@mulmoclaude/accounting-plugin 1.2.2 → 2.0.0

package/dist/server.js

@@ -1,4 +1,4 @@
-import { A as resolveFiscalYearEnd, B as BALANCE_SHEET_ACCOUNT_TYPES, D as isFiscalYearEnd, F as isUnknownArray, H as ACCOUNTING_API, I as ACCOUNTING_BOOKS_CHANNEL, L as BOOK_EVENT_KINDS, M as errorMessage, N as hasStringProp, P as isRecord, R as bookChannel, S as FISCAL_YEAR_END_MONTHS, T as fiscalYearEndMonth, U as ACCOUNTING_ACTIONS, V as JOURNAL_ENTRY_KINDS, _ as SUPPORTED_COUNTRY_CODES, j as ACCOUNTING_DIRS, n as TIME_SERIES_METRICS, t as TIME_SERIES_GRANULARITIES, y as isSupportedCountryCode, z as ACCOUNT_TYPES } from "./shared-xYPtGNvH.js";
+import { A as resolveFiscalYearEnd, B as BALANCE_SHEET_ACCOUNT_TYPES, D as isFiscalYearEnd, F as isUnknownArray, H as ACCOUNTING_API, I as ACCOUNTING_BOOKS_CHANNEL, L as BOOK_EVENT_KINDS, M as errorMessage, N as hasStringProp, P as isRecord, R as bookChannel, S as FISCAL_YEAR_END_MONTHS, T as fiscalYearEndMonth, U as ACCOUNTING_ACTIONS, V as JOURNAL_ENTRY_KINDS, _ as SUPPORTED_COUNTRY_CODES, j as ACCOUNTING_DIRS, n as TIME_SERIES_METRICS, t as TIME_SERIES_GRANULARITIES, y as isSupportedCountryCode, z as ACCOUNT_TYPES } from "./shared-BZAAF-I4.js";
 import { Router } from "express";
 import { randomUUID } from "node:crypto";
 import { promises } from "node:fs";
@@ -7,18 +7,36 @@ import { isEnoent, writeJsonAtomic } from "@mulmoclaude/core/files";
 //#region src/server/bodyFields.ts
 var optionalString = (value) => typeof value === "string" ? value : void 0;
 var optionalRecord = (value) => isRecord(value) ? value : void 0;
+var YEAR_MONTH_RE = /^\d{4}-(0[1-9]|1[0-2])$/;
+var YEAR_MONTH_DAY_RE = /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/;
+/** `YYYY-MM-DD` that names a day the calendar actually has. The regex alone
+*  admits `2026-02-30`, and `Date.UTC` rolls that forward to March instead of
+*  refusing it, so the round trip is what says the date is real. */
+var isCalendarDate = (value) => {
+	if (!YEAR_MONTH_DAY_RE.test(value)) return false;
+	const [year, month, day] = value.split("-").map(Number);
+	if (year === void 0 || month === void 0 || day === void 0) return false;
+	return new Date(Date.UTC(year, month - 1, day)).getUTCDate() === day;
+};
 /** Rebuilt field by field rather than narrowed with a predicate, so the
 *  returned object is one this function actually proved. A half-formed
 *  `{ kind: "month" }` reads as absent and the caller raises its own
 *  "period is required" — previously it reached the report builders and
-*  produced an `undefined-01` date. */
+*  produced an `undefined-01` date.
+*
+*  The FORMAT is checked here too, not just the type: `typeof === "string"`
+*  let `{ kind: "month", period: "banana" }` through, which came back as a
+*  balance sheet dated `"banana-NaN"` and made the snapshot cache write
+*  `banana.json` / `0NaN-NaN.json` into the book (#2765). Malformed reads as
+*  absent so it lands on the caller's existing 400, which already spells out
+*  both accepted shapes for the LLM to repair its payload from. */
 var optionalReportPeriod = (value) => {
 	const period = optionalRecord(value);
-	if (period?.kind === "month" && typeof period.period === "string") return {
+	if (period?.kind === "month" && typeof period.period === "string" && YEAR_MONTH_RE.test(period.period)) return {
 		kind: "month",
 		period: period.period
 	};
-	if (period?.kind === "range" && typeof period.from === "string" && typeof period.to === "string") return {
+	if (period?.kind === "range" && typeof period.from === "string" && typeof period.to === "string" && isCalendarDate(period.from) && isCalendarDate(period.to)) return {
 		kind: "range",
 		from: period.from,
 		to: period.to
@@ -94,6 +112,7 @@ function localDateString(now = /* @__PURE__ */ new Date()) {
 function isValidCalendarDate(date) {
 	if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) return false;
 	const [year, month, day] = date.split("-").map((segment) => parseInt(segment, 10));
+	if (year === void 0 || month === void 0 || day === void 0) return false;
 	const parsed = new Date(Date.UTC(year, month - 1, day));
