Refactor: Remove unused imports and clean up code across multiple pages

- Removed unused Link imports and associated code for navigation in various pages. - Simplified TableHeader components by removing unnecessary class names. - Updated alert dialog styles for better consistency with the design system. - Cleaned up imports in several components to streamline the codebase.
Merge pull request 'Dashborad and prouction' (#18 ) from Dashborad-and-prouction into Dev
2026-07-31 10:26:08 +05:30 · 2026-07-29 17:08:57 +00:00 · 2026-07-28 22:55:56 +05:30 · 2026-07-28 14:59:09 +05:30 · 2026-07-27 06:10:10 +00:00 · 2026-07-27 06:10:00 +00:00
530 changed files with 55736 additions and 3788 deletions
@@ -29,3 +29,10 @@ yarn-error.log*
 .DS_Store
 Thumbs.db
 .idea/
+
+# ── Migrations ─────────────────────────────────────────────────────────
+# New EF Core migrations are not committed. Note the 4 migrations already in
+# Backend/ERPCore/Infra/Persistence/Migrations/ stay tracked — .gitignore does
+# not apply to tracked files — so edits to those still get committed as normal.
+# Untracking them too takes `git rm --cached`.
+**/Migrations/
@@ -1,5 +1,7 @@
 using ERPCore.Common.Http;
+using ERPCore.Infra.Auth;
 using ERPCore.System.Errors;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;

 namespace ERPCore.Controllers;
@@ -8,10 +10,12 @@ namespace ERPCore.Controllers;
 /// Base for the v1 API controllers. Centralises ETag / If-Match handling
 /// (docs/11-BACKEND-PHASE1.md §1.6) so concurrency behaviour is uniform.
 /// Each controller declares its own explicit lowercase <c>[Route]</c> to match
-/// the API contract paths (docs/11 §1.1).
+/// the API contract paths (docs/11 §1.1). Every v1 endpoint requires a valid
+/// AuthHex token satisfying the ERP door policy (docs/10 A.4).
 /// </summary>
 [ApiController]
 [Produces("application/json")]
+[Authorize(JwtAuthExtensions.ErpAccessPolicy)]
 public abstract class ApiControllerBase : ControllerBase
 {
    /// <summary>Parse a mandatory <c>If-Match</c> header, or 428 if absent/malformed.</summary>
@@ -0,0 +1,26 @@
+using ERPCore.Dtos.Audit;
+using ERPCore.Dtos.Common;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Read-only audit trail (FR-X-02; auditor role). Extends the documented §11 API —
+/// the audit trail is required (AR-01 compensating control) and read access is the
+/// only way to consume it.
+/// </summary>
+[Route("api/v1/audit-logs")]
+public sealed class AuditLogsController : ApiControllerBase
+{
+    private readonly IAuditService _audit;
+
+    public AuditLogsController(IAuditService audit) => _audit = audit;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<AuditLogDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<AuditLogDto>>> List(
+        [FromQuery] string? entityType, [FromQuery] int? entityId, [FromQuery] int? userId,
+        [FromQuery] DateOnly? from, [FromQuery] DateOnly? to, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _audit.ListLogsAsync(entityType, entityId, userId, from, to, query, ct));
+}
@@ -0,0 +1,297 @@
+using ERPCore.Dtos.Auth;
+using ERPCore.Dtos.Rbac;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Fronts the external AuthHex identity service (API_REFERENCE.md) so the
+/// frontend never calls AuthHex directly. Sessions are delivered as httpOnly
+/// Secure cookies (docs/02-SECURITY.md §B.2) via <see cref="AuthCookieWriter"/>
+/// — response bodies never carry raw tokens. Does not inherit
+/// <see cref="ApiControllerBase"/>: most actions here are pre-session and need
+/// <see cref="AllowAnonymousAttribute"/>, and the ETag/If-Match handling that
+/// base provides doesn't apply to auth flows.
+/// </summary>
+[ApiController]
+[Produces("application/json")]
+[Route("api/v1/auth")]
+[Authorize(JwtAuthExtensions.ErpAccessPolicy)]
+public sealed class AuthController : ControllerBase
+{
+    private readonly IAuthUserService _users;
+    private readonly IAuthRecoveryService _recovery;
+    private readonly IAuthAltService _alt;
+    private readonly IRoleService _roles;
+
+    public AuthController(IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles)
+    {
+        _users = users;
+        _recovery = recovery;
+        _alt = alt;
+        _roles = roles;
+    }
+
+    /// <summary>
+    /// Authoritative current-session info for the frontend: role + the sidebar nav
+    /// codes it may see (docs/10 C.9 shadow-Role sync). Replaces the frontend's
+    /// previous reliance on a stale, untrusted `roleId` cached in localStorage.
+    /// </summary>
+    [HttpGet("me")]
+    [ProducesResponseType(typeof(MeResponseDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<MeResponseDto>> Me(CancellationToken ct)
+    {
+        var roleCode = User.FindFirst(AuthHexClaims.RoleCode)?.Value;
+        return Ok(await _roles.GetMeAsync(roleCode, ct));
+    }
+
+    // ---- Session-issuing (UserManager) ------------------------------------
+
+    [HttpPost("register")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(AuthSessionResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<AuthSessionResponse>> Register([FromBody] RegisterRequest request, CancellationToken ct)
+    {
+        var result = await _users.RegisterAsync(request, ct);
+        AuthCookieWriter.WriteSession(Response, result.AccessToken, result.RefreshToken, result.Body.ExpiresIn);
+        return Ok(result.Body);
+    }
+
+    [HttpPost("login")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(AuthSessionResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<AuthSessionResponse>> Login([FromBody] LoginRequest request, CancellationToken ct)
+    {
+        var result = await _users.LoginAsync(request, ct);
+        AuthCookieWriter.WriteSession(Response, result.AccessToken, result.RefreshToken, result.Body.ExpiresIn);
+        return Ok(result.Body);
+    }
+
+    [HttpPost("login/otp/verify")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(OtpLoginVerifiedResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<OtpLoginVerifiedResponse>> VerifyLoginOtp([FromBody] VerifyOtpForLoginRequest request, CancellationToken ct)
+    {
+        var result = await _users.VerifyOtpForLoginAsync(request, ct);
+        AuthCookieWriter.WriteSession(Response, result.AccessToken, result.RefreshToken, result.Body.ExpiresIn);
+        return Ok(result.Body);
+    }
+
+    [HttpPost("refresh-token")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(AuthSessionResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<AuthSessionResponse>> RefreshToken([FromBody] RefreshTokenRequest request, CancellationToken ct)
+    {
+        if (!Request.Cookies.TryGetValue(JwtAuthExtensions.RefreshTokenCookie, out var refreshToken) || string.IsNullOrEmpty(refreshToken))
+            throw new DomainException(ErrorCodes.RefreshTokenMissing, "No refresh session cookie present.", 401);
+
+        var result = await _users.RefreshTokenAsync(refreshToken, request, ct);
+        AuthCookieWriter.WriteSession(Response, result.AccessToken, result.RefreshToken, result.Body.ExpiresIn);
+        return Ok(result.Body);
+    }
+
+    // ---- Profile / sessions (UserManager) ---------------------------------
+
+    [HttpGet("users/{userId:guid}")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(GetUserDetailsResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<GetUserDetailsResponse>> GetUserDetails(Guid userId, CancellationToken ct)
+        => Ok(await _users.GetUserDetailsAsync(userId, ct));
+
+    [HttpGet("sessions")]
+    [ProducesResponseType(typeof(List<SessionDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<SessionDto>>> GetSessions(CancellationToken ct)
+        => Ok(await _users.GetUserSessionsAsync(RequireBearerToken(), ct));
+
+    [HttpPost("status")]
+    [ValidateCsrf]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> ChangeStatus([FromBody] ChangeUserStatusRequest request, CancellationToken ct)
+    {
+        await _users.ChangeUserStatusAsync(request, RequireBearerToken(), ct);
+        return NoContent();
+    }
+
+    [HttpPost("lock")]
+    [ValidateCsrf]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> Lock([FromBody] LockUserAccountRequest request, CancellationToken ct)
+    {
+        await _users.LockUserAccountAsync(request, RequireBearerToken(), ct);
+        AuthCookieWriter.ClearSession(Response);
+        return NoContent();
+    }
+
+    [HttpPost("change-password")]
+    [ValidateCsrf]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> ChangePassword([FromBody] ChangeUserPasswordRequest request, CancellationToken ct)
+    {
+        await _users.ChangeUserPasswordAsync(request, RequireBearerToken(), ct);
+        AuthCookieWriter.ClearSession(Response);
+        return NoContent();
+    }
+
+    [HttpPost("verify-password")]
+    [ProducesResponseType(typeof(VerifyPasswordResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<VerifyPasswordResponse>> VerifyPassword([FromBody] VerifyPasswordRequest request, CancellationToken ct)
+        => Ok(await _users.VerifyPasswordAsync(request, RequireBearerToken(), ct));
+
+    /// <summary>
+    /// Ends the session: revokes it upstream where possible, and always clears our cookies.
+    /// <para>
+    /// <c>userId</c> is optional because callers usually cannot supply it — AuthHex returns
+    /// <c>user.userId: null</c> in its own login/register response, so a browser has no id
+    /// to send. It is resolved from the session token's <c>UserId</c> claim instead.
+    /// </para>
+    /// <para>
+    /// The cookies are cleared even if the upstream revoke fails or no user can be
+    /// resolved: a logout that leaves the caller holding a live session cookie is worse
+    /// than one that leaves a stale session server-side (which lapses on its own).
+    /// </para>
+    /// </summary>
+    [HttpPost("logout")]
+    [AllowAnonymous]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> Logout([FromBody] LogoutRequest? request, CancellationToken ct)
+    {
+        var userId = request?.UserId ?? ResolveTokenUserId();
+        if (userId is not null)
+        {
+            try
+            {
+                await _users.LogoutUserAsync(new LogoutRequest { UserId = userId.Value }, ct);
+            }
+            catch (DomainException)
+            {
+                // Upstream unreachable or already-revoked — fall through and clear anyway.
+            }
+        }
+
+        AuthCookieWriter.ClearSession(Response);
+        return NoContent();
+    }
+
+    /// <summary>AuthHex's identity claim, present when the request carried a valid session.</summary>
+    private Guid? ResolveTokenUserId()
+        => Guid.TryParse(User.FindFirst(AuthHexClaims.UserId)?.Value, out var id) ? id : null;
+
+    [HttpPut("me")]
+    [ValidateCsrf]
+    [ProducesResponseType(typeof(UserSummaryDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<UserSummaryDto?>> UpdateMe([FromBody] UpdateUserRequest request, CancellationToken ct)
+        => Ok(await _users.UpdateUserAsync(request, RequireBearerToken(), ct));
+
+    // ---- 2FA (UserManager) -------------------------------------------------
+
+    [HttpPost("2fa/initiate")]
+    [ValidateCsrf]
+    [ProducesResponseType(typeof(TwoFaSetupResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<TwoFaSetupResponse>> InitiateTwoFa(CancellationToken ct)
+        => Ok(await _users.InitiateTwoFaSetupAsync(RequireBearerToken(), ct));
+
+    [HttpPost("2fa/complete")]
+    [ValidateCsrf]
+    [ProducesResponseType(typeof(CompleteTwoFaSetupResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<CompleteTwoFaSetupResponse>> CompleteTwoFa([FromBody] CompleteTwoFaSetupRequest request, CancellationToken ct)
+        => Ok(await _users.CompleteTwoFaSetupAsync(request, RequireBearerToken(), ct));
+
+    [HttpPost("2fa/verify")]
+    [ValidateCsrf]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> VerifyTwoFa([FromBody] VerifyTwoFaRequest request, CancellationToken ct)
+    {
+        await _users.VerifyTwoFaAsync(request, RequireBearerToken(), ct);
+        return NoContent();
+    }
+
+    [HttpPost("2fa/disable")]
+    [ValidateCsrf]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> DisableTwoFa([FromBody] DisableTwoFaRequest request, CancellationToken ct)
+    {
+        await _users.DisableTwoFaAsync(request, RequireBearerToken(), ct);
+        return NoContent();
+    }
+
+    [HttpGet("2fa/status")]
+    [ProducesResponseType(typeof(TwoFaStatusResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<TwoFaStatusResponse>> GetTwoFaStatus(CancellationToken ct)
+        => Ok(await _users.GetTwoFaStatusAsync(RequireBearerToken(), ct));
+
+    // ---- Recovery -----------------------------------------------------------
+
+    [HttpPost("recovery/forgot-password")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(ForgotPasswordResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ForgotPasswordResponse>> ForgotPassword([FromBody] ForgotPasswordRequest request, CancellationToken ct)
+        => Ok(await _recovery.ForgotPasswordAsync(request, ct));
+
+    [HttpPost("recovery/verify-otp")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(VerifyRecoveryOtpResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<VerifyRecoveryOtpResponse>> VerifyRecoveryOtp([FromBody] VerifyRecoveryOtpRequest request, CancellationToken ct)
+        => Ok(await _recovery.VerifyOtpAsync(request, ct));
+
+    [HttpPost("recovery/reset-password")]
+    [AllowAnonymous]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> ResetPassword([FromBody] ResetPasswordRequest request, CancellationToken ct)
+    {
+        await _recovery.ResetPasswordAsync(request, ct);
+        return NoContent();
+    }
+
+    [HttpPost("recovery/reset-password-token")]
+    [AllowAnonymous]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> ResetPasswordWithToken([FromBody] ResetPasswordWithTokenRequest request, CancellationToken ct)
+    {
+        await _recovery.ResetPasswordWithTokenAsync(request, ct);
+        return NoContent();
+    }
+
+    // ---- Availability / OTP (AltOptionManager) -----------------------------
+
+    [HttpPost("availability")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(IsAvailableResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IsAvailableResponse>> CheckAvailability([FromBody] IsAvailableRequest request, CancellationToken ct)
+        => Ok(await _alt.IsAvailableAsync(request, ct));
+
+    [HttpPost("otp/send")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(SendOtpResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SendOtpResponse>> SendOtp([FromBody] SendOtpRequest request, CancellationToken ct)
+        => Ok(await _alt.SendOtpAsync(request, ct));
+
+    [HttpPost("otp/verify")]
+    [AllowAnonymous]
+    [ProducesResponseType(typeof(OtpLoginVerifiedResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<OtpLoginVerifiedResponse>> VerifyAltOtp([FromBody] VerifyAltOtpRequest request, CancellationToken ct)
+    {
+        var result = await _alt.VerifyOtpAsync(request, ct);
+        AuthCookieWriter.WriteSession(Response, result.AccessToken, result.RefreshToken, result.Body.ExpiresIn);
+        return Ok(result.Body);
+    }
+
+    // ---- Helpers --------------------------------------------------------------
+
+    /// <summary>The token that authenticated this request — Bearer header if present, else the session cookie.</summary>
+    private string RequireBearerToken()
+    {
+        var header = Request.Headers.Authorization.ToString();
+        if (!string.IsNullOrEmpty(header) && header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+            return header["Bearer ".Length..];
+
+        if (Request.Cookies.TryGetValue(JwtAuthExtensions.AccessTokenCookie, out var cookieToken) && !string.IsNullOrEmpty(cookieToken))
+            return cookieToken;
+
+        // [Authorize] already guaranteed one of the above was present to authenticate this request.
+        throw new DomainException(ErrorCodes.AuthUpstreamError, "No bearer token found on an authenticated request.", 500);
+    }
+}
@@ -0,0 +1,67 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Brands;
+using ERPCore.Dtos.Common;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Brand master endpoints (docs/11-BACKEND-PHASE1.md §2.6).</summary>
+[Route("api/v1/brands")]
+public sealed class BrandsController : ApiControllerBase
+{
+    private readonly IBrandService _brands;
+
+    public BrandsController(IBrandService brands) => _brands = brands;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<BrandDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<BrandDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _brands.ListAsync(query, status, ct));
+
+    [HttpGet("{brandId:int}")]
+    [ProducesResponseType(typeof(BrandDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<BrandDto>> GetById(int brandId, CancellationToken ct)
+    {
+        var result = await _brands.GetAsync(brandId, ct);
+        if (result is null) return NotFound();
+
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(BrandDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<BrandDto>> Create([FromBody] CreateBrandRequest request, CancellationToken ct)
+    {
+        var result = await _brands.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/brands/{result.Value.BrandId}", result.Value);
+    }
+
+    [HttpPut("{brandId:int}")]
+    [ProducesResponseType(typeof(BrandDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<BrandDto>> Update(int brandId, [FromBody] UpdateBrandRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _brands.UpdateAsync(brandId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Deactivate/reactivate. Masters are never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{brandId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int brandId, [FromBody] UpdateBrandStatusRequest request, CancellationToken ct)
+    {
+        await _brands.SetStatusAsync(brandId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -1,3 +1,4 @@
+using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Categories;
 using ERPCore.Dtos.Common;
 using ERPCore.Services.Interfaces;
@@ -5,7 +6,11 @@ using Microsoft.AspNetCore.Mvc;

