tango-app-api-payment-subscription 3.5.29 → 3.5.31

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tango-app-api-payment-subscription",
-    "version": "3.5.29",
+    "version": "3.5.31",
     "description": "paymentSubscription",
     "main": "index.js",
     "type": "module",
@@ -29,7 +29,7 @@
         "nodemon": "^3.1.0",
         "puppeteer": "^24.41.0",
         "swagger-ui-express": "^5.0.0",
-        "tango-api-schema": "^2.6.43",
+        "tango-api-schema": "^2.6.46",
         "tango-app-api-middleware": "^3.6.18",
         "winston": "^3.12.0",
         "winston-daily-rotate-file": "^5.0.0",

package/src/controllers/brandsBilling.controller.js

@@ -641,6 +641,13 @@ export async function brandInvoiceList( req, res ) {
       if ( inv.paymentStatus === 'paid' ) {
         continue;
       }
+      // Only invoices with a real (generated) invoice number count toward the
+      // Outstanding / Overdue / Pending Payment cards. Pre-finance drafts carry
+      // a temporary DRAFT- number and must be excluded until the real INV/TINV
+      // number is minted at finance approval.
+      if ( String( inv.invoice || '' ).startsWith( 'DRAFT-' ) ) {
+        continue;
+      }
       const excl = toInr( inv, inv.amount );
       const incl = toInr( inv, inv.totalAmount || inv.amount );
       cards.outstandingExclAmount += excl;
@@ -2042,6 +2049,14 @@ export async function billingSummary( req, res ) {
       { $match: {
         status: 'approved',
         paymentStatus: { $in: [ 'unpaid', 'partial', 'due' ] },
+        // Outstanding aging counts only regular invoices. Advance invoices use
+        // the separate TINV- series (quarterly/half-yearly/yearly) and must be
+        // excluded so their balances don't inflate the aging buckets/outstanding
+        // total. Matches the invoice-list 'all' filter idiom. A missing invoice
+        // # is treated as a regular invoice.
+        $expr: { $not: { $regexMatch: {
+          input: { $ifNull: [ '$invoice', '' ] }, regex: '^TINV-',
+        } } },
       } },
       { $addFields: {
         dueDateD: { $cond: [

package/src/controllers/invoice.controller.js

@@ -15,7 +15,7 @@ import * as basepricingService from '../services/basePrice.service.js';
 import * as paymentAccountService from '../services/paymentAccount.service.js';
 import { symbolFor, roundAmount, wordFor } from '../utils/currency.js';
 import { invoiceStatusEnum } from '../dtos/validation.dtos.js';
-import { findOneApplicationDefault } from '../services/applicationDefault.service.js';
+import { findOneApplicationDefault, nextCounterValue } from '../services/applicationDefault.service.js';
 import * as assignedStoreService from '../services/assignedStore.service.js';
 import * as bankTransactionService from '../services/bankTransaction.service.js';
 import { getInrRate, getAdditionalProducts } from './brandsBilling.controller.js';
@@ -128,19 +128,11 @@ export async function createInvoice( req, res ) {
         return res.sendError( 'clientId is required for customInvoice', 400 );
       }
       const Finacialyear = getCurrentFinancialYear();
-      // Quarterly/half-yearly/yearly advance invoices use the separate TINV-
-      // series with its own per-FY counter; monthly advance + normal stay INV-.
-      const invPrefix = invoicePrefixFor( req.body.advanceInvoice, req.body.advancePeriod );
-      const previousinvoice = await invoiceService.findandsort(
-          { invoice: { $regex: `^${invPrefix}${Finacialyear}-` } },
-          {},
-          { invoiceIndex: -1 },
-      );
-      let invoiceNo = '00001';
-      if ( previousinvoice && previousinvoice.length > 0 ) {
-        invoiceNo = Number( previousinvoice[0].invoiceIndex ) + 1;
-        invoiceNo = invoiceNo.toString().padStart( 5, '0' );
-      }
+      // Draft numbering: custom invoices get a temporary DRAFT-<FY>-<seq>
+      // number. The real INV/TINV number is minted at finance approval. See
+      // nextTempInvoiceIndex / formatTempInvoice and transitionInvoiceStatus.
+      const tempSeq = await nextTempInvoiceIndex( Finacialyear );
+      const tempInvoiceNo = formatTempInvoice( Finacialyear, tempSeq );
       const baseDate = req.body.billingDate ? dayjs( req.body.billingDate ) : dayjs();
       let customProducts = Array.isArray( req.body.products ) ? req.body.products : [];
 
