@mulmoclaude/accounting-plugin 1.2.1 → 1.3.0

package/dist/server.cjs

@@ -21,7 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_shared = require("./shared-C9K9ZkfK.cjs");
+const require_shared = require("./shared-BpFVwa6Y.cjs");
 let express = require("express");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
@@ -31,18 +31,36 @@ let _mulmoclaude_core_files = require("@mulmoclaude/core/files");
 //#region src/server/bodyFields.ts
 var optionalString = (value) => typeof value === "string" ? value : void 0;
 var optionalRecord = (value) => require_shared.isRecord(value) ? value : void 0;
+var YEAR_MONTH_RE = /^\d{4}-(0[1-9]|1[0-2])$/;
+var YEAR_MONTH_DAY_RE = /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/;
+/** `YYYY-MM-DD` that names a day the calendar actually has. The regex alone
+*  admits `2026-02-30`, and `Date.UTC` rolls that forward to March instead of
+*  refusing it, so the round trip is what says the date is real. */
+var isCalendarDate = (value) => {
+	if (!YEAR_MONTH_DAY_RE.test(value)) return false;
+	const [year, month, day] = value.split("-").map(Number);
+	if (year === void 0 || month === void 0 || day === void 0) return false;
+	return new Date(Date.UTC(year, month - 1, day)).getUTCDate() === day;
+};
 /** Rebuilt field by field rather than narrowed with a predicate, so the
 *  returned object is one this function actually proved. A half-formed
 *  `{ kind: "month" }` reads as absent and the caller raises its own
 *  "period is required" — previously it reached the report builders and
-*  produced an `undefined-01` date. */
+*  produced an `undefined-01` date.
+*
+*  The FORMAT is checked here too, not just the type: `typeof === "string"`
+*  let `{ kind: "month", period: "banana" }` through, which came back as a
+*  balance sheet dated `"banana-NaN"` and made the snapshot cache write
+*  `banana.json` / `0NaN-NaN.json` into the book (#2765). Malformed reads as
+*  absent so it lands on the caller's existing 400, which already spells out
+*  both accepted shapes for the LLM to repair its payload from. */
 var optionalReportPeriod = (value) => {
 	const period = optionalRecord(value);
-	if (period?.kind === "month" && typeof period.period === "string") return {
+	if (period?.kind === "month" && typeof period.period === "string" && YEAR_MONTH_RE.test(period.period)) return {
 		kind: "month",
 		period: period.period
 	};
-	if (period?.kind === "range" && typeof period.from === "string" && typeof period.to === "string") return {
+	if (period?.kind === "range" && typeof period.from === "string" && typeof period.to === "string" && isCalendarDate(period.from) && isCalendarDate(period.to)) return {
 		kind: "range",
 		from: period.from,
 		to: period.to
@@ -86,254 +104,6 @@ var log = {
 	debug: (namespace, msg, data) => (deps?.logger ?? consoleLogger).debug(namespace, msg, data)
 };
 //#endregion
-//#region src/server/io.ts
-var root = (workspaceRoot) => workspaceRoot ?? defaultWorkspaceRoot();
-function accountingRoot(workspaceRoot) {
-	return node_path.default.join(root(workspaceRoot), require_shared.ACCOUNTING_DIRS.accounting);
-}
-function configPath(workspaceRoot) {
-	return node_path.default.join(accountingRoot(workspaceRoot), "config.json");
-}
-/** Allowed shape for a book id used as a directory name. Defense
-*  against path traversal: a crafted id like "../../config" or
-*  "/tmp/x" would otherwise let `bookRoot` escape the
-*  `data/accounting/books/` tree, since every write path joins
-*  `bookId` directly into the filesystem. The first character is
-*  alphanumeric to forbid leading dashes / underscores that some
-*  shells / docs render confusingly; `_` and `-` are allowed inside.
-*  64 chars is plenty for any reasonable book name. */
-var SAFE_BOOK_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-function isSafeBookId(bookId) {
-	return typeof bookId === "string" && SAFE_BOOK_ID_RE.test(bookId);
-}
-function assertSafeBookId(bookId) {
-	if (!isSafeBookId(bookId)) throw new Error(`accounting: invalid bookId ${JSON.stringify(bookId)} (allowed: alphanumeric / _ / -; 1-64 chars; cannot start with _ or -)`);
-}
-function bookRoot(bookId, workspaceRoot) {
-	assertSafeBookId(bookId);
-	return node_path.default.join(root(workspaceRoot), require_shared.ACCOUNTING_DIRS.accountingBooks, bookId);
-}
-function accountsPath(bookId, workspaceRoot) {
-	return node_path.default.join(bookRoot(bookId, workspaceRoot), "accounts.json");
-}
-function journalDir(bookId, workspaceRoot) {
-	return node_path.default.join(bookRoot(bookId, workspaceRoot), "journal");
-}
-function journalFileFor(bookId, period, workspaceRoot) {
-	return node_path.default.join(journalDir(bookId, workspaceRoot), `${period}.jsonl`);
-}
-function snapshotsDir(bookId, workspaceRoot) {
-	return node_path.default.join(bookRoot(bookId, workspaceRoot), "snapshots");
-}
-function snapshotFileFor(bookId, period, workspaceRoot) {
-	return node_path.default.join(snapshotsDir(bookId, workspaceRoot), `${period}.json`);
-}
-async function fileExists(filePath) {
-	try {
-		await node_fs.promises.access(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** Strict variant of `readJsonOrNull` from `./json.ts`: returns null
-*  on ENOENT but RETHROWS other read errors and parse failures so a
-*  corrupted accounting journal surfaces rather than silently
-*  collapsing to "no data". `./json.ts` keeps the permissive
-*  variant for user-config files where a single bad keystroke
-*  shouldn't 500 the server. */
-async function readJsonStrict(filePath) {
-	try {
-		const raw = await node_fs.promises.readFile(filePath, "utf-8");
-		return JSON.parse(raw);
-	} catch (err) {
-		if ((0, _mulmoclaude_core_files.isEnoent)(err)) return null;
-		throw err;
-	}
-}
-/** Migrate a legacy calendar-quarter `fiscalYearEnd` token ("Q1".."Q4")
-*  to its closing-month number in memory so every downstream consumer
-*  (reports, time-series, the UI selects) sees one shape. Absent stays
-*  absent — the field is optional and resolves to the default on read;
-*  we don't stamp an explicit December onto a book that never chose one.
