@endora-commerce/mod-invoice-ledger 0.100.0

package/dist/manifest.js

@@ -0,0 +1,112 @@
+import { CAPABILITY_KEYS, defineModuleManifest, defineModuleSettingsManifest, INVOICE_LEDGER_READ_PERMISSION, INVOICE_LEDGER_SETTING_CODES, INVOICE_LEDGER_WRITE_PERMISSION, } from '@endora-commerce/contracts';
+export const invoiceLedgerSettingsManifest = defineModuleSettingsManifest({
+    moduleCode: 'invoice_ledger',
+    groups: [{ code: 'invoice_ledger', name: 'Invoice ledger' }],
+    settings: [
+        {
+            code: INVOICE_LEDGER_SETTING_CODES.NUMBERING_MODE,
+            name: 'Invoice numbering source',
+            description: 'Whether issued VAT numbers stay Endora-assigned (mode A) or wait for the ledger vendor (mode B). Sales-channel value overrides the instance default.',
+            groupCode: 'invoice_ledger',
+            valueType: 'string',
+            enumOptions: ['endora', 'vendor'],
+            defaultValue: 'endora',
+        },
+        {
+            code: INVOICE_LEDGER_SETTING_CODES.KSEF_ROUTING,
+            name: 'KSeF submission routing',
+            description: 'Native leaves submission to the platform (a KSeF submission module, when one is installed). Vendor skips native enqueue even when the ledger adapter is off. Sales-channel value overrides the instance default.',
+            groupCode: 'invoice_ledger',
+            valueType: 'string',
+            enumOptions: ['native', 'vendor'],
+            defaultValue: 'native',
+        },
+    ],
+});
+export const manifest = defineModuleManifest({
+    id: 'invoice_ledger',
+    name: 'Invoice ledger',
+    description: 'Shared invoice-ledger rails: vendor mutex, numbering and KSeF routing, deliveries, and document maps. Vendor HTTP lives in the vendor adapter modules.',
+    version: '1.0.0',
+    dependencies: ['settings', 'organizations', 'admin_users', 'sales_channels'],
+    nonBindingDependencies: [
+        {
+            moduleId: 'invoices',
+            name: 'invoiceNumberingHostPort',
+            kind: 'refuses-without',
+            whenAbsent: 'Webhook apply cannot write vendor-assigned numbers while invoices is off.',
+            reason: 'invoice_ledger is non-deactivatable, so invoices cannot be a hard dependency.',
+        },
+        {
+            moduleId: 'invoices',
+            name: 'invoicePaidHostPort',
+            kind: 'refuses-without',
+            whenAbsent: 'Webhook apply cannot stamp an invoice paid from the vendor while invoices is off.',
+            reason: 'invoice_ledger is non-deactivatable, so invoices cannot be a hard dependency.',
+        },
+        {
+            moduleId: 'invoices',
+            name: 'invoiceKsefAssignmentPort',
+            kind: 'refuses-without',
+            whenAbsent: 'Webhook apply cannot record a vendor-assigned KSeF number while invoices is off.',
+            reason: 'invoice_ledger is non-deactivatable, so invoices cannot be a hard dependency.',
+        },
+        {
+            moduleId: 'invoices',
+            name: 'invoiceCopyHostPort',
+            kind: 'degrades-without',
+            whenAbsent: 'Delivery list shows invoice ids without numbers while invoices is off, and no new delivery is queued.',
+            reason: 'List reads invoice numbers through the invoices copy port, and the enqueue path reads the buyer organization it freezes on the delivery row through the same port — the two ledger tables carry their own tenant key rather than hanging off Invoice, because invoice_ledger is non-deactivatable and invoices cannot be a hard dependency. With invoices off nothing issues an invoice, so there is no delivery to queue and the degrade is the list alone.',
+        },
+    ],
+    activation: {
+        nonDeactivatable: true,
+        reason: 'The shared invoice ledger registry must stay available so operator activation of a ledger vendor can be refused when another is already active.',