 namespace ERPCore.Controllers;

-/// <summary>Category endpoints (docs/11-BACKEND-PHASE1.md §2.3).</summary>
+/// <summary>
+/// Category endpoints (docs/11-BACKEND-PHASE1.md §2.3), including the subcategories
+/// nested beneath each category. The hierarchy is exactly two levels deep — the old
+/// <c>?tree=true</c> parameter is gone along with the self-nesting model.
+/// </summary>
 [Route("api/v1/categories")]
 public sealed class CategoriesController : ApiControllerBase
 {
@@ -13,19 +18,79 @@ public sealed class CategoriesController : ApiControllerBase

    public CategoriesController(ICategoryService categories) => _categories = categories;

-    /// <summary>Flat paged list, or a nested tree when <c>tree=true</c>.</summary>
    [HttpGet]
    [ProducesResponseType(typeof(PagedResponse<CategoryDto>), StatusCodes.Status200OK)]
-    [ProducesResponseType(typeof(IReadOnlyList<CategoryTreeDto>), StatusCodes.Status200OK)]
-    public async Task<IActionResult> List([FromQuery] PageQuery query, [FromQuery] bool tree, CancellationToken ct)
-        => tree ? Ok(await _categories.GetTreeAsync(ct)) : Ok(await _categories.ListAsync(query, ct));
+    public async Task<ActionResult<PagedResponse<CategoryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _categories.ListAsync(query, status, ct));
+
+    [HttpGet("{categoryId:int}")]
+    [ProducesResponseType(typeof(CategoryDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<CategoryDto>> GetById(int categoryId, CancellationToken ct)
+    {
+        var result = await _categories.GetAsync(categoryId, ct);
+        if (result is null) return NotFound();
+
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }

