feat: add acquisition API foundation

Add acquisition persistence, cost-basis calculation, seller-scoped admin routes, contracts, validation, migration, and focused application/HTTP tests.

apps/api/tests/application/acquisition-service.test.js

@@ -0,0 +1,41 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { createAcquisitionService } from '../../src/modules/acquisitions/services/acquisition-service.js';
+
+test('creates an owned acquisition and calculates cost basis', async () => {
+  let received;
+  const service = createAcquisitionService({
+    acquisitionRepository: {
+      async createForSeller(input) {
+        received = input;
+        return { status: 'CREATED', acquisition: { id: 'acquisition-1', ...input.acquisition } };
+      },
+    },
+  });
+
+  const result = await service.create({
+    sellerId: 'seller-1',
+    inventoryItemId: 'inventory-1',
+    method: 'PURCHASE',
+    costMinor: 1000,
+    shippingMinor: 150,
+    taxMinor: 75,
+    otherFeesMinor: 50,
+    estimatedTradeValueMinor: 200,
+  });
+
+  assert.equal(received.sellerId, 'seller-1');
+  assert.equal(result.costBasisMinor, 1075);
+});
+
+test('rejects acquisition for an inventory item outside the seller account', async () => {
+  const service = createAcquisitionService({
+    acquisitionRepository: { async createForSeller() { return { status: 'NOT_FOUND' }; } },
+  });
+
+  await assert.rejects(
+    () => service.create({ sellerId: 'seller-1', inventoryItemId: 'inventory-1', method: 'PURCHASE', costMinor: 100 }),
+    (error) => error.code === 'INVENTORY_NOT_FOUND' && error.statusCode === 404,
+  );
+});

apps/api/tests/http/acquisition-routes.test.js

@@ -0,0 +1,57 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildApp } from '../../src/app/build-app.js';
+
+function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
+  return buildApp({
+    authenticateAdmin,
+    authorizeUnsafeRequest,
+    acquisitionService: {
+      async create(input) {
+        return { id: 'acquisition-1', ...input, costBasisMinor: 1075 };
+      },
+      async list() {
+        return [];
+      },
+    },
+  });
+}
+
+test('creates an acquisition for the authenticated seller', async (testContext) => {
+  let csrfChecked = false;
+  const app = createTestApp({
+    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
+    authorizeUnsafeRequest: async () => { csrfChecked = true; },
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/acquisitions',
+    headers: { 'x-csrf-token': 'csrf-token' },
+    payload: {
+      inventoryItemId: 'd2f67d74-9647-48d5-b3a4-74d3b16ea9f8',
+      method: 'PURCHASE',
+      costMinor: 1000,
+    },
+  });
+
+  assert.equal(response.statusCode, 201);
+  assert.equal(response.json().data.costBasisMinor, 1075);
+  assert.equal(csrfChecked, true);
+});
+
+test('rejects invalid acquisition requests', async (testContext) => {
+  const app = createTestApp({ authenticateAdmin: async () => ({ sellerId: 'seller-1' }) });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/acquisitions',
+    payload: { inventoryItemId: 'not-a-uuid', method: '', costMinor: -1 },
+  });
+
+  assert.equal(response.statusCode, 400);
+  assert.equal(response.json().error.code, 'VALIDATION_ERROR');
+});