@@ -173,8 +165,9 @@ export async function createInvoice( req, res ) {
         roundAmount( Number( req.body.totalAmount ) || 0, customCurrency );
 
       const data = {
-        invoice: `${invPrefix}${Finacialyear}-${invoiceNo}`,
-        invoiceIndex: invoiceNo,
+        invoice: tempInvoiceNo,
+        invoiceIndex: null,
+        tempIndex: tempSeq,
         clientId: req.body.clientId,
         groupId: req.body.groupId || undefined,
         groupName: req.body.groupName || '',
@@ -198,24 +191,11 @@ export async function createInvoice( req, res ) {
         advanceInvoice: req.body.advanceInvoice || false,
         advancePeriod: req.body.advanceInvoice ? ( req.body.advancePeriod || 'monthly' ) : undefined,
         advanceMonths: customAdvanceMonths,
-        // Purchase order this invoice is mapped to (optional).
-        purchaseOrderNumber: req.body.purchaseOrderNumber || undefined,
+        // Purchase order can only be attached AFTER the real invoice number is
+        // minted (finance approval); drafts never carry a PO.
+        purchaseOrderNumber: undefined,
       };
       const created = await invoiceService.create( data );
-      // Map to a PO (deduct its remaining balance + log) when one was picked.
-      if ( data.purchaseOrderNumber ) {
-        try {
-          await applyInvoiceToPurchaseOrder( {
-            clientId: data.clientId,
-            purchaseOrderNumber: data.purchaseOrderNumber,
-            invoice: data.invoice,
-            amount: data.totalAmount,
-            req,
-          } );
-        } catch ( poErr ) {
-          logger.error( { error: poErr, function: 'createInvoice.applyPO', invoice: data.invoice } );
-        }
-      }
       const logObj = {
         userName: req.user?.userName,
         email: req.user?.email,
@@ -236,6 +216,11 @@ export async function createInvoice( req, res ) {
       return res.sendSuccess( { data: created } );
     }
 
+    // Running DRAFT sequence for this generation run. Auto-generated invoices
+    // are drafts until finance approval; seed once from the DB max, then
+    // increment per created draft so a single run yields unique DRAFT numbers.
+    let runTempSeq = await nextTempInvoiceIndex( getCurrentFinancialYear() );
+
     for ( let group of invoiceGroupList ) {
       let Finacialyear = getCurrentFinancialYear();
 
@@ -265,22 +250,16 @@ export async function createInvoice( req, res ) {
       const isAdvance = group.advanceInvoice && !advanceCoverProducts;
 
       // Quarterly/half-yearly/yearly advance invoices use the separate TINV-
-      // series with its own per-FY counter; monthly advance + normal stay INV-.
+      // series; monthly advance + normal stay INV-. Still used below to decide
+      // whether to capture the full store list for TINV invoices.
       const invPrefix = invoicePrefixFor( isAdvance, group.advancePeriod );
-      // Scope the highest-index lookup to invoices created in the current FY for
-      // THIS series. Without the FY scope the new FY would continue the previous
-      // year's sequence; without the prefix scope the two series would share one
-      // counter.
-      let previousinvoice = await invoiceService.findandsort(
-          { invoice: { $regex: `^${invPrefix}${Finacialyear}-` } },
-          {},
-          { invoiceIndex: -1 },
-      );
-      let invoiceNo = '00001';
-      if ( previousinvoice && previousinvoice.length > 0 ) {
-        invoiceNo = Number( previousinvoice[0].invoiceIndex ) + 1;
-        invoiceNo = invoiceNo.toString().padStart( 5, '0' );
-      }
+
+      // Draft numbering: assign a temporary DRAFT-<FY>-<seq> number from the
+      // running counter. Real INV/TINV number is minted at finance approval.
+      // (isAdvance/advance fields are still stored on the doc for the mint.)
+      const tempInvoiceNo = formatTempInvoice( Finacialyear, runTempSeq );
+      const tempSeqForThis = runTempSeq;
+      runTempSeq += 1;
 
