lambda-erp 0.8.21__tar.gz → 0.8.22__tar.gz

{lambda_erp-0.8.21 → lambda_erp-0.8.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lambda-erp
-Version: 0.8.21
+Version: 0.8.22
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: Apache-2.0
@@ -8,6 +8,7 @@ License-File: LICENSE
 Requires-Python: >=3.10
 Requires-Dist: anthropic>=0.40
 Requires-Dist: bcrypt>=5
+Requires-Dist: defusedxml>=0.7
 Requires-Dist: fastapi>=0.115
 Requires-Dist: holidays>=0.40
 Requires-Dist: httpx>=0.27

{lambda_erp-0.8.21 → lambda_erp-0.8.22}/api/attachments.py

@@ -49,10 +49,17 @@ OFFICE_MIME_TYPES = {
 # Plain-text formats — inlined into the prompt as text (no file part needed).
 TEXT_MIME_TYPES = {"text/csv", "text/plain"}
 
+# Structured bank uploads are retained as ordinary chat attachments, but are
+# never dumped wholesale into the LLM context. Dedicated deterministic tools
+# parse them and return a compact preview instead.
+STRUCTURED_TOOL_MIME_TYPES = {
+    "application/xml", "text/xml", "application/zip", "application/x-zip-compressed",
+}
+
 ALLOWED_MIME_TYPES = {
     "image/png", "image/jpeg", "image/gif", "image/webp",
     "application/pdf",
-} | OFFICE_MIME_TYPES | TEXT_MIME_TYPES
+} | OFFICE_MIME_TYPES | TEXT_MIME_TYPES | STRUCTURED_TOOL_MIME_TYPES
 
 # Extension -> canonical mime, so a correctly-named file still uploads when the
 # browser/OS mislabels its type (Office files are frequently sent as
@@ -69,6 +76,8 @@ _EXT_TO_MIME = {
     "odp": "application/vnd.oasis.opendocument.presentation",
     "csv": "text/csv",
     "txt": "text/plain",
+    "xml": "application/xml",
+    "zip": "application/zip",
     "pdf": "application/pdf",
     "png": "image/png", "jpg": "image/jpeg", "jpeg": "image/jpeg",
     "gif": "image/gif", "webp": "image/webp",
@@ -240,7 +249,8 @@ async def upload_attachment(
             raise HTTPException(
                 status_code=400,
                 detail=(f"Unsupported file type: {mime or ext or 'unknown'}. Allowed: images, PDF, "
-                        "spreadsheets (Excel/CSV/ODS), and documents (Word/OpenDocument)."),
+                        "spreadsheets (Excel/CSV/ODS), documents (Word/OpenDocument), "
+                        "and structured bank files (XML/ZIP)."),
             )
 
     data = await file.read()
@@ -389,6 +399,14 @@ def build_multimodal_content(attachment: dict) -> dict:
             "type": "image_url",
             "image_url": {"url": f"data:{mime};base64,{data_b64}"},
         }
+    if mime in STRUCTURED_TOOL_MIME_TYPES:
+        return {
+            "type": "text",
+            "text": (
+                f"[Structured attachment: {filename}. Do not retrieve or parse its raw contents in "
+                "the conversation; use the dedicated bank-statement preview tool.]"
+            ),
+        }
     if mime in TEXT_MIME_TYPES or mime.startswith("text/"):
         text = attachment["data"].decode("utf-8", errors="replace")
         return {"type": "text", "text": f"[File: {filename}]\n{text}"}