-*  Nothing is written back here (no auto-migrate on disk). */
-function normalizeBookFiscalYearEnd(book) {
-	if (book.fiscalYearEnd === void 0) return book;
-	const resolved = require_shared.resolveFiscalYearEnd(book.fiscalYearEnd);
-	return book.fiscalYearEnd === resolved ? book : {
-		...book,
-		fiscalYearEnd: resolved
-	};
-}
-async function readConfig(workspaceRoot) {
-	const config = await readJsonStrict(configPath(workspaceRoot));
-	if (!config) return null;
-	return {
-		...config,
-		books: config.books.map(normalizeBookFiscalYearEnd)
-	};
-}
-async function writeConfig(config, workspaceRoot) {
-	await (0, _mulmoclaude_core_files.writeJsonAtomic)(configPath(workspaceRoot), config);
-}
-async function readAccounts(bookId, workspaceRoot) {
-	return await readJsonStrict(accountsPath(bookId, workspaceRoot)) ?? [];
-}
-async function writeAccounts(bookId, accounts, workspaceRoot) {
-	await (0, _mulmoclaude_core_files.writeJsonAtomic)(accountsPath(bookId, workspaceRoot), accounts);
-}
-/** Convert a YYYY-MM-DD date string to its YYYY-MM month bucket. The
-*  month bucket dictates which JSONL file the entry lives in. */
-function periodFromDate(date) {
-	if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) throw new Error(`accounting: invalid date format ${JSON.stringify(date)} (expected YYYY-MM-DD)`);
-	return date.slice(0, 7);
-}
-/** Append one entry to the appropriate month's JSONL.
-*
-*  Uses POSIX append-only semantics (`fs.appendFile` → `O_APPEND`).
-*  Two concurrent callers landing in the same month file are
-*  serialised by the kernel — neither overwrites the other, which
-*  is the bug the previous read-modify-write implementation had.
-*
-*  Crash mid-write: an entry shorter than `PIPE_BUF` (≥ 512 bytes
-*  on every supported platform) writes atomically; a single
-*  serialised `JournalEntry` is comfortably under that. If the
-*  process is killed during the syscall the worst case is a torn
-*  trailing line, which `readJournalMonth` already tolerates by
-*  skipping unparseable lines and surfacing a `skipped` count to
-*  the caller. */
-async function appendJournal(bookId, entry, workspaceRoot) {
-	const file = journalFileFor(bookId, periodFromDate(entry.date), workspaceRoot);
-	await node_fs.promises.mkdir(node_path.default.dirname(file), { recursive: true });
-	await node_fs.promises.appendFile(file, `${JSON.stringify(entry)}\n`, { encoding: "utf-8" });
-}
-function groupEntriesByPeriod(entries) {
-	const byPeriod = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		const period = periodFromDate(entry.date);
-		const list = byPeriod.get(period) ?? [];
-		list.push(entry);
-		byPeriod.set(period, list);
-	}
-	return byPeriod;
-}
-/** Append a batch of entries: same-period entries are concatenated
-*  into one `appendFile` call so the whole same-period chunk hits
-*  the kernel as a single `O_APPEND` write — small chunks (under
-*  `PIPE_BUF`, ≥ 512 bytes on every supported platform) are
-*  guaranteed atomic by POSIX, and `O_APPEND` serialises with any
-*  concurrent appender (a parallel `appendJournal` / `addEntries`
-*  call can never overwrite our write or vice versa). Cross-period
-*  batches loop one append per period; each is independently
-*  concurrency-safe but their union is not transactional across
-*  files (out of scope for the append-only JSONL design). */
-async function appendJournalBatch(bookId, entries, workspaceRoot) {
-	if (entries.length === 0) return;
-	const byPeriod = groupEntriesByPeriod(entries);
-	for (const [period, items] of byPeriod) {
-		const file = journalFileFor(bookId, period, workspaceRoot);
-		await node_fs.promises.mkdir(node_path.default.dirname(file), { recursive: true });
-		const chunk = items.map((entry) => `${JSON.stringify(entry)}\n`).join("");
-		await node_fs.promises.appendFile(file, chunk, { encoding: "utf-8" });
-	}
-}
-/** Read a single month's JSONL. Malformed lines are skipped (logged
-*  by the caller; this layer just returns the parseable subset) so
-*  one bad line doesn't lock the user out of their book. */
-async function readJournalMonth(bookId, period, workspaceRoot) {
-	const file = journalFileFor(bookId, period, workspaceRoot);
-	let raw;
-	try {
-		raw = await node_fs.promises.readFile(file, "utf-8");
-	} catch (err) {
-		if ((0, _mulmoclaude_core_files.isEnoent)(err)) return {
-			entries: [],
-			skipped: 0
-		};
-		throw err;
-	}
-	const entries = [];
-	let skipped = 0;
-	for (const line of raw.split("\n")) {
-		if (line.trim() === "") continue;
-		try {
-			entries.push(JSON.parse(line));
-		} catch {
-			skipped += 1;
-		}
-	}
-	return {
-		entries,
-		skipped
-	};
-}