       let address = group.addressLineOne + group.addressLineTwo + group.city + ',' + group.state + ',' + group.country + ' -' + group.pinCode;
       let getClient = await clientService.findOne( { clientId: group.clientId, status: 'active' } );
@@ -575,11 +554,12 @@ export async function createInvoice( req, res ) {
       let data = {
         groupName: group.groupName,
         groupId: group._id,
-        invoice: req.body.invoiceId ? req.body.invoiceId : `${invPrefix}${Finacialyear}-${invoiceNo}`,
+        invoice: req.body.invoiceId ? req.body.invoiceId : tempInvoiceNo,
         products: products,
         status: 'pendingCsm',
         amount: roundAmount( amount, group.currency ),
-        invoiceIndex: req.body.invoiceId ? findInvoice.invoiceIndex : invoiceNo,
+        invoiceIndex: req.body.invoiceId ? findInvoice.invoiceIndex : null,
+        tempIndex: req.body.invoiceId ? undefined : tempSeqForThis,
         tax: taxList,
         companyName: ( group.registeredCompanyName || '' ).toUpperCase(),
         companyAddress: address,
@@ -676,6 +656,27 @@ function invoicePrefixFor( advanceInvoice, advancePeriod ) {
   return 'INV-';
 }
 
+// Temporary invoice number helpers. New invoices carry a DRAFT-<FY>-<seq>
+// number until finance approval mints the real INV/TINV number. Draft docs
+// store their sequence in `tempIndex` and keep `invoiceIndex` null, so drafts
+// never participate in the real max(invoiceIndex)+1 allocation and deleting a
+// draft leaves no gap in the real series.
+function formatTempInvoice( FY, seq ) {
+  return `DRAFT-${FY}-${String( seq ).padStart( 5, '0' )}`;
+}
+
+// Next temp sequence for a FY: max(tempIndex among ^DRAFT-<FY>-) + 1, else 1.
+async function nextTempInvoiceIndex( FY ) {
+  const previous = await invoiceService.findandsort(
+      { invoice: { $regex: `^DRAFT-${FY}-` } },
+      {},
+      { tempIndex: -1 },
+  );
+  if ( previous && previous.length > 0 && previous[0].tempIndex != null ) {
+    return Number( previous[0].tempIndex ) + 1;
+  }
+  return 1;
+}
 
 // ---------------------------------------------------------------------------
 // Shared annexure builder. Anchored to the invoice's BILLING month and
@@ -1213,6 +1214,235 @@ export async function invoiceDownloadBulk( req, res ) {
   }
 }
 
