }
+};
+async function GET(req) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    const organizationId = resolveActiveOrganizationId(auth);
+    if (!organizationId) return organizationScopeRequiredResponse();
+    const query = billingPaymentListQuerySchema.parse(buildQueryParams(new URL(req.url).searchParams));
+    const em = container.resolve("em").fork();
+    const where = ["p.tenant_id = ?", "p.organization_id = ?", "p.deleted_at IS NULL"];
+    const params = [auth.tenantId, organizationId];
+    const filters = [
+      [query.id, "p.id = ?"],
+      [query.status, "p.status = ?"],
+      [query.billAccountId, "p.bill_account_id = ?"],
+      [query.importId, "p.import_id = ?"],
+      [query.receivedFrom, "p.received_at >= ?::date"],
+      [query.receivedTo, "p.received_at <= ?::date"]
+    ];
+    for (const [value, clause] of filters) {
+      if (value === void 0 || value === null || value === "") continue;
+      where.push(clause);
+      params.push(value);
+    }
+    if (query.search) {
+      const like = `%${query.search.replace(/[%_\\]/g, (m) => `\\${m}`)}%`;
+      where.push("(p.reference ILIKE ? OR p.payer_name ILIKE ? OR p.payer_account ILIKE ?)");
+      params.push(like, like, like);
+    }
+    const whereSql = where.join(" AND ");
+    const totalRows = await em.execute(`SELECT COUNT(*)::int AS total FROM billing_payments p WHERE ${whereSql}`, params);
+    const total = totalRows?.[0]?.total ?? 0;
+    const items = await em.execute(
+      `SELECT p.id, p.received_at, p.amount, p.currency_code, p.reference, p.payer_name, p.payer_account, p.source,
+              p.import_id, p.bill_account_id, a.name AS bill_account_name, p.status, p.unallocated_amount,
+              p.match_reason, p.topup_id, p.created_at
+         FROM billing_payments p
+         LEFT JOIN billing_accounts a ON a.id = p.bill_account_id AND a.tenant_id = p.tenant_id
+        WHERE ${whereSql}
+        ORDER BY p.received_at DESC, p.created_at DESC
+        LIMIT ? OFFSET ?`,
+      [...params, query.pageSize, (query.page - 1) * query.pageSize]
+    );
+    return NextResponse.json({
+      items,
+      total,
+      page: query.page,
+      pageSize: query.pageSize,
+      totalPages: total === 0 ? 1 : Math.ceil(total / query.pageSize)
+    });
+  } catch (err) {
+    if (err instanceof z.ZodError) return NextResponse.json({ error: "Invalid query", issues: err.issues }, { status: 400 });
+    console.error("[billing/payments.GET]", err);
+    return NextResponse.json({ error: "Internal error" }, { status: 500 });
+  }
+}
+const createBodySchema = z.object({
+  receivedAt: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  amount: z.coerce.number().positive(),
+  currencyCode: z.string().trim().length(3),
+  reference: z.string().trim().max(500).optional(),
+  payerName: z.string().trim().max(255).optional(),
+  payerAccount: z.string().trim().max(64).optional(),
+  billAccountId: z.string().uuid().optional()
+});
+async function POST(req) {
+  return runCommandRoute(req, {
+    commandId: "billing.payments.create",
+    bodySchema: createBodySchema,
+    resourceKind: "billing.payment",
+    resourceId: () => null,
+    logLabel: "billing/payments.POST"
+  });
+}
+const openApi = {
+  methods: {
+    GET: {
+      tags: ["Billing"],
+      summary: "List billing payments",
+      description: "Payment register (bank CSV lines, manual entries, gateway captures). Filters: status (`unmatched | matched | partially_allocated | allocated | ignored | converted_to_topup`), billAccountId, importId, receivedFrom / receivedTo (YYYY-MM-DD), search (reference, payer). pageSize \u2264 100.",
+      query: billingPaymentListQuerySchema
+    },
+    POST: {
+      tags: ["Billing"],
+      summary: "Record a payment manually",