+    },
+    settings: invoiceLedgerSettingsManifest,
+    i18n: { bundlesDir: 'i18n' },
+    docs: { dir: 'docs' },
+    /**
+     * Feature 132 — this module **owns** the invoice-ledger vendor capability and
+     * declares it mutually exclusive, minting the code an operator meets
+     * (`contracts/module-capabilities.md` R3.1). A vendor raises the code and must
+     * not declare it (D-95.2); it declares membership and nothing more.
+     */
+    exclusiveCapabilities: [
+        {
+            key: CAPABILITY_KEYS.INVOICE_LEDGER_VENDOR,
+            errorCode: 'INVOICE_LEDGER_VENDOR_ALREADY_ACTIVE',
+        },
+    ],
+    errorCodes: [
+        { code: 'INVOICE_LEDGER_VENDOR_ALREADY_ACTIVE' },
+        { code: 'INVOICE_LEDGER_CREDENTIALS_MISSING' },
+        { code: 'INVOICE_LEDGER_DELIVERY_NOT_RETRYABLE' },
+    ],
+    permissions: [
+        {
+            code: INVOICE_LEDGER_READ_PERMISSION,
+            label: 'View invoice ledger deliveries',
+            description: 'Allows viewing ledger routing and delivery history.',
+        },
+        {
+            code: INVOICE_LEDGER_WRITE_PERMISSION,
+            label: 'Manage invoice ledger',
+            description: 'Allows changing numbering and KSeF routing, and retrying deliveries.',
+            requires: [INVOICE_LEDGER_READ_PERMISSION],
+        },
+    ],
+    actions: [
+        {
+            id: 'open-invoice-ledger-deliveries',
+            labelKey: 'actions.openDeliveries.label',
+            descriptionKey: 'actions.openDeliveries.description',
+            icon: 'ClipboardList',
+            targetRoute: '/invoice-ledger/deliveries',
+            requiredPermission: INVOICE_LEDGER_READ_PERMISSION,
+            keywords: ['ledger', 'deliveries', 'invoices', 'faktury'],
+            weight: 245,
+        },
+    ],
+});
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;IACxE,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC5D,QAAQ,EAAE;QACR;YACE,IAAI,EAAE,4BAA4B,CAAC,cAAc;YACjD,IAAI,EAAE,0BAA0B;YAChC,WAAW,EACT,sJAAsJ;YACxJ,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;YACjC,YAAY,EAAE,QAAQ;SACvB;QACD;YACE,IAAI,EAAE,4BAA4B,CAAC,YAAY;YAC/C,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EACT,kNAAkN;YACpN,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;YACjC,YAAY,EAAE,QAAQ;SACvB;KACF;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,gBAAgB;IACtB,WAAW,EACT,wJAAwJ;IAC1J,OAAO,EAAE,OAAO;IAChB,YAAY,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,CAAC;IAC5E,sBAAsB,EAAE;QACtB;YACE,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,2EAA2E;YACvF,MAAM,EACJ,+EAA+E;SAClF;QACD;YACE,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,mFAAmF;YAC/F,MAAM,EACJ,+EAA+E;SAClF;QACD;YACE,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,kFAAkF;YAC9F,MAAM,EACJ,+EAA+E;SAClF;QACD;YACE,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,kBAAkB;YACxB,UAAU,EACR,uGAAuG;YACzG,MAAM,EACJ,8bAA8b;SACjc;KACF;IACD,UAAU,EAAE;QACV,gBAAgB,EAAE,IAAI;QACtB,MAAM,EACJ,iJAAiJ;KACpJ;IACD,QAAQ,EAAE,6BAA6B;IACvC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB;;;;;OAKG;IACH,qBAAqB,EAAE;QACrB;YACE,GAAG,EAAE,eAAe,CAAC,qBAAqB;YAC1C,SAAS,EAAE,sCAAsC;SAClD;KACF;IACD,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,sCAAsC,EAAE;QAChD,EAAE,IAAI,EAAE,oCAAoC,EAAE;QAC9C,EAAE,IAAI,EAAE,uCAAuC,EAAE;KAClD;IACD,WAAW,EAAE;QACX;YACE,IAAI,EAAE,8BAA8B;YACpC,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,qDAAqD;SACnE;QACD;YACE,IAAI,EAAE,+BAA+B;YACrC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,sEAAsE;YACnF,QAAQ,EAAE,CAAC,8BAA8B,CAAC;SAC3C;KACF;IACD,OAAO,EAAE;QACP;YACE,EAAE,EAAE,gCAAgC;YACpC,QAAQ,EAAE,8BAA8B;YACxC,cAAc,EAAE,oCAAoC;YACpD,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,4BAA4B;YACzC,kBAAkB,EAAE,8BAA8B;YAClD,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC;YACzD,MAAM,EAAE,GAAG;SACZ;KACF;CACF,CAAC,CAAC"}

