feat(dimensions): PR1 substrate — SIE-native registry + dimensions JSONB on journal lines (#857)

* feat(dimensions): substrate — SIE-native registry + dimensions JSONB on journal lines (PR1) Implements phase 1 of dev_docs/dimensions_implementation_plan.md: - New company-native registry tables: dimensions (= SIE #DIM/#UNDERDIM, seeded is_system 1=Kostnadsställe / 6=Projekt via ensure_company_dimensions, nullable bare firm_id) and dimension_values (= #OBJEKT), full RLS incl. DELETE, audit + updated_at triggers, guard triggers (system dims undeletable, sie_dim_no immutable, values referenced by posted lines archive-not-delete). - journal_entry_lines.dimensions jsonb NOT NULL DEFAULT '{}' as the single source of truth ({sie_dim_no: object_code}), CHECK object-typed, GIN (jsonb_path_ops) + partial expression indexes on dims 1/6. Inherits posted- line immutability from the existing trigger with zero new triggers. - Backfill: representation copy of legacy cost_center/project text into the JSONB map (trigger-disabled, schema_sync precedent); legacy cost_centers/ projects registry rows copied into dimension_values; inactive placeholder values for orphaned free-text codes. - Dual-write: engine buildLineInserts + storno/correction/date-move now derive cost_center/project mirrors from the map via lib/bookkeeping/dimension-resolver.ts (normalizeLineDimensions / lineDimensionColumns); reversal copies dims. - CreateJournalEntryLineInput + shared Zod line schema gain a dimensions bag (cost_center/project stay as deprecated aliases); pending-ops voucher lines coerce it. - CI ratchet: direct-jel-insert check in no-new-antipatterns.mjs — inserts into journal_entry_lines outside sanctioned writers fail CI. - pg-real suite: registry RLS/guards/retention, ensure_company_dimensions tenant guard, dims frozen on posted lines, CHECK enforcement (13 tests). Non-breaking: companies without dimensions see zero change; no UI yet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(dimensions): address review findings — canonical keys, boundary-validated staged bags, migration guidance - normalizeLineDimensions canonicalizes numeric keys ('01' -> '1') so leading-zero keys can't split values or miss the cost_center/project mirrors (PR Agent finding). - New coerceDimensionsBag() in dimension-resolver is the single boundary validator for untyped staged payloads, enforcing the same constraints as the Zod line schema (string-only values, 1-40 chars, no SIE-framing chars, canonical keys). pending-operations normalizeVoucherLines now uses it — staged payloads can no longer bypass API-layer validation via numeric coercion (compliance-swarm V2.2/V1.2.5/PI1.1, Swedish review finding 4). - Migration backfill comment now spells out the exact conditions under which the trigger-disable pattern is defensible (BFL 5:5 / BFNAR 2013:2) and what a future reviewer must verify before reusing it (Swedish review finding 2). - 10 new resolver tests incl. reversal-parity (empty bag + aliases == alias-only) proving the reverseEntry and storno paths normalize identically (PR Agent finding 1). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(dimensions): round-2 review — shared Zod schema, transactional backfill, empty-string guard - DimensionsBagSchema now lives in dimension-resolver as the single source of truth; CreateJournalEntryLineSchema and coerceDimensionsBag both delegate to it, so the API layer and the staged pending-operations path provably cannot drift (compliance-swarm V2.2). coerceDimensionsBag switches to whole-bag semantics: any invalid entry rejects the bag, exactly like the API schema. - Migration backfill now runs DISABLE TRIGGER / UPDATE / ENABLE TRIGGER inside one transaction — the ACCESS EXCLUSIVE lock from ALTER TABLE holds until COMMIT, so no concurrent writer can slip an unguarded line write into the window during a live apply (compliance-swarm V1.2, Swedish review finding 1). - NULLIF guard: empty-string legacy mirrors can no longer mint {"n":""} entries the resolver would interpret as "cleared" (PR Agent round-2 edge). - COMMENT ON dimensions.resets_annually documenting the SIE4 #IB/#OIB semantics the PR2+ export path must honour (Swedish review finding 2). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 11:27:07 +02:00
parent f63d3e3100
commit 8cc2efb083
10 changed files with 1078 additions and 49 deletions
@@ -3,6 +3,7 @@ import { normaliseSwish, isValidSwish } from '@/lib/payments/swish'
 import { normalizeVatNumber } from '@/lib/vat/vat-number'
 import { isSaneDateString } from '@/lib/utils'
 import { countCalendarMonths } from '@/lib/bookkeeping/accruals/compute'
+import { DimensionsBagSchema } from '@/lib/bookkeeping/dimension-resolver'

 // ============================================================
 // Shared primitives
@@ -686,6 +687,13 @@ export const CreateJournalEntryLineSchema = z.object({
  amount_in_currency: z.number().optional(),
  exchange_rate: z.number().positive().optional(),
  tax_code: z.string().optional(),
+  // SIE dimension map {sie_dim_no: object_code}, e.g. {"1":"KS01","6":"P001"}.