 	return parsed.getUTCFullYear() === year && parsed.getUTCMonth() === month - 1 && parsed.getUTCDate() === day;
 }
@@ -598,6 +617,7 @@ async function invalidateSnapshotsFrom(bookId, fromPeriod, workspaceRoot) {
 		const match = /^(\d{4}-\d{2})\.json$/.exec(name);
 		if (!match) continue;
 		const [, period] = match;
+		if (period === void 0) continue;
 		if (period >= fromPeriod) {
 			await promises.rm(path.join(snapshotsDir(bookId, workspaceRoot), name), { force: true });
 			removed.push(period);
@@ -834,48 +854,38 @@ function computeCurrentEarnings(accounts, balanceByCode) {
 	}
 	return earnings;
 }
+function buildBalanceSheetSection(type, accounts, balanceByCode, currentEarnings) {
+	const rows = accounts.filter((account) => account.type === type).map((account) => ({
+		accountCode: account.code,
+		accountName: account.name,
+		balance: naturalSign$1(type, balanceByCode.get(account.code) ?? 0)
+	})).filter((row) => Math.abs(row.balance) > ZERO_TOLERANCE);
+	if (type === "equity" && Math.abs(currentEarnings) > ZERO_TOLERANCE) rows.push({
+		accountCode: CURRENT_EARNINGS_ACCOUNT_CODE,
+		accountName: "Current period earnings",
+		balance: currentEarnings
+	});
+	return {
+		type,
+		rows,
+		total: rows.reduce((sum, row) => sum + row.balance, 0)
+	};
+}
 function buildBalanceSheet(input) {
 	const balanceByCode = new Map(input.balances.map((row) => [row.accountCode, row.netDebit]));
 	const currentEarnings = computeCurrentEarnings(input.accounts, balanceByCode);
-	const sections = [];
-	for (const type of [
-		"asset",
-		"liability",
-		"equity"
-	]) {
-		const rows = [];
-		let total = 0;
-		for (const account of input.accounts) {
-			if (account.type !== type) continue;
-			const presented = naturalSign$1(type, balanceByCode.get(account.code) ?? 0);
-			if (Math.abs(presented) <= ZERO_TOLERANCE) continue;
-			rows.push({
-				accountCode: account.code,
-				accountName: account.name,
-				balance: presented
-			});
-			total += presented;
-		}
-		if (type === "equity" && Math.abs(currentEarnings) > ZERO_TOLERANCE) {
-			rows.push({
-				accountCode: CURRENT_EARNINGS_ACCOUNT_CODE,
-				accountName: "Current period earnings",
-				balance: currentEarnings
-			});
-			total += currentEarnings;
-		}
-		sections.push({
-			type,
-			rows,
-			total
-		});
-	}
-	const assetTotal = sections[0].total;
-	const liabEquityTotal = sections[1].total + sections[2].total;
+	const section = (type) => buildBalanceSheetSection(type, input.accounts, balanceByCode, currentEarnings);
+	const assets = section("asset");
+	const liabilities = section("liability");
+	const equity = section("equity");
 	return {
 		asOf: input.asOf,
-		sections,
-		imbalance: assetTotal - liabEquityTotal
+		sections: [
+			assets,
+			liabilities,
+			equity
+		],
+		imbalance: assets.total - (liabilities.total + equity.total)
 	};
 }
 function buildProfitLoss(input) {
@@ -977,7 +987,7 @@ function fmtYmd(year, month, day) {
 	return `${year}-${pad2(month)}-${pad2(day)}`;
 }
 function parseYmd(value) {
-	const [year, month, day] = value.split("-").map((segment) => parseInt(segment, 10));
+	const [year = NaN, month = NaN, day = NaN] = value.split("-").map((segment) => parseInt(segment, 10));
 	return {
 		year,
 		month,
@@ -1157,7 +1167,7 @@ function publishBooksChanged() {
 //#endregion
 //#region src/server/snapshotCache.ts
 function previousPeriod(period) {
-	const [year, month] = period.split("-").map((segment) => parseInt(segment, 10));
+	const [year = NaN, month = NaN] = period.split("-").map((segment) => parseInt(segment, 10));
 	if (month === 1) return `${(year - 1).toString().padStart(4, "0")}-12`;
 	return `${year.toString().padStart(4, "0")}-${(month - 1).toString().padStart(2, "0")}`;
 }
@@ -1183,12 +1193,12 @@ async function buildEmptySnapshot(bookId, period, workspaceRoot) {
 async function getOrBuildSnapshot(bookId, period, workspaceRoot) {
 	const cached = await readSnapshot(bookId, period, workspaceRoot);
 	if (cached) return cached;
-	const periods = await listJournalPeriods(bookId, workspaceRoot);
-	if (periods.length === 0 || period < periods[0]) return buildEmptySnapshot(bookId, period, workspaceRoot);