-/** List the YYYY-MM periods that have a journal file on disk, sorted
-*  ascending. Useful for full-history scans (rebuilding snapshots
-*  from scratch). */
-async function listJournalPeriods(bookId, workspaceRoot) {
-	let names;
-	try {
-		names = await node_fs.promises.readdir(journalDir(bookId, workspaceRoot));
-	} catch (err) {
-		if ((0, _mulmoclaude_core_files.isEnoent)(err)) return [];
-		throw err;
-	}
-	return names.filter((name) => /^\d{4}-\d{2}\.jsonl$/.test(name)).map((name) => name.slice(0, 7)).sort();
-}
-async function readSnapshot(bookId, period, workspaceRoot) {
-	return readJsonStrict(snapshotFileFor(bookId, period, workspaceRoot));
-}
-async function writeSnapshot(bookId, snapshot, workspaceRoot) {
-	const file = snapshotFileFor(bookId, snapshot.period, workspaceRoot);
-	await node_fs.promises.mkdir(node_path.default.dirname(file), { recursive: true });
-	await (0, _mulmoclaude_core_files.writeJsonAtomic)(file, snapshot, { uniqueTmp: true });
-}
-/** Drop snapshot files for all periods >= `fromPeriod`. The next
-*  read regenerates them. Idempotent: missing files are silently
-*  ignored. */
-async function invalidateSnapshotsFrom(bookId, fromPeriod, workspaceRoot) {
-	let names;
-	try {
-		names = await node_fs.promises.readdir(snapshotsDir(bookId, workspaceRoot));
-	} catch (err) {
-		if ((0, _mulmoclaude_core_files.isEnoent)(err)) return { removed: [] };
-		throw err;
-	}
-	const removed = [];
-	for (const name of names) {
-		const match = /^(\d{4}-\d{2})\.json$/.exec(name);
-		if (!match) continue;
-		const [, period] = match;
-		if (period >= fromPeriod) {
-			await node_fs.promises.rm(node_path.default.join(snapshotsDir(bookId, workspaceRoot), name), { force: true });
-			removed.push(period);
-		}
-	}
-	return { removed: removed.sort() };
-}
-/** Drop ALL snapshots for a book — used by `rebuildSnapshots()`
-*  with no `from`. Equivalent to `invalidateSnapshotsFrom("0000-00")`
-*  but reads more clearly at call sites. */
-async function invalidateAllSnapshots(bookId, workspaceRoot) {
-	return invalidateSnapshotsFrom(bookId, "0000-00", workspaceRoot);
-}
-async function bookExists(bookId, workspaceRoot) {
-	return fileExists(bookRoot(bookId, workspaceRoot));
-}
-async function ensureBookDir(bookId, workspaceRoot) {
-	await node_fs.promises.mkdir(bookRoot(bookId, workspaceRoot), { recursive: true });
-	await node_fs.promises.mkdir(journalDir(bookId, workspaceRoot), { recursive: true });
-	await node_fs.promises.mkdir(snapshotsDir(bookId, workspaceRoot), { recursive: true });
-}
-/** Recursively delete a book's directory. Used by `deleteBook` after
-*  the config has been updated to drop the entry. */
-async function removeBookDir(bookId, workspaceRoot) {
-	await node_fs.promises.rm(bookRoot(bookId, workspaceRoot), {
-		recursive: true,
-		force: true
-	});
-}
-//#endregion
 //#region src/server/journal.ts
 /** Floating-point tolerance for the debit = credit check. Currency
 *  amounts arrive as JavaScript numbers (the on-wire format is JSON,
@@ -366,6 +136,7 @@ function localDateString(now = /* @__PURE__ */ new Date()) {
 function isValidCalendarDate(date) {
 	if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) return false;
 	const [year, month, day] = date.split("-").map((segment) => parseInt(segment, 10));
+	if (year === void 0 || month === void 0 || day === void 0) return false;
 	const parsed = new Date(Date.UTC(year, month - 1, day));
 	return parsed.getUTCFullYear() === year && parsed.getUTCMonth() === month - 1 && parsed.getUTCDate() === day;
 }
@@ -435,7 +206,7 @@ function buildLine(raw) {
 *  belong to the caller, because journal entries and opening balances
 *  disagree about them. Returns null when nothing usable came out —
 *  the caller drops the line rather than reading fields off it. */
-function parseJournalLine(raw, idx, errors) {
+function parseJournalLine$1(raw, idx, errors) {
 	if (!require_shared.isRecord(raw)) {
 		errors.push({
 			field: `lines[${idx}]`,
@@ -461,7 +232,7 @@ function validateEntryLine(line, idx, accountCodes, errors) {
 function parseEntryLines(raw, accountCodes, errors) {
 	const lines = [];
 	raw.forEach((rawLine, idx) => {
-		const line = parseJournalLine(rawLine, idx, errors);
+		const line = parseJournalLine$1(rawLine, idx, errors);
 		if (line === null) return;
 		validateEntryLine(line, idx, accountCodes, errors);
 		lines.push(line);
@@ -489,6 +260,20 @@ function parseOptionalString(value, field, errors) {
 		message: `${field} must be a string when supplied`
 	});
 }
+var isOptionalString = (value) => value === void 0 || typeof value === "string";
+var isOptionalNumber = (value) => value === void 0 || typeof value === "number";