+      description: "Creates a manual payment. With `billAccountId` it is matched and applied as credit to the account's open invoices (oldest due first); otherwise it stays unmatched.",
+      requestBody: { schema: createBodySchema },
+      responses: [{ status: 200, description: "`{ paymentId, status, unallocatedAmount }`" }],
+      errors: [{ status: 409, description: "`billing.payment.currency_mismatch`" }]
+    }
+  }
+};
+export {
+  GET,
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/payments/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/billing/api/payments/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  organizationScopeRequiredResponse,\n  resolveActiveOrganizationId,\n} from '@open-mercato/shared/lib/auth/organizationScope'\nimport { buildQueryParams } from '@open-mercato/shared/lib/crud/query-params'\nimport { billingPaymentListQuerySchema } from '../../data/validators'\nimport { runCommandRoute } from '../../lib/commandRoute'\n\n/**\n * `GET /api/billing/payments` \u2014 the payment register (Spec C), newest first.\n * Filters: status, billAccountId, importId, receivedFrom / receivedTo,\n * search (reference / payer name / payer account). Rows carry the account\n * name (joined). Hand-written SQL like the invoice list.\n *\n * `POST /api/billing/payments` \u2014 manual payment entry (`billing.payments.create`).\n */\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['billing.payment.view'] },\n  POST: { requireAuth: true, requireFeatures: ['billing.payment.manage'] },\n}\n\nexport type BillingPaymentRow = {\n  id: string\n  received_at: string\n  amount: string\n  currency_code: string\n  reference: string | null\n  payer_name: string | null\n  payer_account: string | null\n  source: string\n  import_id: string | null\n  bill_account_id: string | null\n  bill_account_name: string | null\n  status: string\n  unallocated_amount: string\n  match_reason: string | null\n  topup_id: string | null\n  created_at: string\n}\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    const organizationId = resolveActiveOrganizationId(auth)\n    if (!organizationId) return organizationScopeRequiredResponse()\n    const query = billingPaymentListQuerySchema.parse(buildQueryParams(new URL(req.url).searchParams))\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const where: string[] = ['p.tenant_id = ?', 'p.organization_id = ?', 'p.deleted_at IS NULL']\n    const params: unknown[] = [auth.tenantId, organizationId]\n    const filters: Array<[unknown, string]> = [\n      [query.id, 'p.id = ?'],\n      [query.status, 'p.status = ?'],\n      [query.billAccountId, 'p.bill_account_id = ?'],\n      [query.importId, 'p.import_id = ?'],\n      [query.receivedFrom, 'p.received_at >= ?::date'],\n      [query.receivedTo, 'p.received_at <= ?::date'],\n    ]\n    for (const [value, clause] of filters) {\n      if (value === undefined || value === null || value === '') continue\n      where.push(clause)\n      params.push(value)\n    }\n    if (query.search) {\n      const like = `%${query.search.replace(/[%_\\\\]/g, (m) => `\\\\${m}`)}%`\n      where.push('(p.reference ILIKE ? OR p.payer_name ILIKE ? OR p.payer_account ILIKE ?)')\n      params.push(like, like, like)\n    }\n    const whereSql = where.join(' AND ')\n    const totalRows = (await em.execute(`SELECT COUNT(*)::int AS total FROM billing_payments p WHERE ${whereSql}`, params)) as unknown as Array<{ total: number }>\n    const total = totalRows?.[0]?.total ?? 0\n    const items = (await em.execute(\n      `SELECT p.id, p.received_at, p.amount, p.currency_code, p.reference, p.payer_name, p.payer_account, p.source,\n              p.import_id, p.bill_account_id, a.name AS bill_account_name, p.status, p.unallocated_amount,\n              p.match_reason, p.topup_id, p.created_at\n         FROM billing_payments p\n         LEFT JOIN billing_accounts a ON a.id = p.bill_account_id AND a.tenant_id = p.tenant_id\n        WHERE ${whereSql}\n        ORDER BY p.received_at DESC, p.created_at DESC\n        LIMIT ? OFFSET ?