@hasna/invoices 0.1.2 → 0.1.3

package/dist/cli/index.js

@@ -2088,12 +2088,78 @@ function normalizePagination(options, defaults) {
   const offset = Number.isFinite(options.offset) ? Math.max(Math.trunc(options.offset), 0) : 0;
   return { limit, offset };
 }
-function toLineTotalCents(line) {
+function assertSafeCents(value, field) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new RangeError(`${field} must be a safe nonnegative integer`);
+  }
+}
+function normalizeInvoiceLine(line, index) {
+  const prefix = `Invoice line ${index + 1}`;
+  if (!line || typeof line !== "object") {
+    throw new TypeError(`${prefix} must be an object`);
+  }
+  const id = line.id;
+  const description = line.description;
+  const quantity = line.quantity;
+  const unitPriceCents = line.unitPriceCents;
+  const taxRateBasisPoints = line.taxRateBasisPoints;
+  if (id !== undefined && typeof id !== "string") {
+    throw new TypeError(`${prefix} id must be a string`);
+  }
+  if (typeof description !== "string" || description.trim().length === 0) {
+    throw new TypeError(`${prefix} description must not be blank`);
+  }
+  if (!Number.isFinite(quantity) || quantity <= 0) {
+    throw new RangeError(`${prefix} quantity must be a finite positive number`);
+  }
+  if (!Number.isSafeInteger(unitPriceCents) || unitPriceCents < 0) {
+    throw new RangeError(`${prefix} unitPriceCents must be a safe nonnegative integer`);
+  }
+  if (taxRateBasisPoints !== undefined && (!Number.isSafeInteger(taxRateBasisPoints) || taxRateBasisPoints < 0)) {
+    throw new RangeError(`${prefix} taxRateBasisPoints must be a safe nonnegative integer`);
+  }
+  return {
+    id,
+    description,
+    quantity,
+    unitPriceCents,
+    taxRateBasisPoints
+  };
+}
+function toLineTotalCents(line, index) {
   const subtotal = Math.round(line.quantity * line.unitPriceCents);
   const taxRate = line.taxRateBasisPoints ?? 0;
   const tax = Math.round(subtotal * taxRate / 1e4);
+  const prefix = `Invoice line ${index + 1}`;
+  assertSafeCents(subtotal, `${prefix} lineTotalCents`);
+  assertSafeCents(tax, `${prefix} lineTaxCents`);
   return { lineTotalCents: subtotal, lineTaxCents: tax };
 }
+function prepareInvoiceLines(lines) {
+  if (!Array.isArray(lines)) {
+    throw new RangeError("Invoice must include at least one line");
+  }
+  const lineCount = lines.length;
+  if (!Number.isSafeInteger(lineCount) || lineCount <= 0) {
+    throw new RangeError("Invoice must include at least one line");
+  }
+  const preparedLines = [];
+  for (let index = 0;index < lineCount; index += 1) {
+    const line = normalizeInvoiceLine(lines[index], index);
+    const { lineTotalCents, lineTaxCents } = toLineTotalCents(line, index);
+    preparedLines.push({
+      id: line.id ?? randomUUID(),
+      position: index,
+      description: line.description,
+      quantity: line.quantity,
+      unitPriceCents: line.unitPriceCents,
+      taxRateBasisPoints: line.taxRateBasisPoints ?? 0,
+      lineTotalCents,
+      lineTaxCents
+    });
+  }
+  return preparedLines;
+}
 function mapPartyRow(row) {
   return {
     id: row.id,
@@ -2157,23 +2223,18 @@ function listParties(db, kind) {
   return db.query("SELECT * FROM parties ORDER BY legal_name ASC").all().map(mapPartyRow);
 }
 function createInvoice(db, input) {
+  const preparedLines = prepareInvoiceLines(input.lines);
   const invoiceId = input.id ?? randomUUID();
-  const preparedLines = input.lines.map((line, index) => {
-    const { lineTotalCents, lineTaxCents } = toLineTotalCents(line);
-    return {
-      id: line.id ?? randomUUID(),
-      position: index,
-      description: line.description,
-      quantity: line.quantity,
-      unitPriceCents: line.unitPriceCents,
-      taxRateBasisPoints: line.taxRateBasisPoints ?? 0,
-      lineTotalCents,
-      lineTaxCents
-    };
-  });
-  const subtotalCents = preparedLines.reduce((sum, line) => sum + line.lineTotalCents, 0);
-  const taxCents = preparedLines.reduce((sum, line) => sum + line.lineTaxCents, 0);
+  let subtotalCents = 0;
+  let taxCents = 0;
+  for (const line of preparedLines) {
+    subtotalCents += line.lineTotalCents;
+    assertSafeCents(subtotalCents, "subtotalCents");
+    taxCents += line.lineTaxCents;
+    assertSafeCents(taxCents, "taxCents");
+  }
   const totalCents = subtotalCents + taxCents;
+  assertSafeCents(totalCents, "totalCents");
   db.transaction(() => {
     db.query(`
 INSERT INTO invoices (