+  // Single source of truth for the constraints lives in dimension-resolver so
+  // the staged pending-operations path validates identically. Wins per key
+  // over the cost_center/project aliases.
+  dimensions: DimensionsBagSchema.optional(),
+  // Deprecated aliases for dimensions['1'] / dimensions['6'] — kept forever
+  // for API/MCP compatibility.
  cost_center: z.string().optional(),
  project: z.string().optional(),
 })
@@ -0,0 +1,134 @@
+import { describe, it, expect } from 'vitest'
+import {
+  normalizeLineDimensions,
+  lineDimensionColumns,
+  coerceDimensionsBag,
+  DIM_COST_CENTER,
+  DIM_PROJECT,
+} from '@/lib/bookkeeping/dimension-resolver'
+
+describe('normalizeLineDimensions', () => {
+  it('returns empty map for a line with no dimension data', () => {
+    expect(normalizeLineDimensions({})).toEqual({})
+    expect(normalizeLineDimensions({ cost_center: null, project: null })).toEqual({})
+  })
+
+  it('maps the deprecated aliases to SIE keys 1 and 6', () => {
+    expect(normalizeLineDimensions({ cost_center: 'KS01', project: 'P001' })).toEqual({
+      '1': 'KS01',
+      '6': 'P001',
+    })
+  })
+
+  it('passes an explicit bag through', () => {
+    expect(normalizeLineDimensions({ dimensions: { '1': 'KS01', '7': 'ANST-4' } })).toEqual({
+      '1': 'KS01',
+      '7': 'ANST-4',
+    })
+  })
+
+  it('lets the explicit bag win over aliases per key', () => {
+    expect(
+      normalizeLineDimensions({
+        dimensions: { '1': 'KS-BAG' },
+        cost_center: 'KS-ALIAS',
+        project: 'P-ALIAS',
+      })
+    ).toEqual({ '1': 'KS-BAG', '6': 'P-ALIAS' })
+  })
+
+  it('treats an explicit empty string in the bag as clearing that dimension', () => {
+    expect(
+      normalizeLineDimensions({ dimensions: { '1': '' }, cost_center: 'KS-ALIAS' })
+    ).toEqual({})
+  })
+
+  it('trims whitespace and drops blank values', () => {
+    expect(
+      normalizeLineDimensions({ dimensions: { '6': '  P001  ' }, cost_center: '   ' })
+    ).toEqual({ '6': 'P001' })
+  })
+
+  it('drops non-numeric and zero/negative keys', () => {
+    expect(
+      normalizeLineDimensions({
+        dimensions: { projekt: 'X', '0': 'Y', '6': 'P001' } as Record<string, string>,
+      })
+    ).toEqual({ '6': 'P001' })
+  })
+
+  it("canonicalizes leading-zero keys ('01' -> '1') so mirrors are derived", () => {
+    const dims = normalizeLineDimensions({ dimensions: { '01': 'KS01', '06': 'P001' } })
+    expect(dims).toEqual({ '1': 'KS01', '6': 'P001' })
+    expect(lineDimensionColumns(dims)).toEqual({ cost_center: 'KS01', project: 'P001' })
+  })
+
+  it("clearing via a leading-zero key ('01': '') also clears the alias-filled '1'", () => {
+    expect(
+      normalizeLineDimensions({ dimensions: { '01': '' }, cost_center: 'KS-ALIAS' })
+    ).toEqual({})
+  })
+
+  it('reversal parity: empty bag + populated aliases equals alias-only input', () => {
+    // reverseEntry passes {dimensions: {}, cost_center, project} for legacy
+    // rows; storno passes the row directly — both must normalize identically.