+// Bulk email — PREVIEW. Filters the selected invoices down to approved-only,
+// computes the combined totals + per-invoice rows, and returns the union of
+// each involved billing group's generateInvoiceTo (TO) plus getInvoiceCcEmails
+// (CC) to prefill the Send Email popup. Does NOT send anything.
+export async function invoiceBulkEmailPreview( req, res ) {
+  try {
+    const invoiceIds = req.body?.invoiceIds;
+    if ( !Array.isArray( invoiceIds ) || invoiceIds.length === 0 ) {
+      return res.sendError( 'invoiceIds must be a non-empty array', 400 );
+    }
+
+    const approved = [];
+    for ( const id of invoiceIds ) {
+      const inv = await invoiceService.findOne( { _id: id } );
+      if ( inv && inv.status === 'approved' ) approved.push( inv );
+    }
+    const skippedCount = invoiceIds.length - approved.length;
+    if ( approved.length === 0 ) {
+      return res.sendError( 'No approved invoices in selection', 400 );
+    }
+
+    const currency = approved[0].currency;
+    const mixedCurrency = approved.some( ( inv ) => inv.currency !== currency );
+    if ( mixedCurrency ) {
+      logger.error( { function: 'invoiceBulkEmailPreview.mixedCurrency', invoiceIds } );
+    }
+    const currencyType = symbolFor( currency );
+    const fractionDigits = currency === 'inr' ? 0 : 2;
+    const moneyFmt = { minimumFractionDigits: fractionDigits, maximumFractionDigits: fractionDigits };
+
+    let totalExclNum = 0;
+    let totalInclNum = 0;
+    const rows = approved.map( ( inv ) => {
+      const excl = roundAmount( inv.amount, inv.currency );
+      const incl = roundAmount( inv.totalAmount, inv.currency );
+      totalExclNum += excl;
+      totalInclNum += incl;
+      return {
+        invoice: inv.invoice,
+        amountExcl: excl.toLocaleString( 'en-IN', moneyFmt ),
+        amountIncl: incl.toLocaleString( 'en-IN', moneyFmt ),
+      };
+    } );
+
+    // TO = union of every involved billing group's generateInvoiceTo.
+    const toSet = new Set();
+    const groupIds = [ ...new Set( approved.map( ( inv ) => String( inv.groupId || '' ) ).filter( Boolean ) ) ];
+    for ( const gid of groupIds ) {
+      const group = await billingService.findOne( { _id: gid } );
+      ( group?.generateInvoiceTo || [] ).forEach( ( e ) => {
+        const v = String( e || '' ).trim();
+        if ( v ) toSet.add( v );
+      } );
+    }
+    const toEmails = [ ...toSet ];
+    const toLower = new Set( toEmails.map( ( e ) => e.toLowerCase() ) );
+
+    // CC = configured heads + per-client CSMs, deduped, minus anyone in TO.
+    const clientId = approved[0].clientId;
+    const ccRaw = await getInvoiceCcEmails( clientId );
+    const ccEmails = [ ...new Set( ( ccRaw || [] ).map( ( e ) => String( e || '' ).trim() ).filter( Boolean ) ) ]
+        .filter( ( e ) => !toLower.has( e.toLowerCase() ) );
+
+    let brandSlug = 'invoices';
+    const firstClient = await clientService.findOne( { clientId } );
+    if ( firstClient?.clientName ) {
+      brandSlug = firstClient.clientName.toLowerCase().replace( /[^a-z0-9]+/g, '-' ).replace( /^-|-$/g, '' ) || 'invoices';
+    }
+    const zipFilename = `invoices-${brandSlug}-${dayjs().format( 'YYYY-MM-DD' )}.zip`;
+
+    return res.sendSuccess( {
+      approvedIds: approved.map( ( inv ) => String( inv._id ) ),
+      skippedCount,
+      rows,
+      totalExcl: totalExclNum.toLocaleString( 'en-IN', moneyFmt ),
+      totalIncl: totalInclNum.toLocaleString( 'en-IN', moneyFmt ),
+      currencyType,
+      toEmails,
+      ccEmails,
+      zipFilename,
+    } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'invoiceBulkEmailPreview' } );
+    return res.sendError( error, 500 );
+  }
+}
+
+// Builds the ZIP in memory (archiver piped into a buffer accumulator) so it
+// can be attached to the SES email rather than streamed to the HTTP response.
+function buildZipBuffer( items ) {
+  return new Promise( ( resolve, reject ) => {
+    const archive = archiver( 'zip', { zlib: { level: 6 } } );
+    const chunks = [];
+    archive.on( 'data', ( c ) => chunks.push( c ) );
+    archive.on( 'error', reject );
+    archive.on( 'end', () => resolve( Buffer.concat( chunks ) ) );
+    for ( const it of items ) {
+      archive.append( it.content, { name: it.name } );
+    }
+    archive.finalize();
+  } );
+}
+
+// Bulk email — SEND. Re-filters to approved-only (authoritative), builds one
+// ZIP of the approved PDFs, renders invoiceBulkEmail.hbs, and sends a single
+// SES email to the user-confirmed recipients. Does NOT change invoice status.
+export async function invoiceBulkEmailSend( req, res ) {
+  try {
+    const { invoiceIds, toEmails, ccEmails } = req.body || {};
+    if ( !Array.isArray( invoiceIds ) || invoiceIds.length === 0 ) {
+      return res.sendError( 'invoiceIds must be a non-empty array', 400 );
+    }
+    const to = [ ...new Set( ( toEmails || [] ).map( ( e ) => String( e || '' ).trim() ).filter( Boolean ) ) ];
+    if ( to.length === 0 ) {
+      return res.sendError( 'At least one recipient is required', 400 );
+    }
+
+    const approved = [];
+    for ( const id of invoiceIds ) {
+      const inv = await invoiceService.findOne( { _id: id } );
+      if ( inv && inv.status === 'approved' ) approved.push( inv );
+    }
+    if ( approved.length === 0 ) {
+      return res.sendError( 'No approved invoices in selection', 400 );
+    }
+
+    const currency = approved[0].currency;
+    const currencyType = symbolFor( currency );
+    const fractionDigits = currency === 'inr' ? 0 : 2;