+function isJournalLine(value) {
+	return require_shared.hasStringProp(value, "accountCode") && isOptionalNumber(value.debit) && isOptionalNumber(value.credit) && isOptionalString(value.memo) && isOptionalString(value.taxRegistrationId);
+}
+/** Checks every field `JournalEntry` and `JournalLine` declare, so a value
+*  that passes really is one. Used when reading the journal JSONL back:
+*  everything this module ever wrote satisfies it (`id` / `date` / `kind` /
+*  `lines` / `createdAt` have been required since the plugin's first
+*  release), while a line that doesn't is exactly the line that takes the
+*  whole book down — `report.ts` iterates `entry.lines` unguarded. */
+function isJournalEntry(value) {
+	return require_shared.hasStringProp(value, "id") && require_shared.hasStringProp(value, "date") && require_shared.hasStringProp(value, "createdAt") && require_shared.JOURNAL_ENTRY_KINDS.some((kind) => kind === value.kind) && require_shared.isUnknownArray(value.lines) && value.lines.every(isJournalLine) && isOptionalString(value.memo) && isOptionalString(value.voidedEntryId) && isOptionalString(value.voidReason) && isOptionalString(value.replacesEntryId);
+}
 /** Normalize a journal line before persistence: trim string fields
 *  and drop empty-string optionals so the JSONL doesn't accumulate
 *  noise like `"taxRegistrationId":""`. Pure — does not mutate
@@ -635,6 +420,258 @@ function voidedIdSet(entries) {
 	return set;
 }
 //#endregion
+//#region src/server/io.ts
+var root = (workspaceRoot) => workspaceRoot ?? defaultWorkspaceRoot();
+function accountingRoot(workspaceRoot) {
+	return node_path.default.join(root(workspaceRoot), require_shared.ACCOUNTING_DIRS.accounting);
+}
+function configPath(workspaceRoot) {
+	return node_path.default.join(accountingRoot(workspaceRoot), "config.json");
+}
+/** Allowed shape for a book id used as a directory name. Defense
+*  against path traversal: a crafted id like "../../config" or
+*  "/tmp/x" would otherwise let `bookRoot` escape the
+*  `data/accounting/books/` tree, since every write path joins
+*  `bookId` directly into the filesystem. The first character is
+*  alphanumeric to forbid leading dashes / underscores that some
+*  shells / docs render confusingly; `_` and `-` are allowed inside.
+*  64 chars is plenty for any reasonable book name. */
+var SAFE_BOOK_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+function isSafeBookId(bookId) {
+	return typeof bookId === "string" && SAFE_BOOK_ID_RE.test(bookId);
+}
+function assertSafeBookId(bookId) {
+	if (!isSafeBookId(bookId)) throw new Error(`accounting: invalid bookId ${JSON.stringify(bookId)} (allowed: alphanumeric / _ / -; 1-64 chars; cannot start with _ or -)`);
+}
+function bookRoot(bookId, workspaceRoot) {
+	assertSafeBookId(bookId);
+	return node_path.default.join(root(workspaceRoot), require_shared.ACCOUNTING_DIRS.accountingBooks, bookId);
+}
+function accountsPath(bookId, workspaceRoot) {
+	return node_path.default.join(bookRoot(bookId, workspaceRoot), "accounts.json");
+}
+function journalDir(bookId, workspaceRoot) {
+	return node_path.default.join(bookRoot(bookId, workspaceRoot), "journal");
+}
+function journalFileFor(bookId, period, workspaceRoot) {
+	return node_path.default.join(journalDir(bookId, workspaceRoot), `${period}.jsonl`);
+}
+function snapshotsDir(bookId, workspaceRoot) {
+	return node_path.default.join(bookRoot(bookId, workspaceRoot), "snapshots");
+}
+function snapshotFileFor(bookId, period, workspaceRoot) {
+	return node_path.default.join(snapshotsDir(bookId, workspaceRoot), `${period}.json`);
+}
+async function fileExists(filePath) {
+	try {
+		await node_fs.promises.access(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Strict variant of `readJsonOrNull` from `./json.ts`: returns null
+*  on ENOENT but RETHROWS other read errors and parse failures so a
+*  corrupted accounting journal surfaces rather than silently
+*  collapsing to "no data". `./json.ts` keeps the permissive
+*  variant for user-config files where a single bad keystroke
+*  shouldn't 500 the server. */
+async function readJsonStrict(filePath) {
+	try {
+		const raw = await node_fs.promises.readFile(filePath, "utf-8");
+		return JSON.parse(raw);
+	} catch (err) {
+		if ((0, _mulmoclaude_core_files.isEnoent)(err)) return null;
+		throw err;
+	}
+}
+/** Migrate a legacy calendar-quarter `fiscalYearEnd` token ("Q1".."Q4")
+*  to its closing-month number in memory so every downstream consumer
+*  (reports, time-series, the UI selects) sees one shape. Absent stays
+*  absent — the field is optional and resolves to the default on read;
+*  we don't stamp an explicit December onto a book that never chose one.