package/dist/migrations/20260908T125013_invoice_ledger_init.d.ts

@@ -0,0 +1,12 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 119 — `invoice_ledger` shared rails (init).
+ *
+ * Five tables per data-model.md. Infakt owns none. UUID invoice ids only:
+ * no foreign key to `invoices` (locked ledger, switchable invoices).
+ */
+export declare class Migration20260908T125013InvoiceLedgerInit extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260908T125013_invoice_ledger_init.d.ts.map

package/dist/migrations/20260908T125013_invoice_ledger_init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260908T125013_invoice_ledger_init.d.ts","sourceRoot":"","sources":["../../src/migrations/20260908T125013_invoice_ledger_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;GAKG;AACH,qBAAa,yCAA0C,SAAQ,SAAS;IACvD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAmKnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAOrC"}

package/dist/migrations/20260908T125013_invoice_ledger_init.js

@@ -0,0 +1,167 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 119 — `invoice_ledger` shared rails (init).
+ *
+ * Five tables per data-model.md. Infakt owns none. UUID invoice ids only:
+ * no foreign key to `invoices` (locked ledger, switchable invoices).
+ */
+export class Migration20260908T125013InvoiceLedgerInit extends Migration {
+    async up() {
+        this.addSql(`
+      create table "invoice_ledger_activation_lock" (
+        "id" uuid not null,
+        "active_module_id" varchar(64) null,
+        "updated_at" timestamptz not null,
+        "updated_by_admin_id" uuid null,
+        constraint "invoice_ledger_activation_lock_pkey" primary key ("id"),
+        constraint "invoice_ledger_activation_lock_id_ck"
+          check ("id" = '00000000-0000-4000-8000-000000000001')
+      );
+    `);
+        this.addSql(`
+      alter table "invoice_ledger_activation_lock"
+        add constraint "invoice_ledger_activation_lock_updated_by_admin_id_foreign"
+        foreign key ("updated_by_admin_id") references "admin_users" ("id")
+        on update cascade on delete set null;
+    `);
+        this.addSql(`
+      create table "invoice_ledger_client_maps" (
+        "id" uuid not null,
+        "adapter_id" varchar(64) not null,
+        "organization_id" uuid not null,
+        "nip_used" varchar(32) not null,
+        "remote_client_id" varchar(64) not null,
+        "sales_channel_id" uuid null,
+        "credential_code" varchar(128) not null,
+        "environment" varchar(16) not null,
+        "updated_at" timestamptz not null,
+        constraint "invoice_ledger_client_maps_pkey" primary key ("id"),
+        constraint "invoice_ledger_client_maps_environment_ck"
+          check ("environment" in ('sandbox', 'production')),
+        constraint "invoice_ledger_client_maps_adapter_org_env_cred_uq"
+          unique ("adapter_id", "organization_id", "environment", "credential_code")
+      );
+    `);
+        this.addSql(`create index "invoice_ledger_client_maps_organization_id_idx" on "invoice_ledger_client_maps" ("organization_id");`);
+        this.addSql(`
+      alter table "invoice_ledger_client_maps"
+        add constraint "invoice_ledger_client_maps_organization_id_foreign"
+        foreign key ("organization_id") references "organizations" ("id")
+        on update cascade;
+    `);
+        this.addSql(`
+      alter table "invoice_ledger_client_maps"
+        add constraint "invoice_ledger_client_maps_sales_channel_id_foreign"
+        foreign key ("sales_channel_id") references "sales_channels" ("id")
+        on update cascade on delete set null;
+    `);
+        this.addSql(`
+      create table "invoice_ledger_document_maps" (
+        "id" uuid not null,
+        "adapter_id" varchar(64) not null,
+        "invoice_id" uuid not null,
+        "original_invoice_id" uuid null,
+        "remote_document_id" varchar(64) null,
+        "environment" varchar(16) not null,
+        "credential_code" varchar(128) not null,
+        "created_at" timestamptz not null,
+        constraint "invoice_ledger_document_maps_pkey" primary key ("id"),
+        constraint "invoice_ledger_document_maps_environment_ck"
+          check ("environment" in ('sandbox', 'production')),
+        constraint "invoice_ledger_document_maps_adapter_invoice_uq"
+          unique ("adapter_id", "invoice_id")
+      );
+    `);
+        this.addSql(`create index "invoice_ledger_document_maps_original_invoice_id_idx" on "invoice_ledger_document_maps" ("original_invoice_id");`);
+        this.addSql(`
+      create unique index "invoice_ledger_document_maps_remote_cred_uq"
+        on "invoice_ledger_document_maps" ("adapter_id", "remote_document_id", "environment", "credential_code")
+        where "remote_document_id" is not null;
+    `);
+        this.addSql(`
+      create table "invoice_ledger_deliveries" (
+        "id" uuid not null,
+        "adapter_id" varchar(64) not null,
+        "invoice_id" uuid not null,
+        "kind" varchar(16) not null,
+        "sales_channel_id" uuid null,