package/dist/db/invoices.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoices.d.ts","sourceRoot":"","sources":["../../src/db/invoices.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,UAAU,mBAAmB;IAC3B,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,qBAAqB;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAmED,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,GAAG,WAAW,CAU3E;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,WAAW,GAAG,IAAI,CAqB9H;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAGzE;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,EAAE,CAKnF;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAkEpF;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAYhF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAE,mBAAwB,GAAG,aAAa,EAAE,CAY7F;AAED,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,aAAa,GAAG,IAAI,CAInH;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAG/D;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAY5D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,aAAa,EAAE,CAsChH"}
+{"version":3,"file":"invoices.d.ts","sourceRoot":"","sources":["../../src/db/invoices.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,UAAU,mBAAmB;IAC3B,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,qBAAqB;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAmKD,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,GAAG,WAAW,CAU3E;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,WAAW,GAAG,IAAI,CAqB9H;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAGzE;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,EAAE,CAKnF;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,GAAG,gBAAgB,CA6DpF;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAYhF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAE,mBAAwB,GAAG,aAAa,EAAE,CAY7F;AAED,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,aAAa,GAAG,IAAI,CAInH;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAG/D;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAY5D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,aAAa,EAAE,CAsChH"}

package/dist/index.js

@@ -210,12 +210,78 @@ function normalizePagination(options, defaults) {
   const offset = Number.isFinite(options.offset) ? Math.max(Math.trunc(options.offset), 0) : 0;
   return { limit, offset };
 }
-function toLineTotalCents(line) {
+function assertSafeCents(value, field) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new RangeError(`${field} must be a safe nonnegative integer`);
+  }
+}
+function normalizeInvoiceLine(line, index) {
+  const prefix = `Invoice line ${index + 1}`;
+  if (!line || typeof line !== "object") {
+    throw new TypeError(`${prefix} must be an object`);
+  }
+  const id = line.id;
+  const description = line.description;
+  const quantity = line.quantity;
+  const unitPriceCents = line.unitPriceCents;
+  const taxRateBasisPoints = line.taxRateBasisPoints;
+  if (id !== undefined && typeof id !== "string") {
+    throw new TypeError(`${prefix} id must be a string`);
+  }
+  if (typeof description !== "string" || description.trim().length === 0) {
+    throw new TypeError(`${prefix} description must not be blank`);
+  }
+  if (!Number.isFinite(quantity) || quantity <= 0) {