+*  Nothing is written back here (no auto-migrate on disk). */
+function normalizeBookFiscalYearEnd(book) {
+	if (book.fiscalYearEnd === void 0) return book;
+	const resolved = require_shared.resolveFiscalYearEnd(book.fiscalYearEnd);
+	return book.fiscalYearEnd === resolved ? book : {
+		...book,
+		fiscalYearEnd: resolved
+	};
+}
+async function readConfig(workspaceRoot) {
+	const config = await readJsonStrict(configPath(workspaceRoot));
+	if (!config) return null;
+	return {
+		...config,
+		books: config.books.map(normalizeBookFiscalYearEnd)
+	};
+}
+async function writeConfig(config, workspaceRoot) {
+	await (0, _mulmoclaude_core_files.writeJsonAtomic)(configPath(workspaceRoot), config);
+}
+async function readAccounts(bookId, workspaceRoot) {
+	return await readJsonStrict(accountsPath(bookId, workspaceRoot)) ?? [];
+}
+async function writeAccounts(bookId, accounts, workspaceRoot) {
+	await (0, _mulmoclaude_core_files.writeJsonAtomic)(accountsPath(bookId, workspaceRoot), accounts);
+}
+/** Convert a YYYY-MM-DD date string to its YYYY-MM month bucket. The
+*  month bucket dictates which JSONL file the entry lives in. */
+function periodFromDate(date) {
+	if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) throw new Error(`accounting: invalid date format ${JSON.stringify(date)} (expected YYYY-MM-DD)`);
+	return date.slice(0, 7);
+}
+/** Append one entry to the appropriate month's JSONL.
+*
+*  Uses POSIX append-only semantics (`fs.appendFile` → `O_APPEND`).
+*  Two concurrent callers landing in the same month file are
+*  serialised by the kernel — neither overwrites the other, which
+*  is the bug the previous read-modify-write implementation had.
+*
+*  Crash mid-write: an entry shorter than `PIPE_BUF` (≥ 512 bytes
+*  on every supported platform) writes atomically; a single
+*  serialised `JournalEntry` is comfortably under that. If the
+*  process is killed during the syscall the worst case is a torn
+*  trailing line, which `readJournalMonth` already tolerates by
+*  skipping unparseable lines and surfacing a `skipped` count to
+*  the caller. */
+async function appendJournal(bookId, entry, workspaceRoot) {
+	const file = journalFileFor(bookId, periodFromDate(entry.date), workspaceRoot);
+	await node_fs.promises.mkdir(node_path.default.dirname(file), { recursive: true });
+	await node_fs.promises.appendFile(file, `${JSON.stringify(entry)}\n`, { encoding: "utf-8" });
+}
+function groupEntriesByPeriod(entries) {
+	const byPeriod = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const period = periodFromDate(entry.date);
+		const list = byPeriod.get(period) ?? [];
+		list.push(entry);
+		byPeriod.set(period, list);
+	}
+	return byPeriod;
+}
+/** Append a batch of entries: same-period entries are concatenated
+*  into one `appendFile` call so the whole same-period chunk hits
+*  the kernel as a single `O_APPEND` write — small chunks (under
+*  `PIPE_BUF`, ≥ 512 bytes on every supported platform) are
+*  guaranteed atomic by POSIX, and `O_APPEND` serialises with any
+*  concurrent appender (a parallel `appendJournal` / `addEntries`
+*  call can never overwrite our write or vice versa). Cross-period
+*  batches loop one append per period; each is independently
+*  concurrency-safe but their union is not transactional across
+*  files (out of scope for the append-only JSONL design). */
+async function appendJournalBatch(bookId, entries, workspaceRoot) {
+	if (entries.length === 0) return;
+	const byPeriod = groupEntriesByPeriod(entries);
+	for (const [period, items] of byPeriod) {
+		const file = journalFileFor(bookId, period, workspaceRoot);
+		await node_fs.promises.mkdir(node_path.default.dirname(file), { recursive: true });
+		const chunk = items.map((entry) => `${JSON.stringify(entry)}\n`).join("");
+		await node_fs.promises.appendFile(file, chunk, { encoding: "utf-8" });
+	}
+}
+/** One JSONL line, or null when it isn't a journal entry — unparseable JSON
+*  and JSON of the wrong shape are the same failure to a caller that can only
+*  skip the line. */
+function parseJournalLine(line) {
+	try {
+		const parsed = JSON.parse(line);
+		return isJournalEntry(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/** Read a single month's JSONL. Malformed lines are skipped (logged
+*  by the caller; this layer just returns the parseable subset) so
+*  one bad line doesn't lock the user out of their book. */
+async function readJournalMonth(bookId, period, workspaceRoot) {
+	const file = journalFileFor(bookId, period, workspaceRoot);
+	let raw;
+	try {
+		raw = await node_fs.promises.readFile(file, "utf-8");
+	} catch (err) {
+		if ((0, _mulmoclaude_core_files.isEnoent)(err)) return {
+			entries: [],
+			skipped: 0
+		};
+		throw err;
+	}
+	const parsed = raw.split("\n").filter((line) => line.trim() !== "").map(parseJournalLine);
+	const entries = parsed.filter((entry) => entry !== null);
+	return {
+		entries,
+		skipped: parsed.length - entries.length
+	};
+}
+/** List the YYYY-MM periods that have a journal file on disk, sorted
+*  ascending. Useful for full-history scans (rebuilding snapshots
+*  from scratch). */
+async function listJournalPeriods(bookId, workspaceRoot) {
+	let names;
+	try {
+		names = await node_fs.promises.readdir(journalDir(bookId, workspaceRoot));