+    expect(
+      normalizeLineDimensions({ dimensions: {}, cost_center: 'KS01', project: 'P001' })
+    ).toEqual(normalizeLineDimensions({ cost_center: 'KS01', project: 'P001' }))
+  })
+})
+
+describe('coerceDimensionsBag (boundary validator for staged payloads)', () => {
+  it('returns undefined for non-objects', () => {
+    expect(coerceDimensionsBag(undefined)).toBeUndefined()
+    expect(coerceDimensionsBag(null)).toBeUndefined()
+    expect(coerceDimensionsBag('P001')).toBeUndefined()
+    expect(coerceDimensionsBag(['6', 'P001'])).toBeUndefined()
+  })
+
+  it('accepts a valid bag and normalizes values', () => {
+    expect(coerceDimensionsBag({ '6': ' P001 ', '1': 'KS01' })).toEqual({
+      '6': 'P001',
+      '1': 'KS01',
+    })
+  })
+
+  it('rejects the WHOLE bag on any invalid entry — same as the API schema', () => {
+    // Numeric value (no silent coercion), invalid key, leading-zero key:
+    // exactly what CreateJournalEntryLineSchema would reject.
+    expect(coerceDimensionsBag({ '6': 42 })).toBeUndefined()
+    expect(coerceDimensionsBag({ '6': 42, '1': 'KS01' })).toBeUndefined()
+    expect(coerceDimensionsBag({ projekt: 'P001', '6': 'P001' })).toBeUndefined()
+    expect(coerceDimensionsBag({ '06': 'P001' })).toBeUndefined()
+  })
+
+  it('enforces the same length/charset constraints as the Zod line schema', () => {
+    expect(coerceDimensionsBag({ '6': 'x'.repeat(41) })).toBeUndefined()
+    expect(coerceDimensionsBag({ '6': 'P"1' })).toBeUndefined()
+    expect(coerceDimensionsBag({ '6': 'P{1}' })).toBeUndefined()
+    expect(coerceDimensionsBag({ '6': 'x'.repeat(40) })).toEqual({ '6': 'x'.repeat(40) })
+  })
+
+  it('returns undefined for an empty or whitespace-only bag', () => {
+    expect(coerceDimensionsBag({})).toBeUndefined()
+  })
+})
+
+describe('lineDimensionColumns', () => {
+  it('derives both mirrors from the map', () => {
+    expect(lineDimensionColumns({ [DIM_COST_CENTER]: 'KS01', [DIM_PROJECT]: 'P001' })).toEqual({
+      cost_center: 'KS01',
+      project: 'P001',
+    })
+  })
+
+  it('returns nulls for missing keys', () => {
+    expect(lineDimensionColumns({})).toEqual({ cost_center: null, project: null })
+    expect(lineDimensionColumns({ '7': 'ANST-4' })).toEqual({ cost_center: null, project: null })
+  })
+
+  it('round-trips with normalizeLineDimensions (mirror consistency)', () => {
+    const dims = normalizeLineDimensions({ cost_center: 'KS01', dimensions: { '6': 'P001' } })
+    expect(lineDimensionColumns(dims)).toEqual({ cost_center: 'KS01', project: 'P001' })
+  })
+})
@@ -0,0 +1,108 @@
+/**
+ * Dimension resolver — the single place line dimensions are normalized and
+ * mirrored (dev_docs/dimensions_implementation_plan.md).
+ *
+ * Storage model: journal_entry_lines.dimensions is a JSONB map keyed by SIE
+ * dimension number ({"1":"KS01","6":"P001"}) and is the single source of
+ * truth. The legacy cost_center/project TEXT columns are deterministic mirrors
+ * of keys '1'/'6' during the dual-write window (they become GENERATED columns
+ * in a later migration). Every journal_entry_lines writer MUST derive the
+ * mirror columns via lineDimensionColumns() — never set them independently.
+ */
+
+import { z } from 'zod'
+
+/** SIE dimension numbers with first-class mirror columns. */
+export const DIM_COST_CENTER = '1'
+export const DIM_PROJECT = '6'
+
+export type LineDimensions = Record<string, string>
+
+/**
+ * THE schema for a dimensions bag ({sie_dim_no: object_code}) — the single
+ * source of truth for its constraints. The API layer
+ * (CreateJournalEntryLineSchema) and the staged pending-operations path
+ * (coerceDimensionsBag) both use this exact schema, so the two validation
+ * layers cannot drift. Keys are canonical SIE dimension numbers (no leading
+ * zeros); values must not contain characters that break SIE field framing.