    [HttpPost]
    [ProducesResponseType(typeof(CategoryDto), StatusCodes.Status201Created)]
-    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
    public async Task<ActionResult<CategoryDto>> Create([FromBody] CreateCategoryRequest request, CancellationToken ct)
    {
-        var dto = await _categories.CreateAsync(request, ct);
-        return Created($"/api/v1/categories/{dto.CategoryId}", dto);
+        var result = await _categories.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/categories/{result.Value.CategoryId}", result.Value);
+    }
+
+    [HttpPut("{categoryId:int}")]
+    [ProducesResponseType(typeof(CategoryDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<CategoryDto>> Update(
+        int categoryId, [FromBody] UpdateCategoryRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _categories.UpdateAsync(categoryId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Deactivate/reactivate. Masters are never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{categoryId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(
+        int categoryId, [FromBody] UpdateCategoryStatusRequest request, CancellationToken ct)
+    {
+        await _categories.SetStatusAsync(categoryId, request.Status, ct);
+        return NoContent();
+    }
+
+    // Subcategories — nested under their parent category (docs/11 §2.3).
+    // Updates live on SubCategoriesController at /api/v1/subcategories/{id}.
+
+    [HttpGet("{categoryId:int}/subcategories")]
+    [ProducesResponseType(typeof(PagedResponse<SubCategoryDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PagedResponse<SubCategoryDto>>> ListSubCategories(
+        int categoryId, [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _categories.ListSubCategoriesAsync(categoryId, query, status, ct));
+
+    [HttpPost("{categoryId:int}/subcategories")]
+    [ProducesResponseType(typeof(SubCategoryDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<SubCategoryDto>> CreateSubCategory(
+        int categoryId, [FromBody] CreateSubCategoryRequest request, CancellationToken ct)
+    {
+        var result = await _categories.CreateSubCategoryAsync(categoryId, request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/subcategories/{result.Value.SubCategoryId}", result.Value);
    }
 }
@@ -0,0 +1,20 @@
+using ERPCore.Dtos.Dashboard;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Dashboard overview stats — cross-domain counts, not a stored entity.</summary>
+[Route("api/v1/dashboard")]
+public sealed class DashboardController : ApiControllerBase
+{
+    private readonly IDashboardService _dashboard;
+
+    public DashboardController(IDashboardService dashboard) => _dashboard = dashboard;
+
+    /// <summary>Aggregate counts for stock, GRN, and procurement.</summary>
+    [HttpGet("stats")]
+    [ProducesResponseType(typeof(DashboardStatsDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<DashboardStatsDto>> GetStats(CancellationToken ct)
+        => Ok(await _dashboard.GetStatsAsync(ct));
+}
@@ -0,0 +1,62 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Grn;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Goods-receipt endpoints (docs/11 §4).</summary>
+[Route("api/v1/grns")]
+public sealed class GrnsController : ApiControllerBase
+{
+    private readonly IGrnService _grns;
+
+    public GrnsController(IGrnService grns) => _grns = grns;
+
+    /// <summary>List GRNs, newest first.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<GrnSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<GrnSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] GrnStatus? status, [FromQuery] int? poId,
+        [FromQuery] int? vendorId, [FromQuery] int? warehouseId, CancellationToken ct)
+        => Ok(await _grns.ListAsync(query, status, poId, vendorId, warehouseId, ct));
+
+    [HttpGet("{grnId:int}")]
+    [ProducesResponseType(typeof(GrnDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<GrnDto>> GetById(int grnId, CancellationToken ct)
+    {
+        var dto = await _grns.GetAsync(grnId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    /// <summary>Create a Draft GRN against a PO or direct. Cost is PO-derived for PO lines.</summary>
+    [HttpPost]
+    [ProducesResponseType(typeof(GrnDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<GrnDto>> Create([FromBody] CreateGrnRequest request, CancellationToken ct)
+    {
+        var dto = await _grns.CreateAsync(request, ct);
+        return Created($"/api/v1/grns/{dto.GrnId}", dto);
+    }
+
+    /// <summary>Confirm: create FIFO layers + inbound ledger + update PO receipts (single UoW txn).</summary>
+    [HttpPost("{grnId:int}/confirm")]
+    [ProducesResponseType(typeof(GrnConfirmResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<GrnConfirmResultDto>> Confirm(
+        int grnId, [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey, CancellationToken ct)
+        => Ok(await _grns.ConfirmAsync(grnId, idempotencyKey, ct));
+
+    /// <summary>Release or reject an inspection-hold line (FR-GRN-05).</summary>
+    [HttpPost("{grnId:int}/lines/{grnLineId:int}/release")]
+    [ProducesResponseType(typeof(ReleaseLineResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ReleaseLineResultDto>> Release(
+        int grnId, int grnLineId, [FromBody] ReleaseLineRequest request, CancellationToken ct)
+        => Ok(await _grns.ReleaseLineAsync(grnId, grnLineId, request.Action, ct));
+}
@@ -0,0 +1,99 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Attendance upload batch endpoints (docs/13-BACKEND-HRM-API.md §4).</summary>
+[Route("api/v1/attendance-batches")]
+public sealed class AttendanceBatchesController : ApiControllerBase
+{
+    private readonly IAttendanceUploadService _attendance;
+    private readonly ICurrentUser _currentUser;
+
+    public AttendanceBatchesController(IAttendanceUploadService attendance, ICurrentUser currentUser)
+    {
+        _attendance = attendance;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet("template.xlsx")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public IActionResult DownloadTemplate([FromQuery] string? format)
+    {
+        var (content, contentType, fileName) = _attendance.GenerateTemplate(string.Equals(format, "csv", StringComparison.OrdinalIgnoreCase));
+        return File(content, contentType, fileName);
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<AttendanceUploadBatchDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<AttendanceUploadBatchDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] AttendanceBatchStatus? status,
+        [FromQuery] int? periodYear, [FromQuery] int? periodMonth, CancellationToken ct)
+        => Ok(await _attendance.ListBatchesAsync(query, status, periodYear, periodMonth, ct));
+
+    [HttpGet("{batchId:int}")]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> GetById(int batchId, CancellationToken ct)
+    {
+        var result = await _attendance.GetBatchAsync(batchId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost]
+    [RequestSizeLimit(20 * 1024 * 1024)]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> Upload(
+        [FromForm] UploadAttendanceBatchMetadata metadata, IFormFile file, CancellationToken ct)
+    {
+        await using var stream = file.OpenReadStream();
+        var result = await _attendance.UploadAsync(stream, file.FileName, metadata.PeriodStart, metadata.PeriodEnd, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/attendance-batches/{result.AttendanceUploadBatchId}", result);
+    }
+
+    [HttpGet("{batchId:int}/records")]
+    [ProducesResponseType(typeof(List<AttendanceRecordDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<AttendanceRecordDto>>> ListRecords(
+        int batchId, [FromQuery] RowValidationStatus? status, CancellationToken ct)
+        => Ok(await _attendance.ListRecordsAsync(batchId, status, ct));
+
+    [HttpPut("{batchId:int}/records/{recordId:int}")]
+    [ProducesResponseType(typeof(AttendanceRecordDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AttendanceRecordDto>> UpdateRecord(
+        int batchId, int recordId, [FromBody] UpdateAttendanceRecordRequest request, CancellationToken ct)
+        => Ok(await _attendance.UpdateRecordAsync(batchId, recordId, request, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{batchId:int}/resolve-duplicate")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> ResolveDuplicate(int batchId, [FromBody] ResolveDuplicateRequest request, CancellationToken ct)
+    {
+        await _attendance.ResolveDuplicateAsync(batchId, request, ct);
+        return NoContent();
+    }
+
+    [HttpPost("{batchId:int}/validate")]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> Validate(int batchId, CancellationToken ct)
+        => Ok(await _attendance.ValidateAsync(batchId, ct));
+
+    [HttpPost("{batchId:int}/confirm")]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> Confirm(int batchId, CancellationToken ct)
+        => Ok(await _attendance.ConfirmAsync(batchId, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{batchId:int}/unlock")]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> Unlock(int batchId, [FromBody] UnlockAttendanceBatchRequest request, CancellationToken ct)
+        => Ok(await _attendance.UnlockAsync(batchId, request.Reason, _currentUser.AuditUserId, ct));
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Branch master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/branches")]
+public sealed class BranchesController : ApiControllerBase
+{
+    private readonly IBranchService _branches;
+
+    public BranchesController(IBranchService branches) => _branches = branches;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<BranchDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<BranchDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _branches.ListAsync(query, status, ct));
+
+    [HttpGet("{branchId:int}")]
+    [ProducesResponseType(typeof(BranchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<BranchDto>> GetById(int branchId, CancellationToken ct)
+    {
+        var result = await _branches.GetAsync(branchId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(BranchDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<BranchDto>> Create([FromBody] CreateBranchRequest request, CancellationToken ct)
+    {
+        var result = await _branches.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/branches/{result.Value.BranchId}", result.Value);
+    }
+
+    [HttpPut("{branchId:int}")]
+    [ProducesResponseType(typeof(BranchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<BranchDto>> Update(int branchId, [FromBody] UpdateBranchRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _branches.UpdateAsync(branchId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{branchId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int branchId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _branches.SetStatusAsync(branchId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,65 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Department master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/departments")]
+public sealed class DepartmentsController : ApiControllerBase
+{
+    private readonly IDepartmentService _departments;
+
+    public DepartmentsController(IDepartmentService departments) => _departments = departments;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<DepartmentDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<DepartmentDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _departments.ListAsync(query, status, ct));
+
+    [HttpGet("{departmentId:int}")]
+    [ProducesResponseType(typeof(DepartmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<DepartmentDto>> GetById(int departmentId, CancellationToken ct)
+    {
+        var result = await _departments.GetAsync(departmentId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(DepartmentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<DepartmentDto>> Create([FromBody] CreateDepartmentRequest request, CancellationToken ct)
+    {
+        var result = await _departments.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/departments/{result.Value.DepartmentId}", result.Value);
+    }
+
+    [HttpPut("{departmentId:int}")]
+    [ProducesResponseType(typeof(DepartmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<DepartmentDto>> Update(int departmentId, [FromBody] UpdateDepartmentRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _departments.UpdateAsync(departmentId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{departmentId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int departmentId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _departments.SetStatusAsync(departmentId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Designation (job title) master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/designations")]
+public sealed class DesignationsController : ApiControllerBase
+{
+    private readonly IDesignationService _designations;
+
+    public DesignationsController(IDesignationService designations) => _designations = designations;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<DesignationDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<DesignationDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _designations.ListAsync(query, status, ct));
+
+    [HttpGet("{designationId:int}")]
+    [ProducesResponseType(typeof(DesignationDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<DesignationDto>> GetById(int designationId, CancellationToken ct)
+    {
+        var result = await _designations.GetAsync(designationId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(DesignationDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<DesignationDto>> Create([FromBody] CreateDesignationRequest request, CancellationToken ct)
+    {
+        var result = await _designations.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/designations/{result.Value.DesignationId}", result.Value);
+    }
+
+    [HttpPut("{designationId:int}")]
+    [ProducesResponseType(typeof(DesignationDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<DesignationDto>> Update(int designationId, [FromBody] UpdateDesignationRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _designations.UpdateAsync(designationId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{designationId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int designationId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _designations.SetStatusAsync(designationId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,217 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>
+/// Employee (staff) endpoints, incl. the Employee&lt;-&gt;User cross-link and staff
+/// document sub-resources (docs/13-BACKEND-HRM-API.md §3).
+/// </summary>
+[Route("api/v1/employees")]
+public sealed class EmployeesController : ApiControllerBase
+{
+    private readonly IEmployeeService _employees;
+    private readonly IEmployeeUserLinkService _links;
+    private readonly IEmployeeDocumentService _documents;
+    private readonly ILeaveBalanceService _leaveBalances;
+    private readonly IEmployeeSalaryStructureService _salaryStructures;
+    private readonly IEmployeeLoanService _loans;
+    private readonly ICurrentUser _currentUser;
+
+    public EmployeesController(
+        IEmployeeService employees, IEmployeeUserLinkService links, IEmployeeDocumentService documents,
+        ILeaveBalanceService leaveBalances, IEmployeeSalaryStructureService salaryStructures,
+        IEmployeeLoanService loans, ICurrentUser currentUser)
+    {
+        _employees = employees;
+        _links = links;
+        _documents = documents;
+        _leaveBalances = leaveBalances;
+        _salaryStructures = salaryStructures;
+        _loans = loans;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<EmployeeListItemDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<EmployeeListItemDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EmployeeStatus? status,
+        [FromQuery] int? departmentId, [FromQuery] int? designationId, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _employees.ListAsync(query, status, departmentId, designationId, branchId, ct));
+
+    /// <summary>Advisory reverse-direction lookup: does a System User already exist with this email? (docs/12-BACKEND-HRM.md A.5)</summary>
+    [HttpGet("email-lookup")]
+    [ProducesResponseType(typeof(UserMatchResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<UserMatchResponse>> EmailLookup([FromQuery] string email, CancellationToken ct)
+        => Ok(new UserMatchResponse(await _links.FindUserCandidateByEmailAsync(email, ct)));
+
+    [HttpGet("{employeeId:int}")]
+    [ProducesResponseType(typeof(EmployeeDetailDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<EmployeeDetailDto>> GetById(int employeeId, CancellationToken ct)
+    {
+        var result = await _employees.GetAsync(employeeId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(EmployeeDetailDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<EmployeeDetailDto>> Create([FromBody] CreateEmployeeRequest request, CancellationToken ct)
+    {
+        var result = await _employees.CreateAsync(request, _currentUser.AuditUserId, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/employees/{result.Value.EmployeeId}", result.Value);
+    }
+
+    [HttpPut("{employeeId:int}")]
+    [ProducesResponseType(typeof(EmployeeDetailDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<EmployeeDetailDto>> Update(int employeeId, [FromBody] UpdateEmployeeRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _employees.UpdateAsync(employeeId, request, expected, _currentUser.AuditUserId, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Never a hard delete — Employee is retained forever (docs/12-BACKEND-HRM.md C.2).</summary>
+    [HttpPatch("{employeeId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int employeeId, [FromBody] UpdateEmployeeStatusRequest request, CancellationToken ct)
+    {
+        await _employees.SetStatusAsync(employeeId, request.Status, ct);
+        return NoContent();
+    }
+
+    [HttpPost("{employeeId:int}/link-user")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> LinkUser(int employeeId, [FromBody] LinkUserRequest request, CancellationToken ct)
+    {
+        await _links.LinkAsync(employeeId, request.UserId, ct);
+        return NoContent();
+    }
+
+    [HttpDelete("{employeeId:int}/link-user")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> UnlinkUser(int employeeId, CancellationToken ct)
+    {
+        await _links.UnlinkAsync(employeeId, ct);
+        return NoContent();
+    }
+
+    [HttpGet("{employeeId:int}/bank-details")]
+    [ProducesResponseType(typeof(List<EmployeeBankDetailDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<EmployeeBankDetailDto>>> ListBankDetails(int employeeId, CancellationToken ct)
+        => Ok(await _employees.ListBankDetailsAsync(employeeId, ct));
+
+    [HttpPut("{employeeId:int}/bank-details")]
+    [ProducesResponseType(typeof(List<EmployeeBankDetailDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<List<EmployeeBankDetailDto>>> ReplaceBankDetails(
+        int employeeId, [FromBody] ReplaceEmployeeBankDetailsRequest request, CancellationToken ct)
+        => Ok(await _employees.ReplaceBankDetailsAsync(employeeId, request, ct));
+
+    [HttpGet("{employeeId:int}/leave-balances")]
+    [ProducesResponseType(typeof(List<LeaveBalanceDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<LeaveBalanceDto>>> ListLeaveBalances(int employeeId, [FromQuery] int? year, CancellationToken ct)
+        => Ok(await _leaveBalances.ListAsync(employeeId, year, ct));
+
+    [HttpPut("{employeeId:int}/leave-balances")]
+    [ProducesResponseType(typeof(List<LeaveBalanceDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<List<LeaveBalanceDto>>> UpdateLeaveBalances(
+        int employeeId, [FromBody] UpdateLeaveBalancesRequest request, CancellationToken ct)
+        => Ok(await _leaveBalances.ApplyAdjustmentsAsync(employeeId, request, ct));
+
+    [HttpGet("{employeeId:int}/salary-structure")]
+    [ProducesResponseType(typeof(List<EmployeeSalaryStructureDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<EmployeeSalaryStructureDto>>> GetSalaryStructureHistory(int employeeId, CancellationToken ct)
+        => Ok(await _salaryStructures.ListHistoryAsync(employeeId, ct));
+
+    [HttpPost("{employeeId:int}/salary-structure")]
+    [ProducesResponseType(typeof(EmployeeSalaryStructureDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<EmployeeSalaryStructureDto>> CreateSalaryStructure(
+        int employeeId, [FromBody] CreateSalaryStructureRequest request, CancellationToken ct)
+    {
+        var result = await _salaryStructures.CreateAsync(employeeId, request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/employees/{employeeId}/salary-structure", result);
+    }
+
+    [HttpGet("{employeeId:int}/loans")]
+    [ProducesResponseType(typeof(List<EmployeeLoanDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<EmployeeLoanDto>>> ListLoans(int employeeId, CancellationToken ct)
+        => Ok(await _loans.ListAsync(employeeId, ct));
+
+    [HttpGet("{employeeId:int}/loans/{loanId:int}")]
+    [ProducesResponseType(typeof(EmployeeLoanDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<EmployeeLoanDto>> GetLoan(int employeeId, int loanId, CancellationToken ct)
+    {
+        var result = await _loans.GetAsync(employeeId, loanId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost("{employeeId:int}/loans")]
+    [ProducesResponseType(typeof(EmployeeLoanDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<EmployeeLoanDto>> CreateLoan(int employeeId, [FromBody] CreateEmployeeLoanRequest request, CancellationToken ct)
+    {
+        var result = await _loans.CreateAsync(employeeId, request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/employees/{employeeId}/loans/{result.EmployeeLoanId}", result);
+    }
+
+    [HttpGet("{employeeId:int}/documents")]
+    [ProducesResponseType(typeof(List<EmployeeDocumentDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<EmployeeDocumentDto>>> ListDocuments(int employeeId, CancellationToken ct)
+        => Ok(await _documents.ListAsync(employeeId, ct));
+
+    [HttpPost("{employeeId:int}/documents")]
+    [RequestSizeLimit(20 * 1024 * 1024)]
+    [ProducesResponseType(typeof(EmployeeDocumentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status413PayloadTooLarge)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<EmployeeDocumentDto>> UploadDocument(
+        int employeeId, [FromForm] UploadEmployeeDocumentRequest request, IFormFile file, CancellationToken ct)
+    {
+        await using var stream = file.OpenReadStream();
+        var result = await _documents.UploadAsync(
+            employeeId, request, stream, file.FileName, file.ContentType, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/employees/{employeeId}/documents/{result.EmployeeDocumentId}", result);
+    }
+
+    [HttpGet("{employeeId:int}/documents/{documentId:int}/download")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> DownloadDocument(int employeeId, int documentId, CancellationToken ct)
+    {
+        var (content, fileName, contentType) = await _documents.DownloadAsync(employeeId, documentId, ct);
+        return File(content, contentType, fileName);
+    }
+
+    [HttpPatch("{employeeId:int}/documents/{documentId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetDocumentStatus(
+        int employeeId, int documentId, [FromBody] UpdateEmployeeDocumentStatusRequest request, CancellationToken ct)
+    {