+        "credential_code" varchar(128) not null,
+        "environment" varchar(16) not null,
+        "numbering_mode" varchar(16) not null,
+        "ksef_routing" varchar(16) not null,
+        "status" varchar(24) not null,
+        "async_task_id" varchar(128) null,
+        "remote_document_id" varchar(64) null,
+        "idempotency_key" varchar(128) not null,
+        "attempt_count" int not null default 0,
+        "attempts" jsonb not null default '[]',
+        "last_error" text null,
+        "remote_paid_at" timestamptz null,
+        "ksef_delegated" boolean not null default false,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "invoice_ledger_deliveries_pkey" primary key ("id"),
+        constraint "invoice_ledger_deliveries_kind_ck"
+          check ("kind" in ('invoice', 'correction')),
+        constraint "invoice_ledger_deliveries_environment_ck"
+          check ("environment" in ('sandbox', 'production')),
+        constraint "invoice_ledger_deliveries_numbering_mode_ck"
+          check ("numbering_mode" in ('endora', 'vendor')),
+        constraint "invoice_ledger_deliveries_ksef_routing_ck"
+          check ("ksef_routing" in ('native', 'vendor')),
+        constraint "invoice_ledger_deliveries_status_ck"
+          check ("status" in ('queued', 'awaiting_remote', 'succeeded', 'failed', 'dead')),
+        constraint "invoice_ledger_deliveries_attempt_count_ck"
+          check ("attempt_count" >= 0),
+        constraint "invoice_ledger_deliveries_adapter_invoice_uq"
+          unique ("adapter_id", "invoice_id"),
+        constraint "invoice_ledger_deliveries_adapter_idempotency_uq"
+          unique ("adapter_id", "idempotency_key")
+      );
+    `);
+        this.addSql(`create index "invoice_ledger_deliveries_status_idx" on "invoice_ledger_deliveries" ("status");`);
+        this.addSql(`
+      create index "invoice_ledger_deliveries_remote_document_idx"
+        on "invoice_ledger_deliveries" ("adapter_id", "remote_document_id")
+        where "remote_document_id" is not null;
+    `);
+        this.addSql(`
+      create unique index "invoice_ledger_deliveries_async_task_uq"
+        on "invoice_ledger_deliveries" ("adapter_id", "async_task_id")
+        where "async_task_id" is not null;
+    `);
+        this.addSql(`
+      alter table "invoice_ledger_deliveries"
+        add constraint "invoice_ledger_deliveries_sales_channel_id_foreign"
+        foreign key ("sales_channel_id") references "sales_channels" ("id")
+        on update cascade on delete set null;
+    `);
+        this.addSql(`
+      create table "invoice_ledger_webhook_receipts" (
+        "id" uuid not null,
+        "adapter_id" varchar(64) not null,
+        "event_id" varchar(128) not null,
+        "event_type" varchar(64) not null,
+        "state" varchar(24) not null,
+        "attempts" int not null default 0,
+        "received_at" timestamptz not null,
+        "applied_at" timestamptz null,
+        "error" text null,
+        constraint "invoice_ledger_webhook_receipts_pkey" primary key ("id"),
+        constraint "invoice_ledger_webhook_receipts_state_ck"
+          check ("state" in ('received', 'processed', 'ignored', 'failed')),
+        constraint "invoice_ledger_webhook_receipts_adapter_event_uq"
+          unique ("adapter_id", "event_id")
+      );
+    `);
+        this.addSql(`create index "invoice_ledger_webhook_receipts_state_idx" on "invoice_ledger_webhook_receipts" ("state");`);
+    }
+    async down() {
+        this.addSql(`drop table if exists "invoice_ledger_webhook_receipts" cascade;`);
+        this.addSql(`drop table if exists "invoice_ledger_deliveries" cascade;`);
+        this.addSql(`drop table if exists "invoice_ledger_document_maps" cascade;`);
+        this.addSql(`drop table if exists "invoice_ledger_client_maps" cascade;`);
+        this.addSql(`drop table if exists "invoice_ledger_activation_lock" cascade;`);
+    }
+}
+//# sourceMappingURL=20260908T125013_invoice_ledger_init.js.map

package/dist/migrations/20260908T125013_invoice_ledger_init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260908T125013_invoice_ledger_init.js","sourceRoot":"","sources":["../../src/migrations/20260908T125013_invoice_ledger_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;GAKG;AACH,MAAM,OAAO,yCAA0C,SAAQ,SAAS;IAC7D,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;KAUX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;KAiBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,oHAAoH,CACrH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;KAgBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,gIAAgI,CACjI,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;;KAIX,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAwCX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;;KAIX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;;;;KAIX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;KAiBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,iEAAiE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/migrations/20260914T140000_invoice_ledger_row_organization.d.ts