+ */
+export const DimensionsBagSchema = z.record(
+  z.string().regex(/^[1-9]\d*$/, 'Dimensionsnyckel måste vara ett SIE-dimensionsnummer'),
+  z.string().min(1).max(40).regex(/^[^"{}]+$/, 'Dimensionskod får inte innehålla ", { eller }')
+)
+
+interface DimensionAliasInput {
+  dimensions?: LineDimensions | null
+  cost_center?: string | null
+  project?: string | null
+}
+
+/**
+ * Merge the explicit `dimensions` bag with the deprecated cost_center/project
+ * aliases into one canonical map. The explicit bag wins per key; aliases only
+ * fill keys the bag does not set. Empty/blank values and non-numeric keys are
+ * dropped so the stored map never carries junk entries.
+ */
+export function normalizeLineDimensions(line: DimensionAliasInput): LineDimensions {
+  const out: LineDimensions = {}
+
+  const costCenter = line.cost_center?.trim()
+  if (costCenter) out[DIM_COST_CENTER] = costCenter
+  const project = line.project?.trim()
+  if (project) out[DIM_PROJECT] = project
+
+  if (line.dimensions) {
+    for (const [key, value] of Object.entries(line.dimensions)) {
+      if (!/^\d+$/.test(key) || Number(key) < 1) continue
+      // Canonical numeric form: '01' and '1' must land on the same key, or
+      // lineDimensionColumns misses the mirror and reports split the value.
+      const dimNo = String(Number(key))
+      const trimmed = typeof value === 'string' ? value.trim() : ''
+      if (!trimmed) {
+        // Explicit empty string in the bag means "clear this dimension" — it
+        // must also override a non-empty alias, so remove any alias-filled key.
+        delete out[dimNo]
+        continue
+      }
+      out[dimNo] = trimmed
+    }
+  }
+
+  return out
+}
+
+/**
+ * Boundary validator for an untyped dimensions bag (staged pending-operation
+ * params, tool payloads). Delegates to DimensionsBagSchema — the exact schema
+ * the API layer uses — so the staged path cannot drift from API validation.
+ * Whole-bag semantics: a bag containing ANY invalid entry is rejected
+ * (returns undefined) rather than partially salvaged; staged payloads were
+ * already schema-validated at staging time, so an invalid entry here means
+ * drift or tampering — booking then proceeds without dimensions, which are
+ * never load-bearing for validity. Interior normalization
+ * (normalizeLineDimensions) stays permissive on charset by design — it must
+ * preserve legacy DB values verbatim on reversal/correction; this function is
+ * the input gate.
+ */
+export function coerceDimensionsBag(raw: unknown): LineDimensions | undefined {
+  if (raw === undefined || raw === null) return undefined
+  const parsed = DimensionsBagSchema.safeParse(raw)
+  if (!parsed.success) return undefined
+  const dims = normalizeLineDimensions({ dimensions: parsed.data })
+  return Object.keys(dims).length > 0 ? dims : undefined
+}
+
+/**
+ * Derive the legacy mirror columns from the canonical map. Pure function —
+ * divergence between `dimensions` and cost_center/project is impossible as
+ * long as every writer goes through this.