+    throw new RangeError(`${prefix} quantity must be a finite positive number`);
+  }
+  if (!Number.isSafeInteger(unitPriceCents) || unitPriceCents < 0) {
+    throw new RangeError(`${prefix} unitPriceCents must be a safe nonnegative integer`);
+  }
+  if (taxRateBasisPoints !== undefined && (!Number.isSafeInteger(taxRateBasisPoints) || taxRateBasisPoints < 0)) {
+    throw new RangeError(`${prefix} taxRateBasisPoints must be a safe nonnegative integer`);
+  }
+  return {
+    id,
+    description,
+    quantity,
+    unitPriceCents,
+    taxRateBasisPoints
+  };
+}
+function toLineTotalCents(line, index) {
   const subtotal = Math.round(line.quantity * line.unitPriceCents);
   const taxRate = line.taxRateBasisPoints ?? 0;
   const tax = Math.round(subtotal * taxRate / 1e4);
+  const prefix = `Invoice line ${index + 1}`;
+  assertSafeCents(subtotal, `${prefix} lineTotalCents`);
+  assertSafeCents(tax, `${prefix} lineTaxCents`);
   return { lineTotalCents: subtotal, lineTaxCents: tax };
 }
+function prepareInvoiceLines(lines) {
+  if (!Array.isArray(lines)) {
+    throw new RangeError("Invoice must include at least one line");
+  }
+  const lineCount = lines.length;
+  if (!Number.isSafeInteger(lineCount) || lineCount <= 0) {
+    throw new RangeError("Invoice must include at least one line");
+  }
+  const preparedLines = [];
+  for (let index = 0;index < lineCount; index += 1) {
+    const line = normalizeInvoiceLine(lines[index], index);
+    const { lineTotalCents, lineTaxCents } = toLineTotalCents(line, index);
+    preparedLines.push({
+      id: line.id ?? randomUUID(),
+      position: index,
+      description: line.description,
+      quantity: line.quantity,
+      unitPriceCents: line.unitPriceCents,
+      taxRateBasisPoints: line.taxRateBasisPoints ?? 0,
+      lineTotalCents,
+      lineTaxCents
+    });
+  }
+  return preparedLines;
+}
 function mapPartyRow(row) {
   return {
     id: row.id,
@@ -292,23 +358,18 @@ function listParties(db, kind) {
   return db.query("SELECT * FROM parties ORDER BY legal_name ASC").all().map(mapPartyRow);
 }
 function createInvoice(db, input) {
+  const preparedLines = prepareInvoiceLines(input.lines);
   const invoiceId = input.id ?? randomUUID();
-  const preparedLines = input.lines.map((line, index) => {
-    const { lineTotalCents, lineTaxCents } = toLineTotalCents(line);
-    return {
-      id: line.id ?? randomUUID(),
-      position: index,
-      description: line.description,
-      quantity: line.quantity,
-      unitPriceCents: line.unitPriceCents,
-      taxRateBasisPoints: line.taxRateBasisPoints ?? 0,
-      lineTotalCents,
-      lineTaxCents
-    };
-  });
-  const subtotalCents = preparedLines.reduce((sum, line) => sum + line.lineTotalCents, 0);
-  const taxCents = preparedLines.reduce((sum, line) => sum + line.lineTaxCents, 0);
+  let subtotalCents = 0;
+  let taxCents = 0;
+  for (const line of preparedLines) {
+    subtotalCents += line.lineTotalCents;
+    assertSafeCents(subtotalCents, "subtotalCents");
+    taxCents += line.lineTaxCents;
+    assertSafeCents(taxCents, "taxCents");
+  }
   const totalCents = subtotalCents + taxCents;
+  assertSafeCents(totalCents, "totalCents");
   db.transaction(() => {
     db.query(`
 INSERT INTO invoices (