@@ -0,0 +1,64 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * `invoice_ledger` deliveries and document maps carry their own tenant key.
+ *
+ * Both tables were `@TransitivelyScoped('Invoice', 'invoiceId')` — a chain hop
+ * into a class `invoices` owns. `invoice_ledger` is `nonDeactivatable` and
+ * cannot declare `invoices` in its manifest `dependencies`
+ * (`module-composition.md` §4a: the entry would make `invoices.enabled` a dead
+ * switch), so an instance that installs the locked set without `invoices`
+ * composes these entities and no `Invoice`, and the tenancy reconciliation
+ * refuses the boot before a migration runs. That is A3 of the instance
+ * acceptance criterion, red on pipeline 13835.
+ *
+ * The organization is frozen on the row at enqueue, beside the credential, the
+ * environment, the numbering mode and the KSeF routing that already are, and
+ * the foreign key is to `organizations` — this module's own declared
+ * dependency, and the one `invoice_ledger_client_maps` already uses. There is
+ * still **no** foreign key to `invoices`
+ * (`specs/119-infakt-integration/data-model.md` §3, unchanged).
+ *
+ * ## The backfill reaches two tables this module does not own, and says so
+ *
+ * `invoice_ledger` shipped on 2026-09-08 and no deployment has run it, so the
+ * expected row count is zero everywhere. It is written as a real backfill all
+ * the same, because "there are no rows" is a claim about today.
+ *
+ * It joins `invoices` **and** `orders`, and the second hop is the same fact
+ * this migration exists for read from the other end: `invoices` carries no
+ * organization column either — `Invoice` is itself
+ * `@TransitivelyScoped('Order', 'orderId')`, so the tenant lives on `orders`.
+ * A first draft read `i."organization_id"` and PostgreSQL answered `42703`,
+ * which is the chain saying out loud that it grounds two tables away.
+ *
+ * Both are `migration-cross-module-sql.md` §4.1's R1 shape — a migration naming
+ * a table it does not own — and both are **reads inside an existence guard**,
+ * which is what makes them safe in the composition this column exists for:
+ * `to_regclass` answers `null` when the owning module was never installed, and
+ * the statement is `execute`d so its names resolve at run time rather than when
+ * the block is parsed. A row whose invoice or order has since gone is deleted
+ * rather than given an invented organization — Principle XI has no
+ * "no organization" path, and a work item for an invoice that is not there has
+ * nothing to deliver.
+ *
+ * **There is no ledger entry for them, and that is a fact about the instrument
+ * rather than a claim that they are not R1.** `check:module-boundary` attributes
+ * a migration's tables by reading SQL text, and this SQL is a single-quoted
+ * string inside a dollar-quoted `do` block, so the walk sees neither `invoices`
+ * nor `orders` here: measured on this branch, `cross-module DML` reads 43 with
+ * and without this file. The ledger is two-way, so an entry describing a finding
+ * the check does not report would fail the build as stale — an edge it cannot
+ * see cannot be recorded in it. The blind spot is real and is reported to the
+ * check's owner; this block is where a reader of *this* file learns what the
+ * ledger would otherwise have told them.
+ *
+ * The two tables are written out rather than looped for the same reason read the
+ * other way: a loop would put the table name in a template hole, and the `alter`
+ * and `create index` statements this file *does* own would become unattributable
+ * too.
+ */
+export declare class Migration20260914T140000InvoiceLedgerRowOrganization extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260914T140000_invoice_ledger_row_organization.d.ts.map

package/dist/migrations/20260914T140000_invoice_ledger_row_organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260914T140000_invoice_ledger_row_organization.d.ts","sourceRoot":"","sources":["../../src/migrations/20260914T140000_invoice_ledger_row_organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,qBAAa,oDAAqD,SAAQ,SAAS;IAClE,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IA8DnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAcrC"}