+	} catch (err) {
+		if ((0, _mulmoclaude_core_files.isEnoent)(err)) return [];
+		throw err;
+	}
+	return names.filter((name) => /^\d{4}-\d{2}\.jsonl$/.test(name)).map((name) => name.slice(0, 7)).sort();
+}
+async function readSnapshot(bookId, period, workspaceRoot) {
+	return readJsonStrict(snapshotFileFor(bookId, period, workspaceRoot));
+}
+async function writeSnapshot(bookId, snapshot, workspaceRoot) {
+	const file = snapshotFileFor(bookId, snapshot.period, workspaceRoot);
+	await node_fs.promises.mkdir(node_path.default.dirname(file), { recursive: true });
+	await (0, _mulmoclaude_core_files.writeJsonAtomic)(file, snapshot, { uniqueTmp: true });
+}
+/** Drop snapshot files for all periods >= `fromPeriod`. The next
+*  read regenerates them. Idempotent: missing files are silently
+*  ignored. */
+async function invalidateSnapshotsFrom(bookId, fromPeriod, workspaceRoot) {
+	let names;
+	try {
+		names = await node_fs.promises.readdir(snapshotsDir(bookId, workspaceRoot));
+	} catch (err) {
+		if ((0, _mulmoclaude_core_files.isEnoent)(err)) return { removed: [] };
+		throw err;
+	}
+	const removed = [];
+	for (const name of names) {
+		const match = /^(\d{4}-\d{2})\.json$/.exec(name);
+		if (!match) continue;
+		const [, period] = match;
+		if (period === void 0) continue;
+		if (period >= fromPeriod) {
+			await node_fs.promises.rm(node_path.default.join(snapshotsDir(bookId, workspaceRoot), name), { force: true });
+			removed.push(period);
+		}
+	}
+	return { removed: removed.sort() };
+}
+/** Drop ALL snapshots for a book — used by `rebuildSnapshots()`
+*  with no `from`. Equivalent to `invalidateSnapshotsFrom("0000-00")`
+*  but reads more clearly at call sites. */
+async function invalidateAllSnapshots(bookId, workspaceRoot) {
+	return invalidateSnapshotsFrom(bookId, "0000-00", workspaceRoot);
+}
+async function bookExists(bookId, workspaceRoot) {
+	return fileExists(bookRoot(bookId, workspaceRoot));
+}
+async function ensureBookDir(bookId, workspaceRoot) {
+	await node_fs.promises.mkdir(bookRoot(bookId, workspaceRoot), { recursive: true });
+	await node_fs.promises.mkdir(journalDir(bookId, workspaceRoot), { recursive: true });
+	await node_fs.promises.mkdir(snapshotsDir(bookId, workspaceRoot), { recursive: true });
+}
+/** Recursively delete a book's directory. Used by `deleteBook` after
+*  the config has been updated to drop the entry. */
+async function removeBookDir(bookId, workspaceRoot) {
+	await node_fs.promises.rm(bookRoot(bookId, workspaceRoot), {
+		recursive: true,
+		force: true
+	});
+}
+//#endregion
 //#region src/server/openingBalances.ts
 /** Find the existing opening entry for a book, if any. Multiple
 *  openings shouldn't coexist (the route enforces void-then-append),
@@ -672,7 +709,7 @@ function parseOpeningLines(raw, accounts, errors) {
 	const accountByCode = new Map(accounts.map((account) => [account.code, account]));
 	const lines = [];
 	raw.forEach((rawLine, idx) => {
-		const line = parseJournalLine(rawLine, idx, errors);
+		const line = parseJournalLine$1(rawLine, idx, errors);
 		if (line === null) return;
 		validateOpeningAccount(line, idx, accountByCode, errors);
 		lines.push(line);
@@ -841,48 +878,38 @@ function computeCurrentEarnings(accounts, balanceByCode) {
 	}
 	return earnings;
 }
+function buildBalanceSheetSection(type, accounts, balanceByCode, currentEarnings) {
+	const rows = accounts.filter((account) => account.type === type).map((account) => ({
+		accountCode: account.code,
+		accountName: account.name,
+		balance: naturalSign$1(type, balanceByCode.get(account.code) ?? 0)
+	})).filter((row) => Math.abs(row.balance) > ZERO_TOLERANCE);
+	if (type === "equity" && Math.abs(currentEarnings) > ZERO_TOLERANCE) rows.push({
+		accountCode: CURRENT_EARNINGS_ACCOUNT_CODE,
+		accountName: "Current period earnings",
+		balance: currentEarnings
+	});
+	return {
+		type,
+		rows,
+		total: rows.reduce((sum, row) => sum + row.balance, 0)
+	};
+}
 function buildBalanceSheet(input) {
 	const balanceByCode = new Map(input.balances.map((row) => [row.accountCode, row.netDebit]));
 	const currentEarnings = computeCurrentEarnings(input.accounts, balanceByCode);
-	const sections = [];
-	for (const type of [
-		"asset",
-		"liability",
-		"equity"
-	]) {
-		const rows = [];
-		let total = 0;
-		for (const account of input.accounts) {
-			if (account.type !== type) continue;
-			const presented = naturalSign$1(type, balanceByCode.get(account.code) ?? 0);
-			if (Math.abs(presented) <= ZERO_TOLERANCE) continue;
-			rows.push({
-				accountCode: account.code,
-				accountName: account.name,
-				balance: presented
-			});
-			total += presented;
-		}
-		if (type === "equity" && Math.abs(currentEarnings) > ZERO_TOLERANCE) {
-			rows.push({
-				accountCode: CURRENT_EARNINGS_ACCOUNT_CODE,
-				accountName: "Current period earnings",
-				balance: currentEarnings
-			});
-			total += currentEarnings;
-		}
-		sections.push({
-			type,
-			rows,
-			total
-		});
-	}
-	const assetTotal = sections[0].total;
-	const liabEquityTotal = sections[1].total + sections[2].total;
+	const section = (type) => buildBalanceSheetSection(type, input.accounts, balanceByCode, currentEarnings);
+	const assets = section("asset");