+        await _documents.SetStatusAsync(employeeId, documentId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>EmploymentType master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/employment-types")]
+public sealed class EmploymentTypesController : ApiControllerBase
+{
+    private readonly IEmploymentTypeService _employmentTypes;
+
+    public EmploymentTypesController(IEmploymentTypeService employmentTypes) => _employmentTypes = employmentTypes;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<EmploymentTypeDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<EmploymentTypeDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _employmentTypes.ListAsync(query, status, ct));
+
+    [HttpGet("{employmentTypeId:int}")]
+    [ProducesResponseType(typeof(EmploymentTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<EmploymentTypeDto>> GetById(int employmentTypeId, CancellationToken ct)
+    {
+        var result = await _employmentTypes.GetAsync(employmentTypeId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(EmploymentTypeDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<EmploymentTypeDto>> Create([FromBody] CreateEmploymentTypeRequest request, CancellationToken ct)
+    {
+        var result = await _employmentTypes.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/employment-types/{result.Value.EmploymentTypeId}", result.Value);
+    }
+
+    [HttpPut("{employmentTypeId:int}")]
+    [ProducesResponseType(typeof(EmploymentTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<EmploymentTypeDto>> Update(int employmentTypeId, [FromBody] UpdateEmploymentTypeRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _employmentTypes.UpdateAsync(employmentTypeId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{employmentTypeId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int employmentTypeId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _employmentTypes.SetStatusAsync(employmentTypeId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Staff document-type catalog ("DocType") endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/hr-document-types")]
+public sealed class HrDocumentTypesController : ApiControllerBase
+{
+    private readonly IHrDocumentTypeService _types;
+
+    public HrDocumentTypesController(IHrDocumentTypeService types) => _types = types;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<HrDocumentTypeDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<HrDocumentTypeDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _types.ListAsync(query, status, ct));
+
+    [HttpGet("{hrDocumentTypeId:int}")]
+    [ProducesResponseType(typeof(HrDocumentTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<HrDocumentTypeDto>> GetById(int hrDocumentTypeId, CancellationToken ct)
+    {
+        var result = await _types.GetAsync(hrDocumentTypeId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(HrDocumentTypeDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<HrDocumentTypeDto>> Create([FromBody] CreateHrDocumentTypeRequest request, CancellationToken ct)
+    {
+        var result = await _types.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/hr-document-types/{result.Value.HrDocumentTypeId}", result.Value);
+    }
+
+    [HttpPut("{hrDocumentTypeId:int}")]
+    [ProducesResponseType(typeof(HrDocumentTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<HrDocumentTypeDto>> Update(int hrDocumentTypeId, [FromBody] UpdateHrDocumentTypeRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _types.UpdateAsync(hrDocumentTypeId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{hrDocumentTypeId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int hrDocumentTypeId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _types.SetStatusAsync(hrDocumentTypeId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,52 @@
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Read-only HRM reports (FR-HR-RPT, docs/13-BACKEND-HRM-API.md §6). No new entities — aggregation over existing tables.</summary>
+[Route("api/v1/reports/hrm")]
+public sealed class HrReportsController : ApiControllerBase
+{
+    private readonly IHrReportService _reports;
+
+    public HrReportsController(IHrReportService reports) => _reports = reports;
+
+    [HttpGet("attendance-summary")]
+    [ProducesResponseType(typeof(List<AttendanceSummaryRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<AttendanceSummaryRowDto>>> AttendanceSummary(
+        [FromQuery] int periodYear, [FromQuery] int periodMonth, [FromQuery] int? departmentId, CancellationToken ct)
+        => Ok(await _reports.AttendanceSummaryAsync(periodYear, periodMonth, departmentId, ct));
+
+    [HttpGet("overtime")]
+    [ProducesResponseType(typeof(List<OvertimeReportRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<OvertimeReportRowDto>>> Overtime(
+        [FromQuery] int periodYear, [FromQuery] int periodMonth, CancellationToken ct)
+        => Ok(await _reports.OvertimeReportAsync(periodYear, periodMonth, ct));
+
+    [HttpGet("late-arrivals")]
+    [ProducesResponseType(typeof(List<LateArrivalReportRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<LateArrivalReportRowDto>>> LateArrivals(
+        [FromQuery] int periodYear, [FromQuery] int periodMonth, CancellationToken ct)
+        => Ok(await _reports.LateArrivalReportAsync(periodYear, periodMonth, ct));
+
+    [HttpGet("payroll-register")]
+    [ProducesResponseType(typeof(List<PayrollRegisterRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<PayrollRegisterRowDto>>> PayrollRegister([FromQuery] int payrollRunId, CancellationToken ct)
+        => Ok(await _reports.PayrollRegisterAsync(payrollRunId, ct));
+
+    [HttpGet("salary-history")]
+    [ProducesResponseType(typeof(List<SalaryHistoryRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<SalaryHistoryRowDto>>> SalaryHistory([FromQuery] int employeeId, CancellationToken ct)
+        => Ok(await _reports.SalaryHistoryAsync(employeeId, ct));
+
+    [HttpGet("leave-balances")]
+    [ProducesResponseType(typeof(List<LeaveBalanceReportRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<LeaveBalanceReportRowDto>>> LeaveBalances([FromQuery] int year, CancellationToken ct)
+        => Ok(await _reports.LeaveBalanceReportAsync(year, ct));
+
+    [HttpGet("document-expiry")]
+    [ProducesResponseType(typeof(List<DocumentExpiryReportRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<DocumentExpiryReportRowDto>>> DocumentExpiry([FromQuery] int withinDays, CancellationToken ct)
+        => Ok(await _reports.DocumentExpiryReportAsync(withinDays, ct));
+}
@@ -0,0 +1,71 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Leave request endpoints (docs/13-BACKEND-HRM-API.md §5).</summary>
+[Route("api/v1/leave-requests")]
+public sealed class LeaveRequestsController : ApiControllerBase
+{
+    private readonly ILeaveRequestService _requests;
+    private readonly ICurrentUser _currentUser;
+
+    public LeaveRequestsController(ILeaveRequestService requests, ICurrentUser currentUser)
+    {
+        _requests = requests;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<LeaveRequestDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<LeaveRequestDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] int? employeeId, [FromQuery] LeaveRequestStatus? status, CancellationToken ct)
+        => Ok(await _requests.ListAsync(query, employeeId, status, ct));
+
+    [HttpGet("{leaveRequestId:int}")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<LeaveRequestDto>> GetById(int leaveRequestId, CancellationToken ct)
+    {
+        var result = await _requests.GetAsync(leaveRequestId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<LeaveRequestDto>> Create([FromBody] CreateLeaveRequestRequest request, CancellationToken ct)
+    {
+        var result = await _requests.CreateAsync(request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/leave-requests/{result.LeaveRequestId}", result);
+    }
+
+    [HttpPost("{leaveRequestId:int}/submit")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveRequestDto>> Submit(int leaveRequestId, CancellationToken ct)
+        => Ok(await _requests.SubmitAsync(leaveRequestId, ct));
+
+    [HttpPost("{leaveRequestId:int}/approve")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveRequestDto>> Approve(int leaveRequestId, CancellationToken ct)
+        => Ok(await _requests.ApproveAsync(leaveRequestId, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{leaveRequestId:int}/reject")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveRequestDto>> Reject(int leaveRequestId, [FromBody] RejectLeaveRequestRequest request, CancellationToken ct)
+        => Ok(await _requests.RejectAsync(leaveRequestId, request.Reason, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{leaveRequestId:int}/cancel")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveRequestDto>> Cancel(int leaveRequestId, CancellationToken ct)
+        => Ok(await _requests.CancelAsync(leaveRequestId, ct));
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Leave type master endpoints (docs/13-BACKEND-HRM-API.md §5).</summary>
+[Route("api/v1/leave-types")]
+public sealed class LeaveTypesController : ApiControllerBase
+{
+    private readonly ILeaveTypeService _leaveTypes;
+
+    public LeaveTypesController(ILeaveTypeService leaveTypes) => _leaveTypes = leaveTypes;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<LeaveTypeDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<LeaveTypeDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _leaveTypes.ListAsync(query, status, ct));
+
+    [HttpGet("{leaveTypeId:int}")]
+    [ProducesResponseType(typeof(LeaveTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<LeaveTypeDto>> GetById(int leaveTypeId, CancellationToken ct)
+    {
+        var result = await _leaveTypes.GetAsync(leaveTypeId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(LeaveTypeDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveTypeDto>> Create([FromBody] CreateLeaveTypeRequest request, CancellationToken ct)
+    {
+        var result = await _leaveTypes.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/leave-types/{result.Value.LeaveTypeId}", result.Value);
+    }
+
+    [HttpPut("{leaveTypeId:int}")]
+    [ProducesResponseType(typeof(LeaveTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<LeaveTypeDto>> Update(int leaveTypeId, [FromBody] UpdateLeaveTypeRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _leaveTypes.UpdateAsync(leaveTypeId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{leaveTypeId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int leaveTypeId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _leaveTypes.SetStatusAsync(leaveTypeId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,85 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Payroll run endpoints (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/payroll-runs")]
+public sealed class PayrollRunsController : ApiControllerBase
+{
+    private readonly IPayrollRunService _payrollRuns;
+    private readonly ICurrentUser _currentUser;
+
+    public PayrollRunsController(IPayrollRunService payrollRuns, ICurrentUser currentUser)
+    {
+        _payrollRuns = payrollRuns;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<PayrollRunDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<PayrollRunDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] int? periodYear, [FromQuery] int? periodMonth,
+        [FromQuery] PayrollRunStatus? status, CancellationToken ct)
+        => Ok(await _payrollRuns.ListAsync(query, periodYear, periodMonth, status, ct));
+
+    [HttpGet("{payrollRunId:int}")]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PayrollRunDto>> GetById(int payrollRunId, CancellationToken ct)
+    {
+        var result = await _payrollRuns.GetAsync(payrollRunId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpGet("{payrollRunId:int}/lines")]
+    [ProducesResponseType(typeof(List<PayrollLineDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<PayrollLineDto>>> ListLines(int payrollRunId, CancellationToken ct)
+        => Ok(await _payrollRuns.ListLinesAsync(payrollRunId, ct));
+
+    [HttpGet("{payrollRunId:int}/lines/{lineId:int}")]
+    [ProducesResponseType(typeof(PayrollLineDetailDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PayrollLineDetailDto>> GetLine(int payrollRunId, int lineId, CancellationToken ct)
+    {
+        var result = await _payrollRuns.GetLineAsync(payrollRunId, lineId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<PayrollRunDto>> Generate([FromBody] GeneratePayrollRunRequest request, CancellationToken ct)
+    {
+        var result = await _payrollRuns.GenerateAsync(request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/payroll-runs/{result.PayrollRunId}", result);
+    }
+
+    [HttpPost("{payrollRunId:int}/approve")]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PayrollRunDto>> Approve(int payrollRunId, CancellationToken ct)
+        => Ok(await _payrollRuns.ApproveAsync(payrollRunId, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{payrollRunId:int}/lock")]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PayrollRunDto>> Lock(int payrollRunId, CancellationToken ct)
+        => Ok(await _payrollRuns.LockAsync(payrollRunId, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{payrollRunId:int}/unlock")]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PayrollRunDto>> Unlock(int payrollRunId, [FromBody] UnlockPayrollRunRequest request, CancellationToken ct)
+        => Ok(await _payrollRuns.UnlockAsync(payrollRunId, request.Reason, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{payrollRunId:int}/generate-payslips")]
+    [ProducesResponseType(typeof(List<PayslipDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<List<PayslipDto>>> GeneratePayslips(int payrollRunId, CancellationToken ct)
+        => Ok(await _payrollRuns.GeneratePayslipsAsync(payrollRunId, ct));
+}
@@ -0,0 +1,33 @@
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Effective-dated EPF/ETF settings (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/payroll-statutory-settings")]
+public sealed class PayrollStatutorySettingsController : ApiControllerBase
+{
+    private readonly IPayrollStatutorySettingService _settings;
+    private readonly ICurrentUser _currentUser;
+
+    public PayrollStatutorySettingsController(IPayrollStatutorySettingService settings, ICurrentUser currentUser)
+    {
+        _settings = settings;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(List<PayrollStatutorySettingDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<PayrollStatutorySettingDto>>> List(CancellationToken ct)
+        => Ok(await _settings.ListAsync(ct));
+
+    [HttpPost]
+    [ProducesResponseType(typeof(PayrollStatutorySettingDto), StatusCodes.Status201Created)]
+    public async Task<ActionResult<PayrollStatutorySettingDto>> Create([FromBody] UpsertPayrollStatutorySettingRequest request, CancellationToken ct)
+    {
+        var result = await _settings.CreateAsync(request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/payroll-statutory-settings/{result.PayrollStatutorySettingId}", result);
+    }
+}
@@ -0,0 +1,32 @@
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Payslip retrieval + HTML print view (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/payslips")]
+public sealed class PayslipsController : ApiControllerBase
+{
+    private readonly IPayslipService _payslips;
+
+    public PayslipsController(IPayslipService payslips) => _payslips = payslips;
+
+    [HttpGet("{payslipId:int}")]
+    [ProducesResponseType(typeof(PayslipDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PayslipDto>> GetById(int payslipId, CancellationToken ct)
+    {
+        var result = await _payslips.GetAsync(payslipId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpGet("{payslipId:int}/view")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> View(int payslipId, CancellationToken ct)
+    {
+        var html = await _payslips.RenderHtmlAsync(payslipId, ct);
+        return html is null ? NotFound() : Content(html, "text/html");
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>SalaryComponent master endpoints (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/salary-components")]
+public sealed class SalaryComponentsController : ApiControllerBase
+{
+    private readonly ISalaryComponentService _components;
+
+    public SalaryComponentsController(ISalaryComponentService components) => _components = components;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<SalaryComponentDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<SalaryComponentDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _components.ListAsync(query, status, ct));
+
+    [HttpGet("{salaryComponentId:int}")]
+    [ProducesResponseType(typeof(SalaryComponentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SalaryComponentDto>> GetById(int salaryComponentId, CancellationToken ct)
+    {
+        var result = await _components.GetAsync(salaryComponentId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(SalaryComponentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<SalaryComponentDto>> Create([FromBody] CreateSalaryComponentRequest request, CancellationToken ct)
+    {
+        var result = await _components.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/salary-components/{result.Value.SalaryComponentId}", result.Value);
+    }
+
+    [HttpPut("{salaryComponentId:int}")]
+    [ProducesResponseType(typeof(SalaryComponentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SalaryComponentDto>> Update(int salaryComponentId, [FromBody] UpdateSalaryComponentRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _components.UpdateAsync(salaryComponentId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{salaryComponentId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int salaryComponentId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _components.SetStatusAsync(salaryComponentId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,28 @@
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Configurable APIT-style tax slabs (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/tax-slabs")]
+public sealed class TaxSlabsController : ApiControllerBase
+{
+    private readonly ITaxSlabService _taxSlabs;
+
+    public TaxSlabsController(ITaxSlabService taxSlabs) => _taxSlabs = taxSlabs;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(List<TaxSlabDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<TaxSlabDto>>> List(CancellationToken ct)
+        => Ok(await _taxSlabs.ListAsync(ct));
+
+    [HttpPost]
+    [ProducesResponseType(typeof(TaxSlabDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<TaxSlabDto>> Create([FromBody] CreateTaxSlabRequest request, CancellationToken ct)
+    {
+        var result = await _taxSlabs.CreateAsync(request, ct);
+        return Created($"/api/v1/tax-slabs/{result.TaxSlabId}", result);
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>WorkShift master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/work-shifts")]
+public sealed class WorkShiftsController : ApiControllerBase
+{
+    private readonly IWorkShiftService _shifts;
+
+    public WorkShiftsController(IWorkShiftService shifts) => _shifts = shifts;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<WorkShiftDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<WorkShiftDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _shifts.ListAsync(query, status, ct));
+
+    [HttpGet("{workShiftId:int}")]
+    [ProducesResponseType(typeof(WorkShiftDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<WorkShiftDto>> GetById(int workShiftId, CancellationToken ct)
+    {
+        var result = await _shifts.GetAsync(workShiftId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(WorkShiftDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<WorkShiftDto>> Create([FromBody] CreateWorkShiftRequest request, CancellationToken ct)
+    {
+        var result = await _shifts.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/work-shifts/{result.Value.WorkShiftId}", result.Value);
+    }
+
+    [HttpPut("{workShiftId:int}")]
+    [ProducesResponseType(typeof(WorkShiftDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<WorkShiftDto>> Update(int workShiftId, [FromBody] UpdateWorkShiftRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _shifts.UpdateAsync(workShiftId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{workShiftId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int workShiftId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _shifts.SetStatusAsync(workShiftId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,73 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.ItemTypes;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Item type master endpoints (docs/11-BACKEND-PHASE1.md §2.7) — the Color/Size/Material
+/// dimension names. <c>GET</c> is the reason this master exists: it populates the item
+/// builder's dropdown. Items never reference an item type; the chosen values are encoded
+/// into the client-generated SKU (docs/10 Part C.9).
+/// </summary>
+[Route("api/v1/item-types")]
+public sealed class ItemTypesController : ApiControllerBase
+{
+    private readonly IItemTypeService _itemTypes;
+
+    public ItemTypesController(IItemTypeService itemTypes) => _itemTypes = itemTypes;
+
+    /// <summary>Feeds the frontend item-builder dropdown; filter <c>status=Active</c> for selectable rows.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<ItemTypeDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<ItemTypeDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _itemTypes.ListAsync(query, status, ct));
+
+    [HttpGet("{itemTypeId:int}")]
+    [ProducesResponseType(typeof(ItemTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ItemTypeDto>> GetById(int itemTypeId, CancellationToken ct)
+    {
+        var result = await _itemTypes.GetAsync(itemTypeId, ct);
+        if (result is null) return NotFound();
+
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(ItemTypeDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ItemTypeDto>> Create([FromBody] CreateItemTypeRequest request, CancellationToken ct)
+    {
+        var result = await _itemTypes.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/item-types/{result.Value.ItemTypeId}", result.Value);
+    }
+
+    [HttpPut("{itemTypeId:int}")]
+    [ProducesResponseType(typeof(ItemTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<ItemTypeDto>> Update(int itemTypeId, [FromBody] UpdateItemTypeRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _itemTypes.UpdateAsync(itemTypeId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Deactivate/reactivate. Masters are never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{itemTypeId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int itemTypeId, [FromBody] UpdateItemTypeStatusRequest request, CancellationToken ct)
+    {
+        await _itemTypes.SetStatusAsync(itemTypeId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -20,16 +20,18 @@ public sealed class ItemsController : ApiControllerBase
    public async Task<ActionResult<PagedResponse<ItemListItemDto>>> List(
        [FromQuery] PageQuery query,
        [FromQuery] EntityStatus? status,
-        [FromQuery] long? categoryId,
+        [FromQuery] int? categoryId,
+        [FromQuery] int? subCategoryId,
+        [FromQuery] int? brandId,
        [FromQuery] TrackingMode? trackingMode,
        CancellationToken ct)
-        => Ok(await _items.ListAsync(query, status, categoryId, trackingMode, ct));
+        => Ok(await _items.ListAsync(query, status, categoryId, subCategoryId, brandId, trackingMode, ct));