package/dist/migrations/20260914T140000_invoice_ledger_row_organization.js

@@ -0,0 +1,126 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * `invoice_ledger` deliveries and document maps carry their own tenant key.
+ *
+ * Both tables were `@TransitivelyScoped('Invoice', 'invoiceId')` — a chain hop
+ * into a class `invoices` owns. `invoice_ledger` is `nonDeactivatable` and
+ * cannot declare `invoices` in its manifest `dependencies`
+ * (`module-composition.md` §4a: the entry would make `invoices.enabled` a dead
+ * switch), so an instance that installs the locked set without `invoices`
+ * composes these entities and no `Invoice`, and the tenancy reconciliation
+ * refuses the boot before a migration runs. That is A3 of the instance
+ * acceptance criterion, red on pipeline 13835.
+ *
+ * The organization is frozen on the row at enqueue, beside the credential, the
+ * environment, the numbering mode and the KSeF routing that already are, and
+ * the foreign key is to `organizations` — this module's own declared
+ * dependency, and the one `invoice_ledger_client_maps` already uses. There is
+ * still **no** foreign key to `invoices`
+ * (`specs/119-infakt-integration/data-model.md` §3, unchanged).
+ *
+ * ## The backfill reaches two tables this module does not own, and says so
+ *
+ * `invoice_ledger` shipped on 2026-09-08 and no deployment has run it, so the
+ * expected row count is zero everywhere. It is written as a real backfill all
+ * the same, because "there are no rows" is a claim about today.
+ *
+ * It joins `invoices` **and** `orders`, and the second hop is the same fact
+ * this migration exists for read from the other end: `invoices` carries no
+ * organization column either — `Invoice` is itself
+ * `@TransitivelyScoped('Order', 'orderId')`, so the tenant lives on `orders`.
+ * A first draft read `i."organization_id"` and PostgreSQL answered `42703`,
+ * which is the chain saying out loud that it grounds two tables away.
+ *
+ * Both are `migration-cross-module-sql.md` §4.1's R1 shape — a migration naming
+ * a table it does not own — and both are **reads inside an existence guard**,
+ * which is what makes them safe in the composition this column exists for:
+ * `to_regclass` answers `null` when the owning module was never installed, and
+ * the statement is `execute`d so its names resolve at run time rather than when
+ * the block is parsed. A row whose invoice or order has since gone is deleted
+ * rather than given an invented organization — Principle XI has no
+ * "no organization" path, and a work item for an invoice that is not there has
+ * nothing to deliver.
+ *
+ * **There is no ledger entry for them, and that is a fact about the instrument
+ * rather than a claim that they are not R1.** `check:module-boundary` attributes
+ * a migration's tables by reading SQL text, and this SQL is a single-quoted
+ * string inside a dollar-quoted `do` block, so the walk sees neither `invoices`
+ * nor `orders` here: measured on this branch, `cross-module DML` reads 43 with
+ * and without this file. The ledger is two-way, so an entry describing a finding
+ * the check does not report would fail the build as stale — an edge it cannot
+ * see cannot be recorded in it. The blind spot is real and is reported to the
+ * check's owner; this block is where a reader of *this* file learns what the
+ * ledger would otherwise have told them.
+ *
+ * The two tables are written out rather than looped for the same reason read the
+ * other way: a loop would put the table name in a template hole, and the `alter`
+ * and `create index` statements this file *does* own would become unattributable
+ * too.
+ */
+export class Migration20260914T140000InvoiceLedgerRowOrganization extends Migration {
+    async up() {
+        this.addSql(`alter table "invoice_ledger_deliveries" add column "organization_id" uuid null;`);
+        this.addSql(`
+      do $$
+      begin
+        if to_regclass('public.invoices') is not null
+           and to_regclass('public.orders') is not null then
+          execute 'update "invoice_ledger_deliveries" as t
+                      set "organization_id" = o."organization_id"
+                     from "invoices" as i
+                     join "orders" as o on o."id" = i."order_id"
+                    where i."id" = t."invoice_id"';
+        end if;
+      end
+      $$;
+    `);
+        this.addSql(`delete from "invoice_ledger_deliveries" where "organization_id" is null;`);
+        this.addSql(`alter table "invoice_ledger_deliveries" alter column "organization_id" set not null;`);
+        this.addSql(`create index "invoice_ledger_deliveries_organization_id_idx" on "invoice_ledger_deliveries" ("organization_id");`);
+        this.addSql(`
+      alter table "invoice_ledger_deliveries"
+        add constraint "invoice_ledger_deliveries_organization_id_foreign"
+        foreign key ("organization_id") references "organizations" ("id")
+        on update cascade;
+    `);
+        this.addSql(`alter table "invoice_ledger_document_maps" add column "organization_id" uuid null;`);
+        this.addSql(`
+      do $$
+      begin
+        if to_regclass('public.invoices') is not null
+           and to_regclass('public.orders') is not null then
+          execute 'update "invoice_ledger_document_maps" as t
+                      set "organization_id" = o."organization_id"
+                     from "invoices" as i
+                     join "orders" as o on o."id" = i."order_id"
+                    where i."id" = t."invoice_id"';
+        end if;
+      end
+      $$;
+    `);
+        this.addSql(`delete from "invoice_ledger_document_maps" where "organization_id" is null;`);
+        this.addSql(`alter table "invoice_ledger_document_maps" alter column "organization_id" set not null;`);
+        this.addSql(`create index "invoice_ledger_document_maps_organization_id_idx" on "invoice_ledger_document_maps" ("organization_id");`);
+        this.addSql(`
+      alter table "invoice_ledger_document_maps"
+        add constraint "invoice_ledger_document_maps_organization_id_foreign"
+        foreign key ("organization_id") references "organizations" ("id")
+        on update cascade;
+    `);
+    }
+    async down() {
+        this.addSql(`
+      alter table "invoice_ledger_deliveries"
+        drop constraint "invoice_ledger_deliveries_organization_id_foreign";
+    `);
+        this.addSql(`drop index "invoice_ledger_deliveries_organization_id_idx";`);
+        this.addSql(`alter table "invoice_ledger_deliveries" drop column "organization_id";`);
+        this.addSql(`
+      alter table "invoice_ledger_document_maps"
+        drop constraint "invoice_ledger_document_maps_organization_id_foreign";
+    `);
+        this.addSql(`drop index "invoice_ledger_document_maps_organization_id_idx";`);
+        this.addSql(`alter table "invoice_ledger_document_maps" drop column "organization_id";`);
+    }
+}
+//# sourceMappingURL=20260914T140000_invoice_ledger_row_organization.js.map