+	const liabilities = section("liability");
+	const equity = section("equity");
 	return {
 		asOf: input.asOf,
-		sections,
-		imbalance: assetTotal - liabEquityTotal
+		sections: [
+			assets,
+			liabilities,
+			equity
+		],
+		imbalance: assets.total - (liabilities.total + equity.total)
 	};
 }
 function buildProfitLoss(input) {
@@ -984,7 +1011,7 @@ function fmtYmd(year, month, day) {
 	return `${year}-${pad2(month)}-${pad2(day)}`;
 }
 function parseYmd(value) {
-	const [year, month, day] = value.split("-").map((segment) => parseInt(segment, 10));
+	const [year = NaN, month = NaN, day = NaN] = value.split("-").map((segment) => parseInt(segment, 10));
 	return {
 		year,
 		month,
@@ -1164,7 +1191,7 @@ function publishBooksChanged() {
 //#endregion
 //#region src/server/snapshotCache.ts
 function previousPeriod(period) {
-	const [year, month] = period.split("-").map((segment) => parseInt(segment, 10));
+	const [year = NaN, month = NaN] = period.split("-").map((segment) => parseInt(segment, 10));
 	if (month === 1) return `${(year - 1).toString().padStart(4, "0")}-12`;
 	return `${year.toString().padStart(4, "0")}-${(month - 1).toString().padStart(2, "0")}`;
 }
@@ -1190,12 +1217,12 @@ async function buildEmptySnapshot(bookId, period, workspaceRoot) {
 async function getOrBuildSnapshot(bookId, period, workspaceRoot) {
 	const cached = await readSnapshot(bookId, period, workspaceRoot);
 	if (cached) return cached;
-	const periods = await listJournalPeriods(bookId, workspaceRoot);
-	if (periods.length === 0 || period < periods[0]) return buildEmptySnapshot(bookId, period, workspaceRoot);
+	const [earliestPeriod] = await listJournalPeriods(bookId, workspaceRoot);
+	if (earliestPeriod === void 0 || period < earliestPeriod) return buildEmptySnapshot(bookId, period, workspaceRoot);
 	const { entries } = await readJournalMonth(bookId, period, workspaceRoot);
 	const monthDelta = aggregateBalances(entries);
 	let priorBalances = [];
-	if (period > periods[0]) priorBalances = (await getOrBuildSnapshot(bookId, previousPeriod(period), workspaceRoot)).balances;
+	if (period > earliestPeriod) priorBalances = (await getOrBuildSnapshot(bookId, previousPeriod(period), workspaceRoot)).balances;
 	const snap = {
 		period,
 		balances: mergeBalances(priorBalances, monthDelta),
@@ -1667,19 +1694,22 @@ function coerceFiscalYearEndInput(raw) {
 	if (!require_shared.isFiscalYearEnd(month)) throw unsupportedFiscalYearEndError(raw);
 	return month;
 }
-/** Boundary checks shared by updateBook (name / country only —
-*  fiscalYearEnd is coerced + validated separately via
-*  `coerceFiscalYearEndInput`). Throws on the first failure so the
-*  surrounding function stays under the cognitive-complexity threshold;
-*  each rule is also unit-testable independently via the service entry
-*  point. */
-function validateUpdateBookInput(input) {
+/** Boundary checks for updateBook (name / country only — fiscalYearEnd is
+*  coerced + validated separately via `coerceFiscalYearEndInput`). Throws on
+*  the first failure so the surrounding function stays under the
+*  cognitive-complexity threshold, and hands back the country to persist:
+*  `undefined` = the field was omitted, `""` = explicit clear. */
+function parseUpdateBookInput(input) {
 	if (input.name !== void 0 && (typeof input.name !== "string" || input.name.trim() === "")) throw new AccountingError(400, "name must be a non-empty string when supplied");
-	if (input.country !== void 0 && input.country !== "" && !require_shared.isSupportedCountryCode(input.country)) throw unsupportedCountryError(input.country);
+	const { country } = input;
+	if (country === void 0 || country === "") return country;
+	if (!require_shared.isSupportedCountryCode(country)) throw unsupportedCountryError(country);
+	return country;
 }
 async function createBook(input, workspaceRoot) {
 	if (typeof input.name !== "string" || input.name.trim() === "") throw new AccountingError(400, "name is required");
-	if (input.country !== void 0 && !require_shared.isSupportedCountryCode(input.country)) throw unsupportedCountryError(input.country);
+	const { country } = input;
+	if (country !== void 0 && !require_shared.isSupportedCountryCode(country)) throw unsupportedCountryError(country);
 	const fiscalYearEnd = coerceFiscalYearEndInput(input.fiscalYearEnd) ?? 12;
 	const config = await loadOrInitConfig(workspaceRoot);
 	const bookId = input.id ?? await generateBookId(config, workspaceRoot);
@@ -1690,7 +1720,7 @@ async function createBook(input, workspaceRoot) {
 		id: bookId,
 		name: input.name,
 		currency: input.currency ?? DEFAULT_CURRENCY,
-		...input.country ? { country: input.country } : {},
+		...country ? { country } : {},
 		fiscalYearEnd,
 		createdAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
@@ -1704,15 +1734,15 @@ async function updateBook(input, workspaceRoot) {
 	const config = await loadOrInitConfig(workspaceRoot);
 	const target = findBook(config, input.bookId);
 	if (!target) throw new AccountingError(404, `book ${JSON.stringify(input.bookId)} not found`);
-	validateUpdateBookInput(input);
+	const country = parseUpdateBookInput(input);
 	const fiscalYearEnd = coerceFiscalYearEndInput(input.fiscalYearEnd);
 	const next = {