{lambda_erp-0.8.21 → lambda_erp-0.8.22}/api/chat.py

@@ -448,7 +448,7 @@ DOCUMENT_SLUGS = [
     "purchase-order", "purchase-invoice",
     "payment-entry", "journal-entry", "stock-entry",
     "delivery-note", "purchase-receipt", "pos-invoice",
-    "pricing-rule", "budget", "subscription", "bank-transaction",
+    "pricing-rule", "budget", "subscription", "bank-account", "bank-transaction",
     # Owned equipment and its hire calendar. Core doctypes, so they belong in
     # this list rather than surfacing as "deployment-specific extensions"
     # (_extra_document_slugs is defined as everything NOT named here).
@@ -814,10 +814,58 @@ TOOLS = [
         "type": "function",
         "function": {
             "name": "list_chat_attachments",
-            "description": "List all files the user has uploaded in this chat session — PDFs, images, spreadsheets (Excel/CSV/ODS), and documents (Word/OpenDocument). Returns metadata including id, filename, mime type, size, and upload date. Use this when the user references a previously uploaded file or you need to find an attachment to retrieve.",
+            "description": "List all files the user has uploaded in this chat session — PDFs, images, spreadsheets (Excel/CSV/ODS), documents (Word/OpenDocument), and structured bank files (CAMT XML/ZIP). Returns metadata including id, filename, mime type, size, and upload date. Use this when the user references a previously uploaded file or you need its attachment id.",
             "parameters": {"type": "object", "properties": {}},
         },
     },
+    {
+        "type": "function",
+        "function": {
+            "name": "preview_bank_statement_attachments",
+            "description": "Safely parse CAMT.053 XML or ZIP chat attachments and return a compact, read-only import preview: masked account, currency, period, balances, entry/detail/batch/QR counts, duplicates, warnings, and any exact Bank Account mapping. The raw XML is never added to the model context. Always call this before importing bank statements.",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "attachment_ids": {
+                        "type": "array",
+                        "items": {"type": "string"},
+                        "minItems": 1,
+                        "maxItems": 20,
+                        "description": "CAMT XML/ZIP attachment ids from this chat.",
+                    },
+                },
+                "required": ["attachment_ids"],
+            },
+        },
+    },
+    {
+        "type": "function",
+        "function": {
+            "name": "import_bank_statement_attachments",
+            "description": "Import previously previewed CAMT attachments as Bank Transactions without creating or posting any Payment Entry, Journal Entry, or GL entry. Exact file re-uploads and stable duplicate bank entries are skipped. Use only after showing the preview and receiving explicit user confirmation. Requires manager access and is unavailable in public demo mode.",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "attachment_ids": {
+                        "type": "array",
+                        "items": {"type": "string"},
+                        "minItems": 1,
+                        "maxItems": 20,
+                    },
+                    "mappings": {
+                        "type": "object",
+                        "additionalProperties": {"type": "string"},
+                        "description": "Optional mapping of statement_key from the preview to Bank Account document name. Exact IBAN matches are used automatically.",
+                    },
+                    "confirmed": {
+                        "type": "boolean",
+                        "description": "Must be true, and only after the user explicitly confirmed the displayed preview.",
+                    },
+                },
+                "required": ["attachment_ids", "confirmed"],
+            },
+        },
+    },
     {
         "type": "function",
         "function": {
@@ -1302,15 +1350,20 @@ def build_tools(user_info: dict | None = None):
     extra_docs = _extra_document_slugs()
     extra_masters = _extra_master_types()
     action_tools = services.registered_action_tools()
+    hidden_tools: set[str] = set()
     if user_info is not None:
         role = user_info.get("role")
         action_tools = [
             tool for tool in action_tools
             if services.registered_action_allowed(tool["function"]["name"], role)
         ]
-    if not extra_docs and not extra_masters and not action_tools:
+        if role not in {"manager", "admin"}:
+            hidden_tools.add("import_bank_statement_attachments")
+    if not extra_docs and not extra_masters and not action_tools and not hidden_tools:
         return TOOLS
     tools = copy.deepcopy(TOOLS)
+    if hidden_tools:
+        tools = [tool for tool in tools if tool["function"]["name"] not in hidden_tools]
     for tool in tools:
         props = tool["function"].get("parameters", {}).get("properties", {})
         for schema in props.values():
@@ -1813,6 +1866,98 @@ def _handle_retrieve_chat_attachment(args, session_id: str | None = None, user_i
     }
 