package/dist/migrations/20260914T140000_invoice_ledger_row_organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260914T140000_invoice_ledger_row_organization.js","sourceRoot":"","sources":["../../src/migrations/20260914T140000_invoice_ledger_row_organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,MAAM,OAAO,oDAAqD,SAAQ,SAAS;IACxE,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC,iFAAiF,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;KAaX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,0EAA0E,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kHAAkH,CACnH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CACT,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;KAaX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,6EAA6E,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wHAAwH,CACzH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC;;;KAGX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,wEAAwE,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC;;;KAGX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081).
+ */
+import { Migration20260908T125013InvoiceLedgerInit } from './20260908T125013_invoice_ledger_init.js';
+import { Migration20260914T140000InvoiceLedgerRowOrganization } from './20260914T140000_invoice_ledger_row_organization.js';
+export declare const migrations: (typeof Migration20260908T125013InvoiceLedgerInit)[];
+export { Migration20260908T125013InvoiceLedgerInit };
+export { Migration20260914T140000InvoiceLedgerRowOrganization };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,yCAAyC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,oDAAoD,EAAE,MAAM,sDAAsD,CAAC;AAE5H,eAAO,MAAM,UAAU,sDAGtB,CAAC;AAEF,OAAO,EAAE,yCAAyC,EAAE,CAAC;AACrD,OAAO,EAAE,oDAAoD,EAAE,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,16 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081).
+ */
+import { Migration20260908T125013InvoiceLedgerInit } from './20260908T125013_invoice_ledger_init.js';
+import { Migration20260914T140000InvoiceLedgerRowOrganization } from './20260914T140000_invoice_ledger_row_organization.js';
+export const migrations = [
+    Migration20260908T125013InvoiceLedgerInit,
+    Migration20260914T140000InvoiceLedgerRowOrganization,
+];
+export { Migration20260908T125013InvoiceLedgerInit };
+export { Migration20260914T140000InvoiceLedgerRowOrganization };
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,yCAAyC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,oDAAoD,EAAE,MAAM,sDAAsD,CAAC;AAE5H,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,yCAAyC;IACzC,oDAAoD;CACrD,CAAC;AAEF,OAAO,EAAE,yCAAyC,EAAE,CAAC;AACrD,OAAO,EAAE,oDAAoD,EAAE,CAAC"}