package/dist/mcp/index.js

@@ -4206,12 +4206,78 @@ function normalizePagination(options, defaults) {
   const offset = Number.isFinite(options.offset) ? Math.max(Math.trunc(options.offset), 0) : 0;
   return { limit, offset };
 }
-function toLineTotalCents(line) {
+function assertSafeCents(value, field) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new RangeError(`${field} must be a safe nonnegative integer`);
+  }
+}
+function normalizeInvoiceLine(line, index) {
+  const prefix = `Invoice line ${index + 1}`;
+  if (!line || typeof line !== "object") {
+    throw new TypeError(`${prefix} must be an object`);
+  }
+  const id = line.id;
+  const description = line.description;
+  const quantity = line.quantity;
+  const unitPriceCents = line.unitPriceCents;
+  const taxRateBasisPoints = line.taxRateBasisPoints;
+  if (id !== undefined && typeof id !== "string") {
+    throw new TypeError(`${prefix} id must be a string`);
+  }
+  if (typeof description !== "string" || description.trim().length === 0) {
+    throw new TypeError(`${prefix} description must not be blank`);
+  }
+  if (!Number.isFinite(quantity) || quantity <= 0) {
+    throw new RangeError(`${prefix} quantity must be a finite positive number`);
+  }
+  if (!Number.isSafeInteger(unitPriceCents) || unitPriceCents < 0) {
+    throw new RangeError(`${prefix} unitPriceCents must be a safe nonnegative integer`);
+  }
+  if (taxRateBasisPoints !== undefined && (!Number.isSafeInteger(taxRateBasisPoints) || taxRateBasisPoints < 0)) {
+    throw new RangeError(`${prefix} taxRateBasisPoints must be a safe nonnegative integer`);
+  }
+  return {
+    id,
+    description,
+    quantity,
+    unitPriceCents,
+    taxRateBasisPoints
+  };
+}
+function toLineTotalCents(line, index) {
   const subtotal = Math.round(line.quantity * line.unitPriceCents);
   const taxRate = line.taxRateBasisPoints ?? 0;
   const tax = Math.round(subtotal * taxRate / 1e4);
+  const prefix = `Invoice line ${index + 1}`;
+  assertSafeCents(subtotal, `${prefix} lineTotalCents`);
+  assertSafeCents(tax, `${prefix} lineTaxCents`);
   return { lineTotalCents: subtotal, lineTaxCents: tax };
 }
+function prepareInvoiceLines(lines) {
+  if (!Array.isArray(lines)) {
+    throw new RangeError("Invoice must include at least one line");
+  }
+  const lineCount = lines.length;
+  if (!Number.isSafeInteger(lineCount) || lineCount <= 0) {
+    throw new RangeError("Invoice must include at least one line");
+  }
+  const preparedLines = [];
+  for (let index = 0;index < lineCount; index += 1) {
+    const line = normalizeInvoiceLine(lines[index], index);
+    const { lineTotalCents, lineTaxCents } = toLineTotalCents(line, index);
+    preparedLines.push({
+      id: line.id ?? randomUUID(),
+      position: index,
+      description: line.description,
+      quantity: line.quantity,
+      unitPriceCents: line.unitPriceCents,
+      taxRateBasisPoints: line.taxRateBasisPoints ?? 0,
+      lineTotalCents,
+      lineTaxCents
+    });
+  }
+  return preparedLines;
+}
 function mapPartyRow(row) {
   return {
     id: row.id,
@@ -4275,23 +4341,18 @@ function listParties(db, kind) {
   return db.query("SELECT * FROM parties ORDER BY legal_name ASC").all().map(mapPartyRow);
 }
 function createInvoice(db, input) {
+  const preparedLines = prepareInvoiceLines(input.lines);
   const invoiceId = input.id ?? randomUUID();
-  const preparedLines = input.lines.map((line, index) => {
-    const { lineTotalCents, lineTaxCents } = toLineTotalCents(line);
-    return {
-      id: line.id ?? randomUUID(),
-      position: index,
-      description: line.description,
-      quantity: line.quantity,
-      unitPriceCents: line.unitPriceCents,
-      taxRateBasisPoints: line.taxRateBasisPoints ?? 0,
-      lineTotalCents,
-      lineTaxCents
-    };
-  });
-  const subtotalCents = preparedLines.reduce((sum, line) => sum + line.lineTotalCents, 0);
-  const taxCents = preparedLines.reduce((sum, line) => sum + line.lineTaxCents, 0);
+  let subtotalCents = 0;
+  let taxCents = 0;
+  for (const line of preparedLines) {
+    subtotalCents += line.lineTotalCents;
+    assertSafeCents(subtotalCents, "subtotalCents");
+    taxCents += line.lineTaxCents;
+    assertSafeCents(taxCents, "taxCents");
+  }
   const totalCents = subtotalCents + taxCents;
+  assertSafeCents(totalCents, "totalCents");
   db.transaction(() => {
     db.query(`
 INSERT INTO invoices (

