feat(dimensions): PR10 advanced — custom dimensions, hierarchy, account rules, commit enforcement (#886)

* feat(dimensions): PR10 advanced — custom dimensions, hierarchy, account rules, commit enforcement

The final rung of the dimensions ladder
(dev_docs/dimensions_implementation_plan.md §7 row 10):

- custom dimensions: POST /api/dimensions creates registry dims (next free
  SIE number >= 20 when omitted; explicit numbers allowed — SIE import
  already mints reserved ones); register gets a 'Ny dimension' dialog with
  a quiet Avancerat disclosure for the #UNDERDIM parent; GET now carries
  parent_sie_dim_no (the column + SIE round-trip existed since PR1/PR5 —
  this exposes it)
- account_dimension_rules (migration 20260703120000): one rule per
  (account, dimension) — required / default / fixed, per-rule is_active,
  company-scoped RLS, composite FK to the registry, value-presence CHECK
- enforcement, opt-in BY CONSTRUCTION (zero rules = engine byte-identical;
  deliberately NO settings toggle — a rule that exists but is ignored is
  worse than either extreme): default/fixed apply onto line bags at draft
  creation (fixed overwrites, default fills); required asserts at
  commitEntry with a Swedish MANDATORY_DIMENSION_MISSING naming every
  account + dimension; the bulk-book route runs the same policy before its
  RPC; storno/correction paths never pass through commitEntry so history
  always reverses regardless of policy; rule fetches fail open incl.
  thrown exceptions
- chart of accounts: per-account Dimensionsregler section in
  EditAccountDialog (Krävs/Förval/Låst, value picker, pause switch),
  gated on the existing dimensions toggle, quiet when empty
- pickers: LineDimensionFields is registry-driven (one combobox per active
  dimension, cached fetch, hardcoded 1/6 fallback) — every existing mount
  lights up custom dims with zero changes
- agent briefing: per-dimension required_on_accounts/default_on_accounts
  so agents self-correct instead of bouncing off the policy error
- rules CRUD API with existence/active/company validation and qualified
  DTO ids; firm_id FK deferred until the firms table lands (per plan)

39 new tests (pure-fn rules, engine enforcement, both new API surfaces,
pg-real RLS/CHECK/cascade suite); full suite 6,791 green; migration
replayed on a fresh container.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: renumber migration to 20260703200000 — version collision with prod

The concurrent session shipped pending_operations_add_link_document_to_voucher
as 20260703120000 today; the Supabase preview branch (cloned from prod)
rejected the duplicate version key.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: review round — auto-pick retry on collision, fail-open warnings, query schema

- POST /api/dimensions retries once past a concurrent number claim when the
  number was auto-picked (explicit choices still 409)
- every fail-open skip of the dimension-rules policy now logs a structured
  warning (engine draft/commit paths + bulk-book) — deliberate fail-open,
  but observable
- GET /api/dimensions/rules validates its query through
  ListDimensionRulesQuerySchema instead of an inline regex

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

app/api/transactions/bulk-book/__tests__/route.test.ts

@@ -139,6 +139,8 @@ describe('POST /api/transactions/bulk-book', () => {
       { account_number: '2611', debit_amount: '', credit_amount: String(total * 0.2), line_description: 'Utg moms 25%' },
     ])
 
+    // Account dimension rules pre-check (PR10) — none configured.
+    enqueue({ data: [], error: null })
     // RPC returns happy path.
     enqueue({
       data: {

app/api/transactions/bulk-book/route.ts

@@ -5,6 +5,12 @@ import { BulkBookSchema } from '@/lib/api/schemas'
 import { errorResponseFromCode } from '@/lib/errors/get-structured-error'
 import { applyTemplate } from '@/lib/bookkeeping/template-library'
 import { mergeDimensionBags } from '@/lib/bookkeeping/dimension-resolver'
+import {
+  applyDimensionRules,
+  assertMandatoryDimensions,
+  fetchActiveDimensionRules,
+} from '@/lib/bookkeeping/dimension-rules'
+import { bookkeepingErrorResponse } from '@/lib/bookkeeping/errors'
 import { eventBus } from '@/lib/events/bus'
 import { ensureInitialized } from '@/lib/init'
 import type { BookingTemplateLibraryLine, Transaction } from '@/types'
@@ -242,6 +248,28 @@ export const POST = withRouteContext(
       }
     }
 
+    // Account dimension rules (dimensions PR10): the bulk-book RPC bypasses
+    // the TS engine, so the policy layer runs here — defaults/fixed applied
+    // to the computed lines, then 'required' asserted. Zero rules (the
+    // default) or a failed fetch changes nothing (fail-open, same posture as
+    // the engine).
+    if (newEntryPayload) {
+      const rules = await fetchActiveDimensionRules(supabase, companyId!)
+      if (rules === null) {
+        opLog.warn('dimension rule fetch failed — policy skipped (fail-open)')
+      }
+      if (rules && rules.length > 0) {
+        newEntryPayload.lines = applyDimensionRules(newEntryPayload.lines, rules)
+        try {
+          assertMandatoryDimensions(newEntryPayload.lines, rules)
+        } catch (err) {
+          const mapped = bookkeepingErrorResponse(err)
+          if (mapped) return mapped
+          throw err
+        }
+      }
+    }
+
     // p_user_id removed in PR #608 (round-3 hardening pattern applied
     // consistently). RPC resolves the caller via auth.uid().
     const { data, error } = await supabase.rpc('bulk_book_transactions', {