 
+def _load_camt_chat_attachments(args, user_id: str | None):
+    attachment_ids = args.get("attachment_ids") or []
+    if not user_id:
+        return None, {"error": "No authenticated user for bank statement attachments."}
+    if not isinstance(attachment_ids, list) or not 1 <= len(attachment_ids) <= 20:
+        return None, {"error": "attachment_ids must contain between 1 and 20 attachment ids."}
+    from api.attachments import get_attachments_by_ids
+    from lambda_erp.accounting.camt import CamtError, parse_camt_upload
+
+    attachments = get_attachments_by_ids(attachment_ids, user_id)
+    found = {item["id"] for item in attachments}
+    missing = [item for item in attachment_ids if item not in found]
+    if missing:
+        return None, {"error": "One or more attachments were not found or access was denied."}
+    documents = []
+    try:
+        for attachment in attachments:
+            documents.extend(parse_camt_upload(attachment["data"], attachment["filename"]))
+    except CamtError as exc:
+        return None, {"error": str(exc)}
+    return documents, None
+
+
+def _handle_preview_bank_statement_attachments(args, user_id: str | None = None):
+    documents, error = _load_camt_chat_attachments(args, user_id)
+    if error:
+        return error
+    from lambda_erp.accounting.bank_statement_import import preview_documents
+    return preview_documents(documents)
+
+
+def _handle_import_bank_statement_attachments(args, user_info: dict | None = None):
+    role = (user_info or {}).get("role")
+    if role not in {"manager", "admin"}:
+        return {"error": "Importing bank statements requires manager access and is unavailable in demo mode."}
+    if args.get("confirmed") is not True:
+        return {
+            "error": (
+                "Explicit confirmation is required. Show the bank statement preview, ask the user "
+                "to confirm it, and call the import tool in a later turn with confirmed=true."
+            )
+        }
+    user_id = (user_info or {}).get("name")
+    documents, error = _load_camt_chat_attachments(args, user_id)
+    if error:
+        return error
+    from lambda_erp.accounting.bank_statement_import import import_documents, preview_documents
+    from lambda_erp.exceptions import ValidationError
+
+    mappings = args.get("mappings") or {}
+    if not isinstance(mappings, dict):
+        return {"error": "mappings must be an object of statement_key to Bank Account name."}
+    # Exact IBAN matches are safe to fill automatically; anything ambiguous or
+    # unmapped is returned to the model as a focused question for the user.
+    preview = preview_documents(documents)
+    effective_mappings = dict(mappings)
+    missing = []
+    for statement in preview["statements"]:
+        if statement["already_imported"]:
+            continue
+        key = statement["statement_key"]
+        matched = statement.get("matched_bank_account")
+        if key not in effective_mappings and matched:
+            effective_mappings[key] = matched["name"]
+        if key not in effective_mappings:
+            missing.append({
+                "statement_key": key,
+                "file_name": statement["file_name"],
+                "account_iban_masked": statement["account_iban_masked"],
+                "currency": statement["account_currency"],
+            })
+    if missing:
+        return {
+            "error": "Bank Account mapping is required before import.",
+            "unmapped_statements": missing,
+        }
+    try:
+        result = import_documents(
+            documents, effective_mappings, imported_by=user_id
+        )
+    except ValidationError as exc:
+        return {"error": str(exc)}
+    # Keep the model context bounded even for multi-year statements.
+    return {
+        "imports": [
+            {key: value for key, value in item.items() if key != "transactions"}
+            for item in result["imports"]
+        ],
+        "exact_duplicate_imports": result["exact_duplicate_imports"],
+    }
+
+
 def _handle_query_dataset(args):
     from api.routers.analytics import aggregate_semantic_dataset
 