+    const moneyFmt = { minimumFractionDigits: fractionDigits, maximumFractionDigits: fractionDigits };
+
+    // Build each PDF; collect failures without aborting the whole send.
+    const zipItems = [];
+    const rows = [];
+    let totalExclNum = 0;
+    let totalInclNum = 0;
+    let skippedBuildCount = 0;
+    for ( const inv of approved ) {
+      try {
+        const { pdfBuffer, filename } = await buildInvoicePdfBuffer( String( inv._id ) );
+        zipItems.push( { content: pdfBuffer, name: filename } );
+        const excl = roundAmount( inv.amount, inv.currency );
+        const incl = roundAmount( inv.totalAmount, inv.currency );
+        totalExclNum += excl;
+        totalInclNum += incl;
+        rows.push( {
+          invoice: inv.invoice,
+          amountExcl: excl.toLocaleString( 'en-IN', moneyFmt ),
+          amountIncl: incl.toLocaleString( 'en-IN', moneyFmt ),
+        } );
+      } catch ( err ) {
+        skippedBuildCount++;
+        logger.error( { error: err, function: 'invoiceBulkEmailSend.buildPdf', invoiceId: inv._id } );
+      }
+    }
+    if ( zipItems.length === 0 ) {
+      return res.sendError( 'Failed to build any invoice PDF', 500 );
+    }
+
+    const clientId = approved[0].clientId;
+    const clientDetails = await clientService.findOne( { clientId } );
+    const virtualAccount = await paymentAccountService.findOneAccount( { clientId } );
+
+    // Subject month is derived from the first approved invoice's billing month,
+    // mirroring the single-invoice email convention (billingDate, else
+    // monthOfbilling 'MM'). Falls back to empty string if neither is present.
+    const subjectMonth = approved[0].billingDate ?
+      dayjs( approved[0].billingDate ).format( 'MMMM' ) :
+      ( approved[0].monthOfbilling ? dayjs( approved[0].monthOfbilling, 'MM' ).format( 'MMMM' ) : '' );
+
+    let brandSlug = 'invoices';
+    if ( clientDetails?.clientName ) {
+      brandSlug = clientDetails.clientName.toLowerCase().replace( /[^a-z0-9]+/g, '-' ).replace( /^-|-$/g, '' ) || 'invoices';
+    }
+    const zipFilename = `invoices-${brandSlug}-${dayjs().format( 'YYYY-MM-DD' )}.zip`;
+    const zipBuffer = await buildZipBuffer( zipItems );
+
+    const templateHtml = fs.readFileSync( path.resolve( path.dirname( '' ) ) + '/src/hbs/invoiceBulkEmail.hbs', 'utf8' );
+    const template = Handlebars.compile( templateHtml );
+    const mailbody = template( {
+      clientName: clientDetails?.clientName || '',
+      currencyType,
+      totalExcl: totalExclNum.toLocaleString( 'en-IN', moneyFmt ),
+      totalIncl: totalInclNum.toLocaleString( 'en-IN', moneyFmt ),
+      virtualaccountNumber: virtualAccount ? virtualAccount.accountNumber : '',
+      virtualifsc: virtualAccount ? virtualAccount.ifsc : '',
+      uidomain: `${JSON.parse( process.env.URL ).domain}`,
+      logo: `${JSON.parse( process.env.URL ).apiDomain}/logo.png`,
+      rows,
+    } );
+
+    const attachment = {
+      filename: zipFilename,
+      content: zipBuffer,
+      contentType: 'application/zip',
+    };
+    const SES = JSON.parse( process.env.SES );
+    const fromEmail = SES.accountsEmail;
+    const toLower = new Set( to.map( ( e ) => e.toLowerCase() ) );
+    const cc = [ ...new Set( ( ccEmails || [] ).map( ( e ) => String( e || '' ).trim() ).filter( Boolean ) ) ]
+        .filter( ( e ) => !toLower.has( e.toLowerCase() ) );
+
+    const mailSubject = `Invoice for ${subjectMonth} - Tango/${clientDetails?.clientName || ''}`;
+    const result = await sendEmailWithSES( to, mailSubject, mailbody, attachment, fromEmail, cc.length ? cc : undefined );
+
+    const logObj = {
+      userName: req.user?.userName,
+      email: req.user?.email,
+      clientId,
+      logSubType: 'invoiceBulkEmail',
+      logType: 'invoice',
+      date: new Date(),
+      changes: [ `Bulk-emailed ${rows.length} invoice(s): ${rows.map( ( r ) => r.invoice ).join( ', ' )}` ],
+      eventType: '',
+      timestamp: new Date(),
+      showTo: [ 'tango' ],
+    };
+    insertOpenSearchData( JSON.parse( process.env.OPENSEARCH ).activityLog, logObj );
+
+    if ( !result ) {
+      return res.sendError( 'Failed to send email', 500 );
+    }
+    return res.sendSuccess( { emailedCount: rows.length, skippedBuildCount } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'invoiceBulkEmailSend' } );
+    return res.sendError( error, 500 );
+  }
+}
+
 // Bank/beneficiary details for the invoice preview. Fixed beneficiary account
 // — hardcoded to match the PDF exactly (NOT read from the DB).
 export async function invoiceBankDetails( req, res ) {
@@ -2342,6 +2572,13 @@ export async function clientInvoiceList( req, res ) {
       if ( inv.paymentStatus === 'paid' ) {
         continue;
       }
+      // Only invoices with a real (generated) invoice number count toward the
+      // Outstanding / Overdue / Pending Payment cards. Pre-finance drafts carry
+      // a temporary DRAFT- number and are excluded until the real INV/TINV
+      // number is minted at finance approval.
+      if ( String( inv.invoice || '' ).startsWith( 'DRAFT-' ) ) {
+        continue;
+      }
       const fx = rateByCurrency[String( inv.currency || 'inr' )] || 1;
       const total = Number( inv.totalAmount ) || Number( inv.amount ) || 0;
       const paid = Number( inv.paidAmount ) || 0;
@@ -2819,6 +3056,15 @@ export async function updateInvoice( req, res ) {
       return res.sendError( 'Cannot edit a final-approved invoice.', 409 );
     }
 