+ */
+export function lineDimensionColumns(dimensions: LineDimensions): {
+  cost_center: string | null
+  project: string | null
+} {
+  return {
+    cost_center: dimensions[DIM_COST_CENTER] ?? null,
+    project: dimensions[DIM_PROJECT] ?? null,
+  }
+}
@@ -14,6 +14,7 @@ import {
  JournalEntryNotFoundError,
 } from '@/lib/bookkeeping/errors'
 import { resolveDefaultSeriesForSource } from '@/lib/bookkeeping/voucher-series-resolver'
+import { normalizeLineDimensions, lineDimensionColumns } from '@/lib/bookkeeping/dimension-resolver'
 import { backfillStandardBASAccounts } from '@/lib/bookkeeping/account-backfill'
 import { syncInvoiceStatusFromPaymentEntry, isPaymentSourceType } from '@/lib/bookkeeping/payment-sync'
 import { getActor } from '@/lib/bookkeeping/actor-context'
@@ -185,21 +186,26 @@ function buildLineInserts(
  lines: CreateJournalEntryLineInput[],
  accountIdMap: Map<string, string>
 ) {
-  return lines.map((line, index) => ({
-    journal_entry_id: entryId,
-    account_number: line.account_number,
-    account_id: accountIdMap.get(line.account_number) || null,
-    debit_amount: Math.round((line.debit_amount || 0) * 100) / 100,
-    credit_amount: Math.round((line.credit_amount || 0) * 100) / 100,
-    currency: line.currency || 'SEK',
-    amount_in_currency: line.amount_in_currency ? Math.round(line.amount_in_currency * 100) / 100 : null,
-    exchange_rate: line.exchange_rate || null,
-    line_description: line.line_description || null,
-    tax_code: line.tax_code || null,
-    cost_center: line.cost_center || null,
-    project: line.project || null,
-    sort_order: index,
-  }))
+  return lines.map((line, index) => {
+    // dimensions JSONB is the source of truth; cost_center/project are
+    // derived mirrors (dual-write window — see lib/bookkeeping/dimension-resolver.ts)
+    const dimensions = normalizeLineDimensions(line)
+    return {
+      journal_entry_id: entryId,
+      account_number: line.account_number,
+      account_id: accountIdMap.get(line.account_number) || null,
+      debit_amount: Math.round((line.debit_amount || 0) * 100) / 100,
+      credit_amount: Math.round((line.credit_amount || 0) * 100) / 100,
+      currency: line.currency || 'SEK',
+      amount_in_currency: line.amount_in_currency ? Math.round(line.amount_in_currency * 100) / 100 : null,
+      exchange_rate: line.exchange_rate || null,
+      line_description: line.line_description || null,
+      tax_code: line.tax_code || null,
+      dimensions,
+      ...lineDimensionColumns(dimensions),
+      sort_order: index,
+    }
+  })
 }

 /**
@@ -662,6 +668,7 @@ export async function reverseEntry(
      : undefined,
    exchange_rate: line.exchange_rate || undefined,
    tax_code: line.tax_code || undefined,
+    dimensions: line.dimensions || undefined,
    cost_center: line.cost_center || undefined,
    project: line.project || undefined,
  }))
@@ -6,6 +6,7 @@ import type {
  JournalEntryLine,
 } from '@/types'
 import { validateBalance, getNextVoucherNumber } from '@/lib/bookkeeping/engine'
+import { normalizeLineDimensions, lineDimensionColumns } from '@/lib/bookkeeping/dimension-resolver'
 import { backfillStandardBASAccounts } from '@/lib/bookkeeping/account-backfill'
 import { resolvePeriodStatusForDate } from '@/lib/core/bookkeeping/period-service'
 import {
@@ -271,22 +272,25 @@ export async function correctEntry(
    throw new BookkeepingDatabaseError('create_reversal_entry', reversalError?.message)
  }

-  // Insert reversed lines (swap debit and credit)
-  const reversalLineInserts = originalLines.map((line, index) => ({
-    journal_entry_id: reversalEntry.id,
-    account_number: line.account_number,
-    account_id: line.account_id || null,
-    debit_amount: Math.round((Number(line.credit_amount) || 0) * 100) / 100,
-    credit_amount: Math.round((Number(line.debit_amount) || 0) * 100) / 100,
-    currency: line.currency || 'SEK',
-    amount_in_currency: line.amount_in_currency ? -Number(line.amount_in_currency) : null,
-    exchange_rate: line.exchange_rate || null,
-    line_description: `Storno: ${line.line_description || ''}`,
-    tax_code: line.tax_code || null,
-    cost_center: line.cost_center || null,
-    project: line.project || null,
-    sort_order: index,
-  }))
+  // Insert reversed lines (swap debit and credit, preserve dimensions)
+  const reversalLineInserts = originalLines.map((line, index) => {