@@ -1970,6 +2115,8 @@ TOOL_HANDLERS = {
     "retrieve_chat_history": lambda args: _handle_retrieve_chat_history(args),
     "list_chat_attachments": _handle_list_chat_attachments,
     "retrieve_chat_attachment": _handle_retrieve_chat_attachment,
+    "preview_bank_statement_attachments": _handle_preview_bank_statement_attachments,
+    "import_bank_statement_attachments": _handle_import_bank_statement_attachments,
     "query_dataset": _handle_query_dataset,
     "create_custom_analytics_report": lambda args: _handle_create_custom_analytics_report(args),
     "get_custom_analytics_report": lambda args: _handle_get_custom_analytics_report(args),
@@ -2203,13 +2350,31 @@ When a user asks you to do something they don't have permission for, explain wha
 ## Available Document Types (use the slug when calling tools)
 - **Selling:** quotation, proposal, sales-order, sales-invoice, pos-invoice
 - **Buying:** purchase-order, purchase-invoice
-- **Accounting:** payment-entry, journal-entry, budget, subscription, bank-transaction
+- **Accounting:** payment-entry, journal-entry, budget, subscription, bank-account, bank-transaction
 - **Stock:** stock-entry, delivery-note, purchase-receipt
 - **Assets & hire:** asset, reservation
 - **Settings:** pricing-rule{extension_doctypes_line}{chat_doctype_section}
 
 ## Document Workflow & What Each Document Does
 
+### CAMT bank statement imports
+CAMT XML/ZIP attachments are structured financial inputs. Never retrieve their raw contents into
+the conversation and never try to interpret the XML manually. Use this workflow:
+1. Find the attachment ids with `list_chat_attachments` when necessary.
+2. Call `preview_bank_statement_attachments` and present its period, masked account, currency,
+   opening/closing balances, credits/debits, entry/detail/batch counts, QR-reference count,
+   duplicate status, warnings, and proposed Bank Account mapping.
+3. If there is no exact mapping, list or create a `bank-account` document. It must link the external
+   IBAN to the correct Company and GL Account; never guess that accounting mapping.
+4. Ask the user for explicit confirmation after showing the preview. Do not call the import tool in
+   the same turn in which you first show the preview.
+5. Only after that confirmation, call `import_bank_statement_attachments` with `confirmed=true`.
+
+The CAMT import creates unposted Bank Transactions and their batch details only. It never creates,
+submits, or posts a Payment Entry, Journal Entry, or GL Entry. Do not imply that invoices have been
+settled or the ledger changed merely because a statement was imported. Matching/reconciliation is a
+separate later step. Keep Bank Account IBANs masked in ordinary chat responses.
+
 ### Sales Cycle
 Quotation → Sales Order → Delivery Note (shipping) / Sales Invoice (billing) → Payment Entry
 Shortcuts: Quotation can also convert directly to Sales Invoice or Delivery Note (skipping Sales Order) for quick deals.
@@ -3042,6 +3207,12 @@ async def run_thinking_loop(
         tool_handlers["retrieve_chat_history"] = lambda args: _handle_retrieve_chat_history(args, session_id)
         user_id_for_tools = user_info.get("name") if user_info else None
         tool_handlers["list_chat_attachments"] = lambda args: _handle_list_chat_attachments(args, session_id, user_id_for_tools)
+        tool_handlers["preview_bank_statement_attachments"] = (
+            lambda args: _handle_preview_bank_statement_attachments(args, user_id_for_tools)
+        )
+        tool_handlers["import_bank_statement_attachments"] = (
+            lambda args: _handle_import_bank_statement_attachments(args, user_info)
+        )
         _scoped_retrieve_attachment = (
             lambda args: _handle_retrieve_chat_attachment(args, session_id, user_id_for_tools)
         )

{lambda_erp-0.8.21 → lambda_erp-0.8.22}/api/main.py

@@ -19,7 +19,7 @@ from api.auth import router as auth_router, COOKIE_NAME, decode_token
 from api.oauth import router as oauth_router
 from api.attachments import router as attachments_router
 from api.chat import chat_websocket, router as chat_router
-from api.routers import admin, documents, masters, reports, setup as setup_router, bank_reconciliation, analytics, accounting, proposals, chat_api, mcp, availability, actions
+from api.routers import admin, documents, masters, reports, setup as setup_router, bank_reconciliation, bank_statements, analytics, accounting, proposals, chat_api, mcp, availability, actions
 
 
 def load_plugins() -> None:
@@ -112,6 +112,7 @@ app.include_router(reports.router, prefix="/api")
 app.include_router(analytics.router, prefix="/api")
 app.include_router(setup_router.router, prefix="/api")
 app.include_router(bank_reconciliation.router, prefix="/api")
+app.include_router(bank_statements.router, prefix="/api")
 app.include_router(accounting.router, prefix="/api")
 app.include_router(admin.router, prefix="/api")
 app.include_router(chat_router, prefix="/api")