+    // A Purchase Order can only be attached once the invoice has a real
+    // number (minted at finance approval). Reject PO attach on a DRAFT-.
+    if ( req.body.purchaseOrderNumber && String( invoice.invoice || '' ).startsWith( 'DRAFT-' ) ) {
+      return res.sendError(
+          'Attach a PO only after the invoice number is finalised (finance approval).',
+          409,
+      );
+    }
+
     let updateData = {};
     const allowedFields = [
       'companyName', 'companyAddress', 'GSTNumber', 'PlaceOfSupply',
@@ -2946,10 +3192,13 @@ export async function deleteInvoice( req, res ) {
       return res.sendError( 'Invoice not found', 404 );
     }
 
-    // Same lock the UI enforces — a final-approved invoice must not be
-    // deletable, even by a power user hitting the API directly.
-    if ( invoice.status === 'approved' ) {
-      return res.sendError( 'Cannot delete a final-approved invoice.', 409 );
+    // Once a real invoice number has been minted (at finance approval), the
+    // invoice can no longer be deleted — deleting it would reopen a gap in the
+    // gapless INV/TINV series. Only pre-finance drafts (number still starts
+    // with DRAFT-) are deletable. This supersedes the old approved-only lock
+    // (a pendingApproval invoice already carries a real number).
+    if ( !String( invoice.invoice || '' ).startsWith( 'DRAFT-' ) ) {
+      return res.sendError( 'Cannot delete an invoice once its invoice number has been generated.', 409 );
     }
 
     await invoiceService.deleteRecord( { _id: invoiceId } );
@@ -2994,7 +3243,43 @@ async function transitionInvoiceStatus( req, res, fromStatus, toStatus ) {
       );
     }
 