package/dist/server/index.js

@@ -4014,12 +4014,78 @@ function normalizePagination(options, defaults) {
   const offset = Number.isFinite(options.offset) ? Math.max(Math.trunc(options.offset), 0) : 0;
   return { limit, offset };
 }
-function toLineTotalCents(line) {
+function assertSafeCents(value, field) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new RangeError(`${field} must be a safe nonnegative integer`);
+  }
+}
+function normalizeInvoiceLine(line, index) {
+  const prefix = `Invoice line ${index + 1}`;
+  if (!line || typeof line !== "object") {
+    throw new TypeError(`${prefix} must be an object`);
+  }
+  const id = line.id;
+  const description = line.description;
+  const quantity = line.quantity;
+  const unitPriceCents = line.unitPriceCents;
+  const taxRateBasisPoints = line.taxRateBasisPoints;
+  if (id !== undefined && typeof id !== "string") {
+    throw new TypeError(`${prefix} id must be a string`);
+  }
+  if (typeof description !== "string" || description.trim().length === 0) {
+    throw new TypeError(`${prefix} description must not be blank`);
+  }
+  if (!Number.isFinite(quantity) || quantity <= 0) {
+    throw new RangeError(`${prefix} quantity must be a finite positive number`);
+  }
+  if (!Number.isSafeInteger(unitPriceCents) || unitPriceCents < 0) {
+    throw new RangeError(`${prefix} unitPriceCents must be a safe nonnegative integer`);
+  }
+  if (taxRateBasisPoints !== undefined && (!Number.isSafeInteger(taxRateBasisPoints) || taxRateBasisPoints < 0)) {
+    throw new RangeError(`${prefix} taxRateBasisPoints must be a safe nonnegative integer`);
+  }
+  return {
+    id,
+    description,
+    quantity,
+    unitPriceCents,
+    taxRateBasisPoints
+  };
+}
+function toLineTotalCents(line, index) {
   const subtotal = Math.round(line.quantity * line.unitPriceCents);
   const taxRate = line.taxRateBasisPoints ?? 0;
   const tax = Math.round(subtotal * taxRate / 1e4);
+  const prefix = `Invoice line ${index + 1}`;
+  assertSafeCents(subtotal, `${prefix} lineTotalCents`);
+  assertSafeCents(tax, `${prefix} lineTaxCents`);
   return { lineTotalCents: subtotal, lineTaxCents: tax };
 }
+function prepareInvoiceLines(lines) {
+  if (!Array.isArray(lines)) {
+    throw new RangeError("Invoice must include at least one line");
+  }
+  const lineCount = lines.length;
+  if (!Number.isSafeInteger(lineCount) || lineCount <= 0) {
+    throw new RangeError("Invoice must include at least one line");
+  }
+  const preparedLines = [];
+  for (let index = 0;index < lineCount; index += 1) {
+    const line = normalizeInvoiceLine(lines[index], index);
+    const { lineTotalCents, lineTaxCents } = toLineTotalCents(line, index);
+    preparedLines.push({
+      id: line.id ?? randomUUID(),
+      position: index,
+      description: line.description,
+      quantity: line.quantity,
+      unitPriceCents: line.unitPriceCents,
+      taxRateBasisPoints: line.taxRateBasisPoints ?? 0,
+      lineTotalCents,
+      lineTaxCents
+    });
+  }
+  return preparedLines;
+}
 function mapPartyRow(row) {
   return {
     id: row.id,
@@ -4083,23 +4149,18 @@ function listParties(db, kind) {
   return db.query("SELECT * FROM parties ORDER BY legal_name ASC").all().map(mapPartyRow);
 }
 function createInvoice(db, input) {
+  const preparedLines = prepareInvoiceLines(input.lines);
   const invoiceId = input.id ?? randomUUID();
-  const preparedLines = input.lines.map((line, index) => {
-    const { lineTotalCents, lineTaxCents } = toLineTotalCents(line);
-    return {
-      id: line.id ?? randomUUID(),
-      position: index,
-      description: line.description,
-      quantity: line.quantity,
-      unitPriceCents: line.unitPriceCents,
-      taxRateBasisPoints: line.taxRateBasisPoints ?? 0,
-      lineTotalCents,
-      lineTaxCents
-    };
-  });
-  const subtotalCents = preparedLines.reduce((sum, line) => sum + line.lineTotalCents, 0);
-  const taxCents = preparedLines.reduce((sum, line) => sum + line.lineTaxCents, 0);
+  let subtotalCents = 0;
+  let taxCents = 0;
+  for (const line of preparedLines) {
+    subtotalCents += line.lineTotalCents;
+    assertSafeCents(subtotalCents, "subtotalCents");
+    taxCents += line.lineTaxCents;
+    assertSafeCents(taxCents, "taxCents");
+  }
   const totalCents = subtotalCents + taxCents;
+  assertSafeCents(totalCents, "totalCents");
   db.transaction(() => {
     db.query(`
 INSERT INTO invoices (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/invoices",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Invoice generation and management for AI agents - CLI + MCP server + REST API + dashboard + SDK",
   "type": "module",
   "main": "dist/index.js",