lambda_erp-0.8.22/api/routers/bank_statements.py

@@ -0,0 +1,118 @@
+"""Manual CAMT statement preview, import history, and audit-file access."""
+
+from __future__ import annotations
+
+import json
+from urllib.parse import quote
+
+from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile
+from fastapi.responses import Response
+
+from api.auth import require_non_public_manager, require_role
+from lambda_erp.accounting.bank_statement_import import import_documents, preview_documents
+from lambda_erp.accounting.camt import CamtError, MAX_ARCHIVE_BYTES, mask_iban, parse_camt_upload
+from lambda_erp.database import get_db
+from lambda_erp.exceptions import ValidationError
+
+
+router = APIRouter(prefix="/bank-statements", tags=["bank-statements"])
+MAX_TOTAL_UPLOAD_BYTES = 50 * 1024 * 1024
+
+
+async def _parse_uploads(files: list[UploadFile]):
+    if not files:
+        raise HTTPException(status_code=422, detail="Select at least one CAMT XML or ZIP file")
+    documents = []
+    total = 0
+    for upload in files:
+        data = await upload.read(MAX_ARCHIVE_BYTES + 1)
+        total += len(data)
+        if len(data) > MAX_ARCHIVE_BYTES:
+            raise HTTPException(status_code=413, detail=f"File {upload.filename!r} is too large")
+        if total > MAX_TOTAL_UPLOAD_BYTES:
+            raise HTTPException(status_code=413, detail="Combined uploads are too large")
+        try:
+            documents.extend(parse_camt_upload(data, upload.filename or "statement.xml"))
+        except CamtError as exc:
+            raise HTTPException(status_code=422, detail=f"{upload.filename}: {exc}") from exc
+    return documents
+
+
+@router.post("/preview")
+async def preview_bank_statements(
+    files: list[UploadFile] = File(...),
+    _user: dict = Depends(require_non_public_manager),
+):
+    """Parse uploads without writing any statement or transaction data."""
+    return preview_documents(await _parse_uploads(files))
+
+
+@router.post("/import")
+async def import_bank_statements(
+    files: list[UploadFile] = File(...),
+    mappings: str = Form(...),
+    user: dict = Depends(require_non_public_manager),
+):
+    """Re-parse and atomically import the previewed uploads."""
+    try:
+        parsed_mappings = json.loads(mappings)
+    except (TypeError, json.JSONDecodeError) as exc:
+        raise HTTPException(status_code=422, detail="mappings must be a JSON object") from exc
+    if not isinstance(parsed_mappings, dict) or not all(
+        isinstance(key, str) and isinstance(value, str)
+        for key, value in parsed_mappings.items()
+    ):
+        raise HTTPException(status_code=422, detail="mappings must map statement keys to Bank Accounts")
+    try:
+        return import_documents(
+            await _parse_uploads(files), parsed_mappings, imported_by=user.get("name")
+        )
+    except ValidationError as exc:
+        raise HTTPException(status_code=422, detail=str(exc)) from exc
+
+
+@router.get("")
+def list_bank_statement_imports(
+    limit: int = 50,
+    _user: dict = Depends(require_role("viewer")),
+):
+    limit = max(1, min(limit, 200))
+    rows = get_db().sql(
+        'SELECT i.name, i.bank_account, b.account_name AS bank_account_name, '
+        'i.source_filename, i.schema_version, i.account_iban, i.currency, '
+        'i.from_date, i.to_date, i.opening_balance, i.closing_balance, '
+        'i.imported_entry_count, i.duplicate_entry_count, i.warning_count, '
+        'i.status, i.imported_by, i.creation '
+        'FROM "Bank Statement Import" i '
+        'LEFT JOIN "Bank Account" b ON b.name = i.bank_account '
+        'ORDER BY i.creation DESC LIMIT ?',
+        [limit],
+    )
+    result = []
+    for row in rows:
+        item = dict(row)
+        item["account_iban_masked"] = mask_iban(item.pop("account_iban") or "")
+        result.append(item)
+    return {"rows": result}
+
+
+@router.get("/{import_name}/source")
+def download_bank_statement_source(
+    import_name: str,
+    _user: dict = Depends(require_non_public_manager),
+):
+    rows = get_db().sql(
+        'SELECT i.source_filename, s.source_data '
+        'FROM "Bank Statement Import" i '
+        'JOIN "Bank Statement Source" s ON s.import_name = i.name '
+        'WHERE i.name = ?',
+        [import_name],
+    )
+    if not rows:
+        raise HTTPException(status_code=404, detail="Bank statement source not found")
+    filename = rows[0]["source_filename"] or f"{import_name}.xml"
+    return Response(
+        content=bytes(rows[0]["source_data"]),
+        media_type="application/xml",
+        headers={"Content-Disposition": f"attachment; filename*=UTF-8''{quote(filename)}"},
+    )