    /// <summary>Get a single item; returns an <c>ETag</c> for optimistic concurrency.</summary>
-    [HttpGet("{itemId:long}")]
+    [HttpGet("{itemId:int}")]
    [ProducesResponseType(typeof(ItemDetailDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<ItemDetailDto>> GetById(long itemId, CancellationToken ct)
+    public async Task<ActionResult<ItemDetailDto>> GetById(int itemId, CancellationToken ct)
    {
        var result = await _items.GetAsync(itemId, ct);
        if (result is null) return NotFound();
@@ -51,11 +53,11 @@ public sealed class ItemsController : ApiControllerBase
    }

    /// <summary>Full update; requires <c>If-Match</c> (412 on stale ETag).</summary>
-    [HttpPut("{itemId:long}")]
+    [HttpPut("{itemId:int}")]
    [ProducesResponseType(typeof(ItemDetailDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
-    public async Task<ActionResult<ItemDetailDto>> Update(long itemId, [FromBody] UpdateItemRequest request, CancellationToken ct)
+    public async Task<ActionResult<ItemDetailDto>> Update(int itemId, [FromBody] UpdateItemRequest request, CancellationToken ct)
    {
        var expected = RequireIfMatch();
        var result = await _items.UpdateAsync(itemId, request, expected, ct);
@@ -64,26 +66,26 @@ public sealed class ItemsController : ApiControllerBase
    }