package/docs/invoice-ledger.md

@@ -0,0 +1,22 @@
+---
+title: Invoice ledger
+description: Shared vendor mutex, numbering and KSeF routing, and durable invoice deliveries for ledger adapters.
+---
+
+# Invoice ledger
+
+The `invoice_ledger` module owns the shared rails every accounting adapter uses: mutual exclusion so only one vendor is operator-active, numbering and KSeF routing settings, client and document maps, deliveries, and webhook receipts.
+
+Vendor adapter modules own the HTTP to their vendor. This module calls no vendor.
+
+## Operators
+
+- **Invoice ledger** in Sales opens deliveries. Routing is a tab on the same strip.
+- A vendor adapter module adds its connection tab when that adapter is on.
+- Routing (Endora vs vendor numbering, native vs vendor KSeF) is a confirmed write.
+- Switching a vendor adapter off hides its tab. Delivery history on this module stays.
+- Switching Invoice ledger off on `/platform/modules` also switches off every active adapter. Adapters cannot be switched on again until the ledger is on. Switching the ledger back on leaves adapters off.
+
+## Engineers
+
+Schema lives here. A vendor adapter ships no migration of its own. Invoice ids on maps and deliveries are UUIDs with no foreign key to the invoices module.

package/i18n/en.json

@@ -0,0 +1,50 @@
+{
+  "actions.openDeliveries.label": "Invoice ledger deliveries",
+  "actions.openDeliveries.description": "Vendor copy status, failures and retry",
+  "nav.deliveries.label": "Invoice ledger",
+  "tabs.deliveries": "Deliveries",
+  "tabs.routing": "Routing",
+  "deliveries.page.title": "Invoice ledger deliveries",
+  "deliveries.page.subtitle": "Copy status for invoices sent to the active ledger vendor.",
+  "routing.page.title": "Invoice ledger routing",
+  "routing.page.subtitle": "Numbering source and KSeF routing for the invoice ledger.",
+  "nav.routing.label": "Ledger routing",
+  "routing.form.title": "Instance routing",
+  "routing.numberingMode": "Invoice numbering",
+  "routing.numberingMode.endora": "Endora number (mode A)",
+  "routing.numberingMode.vendor": "Wait for vendor number (mode B)",
+  "routing.ksefRouting": "KSeF routing",
+  "routing.ksefRouting.native": "Native KSeF module",
+  "routing.ksefRouting.vendor": "Vendor send-to-ksef",
+  "routing.confirm": "I confirm changing the numbering source. Invoices already issued keep their numbers.",
+  "routing.save": "Save routing",
+  "routing.saved": "Routing saved.",
+  "error.load": "Could not load invoice ledger routing.",
+  "error.save": "Could not save invoice ledger routing.",
+  "error.loadDeliveries": "Could not load invoice ledger deliveries.",
+  "error.retry": "Could not retry this delivery.",
+  "deliveries.column.invoice": "Invoice",
+  "deliveries.column.adapter": "Adapter",
+  "deliveries.column.status": "Status",
+  "deliveries.column.lastError": "Reason",
+  "deliveries.column.environment": "Environment",
+  "deliveries.column.updated": "Updated",
+  "deliveries.status.queued": "Queued",
+  "deliveries.status.awaiting_remote": "Awaiting vendor",
+  "deliveries.status.succeeded": "Succeeded",
+  "deliveries.status.failed": "Failed",
+  "deliveries.status.dead": "Stopped",
+  "deliveries.filter.status.all": "All statuses",
+  "deliveries.retry": "Retry",
+  "deliveries.empty": "No deliveries yet.",
+  "deliveries.loading": "Loading deliveries.",
+  "deliveries.noError": "None",
+  "deliveries.loadMore": "Load more",
+  "invoicePanel.title": "Ledger document",
+  "invoicePanel.remoteDocumentId": "Remote document id",
+  "adminRoles.permission.invoice_ledger:read": "View invoice ledger deliveries",
+  "adminRoles.permission.invoice_ledger:write": "Manage invoice ledger",
+  "errors.INVOICE_LEDGER_VENDOR_ALREADY_ACTIVE": "Another invoice ledger vendor is already active ({activeModuleId}). Switch it off first.",
+  "errors.INVOICE_LEDGER_CREDENTIALS_MISSING": "The ledger vendor credentials for this invoice are missing.",
+  "errors.INVOICE_LEDGER_DELIVERY_NOT_RETRYABLE": "This delivery cannot be retried."
+}