+    const dimensions = normalizeLineDimensions(line)
+    return {
+      journal_entry_id: reversalEntry.id,
+      account_number: line.account_number,
+      account_id: line.account_id || null,
+      debit_amount: Math.round((Number(line.credit_amount) || 0) * 100) / 100,
+      credit_amount: Math.round((Number(line.debit_amount) || 0) * 100) / 100,
+      currency: line.currency || 'SEK',
+      amount_in_currency: line.amount_in_currency ? -Number(line.amount_in_currency) : null,
+      exchange_rate: line.exchange_rate || null,
+      line_description: `Storno: ${line.line_description || ''}`,
+      tax_code: line.tax_code || null,
+      dimensions,
+      ...lineDimensionColumns(dimensions),
+      sort_order: index,
+    }
+  })

  const { error: reversalLinesError } = await supabase
    .from('journal_entry_lines')
@@ -352,23 +356,26 @@ export async function correctEntry(
    correctedEntry = newEntry

    // Insert corrected lines
-    const correctedLineInserts = correctedLines.map((line, index) => ({
-      journal_entry_id: correctedEntry.id,
-      account_number: line.account_number,
-      account_id: accountIdMap.get(line.account_number) || null,
-      debit_amount: Math.round((line.debit_amount || 0) * 100) / 100,
-      credit_amount: Math.round((line.credit_amount || 0) * 100) / 100,
-      currency: line.currency || 'SEK',
-      amount_in_currency: line.amount_in_currency
-        ? Math.round(line.amount_in_currency * 100) / 100
-        : null,
-      exchange_rate: line.exchange_rate || null,
-      line_description: line.line_description || null,
-      tax_code: line.tax_code || null,
-      cost_center: line.cost_center || null,
-      project: line.project || null,
-      sort_order: index,
-    }))
+    const correctedLineInserts = correctedLines.map((line, index) => {
+      const dimensions = normalizeLineDimensions(line)
+      return {
+        journal_entry_id: correctedEntry.id,
+        account_number: line.account_number,
+        account_id: accountIdMap.get(line.account_number) || null,
+        debit_amount: Math.round((line.debit_amount || 0) * 100) / 100,
+        credit_amount: Math.round((line.credit_amount || 0) * 100) / 100,
+        currency: line.currency || 'SEK',
+        amount_in_currency: line.amount_in_currency
+          ? Math.round(line.amount_in_currency * 100) / 100
+          : null,
+        exchange_rate: line.exchange_rate || null,
+        line_description: line.line_description || null,
+        tax_code: line.tax_code || null,
+        dimensions,
+        ...lineDimensionColumns(dimensions),
+        sort_order: index,
+      }
+    })

    const { error: correctedLinesError } = await supabase
      .from('journal_entry_lines')
@@ -526,6 +533,7 @@ export async function recordateEntry(
        line.amount_in_currency != null ? Number(line.amount_in_currency) : undefined,
      exchange_rate: line.exchange_rate != null ? Number(line.exchange_rate) : undefined,
      tax_code: line.tax_code || undefined,
+      dimensions: line.dimensions || undefined,
      cost_center: line.cost_center || undefined,
      project: line.project || undefined,
    }))
@@ -26,6 +26,7 @@ import {
  createCreditNoteJournalEntry,
 } from '@/lib/bookkeeping/invoice-entries'
 import { createJournalEntry, findFiscalPeriod, reverseEntry, validateBalance } from '@/lib/bookkeeping/engine'
+import { coerceDimensionsBag } from '@/lib/bookkeeping/dimension-resolver'
 import { cancelOrphanedPaymentEntry } from '@/lib/bookkeeping/cancel-orphaned-entry'
 import { runWithActor } from '@/lib/bookkeeping/actor-context-node'
 import type { CommitActor } from '@/lib/bookkeeping/actor-context'
@@ -2667,6 +2668,9 @@ function normalizeVoucherLines(raw: unknown): CreateJournalEntryLineInput[] {
      amount_in_currency: line.amount_in_currency !== undefined ? Number(line.amount_in_currency) : undefined,
      exchange_rate: line.exchange_rate !== undefined ? Number(line.exchange_rate) : undefined,
      tax_code: line.tax_code ? String(line.tax_code) : undefined,
+      // Boundary-validated with the same constraints as the Zod line schema —
+      // staged payloads must not bypass API-layer validation (SOC 2 PI1.1).
+      dimensions: coerceDimensionsBag(line.dimensions),
      cost_center: line.cost_center ? String(line.cost_center) : undefined,
      project: line.project ? String(line.project) : undefined,
    }