    /// <summary>Activate / deactivate the item (FR-MD-08 — deactivate, not delete).</summary>
-    [HttpPatch("{itemId:long}/status")]
+    [HttpPatch("{itemId:int}/status")]
    [ProducesResponseType(StatusCodes.Status204NoContent)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> SetStatus(long itemId, [FromBody] UpdateItemStatusRequest request, CancellationToken ct)
+    public async Task<IActionResult> SetStatus(int itemId, [FromBody] UpdateItemStatusRequest request, CancellationToken ct)
    {
        await _items.SetStatusAsync(itemId, request.Status, ct);
        return NoContent();
    }

    /// <summary>Replace the item's per-warehouse reorder settings (FR-MD-05).</summary>
-    [HttpPut("{itemId:long}/reorder")]
+    [HttpPut("{itemId:int}/reorder")]
    [ProducesResponseType(typeof(ItemReorderSettingsDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<ItemReorderSettingsDto>> UpdateReorder(long itemId, [FromBody] UpdateReorderRequest request, CancellationToken ct)
+    public async Task<ActionResult<ItemReorderSettingsDto>> UpdateReorder(int itemId, [FromBody] UpdateReorderRequest request, CancellationToken ct)
        => Ok(await _items.UpdateReorderAsync(itemId, request, ct));

    /// <summary>Replace the item's UOM conversions (FR-MD-02).</summary>
-    [HttpPut("{itemId:long}/uom-conversions")]
+    [HttpPut("{itemId:int}/uom-conversions")]
    [ProducesResponseType(typeof(ItemUomConversionsDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<ItemUomConversionsDto>> UpdateUomConversions(long itemId, [FromBody] UpdateUomConversionsRequest request, CancellationToken ct)
+    public async Task<ActionResult<ItemUomConversionsDto>> UpdateUomConversions(int itemId, [FromBody] UpdateUomConversionsRequest request, CancellationToken ct)
        => Ok(await _items.UpdateUomConversionsAsync(itemId, request, ct));
 }
@@ -0,0 +1,24 @@
+using ERPCore.Dtos.Audit;
+using ERPCore.Dtos.Common;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Read-only GL-ready journal stubs (FR-STK-13; consumed by the Accounting phase).
+/// Data only — no posting in Phase 1.
+/// </summary>
+[Route("api/v1/journal-entries")]
+public sealed class JournalEntriesController : ApiControllerBase
+{
+    private readonly IAuditService _audit;
+
+    public JournalEntriesController(IAuditService audit) => _audit = audit;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<JournalEntryStubDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<JournalEntryStubDto>>> List(
+        [FromQuery] string? sourceDocType, [FromQuery] int? sourceDocId, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _audit.ListJournalAsync(sourceDocType, sourceDocId, query, ct));
+}
@@ -0,0 +1,39 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Dtos.Rbac;
+using ERPCore.Repositories.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Read-only sidebar nav tree, used by the Role permission-assignment checkbox
+/// UI and by `GET /auth/me` (see AuthController) to resolve a role's visible codes.
+/// NavItem/SubNavItem rows are seeded (NavItemConfiguration/SubNavItemConfiguration)
+/// to match the frontend's hardcoded sidebar — not admin-editable in this phase.
+/// </summary>
+[Route("api/v1/nav")]
+public sealed class NavController : ApiControllerBase
+{
+    private readonly IRepository<NavItem> _navItems;
+
+    public NavController(IRepository<NavItem> navItems) => _navItems = navItems;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(List<NavItemDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<NavItemDto>>> GetTree(CancellationToken ct)
+    {
+        var items = await _navItems.Query().AsNoTracking()
+            .Include(n => n.Children)
+            .OrderBy(n => n.SortOrder)
+            .ToListAsync(ct);
+
+        var dto = items.Select(n => new NavItemDto(
+            n.NavItemId, n.Code, n.Label, n.Icon, n.Href, n.SortOrder,
+            n.Children.OrderBy(c => c.SortOrder)
+                .Select(c => new SubNavItemDto(c.SubNavItemId, c.Code, c.Label, c.Icon, c.Href, c.SortOrder))
+                .ToList())).ToList();
+
+        return Ok(dto);
+    }
+}
@@ -0,0 +1,46 @@
+using ERPCore.Dtos.Config;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Product configuration endpoints (docs/11-BACKEND-PHASE1.md §2.8) — the singleton
+/// feature gate for subcategories/brands/item-types.
+/// <para>
+/// <b>Authorization:</b> writes are admitted by the inherited ERP door policy only.
+/// A dedicated <c>CONFIG_MANAGE</c> permission is reserved for when per-endpoint RBAC
+/// lands (FR-X-01, currently deferred) — at that point this action gets the attribute
+/// with no other change. Until then any ERP-admitted user can flip these flags; that is
+/// the accepted Phase-1 posture, consistent with every other endpoint.
+/// </para>
+/// </summary>
+[Route("api/v1/product-config")]
+public sealed class ProductConfigController : ApiControllerBase
+{
+    private readonly IProductConfigService _config;
+
+    public ProductConfigController(IProductConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(ProductConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ProductConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut]
+    [ProducesResponseType(typeof(ProductConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<ProductConfigDto>> Update(
+        [FromBody] UpdateProductConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}
@@ -17,13 +17,13 @@ public sealed class PurchaseOrdersController : ApiControllerBase
    [HttpGet]
    [ProducesResponseType(typeof(PagedResponse<PurchaseOrderSummaryDto>), StatusCodes.Status200OK)]
    public async Task<ActionResult<PagedResponse<PurchaseOrderSummaryDto>>> List(
-        [FromQuery] PageQuery query, [FromQuery] PurchaseOrderStatus? status, [FromQuery] long? vendorId, CancellationToken ct)
+        [FromQuery] PageQuery query, [FromQuery] PurchaseOrderStatus? status, [FromQuery] int? vendorId, CancellationToken ct)
        => Ok(await _pos.ListAsync(query, status, vendorId, ct));