{lambda_erp-0.8.21 → lambda_erp-0.8.22}/api/services.py

@@ -25,6 +25,7 @@ from lambda_erp.controllers.pricing_rule import PricingRule
 from lambda_erp.accounting.budget import Budget
 from lambda_erp.accounting.subscription import Subscription
 from lambda_erp.accounting.bank_transaction import BankTransaction
+from lambda_erp.accounting.bank_account import BankAccount
 from lambda_erp.assets.asset import Asset
 from lambda_erp.assets.reservation import Reservation
 
@@ -48,6 +49,7 @@ DOCUMENT_CLASSES = {
     "Budget": Budget,
     "Subscription": Subscription,
     "Bank Transaction": BankTransaction,
+    "Bank Account": BankAccount,
     # Neither posts to the GL or the Stock Ledger; both stay at docstatus 0 and
     # carry their meaning in `status`. Registered here so the generic document
     # CRUD, the chat tools and MCP drive them like every other doctype.

{lambda_erp-0.8.21 → lambda_erp-0.8.22}/frontend/src/api/client.ts

@@ -61,6 +61,71 @@ export async function request<T>(path: string, options?: RequestInit): Promise<T
   return res.json();
 }
 
+async function multipartRequest<T>(path: string, form: FormData): Promise<T> {
+  const res = await fetch(`${BASE}${path}`, {
+    method: "POST",
+    credentials: "include",
+    body: form,
+  });
+  if (!res.ok) {
+    if (res.status === 401) {
+      window.location.href = "/login";
+      throw new ApiError(401, "Session expired");
+    }
+    const body = await res.json().catch(() => ({ detail: res.statusText }));
+    throw new ApiError(res.status, formatErrorDetail(body.detail));
+  }
+  return res.json() as Promise<T>;
+}
+
+export interface BankStatementPreview {
+  statement_key: string;
+  file_name: string;
+  schema_version: string;
+  statement_id: string;
+  account_iban_masked: string;
+  account_name: string | null;
+  account_currency: string;
+  bank_name: string | null;
+  bank_bic: string | null;
+  from_date: string | null;
+  to_date: string | null;
+  opening_balance: string | null;
+  closing_balance: string | null;
+  credit_total: string;
+  debit_total: string;
+  entry_count: number;
+  booked_entry_count: number;
+  detail_count: number;
+  batch_entry_count: number;
+  qr_reference_count: number;
+  duplicate_entry_count: number;
+  already_imported: boolean;
+  existing_import: string | null;
+  matched_bank_account: {
+    name: string;
+    account_name: string;
+    company: string;
+    account: string;
+    currency: string;
+    bank_name: string | null;
+    iban_masked: string;
+  } | null;
+  warnings: string[];
+}
+
+export interface BankStatementImportResult {
+  imports: Array<{
+    name: string;
+    bank_account: string;
+    account_iban_masked: string;
+    imported_entry_count: number;
+    duplicate_entry_count: number;
+    skipped_non_booked_count: number;
+  }>;
+  exact_duplicate_imports: string[];
+}
+
 function qs(params?: Record<string, string | number | undefined>) {
   if (!params) return "";
   const clean = Object.fromEntries(
@@ -153,6 +218,25 @@ export const api = {
   },
   getChatAttachmentUrl: (id: string) => `${BASE}/chat/attachments/${encodeURIComponent(id)}`,
 
