feat: reconcile application vertical slices

Backfill the completed acquisitions, sales, dashboard, pricing, search, public detail, worker, migration, contracts, validation, tests, and implementation-status changes into one verified application slice.

apps/api/tests/http/sale-routes.test.js

@@ -1,15 +1,15 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
+import assert from "node:assert/strict";
+import test from "node:test";
 
-import { buildApp } from '../../src/app/build-app.js';
+import { buildApp } from "../../src/app/build-app.js";
 
 const saleResult = {
   sale: {
-    id: 'sale-1',
-    sellerId: 'seller-1',
-    saleDate: '2026-09-09',
+    id: "sale-1",
+    sellerId: "seller-1",
+    saleDate: "2026-09-09",
     soldPriceMinor: 2499,
-    currency: 'USD',
+    currency: "USD",
     platformFeesMinor: 0,
     paymentProcessingFeesMinor: 0,
     shippingCostMinor: 0,
@@ -17,12 +17,12 @@ const saleResult = {
     otherFeesMinor: 0,
   },
   saleItem: {
-    id: 'sale-item-1',
-    inventoryItemId: 'inventory-1',
+    id: "sale-item-1",
+    inventoryItemId: "inventory-1",
     soldPriceMinor: 2499,
     costBasisMinor: 1200,
   },
-  inventoryItem: { id: 'inventory-1', status: 'SOLD' },
+  inventoryItem: { id: "inventory-1", status: "SOLD" },
 };
 
 function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
@@ -31,70 +31,74 @@ function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
     authorizeUnsafeRequest,
     saleService: {
       async create(input) {
-        assert.equal(input.sellerId, 'seller-1');
+        assert.equal(input.sellerId, "seller-1");
         return saleResult;
       },
     },
   });
 }
 
-test('creates a sale for the authenticated seller with CSRF protection', async (testContext) => {
+test("creates a sale for the authenticated seller with CSRF protection", async (testContext) => {
   let csrfChecks = 0;
   const app = createTestApp({
-    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
-    authorizeUnsafeRequest: async () => { csrfChecks += 1; },
+    authenticateAdmin: async () => ({ sellerId: "seller-1" }),
+    authorizeUnsafeRequest: async () => {
+      csrfChecks += 1;
+    },
   });
   testContext.after(() => app.close());
 
   const response = await app.inject({
-    method: 'POST',
-    url: '/api/v1/admin/sales',
-    headers: { 'x-csrf-token': 'csrf-token' },
+    method: "POST",
+    url: "/api/v1/admin/sales",
+    headers: { "x-csrf-token": "csrf-token" },
     payload: {
-      inventoryItemId: 'd2f67d74-9647-48d5-b3a4-74d3b16ea9f8',
+      inventoryItemId: "d2f67d74-9647-48d5-b3a4-74d3b16ea9f8",
       costBasisMinor: 1200,
-      saleDate: '2026-09-09',
+      saleDate: "2026-09-09",
       soldPriceMinor: 2499,
     },
   });
 
   assert.equal(response.statusCode, 201);
-  assert.equal(response.json().data.inventoryItem.status, 'SOLD');
+  assert.equal(response.json().data.inventoryItem.status, "SOLD");
   assert.equal(csrfChecks, 1);
 });
 
-test('rejects invalid sale requests and unauthenticated requests', async (testContext) => {
-  const app = createTestApp({ authenticateAdmin: async () => ({ sellerId: 'seller-1' }) });
+test("rejects invalid sale requests and unauthenticated requests", async (testContext) => {
+  const app = createTestApp({
+    authenticateAdmin: async () => ({ sellerId: "seller-1" }),
+  });
   testContext.after(() => app.close());
 
   const invalidResponse = await app.inject({
-    method: 'POST',
-    url: '/api/v1/admin/sales',
+    method: "POST",
+    url: "/api/v1/admin/sales",
     payload: {
-      inventoryItemId: 'not-a-uuid',
+      inventoryItemId: "not-a-uuid",
       costBasisMinor: -1,
-      saleDate: 'tomorrow',
+      saleDate: "tomorrow",
       soldPriceMinor: 0,
     },
   });
   assert.equal(invalidResponse.statusCode, 400);
-  assert.equal(invalidResponse.json().error.code, 'VALIDATION_ERROR');
+  assert.equal(invalidResponse.json().error.code, "VALIDATION_ERROR");
 
   const unauthenticatedApp = createTestApp();
   testContext.after(() => unauthenticatedApp.close());
   const unauthenticatedResponse = await unauthenticatedApp.inject({
-    method: 'POST',
-    url: '/api/v1/admin/sales',
+    method: "POST",
+    url: "/api/v1/admin/sales",
     payload: {},
   });
   assert.equal(unauthenticatedResponse.statusCode, 401);
-  assert.equal(unauthenticatedResponse.json().error.code, 'UNAUTHORIZED');
+  assert.equal(unauthenticatedResponse.json().error.code, "UNAUTHORIZED");
 });
 
-test('voids a sale with CSRF protection and actor identity', async (testContext) => {
+test("voids a sale with CSRF protection and actor identity", async (testContext) => {
   let voidInput;
   const app = buildApp({
-    authenticateAdmin: async () => ({ userId: 'user-1', sellerId: 'seller-1' }),
+    authenticateAdmin: async () => ({ userId: "user-1", sellerId: "seller-1" }),
     authorizeUnsafeRequest: async () => {},
     saleService: {
       async void(input) {
@@ -106,13 +110,13 @@ test('voids a sale with CSRF protection and actor identity', async (testContext)
   testContext.after(() => app.close());
 
   const response = await app.inject({
-    method: 'POST',
-    url: '/api/v1/admin/sales/sale-1/void',
-    headers: { 'x-csrf-token': 'csrf-token' },
-    payload: { reason: 'Duplicate entry' },
+    method: "POST",
+    url: "/api/v1/admin/sales/sale-1/void",
+    headers: { "x-csrf-token": "csrf-token" },
+    payload: { reason: "Duplicate entry" },
   });
 
   assert.equal(response.statusCode, 200);
-  assert.equal(voidInput.actorUserId, 'user-1');
-  assert.equal(response.json().data.inventoryItem.status, 'SOLD');
-});
+  assert.equal(voidInput.actorUserId, "user-1");
+  assert.equal(response.json().data.inventoryItem.status, "SOLD");
+});