`,\n      [...params, query.pageSize, (query.page - 1) * query.pageSize],\n    )) as unknown as BillingPaymentRow[]\n    return NextResponse.json({\n      items,\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: total === 0 ? 1 : Math.ceil(total / query.pageSize),\n    })\n  } catch (err) {\n    if (err instanceof z.ZodError) return NextResponse.json({ error: 'Invalid query', issues: err.issues }, { status: 400 })\n    console.error('[billing/payments.GET]', err)\n    return NextResponse.json({ error: 'Internal error' }, { status: 500 })\n  }\n}\n\nconst createBodySchema = z.object({\n  receivedAt: z.string().regex(/^\\d{4}-\\d{2}-\\d{2}$/),\n  amount: z.coerce.number().positive(),\n  currencyCode: z.string().trim().length(3),\n  reference: z.string().trim().max(500).optional(),\n  payerName: z.string().trim().max(255).optional(),\n  payerAccount: z.string().trim().max(64).optional(),\n  billAccountId: z.string().uuid().optional(),\n})\n\nexport async function POST(req: Request) {\n  return runCommandRoute(req, {\n    commandId: 'billing.payments.create',\n    bodySchema: createBodySchema,\n    resourceKind: 'billing.payment',\n    resourceId: () => null,\n    logLabel: 'billing/payments.POST',\n  })\n}\n\nexport const openApi = {\n  methods: {\n    GET: {\n      tags: ['Billing'],\n      summary: 'List billing payments',\n      description:\n        'Payment register (bank CSV lines, manual entries, gateway captures). Filters: status ' +\n        '(`unmatched | matched | partially_allocated | allocated | ignored | converted_to_topup`), billAccountId, ' +\n        'importId, receivedFrom / receivedTo (YYYY-MM-DD), search (reference, payer). pageSize \u2264 100.',\n      query: billingPaymentListQuerySchema,\n    },\n    POST: {\n      tags: ['Billing'],\n      summary: 'Record a payment manually',\n      description:\n        'Creates a manual payment. With `billAccountId` it is matched and applied as credit to the ' +\n        \"account's open invoices (oldest due first); otherwise it stays unmatched.\",\n      requestBody: { schema: createBodySchema },\n      responses: [{ status: 200, description: '`{ paymentId, status, unallocatedAmount }`' }],\n      errors: [{ status: 409, description: '`billing.payment.currency_mismatch`' }],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,qCAAqC;AAC9C,SAAS,uBAAuB;AAWzB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AAAA,EACpE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACzE;AAqBA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG,UAAM,iBAAiB,4BAA4B,IAAI;AACvD,QAAI,CAAC,eAAgB,QAAO,kCAAkC;AAC9D,UAAM,QAAQ,8BAA8B,MAAM,iBAAiB,IAAI,IAAI,IAAI,GAAG,EAAE,YAAY,CAAC;AACjG,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,QAAkB,CAAC,mBAAmB,yBAAyB,sBAAsB;AAC3F,UAAM,SAAoB,CAAC,KAAK,UAAU,cAAc;AACxD,UAAM,UAAoC;AAAA,MACxC,CAAC,MAAM,IAAI,UAAU;AAAA,MACrB,CAAC,MAAM,QAAQ,cAAc;AAAA,MAC7B,CAAC,MAAM,eAAe,uBAAuB;AAAA,MAC7C,CAAC,MAAM,UAAU,iBAAiB;AAAA,MAClC,CAAC,MAAM,cAAc,0BAA0B;AAAA,MAC/C,CAAC,MAAM,YAAY,0BAA0B;AAAA,IAC/C;AACA,eAAW,CAAC,OAAO,MAAM,KAAK,SAAS;AACrC,UAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI;AAC3D,YAAM,KAAK,MAAM;AACjB,aAAO,KAAK,KAAK;AAAA,IACnB;AACA,QAAI,MAAM,QAAQ;AAChB,YAAM,OAAO,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AACjE,YAAM,KAAK,0EAA0E;AACrF,aAAO,KAAK,MAAM,MAAM,IAAI;AAAA,IAC9B;AACA,UAAM,WAAW,MAAM,KAAK,OAAO;AACnC,UAAM,YAAa,MAAM,GAAG,QAAQ,+DAA+D,QAAQ,IAAI,MAAM;AACrH,UAAM,QAAQ,YAAY,CAAC,GAAG,SAAS;AACvC,UAAM,QAAS,MAAM,GAAG;AAAA,MACtB;AAAA;AAAA;AAAA;AAAA;AAAA,gBAKU,QAAQ;AAAA;AAAA;AAAA,MAGlB,CAAC,GAAG,QAAQ,MAAM,WAAW,MAAM,OAAO,KAAK,MAAM,QAAQ;AAAA,IAC/D;AACA,WAAO,aAAa,KAAK;AAAA,MACvB;AAAA,MACA;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,UAAU,IAAI,IAAI,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,IAChE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,QAAQ,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvH,YAAQ,MAAM,0BAA0B,GAAG;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,YAAY,EAAE,OAAO,EAAE,MAAM,qBAAqB;AAAA,EAClD,QAAQ,EAAE,OAAO,OAAO,EAAE,SAAS;AAAA,EACnC,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACjD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC5C,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,SAAO,gBAAgB,KAAK;AAAA,IAC1B,WAAW;AAAA,IACX,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,KAAK;AAAA,MACH,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aACE;AAAA,MAGF,OAAO;AAAA,IACT;AAAA,IACA,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aACE;AAAA,MAEF,aAAa,EAAE,QAAQ,iBAAiB;AAAA,MACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,6CAA6C,CAAC;AAAA,MACtF,QAAQ,CAAC,EAAE,QAAQ,KAAK,aAAa,sCAAsC,CAAC;AAAA,IAC9E;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/billing/api/payments/unallocate/route.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { runCommandRoute } from "../../../lib/commandRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["billing.payment.manage"] }
+};
+const bodySchema = z.object({ allocationId: z.string().uuid() });
+async function POST(req) {
+  return runCommandRoute(req, {
+    commandId: "billing.payments.unallocate",
+    bodySchema,
+    resourceKind: "billing.payment",
+    resourceId: (body) => body.allocationId,
+    logLabel: "billing/payments/unallocate.POST"
+  });
+}
+const openApi = {
+  methods: {
+    POST: {
+      tags: ["Billing"],
+      summary: "Remove an allocation",
+      description: "Un-allocates a payment or credit memo allocation (soft delete, history kept). The source's unallocated amount is restored and the invoice recomputed.",
+      requestBody: { schema: bodySchema },
+      responses: [{ status: 200, description: "Updated payment state" }],
+      errors: [
+        { status: 404, description: "Allocation not found" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/billing/api/payments/unallocate/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/billing/api/payments/unallocate/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { runCommandRoute } from '../../../lib/commandRoute'\n\n/** `POST /api/billing/payments/unallocate` \u2014 remove an allocation (Spec C). */\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['billing.payment.manage'] },\n}\n\nconst bodySchema = z.object({ allocationId: z.string().uuid() })\n\nexport async function POST(req: Request) {\n  return runCommandRoute(req, {\n    commandId: 'billing.payments.unallocate',\n    bodySchema,\n    resourceKind: 'billing.payment',\n    resourceId: (body) => body.allocationId,\n    logLabel: 'billing/payments/unallocate.POST',\n  })\n}\n\nexport const openApi = {\n  methods: {\n    POST: {\n      tags: ['Billing'],\n      summary: 'Remove an allocation',\n      description: 'Un-allocates a payment or credit memo allocation (soft delete, history kept). The source\\'s unallocated amount is restored and the invoice recomputed.',\n      requestBody: { schema: bodySchema },\n      responses: [{ status: 200, description: 'Updated payment state' }],\n      errors: [\n        { status: 404, description: 'Allocation not found' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,uBAAuB;AAIzB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AACzE;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAE/D,eAAsB,KAAK,KAAc;AACvC,SAAO,gBAAgB,KAAK;AAAA,IAC1B,WAAW;AAAA,IACX;AAAA,IACA,cAAc;AAAA,IACd,YAAY,CAAC,SAAS,KAAK;AAAA,IAC3B,UAAU;AAAA,EACZ,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,WAAW;AAAA,MAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,CAAC;AAAA,MACjE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}