+	const [earliestPeriod] = await listJournalPeriods(bookId, workspaceRoot);
+	if (earliestPeriod === void 0 || period < earliestPeriod) return buildEmptySnapshot(bookId, period, workspaceRoot);
 	const { entries } = await readJournalMonth(bookId, period, workspaceRoot);
 	const monthDelta = aggregateBalances(entries);
 	let priorBalances = [];
-	if (period > periods[0]) priorBalances = (await getOrBuildSnapshot(bookId, previousPeriod(period), workspaceRoot)).balances;
+	if (period > earliestPeriod) priorBalances = (await getOrBuildSnapshot(bookId, previousPeriod(period), workspaceRoot)).balances;
 	const snap = {
 		period,
 		balances: mergeBalances(priorBalances, monthDelta),
@@ -1923,7 +1933,7 @@ async function setOpeningBalances(input, workspaceRoot) {
 }
 function endDateOfPeriod(period) {
 	if (period.kind === "month") {
-		const [year, month] = period.period.split("-").map((segment) => parseInt(segment, 10));
+		const [year = NaN, month = NaN] = period.period.split("-").map((segment) => parseInt(segment, 10));
 		const last = new Date(Date.UTC(year, month, 0)).getUTCDate();
 		return `${period.period}-${String(last).padStart(2, "0")}`;
 	}
@@ -2092,6 +2102,7 @@ async function handleGetReport(rest) {
 	const periodInput = optionalReportPeriod(rest.period);
 	const bookId = optionalString(rest.bookId);
 	const periodRequired = (label) => new AccountingError(400, `${label}: period is required — { kind: "month", period: "YYYY-MM" } or { kind: "range", from: "YYYY-MM-DD", to: "YYYY-MM-DD" }`);
+	if (rest.period !== void 0 && rest.period !== null && !periodInput) throw periodRequired(`getReport ${kind || "(no kind)"}`);
 	if (kind === "balance") {
 		if (!periodInput) throw periodRequired("getReport balance");
 		return getBalanceSheetReport({
@@ -2217,11 +2228,11 @@ var MESSAGE_BUILDERS = {
 	},
 	[ACCOUNTING_ACTIONS.addEntries]: (fields) => {
 		const entries = (isUnknownArray(fields.entries) ? fields.entries : []).map(describeEntry);
-		if (entries.length === 0) return "Posted 0 journal entries.";
-		if (entries.length === 1) {
-			const [entry] = entries;
-			const idFragment = entry.id ? ` (id: ${entry.id})` : "";
-			return `Posted a journal entry on ${entry.date ?? "the requested date"}${idFragment}.`;
+		const [firstEntry, ...furtherEntries] = entries;
+		if (!firstEntry) return "Posted 0 journal entries.";
+		if (furtherEntries.length === 0) {
+			const idFragment = firstEntry.id ? ` (id: ${firstEntry.id})` : "";
+			return `Posted a journal entry on ${firstEntry.date ?? "the requested date"}${idFragment}.`;
 		}
 		const summary = entries.map((entry) => `${entry.date ?? "?"} (id: ${entry.id ?? "?"})`).join(", ");
 		return `Posted ${entries.length} journal entries: ${summary}.`;
@@ -2249,14 +2260,22 @@ var MESSAGE_BUILDERS = {
 		return `Updated ${bookName ? JSON.stringify(bookName) : "the book"}${country ? ` (country: ${country})` : ""}.`;
 	}
 };
+/** Read a record entry under a user/LLM-controlled key. The
+*  `Object.hasOwn` gate is load-bearing: a bare `record[key]` resolves
+*  inherited prototype members, so a crafted action ("constructor",
+*  "toString") would dispatch to an unexpected target instead of
+*  reading as absent. */
+function ownEntry(record, key) {
+	return Object.hasOwn(record, key) ? record[key] : void 0;
+}
 function previewMessage(action, fields) {
-	const head = Object.hasOwn(MESSAGE_BUILDERS, action) ? MESSAGE_BUILDERS[action](fields) : void 0;
+	const head = ownEntry(MESSAGE_BUILDERS, action)?.(fields);
 	return head ? `${head} ${VIEW_VISIBLE_TRAILER}` : VIEW_VISIBLE_TRAILER;
 }
 async function dispatch(body) {
 	const { action, ...rest } = body;
-	if (!Object.hasOwn(ACTION_HANDLERS, action)) throw new AccountingError(400, `unknown action ${JSON.stringify(action)}`);
-	const handler = ACTION_HANDLERS[action];
+	const handler = ownEntry(ACTION_HANDLERS, action);
+	if (!handler) throw new AccountingError(400, `unknown action ${JSON.stringify(action)}`);
 	const result = await handler(rest);
 	const handlerFields = isRecord(result) ? result : { value: result };
 	const dataField = PREVIEW_ACTIONS.has(action) ? { data: {