-    await invoiceService.updateOne( { _id: invoiceId }, { status: toStatus } );
+    // Mint the real INV/TINV number at finance approval. Before this, the
+    // invoice carries a temporary DRAFT-<FY>-<seq> number; here we assign the
+    // next real number = max(invoiceIndex among ^prefix<FY>-)+1. Guarded on the
+    // DRAFT- prefix so an already-real invoice (existing in-flight, or a
+    // re-run) is never renumbered — idempotent.
+    const update = { status: toStatus };
+    if ( fromStatus === 'pendingFinance' && String( invoice.invoice || '' ).startsWith( 'DRAFT-' ) ) {
+      const FY = getCurrentFinancialYear();
+      const prefix = invoicePrefixFor( invoice.advanceInvoice, invoice.advancePeriod );
+      // Reserve the next number ATOMICALLY. Bulk finance-approval fires many
+      // requests in parallel; the old read-max-then-write approach let them all
+      // read the same max and mint the SAME number. nextCounterValue uses an
+      // atomic $inc on a per-series counter, so simultaneous callers each get a
+      // distinct number. The counter is lazily seeded (once, on first use) from
+      // the current DB max of this prefix+FY series so existing numbers are
+      // never reused.
+      // Numeric max of existing invoiceIndex for this series. invoiceIndex is a
+      // STRING in the schema and historical values are zero-padded ('00569'),
+      // so a Mongo sort would compare lexically — compute the true numeric max
+      // in JS instead. Used only to seed the counter on its first use.
+      const previous = await invoiceService.find(
+          { invoice: { $regex: `^${prefix}${FY}-` } },
+          { invoiceIndex: 1 },
+      );
+      let dbMax = 0;
+      for ( const p of ( previous || [] ) ) {
+        const n = Number( p.invoiceIndex );
+        if ( !Number.isNaN( n ) && n > dbMax ) {
+          dbMax = n;
+        }
+      }
+      const realNo = await nextCounterValue( 'invoiceCounter', `${prefix}${FY}`, dbMax );
+      update.invoice = `${prefix}${FY}-${String( realNo ).padStart( 5, '0' )}`;
+      update.invoiceIndex = realNo;
+      update.tempIndex = null;
+    }
+    await invoiceService.updateOne( { _id: invoiceId }, update );
 
     insertOpenSearchData( JSON.parse( process.env.OPENSEARCH ).activityLog, {
       userName: req.user?.userName,
@@ -3003,13 +3288,13 @@ async function transitionInvoiceStatus( req, res, fromStatus, toStatus ) {
       logSubType: 'invoiceStatusTransition',
       logType: 'invoice',
       date: new Date(),
-      changes: [ `Invoice ${invoice.invoice} advanced from ${fromStatus} to ${toStatus} by ${req.user?.email}` ],
+      changes: [ `Invoice ${update.invoice || invoice.invoice} advanced from ${fromStatus} to ${toStatus} by ${req.user?.email}` ],
       eventType: '',
       timestamp: new Date(),
       showTo: [ 'tango' ],
     } );
 
-    return res.sendSuccess( { invoiceId, fromStatus, status: toStatus } );
+    return res.sendSuccess( { invoiceId, fromStatus, status: toStatus, invoice: update.invoice || invoice.invoice } );
   } catch ( error ) {
     logger.error( { error: error, function: 'transitionInvoiceStatus', fromStatus, toStatus, invoiceId: req.body?.invoiceId } );
     return res.sendError( error, 500 );

