feat: add pricing quality controls

Add robust outlier detection, stale valuation metadata, and audited seller-scoped market-value overrides with migration and tests.

apps/api/tests/application/pricing-service.test.js

@@ -10,6 +10,9 @@ test('records an owned pricing observation and calculates a valuation', async ()
         assert.equal(sellerId, 'seller-1');
         return { status: 'CREATED', observation };
       },
+      async markOutliersForSeller() {
+        return { status: 'UPDATED' };
+      },
       async calculateForSeller() {
         return { status: 'CALCULATED', valuation: { valueMinor: 2500 }, observations: [] };
       },
@@ -23,4 +26,12 @@ test('records an owned pricing observation and calculates a valuation', async ()
   assert.equal(observation.priceMinor, 2500);
   const valuation = await service.calculate({ sellerId: 'seller-1', inventoryItemId: 'inventory-1' });
   assert.equal(valuation.valuation.valueMinor, 2500);
+});
+
+test('requires a reason for an audited market-value override', async () => {
+  const service = createPricingService({ pricingRepository: { async createOverride() { throw new Error('should not run'); } } });
+  await assert.rejects(
+    () => service.override({ sellerId: 'seller-1', actorUserId: 'user-1', inventoryItemId: 'inventory-1', valueMinor: 2000, reason: 'x' }),
+    (error) => error.code === 'OVERRIDE_REASON_REQUIRED' && error.statusCode === 400,
+  );
 });

apps/api/tests/domain/acquisition-pricing.test.js

@@ -8,6 +8,7 @@ import {
 import {
   calculateMedianPriceMinor,
   createPricingObservation,
+  identifyOutlierPrices,
 } from '../../src/modules/pricing/domain/pricing-observation.js';
 
 test('calculates acquisition cost basis from all cost components', () => {
@@ -57,3 +58,8 @@ test('creates pricing observations and calculates a median observed price', () =
   assert.equal(observation.priceMinor, 2499);
   assert.equal(calculateMedianPriceMinor([1199, 2499, 2000]), 2000);
 });
+
+test('identifies extreme pricing observations without discarding normal values', () => {
+  assert.deepEqual([...identifyOutlierPrices([1000, 1050, 1100, 5000])], [5000]);
+  assert.equal(identifyOutlierPrices([1000, 1050, 1100]).size, 0);
+});

apps/api/tests/http/pricing-routes.test.js

@@ -25,4 +25,23 @@ test('accepts a protected pricing observation and valuation request', async (tes
   assert.equal(valuationResponse.statusCode, 200);
   assert.equal(valuationResponse.json().data.valueMinor, 2500);
   assert.equal(csrfChecks, 2);
+});
+
+test('accepts a CSRF-protected market-value override', async (testContext) => {
+  let received;
+  const app = buildApp({
+    authenticateAdmin: async () => ({ userId: 'user-1', sellerId: 'seller-1' }),
+    authorizeUnsafeRequest: async () => {},
+    pricingService: { async override(input) { received = input; return { id: 'override-1', ...input }; } },
+  });
+  testContext.after(() => app.close());
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/inventory/21eb218b-7a95-4f80-a9e3-e306f7ca1f2e/valuation/override',
+    headers: { 'x-csrf-token': 'csrf' },
+    payload: { valueMinor: 2600, reason: 'Verified recent sale' },
+  });
+  assert.equal(response.statusCode, 201);
+  assert.equal(received.actorUserId, 'user-1');
+  assert.equal(response.json().data.valueMinor, 2600);
 });