+  previewBankStatements: (files: File[]) => {
+    const form = new FormData();
+    files.forEach((file) => form.append("files", file));
+    return multipartRequest<{ statements: BankStatementPreview[] }>("/bank-statements/preview", form);
+  },
+
+  importBankStatements: (files: File[], mappings: Record<string, string>) => {
+    const form = new FormData();
+    files.forEach((file) => form.append("files", file));
+    form.append("mappings", JSON.stringify(mappings));
+    return multipartRequest<BankStatementImportResult>("/bank-statements/import", form);
+  },
+
+  listBankStatementImports: (limit = 50) =>
+    request<{ rows: any[] }>(`/bank-statements${qs({ limit })}`),
+
+  bankStatementSourceUrl: (name: string) =>
+    `${BASE}/bank-statements/${encodeURIComponent(name)}/source`,
+
   // Chat
   createChatSession: () =>
     request<{ id: string; title: string; created_at: string; updated_at: string; last_message_at?: string | null }>(

lambda_erp-0.8.22/lambda_erp/accounting/bank_account.py

@@ -0,0 +1,77 @@
+"""Bank-account master used to map an external IBAN to a GL account."""
+
+import re
+
+from lambda_erp.database import get_db
+from lambda_erp.exceptions import ValidationError
+from lambda_erp.model import Document
+
+
+_IBAN_RE = re.compile(r"^[A-Z]{2}[0-9A-Z]{13,32}$")
+
+
+def normalize_iban(value: str | None) -> str:
+    """Return a compact uppercase IBAN and validate its checksum.
+
+    IBANs are identifiers, not display strings. Persisting one canonical form
+    makes account lookup and CAMT imports deterministic even when users paste
+    spaces or lowercase characters from a bank document.
+    """
+    iban = re.sub(r"\s+", "", value or "").upper()
+    if not _IBAN_RE.fullmatch(iban):
+        raise ValidationError("IBAN has an invalid format")
+    rearranged = iban[4:] + iban[:4]
+    numeric = "".join(str(ord(ch) - 55) if ch.isalpha() else ch for ch in rearranged)
+    remainder = 0
+    for offset in range(0, len(numeric), 9):
+        remainder = int(str(remainder) + numeric[offset:offset + 9]) % 97
+    if remainder != 1:
+        raise ValidationError("IBAN checksum is invalid")
+    return iban
+
+
+class BankAccount(Document):
+    """A real-world bank account mapped to one ledger Bank account."""
+
+    DOCTYPE = "Bank Account"
+    CHILD_TABLES = {}
+    PREFIX = "BANK"
+
+    LINK_FIELDS = {
+        "company": "Company",
+        "account": "Account",
+    }
+    ACCOUNT_TYPE_CONSTRAINTS = {
+        "account": {"account_type": "Bank"},
+    }
+
+    def validate(self):
+        if not self.account_name:
+            raise ValidationError("Bank Account Name is required")
+        if not self.company:
+            raise ValidationError("Company is required")
+        if not self.account:
+            raise ValidationError("GL Account is required")
+
+        self._data["iban"] = normalize_iban(self.iban)
+        account = get_db().get_value(
+            "Account", self.account, ["company", "account_currency", "account_type"]
+        )
+        if account:
+            if account.get("company") != self.company:
+                raise ValidationError("GL Account belongs to a different company")
+            account_currency = (account.get("account_currency") or "").upper()
+            requested_currency = (self.currency or account_currency).upper()
+            if account_currency and requested_currency != account_currency:
+                raise ValidationError(
+                    f"Bank Account currency {requested_currency} does not match "
+                    f"GL Account currency {account_currency}"
+                )
+            self._data["currency"] = requested_currency
+
+        existing = get_db().sql(
+            'SELECT name FROM "Bank Account" WHERE iban = ? AND name <> ? LIMIT 1',
+            [self.iban, self.name],
+        )
+        if existing:
+            raise ValidationError("This IBAN is already mapped to another Bank Account")