-    [HttpGet("{poId:long}")]
+    [HttpGet("{poId:int}")]
    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<PurchaseOrderDto>> GetById(long poId, CancellationToken ct)
+    public async Task<ActionResult<PurchaseOrderDto>> GetById(int poId, CancellationToken ct)
    {
        var result = await _pos.GetAsync(poId, ct);
        if (result is null) return NotFound();
@@ -44,12 +44,12 @@ public sealed class PurchaseOrdersController : ApiControllerBase
    }

    /// <summary>Edit while open (FR-PROC-05); requires <c>If-Match</c>. 409 PO_NOT_EDITABLE if closed.</summary>
-    [HttpPut("{poId:long}")]
+    [HttpPut("{poId:int}")]
    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
-    public async Task<ActionResult<PurchaseOrderDto>> Update(long poId, [FromBody] UpdatePurchaseOrderRequest request, CancellationToken ct)
+    public async Task<ActionResult<PurchaseOrderDto>> Update(int poId, [FromBody] UpdatePurchaseOrderRequest request, CancellationToken ct)
    {
        var expected = RequireIfMatch();
        var result = await _pos.UpdateAsync(poId, request, expected, ct);
@@ -57,18 +57,37 @@ public sealed class PurchaseOrdersController : ApiControllerBase
        return Ok(result.Value);
    }

-    /// <summary>Approve — no-op in Phase 1 (POs auto-approve); transitions PendingApproval→Approved when enabled.</summary>
-    [HttpPost("{poId:long}/approve")]
-    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<PurchaseOrderDto>> Approve(long poId, CancellationToken ct)
-        => Ok(await _pos.ApproveAsync(poId, ct));
-
-    /// <summary>Cancel — 409 if any goods have been received against the PO.</summary>
-    [HttpPost("{poId:long}/cancel")]
+    /// <summary>Submit a Draft PO (Draft → Approved). 409 PO_NOT_EDITABLE if not Draft.</summary>
+    [HttpPost("{poId:int}/submit")]
    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
-    public async Task<ActionResult<PurchaseOrderDto>> Cancel(long poId, [FromBody] CancelPurchaseOrderRequest request, CancellationToken ct)
+    public async Task<ActionResult<PurchaseOrderDto>> Submit(int poId, CancellationToken ct)
+        => Ok(await _pos.SubmitAsync(poId, ct));
+
+    /// <summary>Delete a PO — permitted only while Draft (409 PO_NOT_EDITABLE otherwise).</summary>
+    [HttpDelete("{poId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int poId, CancellationToken ct)
+    {
+        await _pos.DeleteAsync(poId, ct);
+        return NoContent();
+    }
+
+    /// <summary>Approve — no-op in Phase 1 (POs auto-approve); transitions PendingApproval→Approved when enabled.</summary>
+    [HttpPost("{poId:int}/approve")]
+    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PurchaseOrderDto>> Approve(int poId, CancellationToken ct)
+        => Ok(await _pos.ApproveAsync(poId, ct));
+
+    /// <summary>Cancel — 409 if any goods have been received against the PO.</summary>
+    [HttpPost("{poId:int}/cancel")]
+    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseOrderDto>> Cancel(int poId, [FromBody] CancelPurchaseOrderRequest request, CancellationToken ct)
        => Ok(await _pos.CancelAsync(poId, request.Reason, ct));
 }
@@ -0,0 +1,44 @@
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Procurement;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Purchase-return endpoints (docs/11 §3.4).</summary>
+[Route("api/v1/purchase-returns")]
+public sealed class PurchaseReturnsController : ApiControllerBase
+{
+    private readonly IPurchaseReturnService _returns;
+
+    public PurchaseReturnsController(IPurchaseReturnService returns) => _returns = returns;
+
+    /// <summary>List posted returns, newest first.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<PurchaseReturnSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<PurchaseReturnSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] int? vendorId, [FromQuery] int? warehouseId, CancellationToken ct)
+        => Ok(await _returns.ListAsync(query, vendorId, warehouseId, ct));
+
+    /// <summary>Get one return with its lines and the ledger entries it posted.</summary>
+    [HttpGet("{returnId:int}")]
+    [ProducesResponseType(typeof(PurchaseReturnDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PurchaseReturnDto>> GetById(int returnId, CancellationToken ct)
+    {
+        var dto = await _returns.GetAsync(returnId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    /// <summary>Create + auto-post a return (outbound movement). 409 if return exceeds available stock.</summary>
+    [HttpPost]
+    [ProducesResponseType(typeof(PurchaseReturnDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<PurchaseReturnDto>> Create([FromBody] CreatePurchaseReturnRequest request, CancellationToken ct)
+    {
+        var dto = await _returns.CreateAsync(request, ct);
+        return Created($"/api/v1/purchase-returns/{dto.ReturnId}", dto);
+    }
+}
@@ -0,0 +1,31 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Reference;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Reason-code reference endpoints (docs/11 §6).</summary>
+[Route("api/v1/reason-codes")]
+public sealed class ReasonCodesController : ApiControllerBase
+{
+    private readonly IReasonCodeService _codes;
+
+    public ReasonCodesController(IReasonCodeService codes) => _codes = codes;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<ReasonCodeDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<ReasonCodeDto>>> List(
+        [FromQuery] ReasonContext? context, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _codes.ListAsync(context, query, ct));
+
+    [HttpPost]
+    [ProducesResponseType(typeof(ReasonCodeDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ReasonCodeDto>> Create([FromBody] CreateReasonCodeRequest request, CancellationToken ct)
+    {
+        var dto = await _codes.CreateAsync(request, ct);
+        return Created($"/api/v1/reason-codes/{dto.ReasonCodeId}", dto);
+    }
+}
@@ -1,3 +1,4 @@
+using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
 using ERPCore.Services.Interfaces;
@@ -15,13 +16,14 @@ public sealed class RequisitionsController : ApiControllerBase

    [HttpGet]
    [ProducesResponseType(typeof(PagedResponse<RequisitionSummaryDto>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedResponse<RequisitionSummaryDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _requisitions.ListAsync(query, ct));
+    public async Task<ActionResult<PagedResponse<RequisitionSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] RequisitionStatus? status, CancellationToken ct)
+        => Ok(await _requisitions.ListAsync(query, status, ct));

-    [HttpGet("{requisitionId:long}")]
+    [HttpGet("{requisitionId:int}")]
    [ProducesResponseType(typeof(RequisitionDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<RequisitionDto>> GetById(long requisitionId, CancellationToken ct)
+    public async Task<ActionResult<RequisitionDto>> GetById(int requisitionId, CancellationToken ct)
    {
        var dto = await _requisitions.GetAsync(requisitionId, ct);
        return dto is null ? NotFound() : Ok(dto);
@@ -36,9 +38,9 @@ public sealed class RequisitionsController : ApiControllerBase
        return Created($"/api/v1/requisitions/{dto.RequisitionId}", dto);
    }

-    [HttpPost("{requisitionId:long}/submit")]
+    [HttpPost("{requisitionId:int}/submit")]
    [ProducesResponseType(typeof(RequisitionDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<RequisitionDto>> Submit(long requisitionId, CancellationToken ct)
+    public async Task<ActionResult<RequisitionDto>> Submit(int requisitionId, CancellationToken ct)
        => Ok(await _requisitions.SubmitAsync(requisitionId, ct));
 }
@@ -1,3 +1,5 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -12,10 +14,17 @@ public sealed class RfqsController : ApiControllerBase

    public RfqsController(IRfqService rfqs) => _rfqs = rfqs;

-    [HttpGet("{rfqId:long}")]
+    /// <summary>List RFQs, newest first.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<RfqSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<RfqSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] RfqStatus? status, CancellationToken ct)
+        => Ok(await _rfqs.ListAsync(query, status, ct));
+
+    [HttpGet("{rfqId:int}")]
    [ProducesResponseType(typeof(RfqDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<RfqDto>> GetById(long rfqId, CancellationToken ct)
+    public async Task<ActionResult<RfqDto>> GetById(int rfqId, CancellationToken ct)
    {
        var dto = await _rfqs.GetAsync(rfqId, ct);
        return dto is null ? NotFound() : Ok(dto);
@@ -30,20 +39,20 @@ public sealed class RfqsController : ApiControllerBase
        return Created($"/api/v1/rfqs/{dto.RfqId}", dto);
    }

-    [HttpPost("{rfqId:long}/quotations")]
+    [HttpPost("{rfqId:int}/quotations")]
    [ProducesResponseType(typeof(VendorQuotationDto), StatusCodes.Status201Created)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
-    public async Task<ActionResult<VendorQuotationDto>> AddQuotation(long rfqId, [FromBody] CreateQuotationRequest request, CancellationToken ct)
+    public async Task<ActionResult<VendorQuotationDto>> AddQuotation(int rfqId, [FromBody] CreateQuotationRequest request, CancellationToken ct)
    {
        var dto = await _rfqs.AddQuotationAsync(rfqId, request, ct);
        return Created($"/api/v1/rfqs/{rfqId}/quotations/{dto.QuotationId}", dto);
    }