package/src/hbs/invoiceBulkEmail.hbs

@@ -0,0 +1,70 @@
+<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8" /><meta content="width=device-width" name="viewport" />
+<title>Invoices from Tango Eye</title></head>
+<body style="margin:0;padding:0;background-color:#b1b1b1;font-family:Inter,Arial,sans-serif;">
+<table width="100%" cellpadding="0" cellspacing="0" border="0"><tr><td align="center">
+<table bgcolor="#ffffff" width="640" cellspacing="0" cellpadding="0" border="0"
+  style="margin:0 auto;border:1px solid #d0d5dd;border-radius:12px;">
+<tr><td style="padding:40px 52px;">
+  <img src="{{logo}}" width="143" style="display:block;margin-bottom:24px;" />
+  <div style="color:#121a26;font-weight:700;font-size:24px;line-height:140%;">
+    Invoices from Tango Eye — attached (ZIP)
+  </div>
+  <div style="height:24px;"></div>
+  <div style="color:#384860;font-size:16px;line-height:150%;">
+    Dear {{clientName}},<br><br>
+    Thank you for choosing Tango Eye services.<br><br>
+    Attached are your invoices for the services provided by Tango Eye. The total amount due
+    across all invoices is <b>{{currencyType}}{{totalIncl}}</b>. Please refer to the summary
+    below for individual invoice amounts.
+  </div>
+  <div style="height:24px;"></div>
+
+  <div style="background-color:#f1f5f9;border:1px solid #e2e8f0;border-radius:8px;padding:20px 28px;">
+    <div style="color:#121a26;font-weight:700;font-size:18px;">Virtual Account Details</div>
+    <div style="height:12px;"></div>
+    <div style="color:#121a26;font-weight:500;font-size:16px;">Account Number - {{virtualaccountNumber}}</div>
+    <div style="color:#121a26;font-weight:500;font-size:16px;">IFSC Code - {{virtualifsc}}</div>
+  </div>
+  <div style="height:24px;"></div>
+
+  <table width="100%" cellspacing="0" cellpadding="0" border="0" style="border-collapse:collapse;">
+    <tr style="background-color:#f9fafb;">
+      <td style="padding:12px 16px;color:#667085;font-weight:600;font-size:14px;border-bottom:1px solid #eaecf0;">Invoice Number</td>
+      <td align="right" style="padding:12px 16px;color:#667085;font-weight:600;font-size:14px;border-bottom:1px solid #eaecf0;">Amount (excl. tax)</td>
+      <td align="right" style="padding:12px 16px;color:#667085;font-weight:600;font-size:14px;border-bottom:1px solid #eaecf0;">Amount (incl. tax)</td>
+    </tr>
+    {{#each rows}}
+    <tr>
+      <td style="padding:12px 16px;color:#475467;font-size:14px;border-bottom:1px solid #eaecf0;">#{{this.invoice}}</td>
+      <td align="right" style="padding:12px 16px;color:#475467;font-size:14px;border-bottom:1px solid #eaecf0;">{{../currencyType}}{{this.amountExcl}}</td>
+      <td align="right" style="padding:12px 16px;color:#475467;font-size:14px;border-bottom:1px solid #eaecf0;">{{../currencyType}}{{this.amountIncl}}</td>
+    </tr>
+    {{/each}}
+    <tr>
+      <td style="padding:12px 16px;color:#121a26;font-weight:700;font-size:14px;">Total</td>
+      <td align="right" style="padding:12px 16px;color:#121a26;font-weight:700;font-size:14px;">{{currencyType}}{{totalExcl}}</td>
+      <td align="right" style="padding:12px 16px;color:#121a26;font-weight:700;font-size:14px;">{{currencyType}}{{totalIncl}}</td>
+    </tr>
+  </table>
+  <div style="height:24px;"></div>
+
+  <div style="color:#384860;font-size:16px;line-height:150%;">
+    Currently, we do not support RBL to RBL Internal Fund Transfer (IIFT) transactions on the
+    above account number.<br><br>
+    Cheque deposits are not available for the above account number.
+  </div>
+  <div style="height:24px;"></div>
+
+  <div style="color:#384860;font-size:16px;line-height:150%;">
+    Should you have any inquiries or require assistance, feel free to reach out.<br><br>
+    Thank you for your prompt attention to this matter.<br><br>
+    Best regards,<br><br>Team Tango
+  </div>
+  <div style="height:24px;border-top:1px solid #eaecf0;margin-top:24px;"></div>
+  <div style="color:#202b3c;font-size:12px;">2024 © Tango Eye. All rights reserved.</div>
+</td></tr>
+</table>
+</td></tr></table>
+</body></html>