 		...target,
 		...input.name !== void 0 ? { name: input.name } : {},
-		...input.country !== void 0 && input.country !== "" ? { country: input.country } : {},
+		...country ? { country } : {},
 		...fiscalYearEnd !== void 0 ? { fiscalYearEnd } : {}
 	};
-	if (input.country === "") delete next.country;
+	if (country === "") delete next.country;
 	await writeConfig({ books: config.books.map((book) => book.id === input.bookId ? next : book) }, workspaceRoot);
 	publishBooksChanged();
 	return { book: next };
@@ -1927,7 +1957,7 @@ async function setOpeningBalances(input, workspaceRoot) {
 }
 function endDateOfPeriod(period) {
 	if (period.kind === "month") {
-		const [year, month] = period.period.split("-").map((segment) => parseInt(segment, 10));
+		const [year = NaN, month = NaN] = period.period.split("-").map((segment) => parseInt(segment, 10));
 		const last = new Date(Date.UTC(year, month, 0)).getUTCDate();
 		return `${period.period}-${String(last).padStart(2, "0")}`;
 	}
@@ -1983,12 +2013,14 @@ function ensureValidYmd(label, value) {
 	return value;
 }
 function ensureMetric(value) {
-	if (typeof value !== "string" || !require_shared.TIME_SERIES_METRICS.includes(value)) throw new AccountingError(400, `getTimeSeries: metric must be one of ${require_shared.TIME_SERIES_METRICS.join(", ")}`);
-	return value;
+	const metric = require_shared.TIME_SERIES_METRICS.find((candidate) => candidate === value);
+	if (metric === void 0) throw new AccountingError(400, `getTimeSeries: metric must be one of ${require_shared.TIME_SERIES_METRICS.join(", ")}`);
+	return metric;
 }
 function ensureGranularity(value) {
-	if (typeof value !== "string" || !require_shared.TIME_SERIES_GRANULARITIES.includes(value)) throw new AccountingError(400, `getTimeSeries: granularity must be one of ${require_shared.TIME_SERIES_GRANULARITIES.join(", ")}`);
-	return value;
+	const granularity = require_shared.TIME_SERIES_GRANULARITIES.find((candidate) => candidate === value);
+	if (granularity === void 0) throw new AccountingError(400, `getTimeSeries: granularity must be one of ${require_shared.TIME_SERIES_GRANULARITIES.join(", ")}`);
+	return granularity;
 }
 function resolveAccountCode(metric, raw) {
 	if (metric === "accountBalance") {
@@ -2094,6 +2126,7 @@ async function handleGetReport(rest) {
 	const periodInput = optionalReportPeriod(rest.period);
 	const bookId = optionalString(rest.bookId);
 	const periodRequired = (label) => new AccountingError(400, `${label}: period is required — { kind: "month", period: "YYYY-MM" } or { kind: "range", from: "YYYY-MM-DD", to: "YYYY-MM-DD" }`);
+	if (rest.period !== void 0 && rest.period !== null && !periodInput) throw periodRequired(`getReport ${kind || "(no kind)"}`);
 	if (kind === "balance") {
 		if (!periodInput) throw periodRequired("getReport balance");
 		return getBalanceSheetReport({
@@ -2219,11 +2252,11 @@ var MESSAGE_BUILDERS = {
 	},
 	[require_shared.ACCOUNTING_ACTIONS.addEntries]: (fields) => {
 		const entries = (require_shared.isUnknownArray(fields.entries) ? fields.entries : []).map(describeEntry);
-		if (entries.length === 0) return "Posted 0 journal entries.";
-		if (entries.length === 1) {
-			const [entry] = entries;
-			const idFragment = entry.id ? ` (id: ${entry.id})` : "";
-			return `Posted a journal entry on ${entry.date ?? "the requested date"}${idFragment}.`;
+		const [firstEntry, ...furtherEntries] = entries;
+		if (!firstEntry) return "Posted 0 journal entries.";
+		if (furtherEntries.length === 0) {
+			const idFragment = firstEntry.id ? ` (id: ${firstEntry.id})` : "";
+			return `Posted a journal entry on ${firstEntry.date ?? "the requested date"}${idFragment}.`;
 		}
 		const summary = entries.map((entry) => `${entry.date ?? "?"} (id: ${entry.id ?? "?"})`).join(", ");
 		return `Posted ${entries.length} journal entries: ${summary}.`;
@@ -2251,14 +2284,22 @@ var MESSAGE_BUILDERS = {
 		return `Updated ${bookName ? JSON.stringify(bookName) : "the book"}${country ? ` (country: ${country})` : ""}.`;
 	}
 };
+/** Read a record entry under a user/LLM-controlled key. The
+*  `Object.hasOwn` gate is load-bearing: a bare `record[key]` resolves
+*  inherited prototype members, so a crafted action ("constructor",
+*  "toString") would dispatch to an unexpected target instead of
+*  reading as absent. */
+function ownEntry(record, key) {
+	return Object.hasOwn(record, key) ? record[key] : void 0;
+}
 function previewMessage(action, fields) {
-	const head = Object.hasOwn(MESSAGE_BUILDERS, action) ? MESSAGE_BUILDERS[action](fields) : void 0;
+	const head = ownEntry(MESSAGE_BUILDERS, action)?.(fields);
 	return head ? `${head} ${VIEW_VISIBLE_TRAILER}` : VIEW_VISIBLE_TRAILER;
 }
 async function dispatch(body) {
 	const { action, ...rest } = body;
-	if (!Object.hasOwn(ACTION_HANDLERS, action)) throw new AccountingError(400, `unknown action ${JSON.stringify(action)}`);
-	const handler = ACTION_HANDLERS[action];
+	const handler = ownEntry(ACTION_HANDLERS, action);
+	if (!handler) throw new AccountingError(400, `unknown action ${JSON.stringify(action)}`);
 	const result = await handler(rest);
 	const handlerFields = require_shared.isRecord(result) ? result : { value: result };
 	const dataField = PREVIEW_ACTIONS.has(action) ? { data: {