-    [HttpGet("{rfqId:long}/comparison")]
+    [HttpGet("{rfqId:int}/comparison")]
    [ProducesResponseType(typeof(RfqComparisonDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<RfqComparisonDto>> Comparison(long rfqId, CancellationToken ct)
+    public async Task<ActionResult<RfqComparisonDto>> Comparison(int rfqId, CancellationToken ct)
        => Ok(await _rfqs.GetComparisonAsync(rfqId, ct));
 }
@@ -0,0 +1,88 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Rbac;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Role CRUD + permission assignment (mirrors AuthHex's Role; see docs/10 C.9).</summary>
+[Route("api/v1/roles")]
+public sealed class RolesController : ApiControllerBase
+{
+    private readonly IRoleService _roles;
+
+    public RolesController(IRoleService roles) => _roles = roles;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<RoleDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<RoleDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _roles.ListAsync(query, status, ct));
+
+    [HttpGet("{roleId:int}")]
+    [ProducesResponseType(typeof(RoleDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<RoleDto>> GetById(int roleId, CancellationToken ct)
+    {
+        var result = await _roles.GetAsync(roleId, ct);
+        if (result is null) return NotFound();
+
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(RoleDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<RoleDto>> Create([FromBody] CreateRoleRequest request, CancellationToken ct)
+    {
+        var result = await _roles.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/roles/{result.Value.RoleId}", result.Value);
+    }
+
+    [HttpPut("{roleId:int}")]
+    [ProducesResponseType(typeof(RoleDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<RoleDto>> Update(int roleId, [FromBody] UpdateRoleRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _roles.UpdateAsync(roleId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{roleId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int roleId, [FromBody] UpdateRoleStatusRequest request, CancellationToken ct)
+    {
+        await _roles.SetStatusAsync(roleId, request.Status, ct);
+        return NoContent();
+    }
+
+    [HttpDelete("{roleId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int roleId, CancellationToken ct)
+    {
+        await _roles.DeleteAsync(roleId, ct);
+        return NoContent();
+    }
+
+    [HttpGet("{roleId:int}/permissions")]
+    [ProducesResponseType(typeof(RolePermissionsDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<RolePermissionsDto>> GetPermissions(int roleId, CancellationToken ct)
+        => Ok(await _roles.GetPermissionsAsync(roleId, ct));
+
+    [HttpPut("{roleId:int}/permissions")]
+    [ProducesResponseType(typeof(RolePermissionsDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<RolePermissionsDto>> AssignPermissions(
+        int roleId, [FromBody] AssignRolePermissionsRequest request, CancellationToken ct)
+        => Ok(await _roles.AssignPermissionsAsync(roleId, request, ct));
+}
@@ -0,0 +1,44 @@
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Stock;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Stock-adjustment endpoints (docs/11 §5.5).</summary>
+[Route("api/v1/stock-adjustments")]
+public sealed class StockAdjustmentsController : ApiControllerBase
+{
+    private readonly IAdjustmentService _adjustments;
+
+    public StockAdjustmentsController(IAdjustmentService adjustments) => _adjustments = adjustments;
+
+    /// <summary>List posted adjustments, newest first.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<AdjustmentSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<AdjustmentSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] int? warehouseId, [FromQuery] int? reasonCodeId, CancellationToken ct)
+        => Ok(await _adjustments.ListAsync(query, warehouseId, reasonCodeId, ct));
+
+    /// <summary>Get one adjustment with its lines and the ledger entries it posted.</summary>
+    [HttpGet("{adjustmentId:int}")]
+    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<AdjustmentDto>> GetById(int adjustmentId, CancellationToken ct)
+    {
+        var dto = await _adjustments.GetAsync(adjustmentId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    /// <summary>Create + auto-post an adjustment (mandatory reason code; decrease FIFO-consumes).</summary>
+    [HttpPost]
+    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<AdjustmentDto>> Create([FromBody] CreateAdjustmentRequest request, CancellationToken ct)
+    {
+        var dto = await _adjustments.CreateAsync(request, ct);
+        return Created($"/api/v1/stock-adjustments/{dto.AdjustmentId}", dto);
+    }
+}
@@ -0,0 +1,70 @@
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Procurement;
+using ERPCore.Dtos.Stock;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Stock enquiry, ledger, valuation and reorder-alert endpoints (docs/11 §5.1–5.3, §5.7).</summary>
+[Route("api/v1/stock")]
+public sealed class StockController : ApiControllerBase
+{
+    private readonly IStockService _stock;
+    private readonly IReorderService _reorder;
+
+    public StockController(IStockService stock, IReorderService reorder)
+    {
+        _stock = stock;
+        _reorder = reorder;
+    }
+
+    [HttpGet("on-hand")]
+    [ProducesResponseType(typeof(StockOnHandDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<StockOnHandDto>> OnHand([FromQuery] int itemId, [FromQuery] int warehouseId, CancellationToken ct)
+        => Ok(await _stock.GetOnHandAsync(itemId, warehouseId, ct));
+
+    /// <summary>On-hand across every stocked (item, warehouse) pair; both filters optional.</summary>
+    [HttpGet("on-hand/list")]
+    [ProducesResponseType(typeof(PagedResponse<StockOnHandDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<StockOnHandDto>>> OnHandList(
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _stock.GetOnHandListAsync(itemId, warehouseId, query, ct));
+
+    /// <summary>
+    /// Immutable movement history. <c>sourceDocType</c>/<c>sourceDocId</c> answer "what did
+    /// this document post?" — the ledger's document reference is polymorphic, so there is
+    /// no FK to navigate instead (docs/10 C.9).
+    /// </summary>
+    [HttpGet("ledger")]
+    [ProducesResponseType(typeof(PagedResponse<StockLedgerRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<StockLedgerRowDto>>> Ledger(
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId,
+        [FromQuery] DateOnly? from, [FromQuery] DateOnly? to,
+        [FromQuery] string? sourceDocType, [FromQuery] int? sourceDocId,
+        [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _stock.GetLedgerAsync(itemId, warehouseId, from, to, sourceDocType, sourceDocId, query, ct));
+
+    [HttpGet("valuation")]
+    [ProducesResponseType(typeof(StockValuationDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<StockValuationDto>> Valuation([FromQuery] int itemId, [FromQuery] int warehouseId, CancellationToken ct)
+        => Ok(await _stock.GetValuationAsync(itemId, warehouseId, ct));
+
+    /// <summary>Items at/below their reorder point (FR-STK-10), computed on read.</summary>
+    [HttpGet("reorder-alerts")]
+    [ProducesResponseType(typeof(PagedResponse<ReorderAlertDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<ReorderAlertDto>>> ReorderAlerts(
+        [FromQuery] int? warehouseId, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _reorder.GetAlertsAsync(warehouseId, query, ct));
+
+    /// <summary>Create a draft requisition for an item's suggested reorder quantity.</summary>
+    [HttpPost("reorder-alerts/{itemId:int}/requisition")]
+    [ProducesResponseType(typeof(RequisitionDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<RequisitionDto>> SuggestRequisition(
+        int itemId, [FromQuery] int warehouseId, CancellationToken ct)
+    {
+        var dto = await _reorder.CreateSuggestedRequisitionAsync(itemId, warehouseId, ct);
+        return Created($"/api/v1/requisitions/{dto.RequisitionId}", dto);
+    }
+}
@@ -0,0 +1,58 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Stock;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Stock-count endpoints (docs/11 §5.6).</summary>
+[Route("api/v1/stock-counts")]
+public sealed class StockCountsController : ApiControllerBase
+{
+    private readonly ICountService _counts;
+
+    public StockCountsController(ICountService counts) => _counts = counts;
+
+    /// <summary>List counts, newest first.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<CountSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<CountSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] CountStatus? status, [FromQuery] int? warehouseId, CancellationToken ct)
+        => Ok(await _counts.ListAsync(query, status, warehouseId, ct));
+
+    [HttpGet("{countId:int}")]
+    [ProducesResponseType(typeof(CountDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<CountDto>> GetById(int countId, CancellationToken ct)
+    {
+        var dto = await _counts.GetAsync(countId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    /// <summary>Create a count with system quantities snapshotted (immutable).</summary>
+    [HttpPost]
+    [ProducesResponseType(typeof(CountDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<CountDto>> Create([FromBody] CreateCountRequest request, CancellationToken ct)
+    {
+        var dto = await _counts.CreateAsync(request, ct);
+        return Created($"/api/v1/stock-counts/{dto.CountId}", dto);
+    }
+
+    /// <summary>Enter counted quantities; variance = counted − system.</summary>
+    [HttpPut("{countId:int}/counts")]
+    [ProducesResponseType(typeof(CountDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<CountDto>> EnterCounts(int countId, [FromBody] EnterCountsRequest request, CancellationToken ct)
+        => Ok(await _counts.EnterCountsAsync(countId, request, ct));
+
+    /// <summary>Post: emit a variance adjustment and close the count.</summary>
+    [HttpPost("{countId:int}/post")]
+    [ProducesResponseType(typeof(CountPostResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<CountPostResultDto>> Post(int countId, CancellationToken ct)
+        => Ok(await _counts.PostAsync(countId, ct));
+}
@@ -0,0 +1,59 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Stock;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Stock-transfer endpoints (docs/11 §5.4).</summary>
+[Route("api/v1/stock-transfers")]
+public sealed class StockTransfersController : ApiControllerBase
+{
+    private readonly ITransferService _transfers;
+
+    public StockTransfersController(ITransferService transfers) => _transfers = transfers;
+
+    /// <summary>List transfers, newest first.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<TransferSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<TransferSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] TransferStatus? status,
+        [FromQuery] int? srcWarehouseId, [FromQuery] int? destWarehouseId, CancellationToken ct)
+        => Ok(await _transfers.ListAsync(query, status, srcWarehouseId, destWarehouseId, ct));
+
+    [HttpGet("{transferId:int}")]
+    [ProducesResponseType(typeof(TransferDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<TransferDto>> GetById(int transferId, CancellationToken ct)
+    {
+        var dto = await _transfers.GetAsync(transferId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(TransferDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<TransferDto>> Create([FromBody] CreateTransferRequest request, CancellationToken ct)
+    {
+        var dto = await _transfers.CreateAsync(request, ct);
+        return Created($"/api/v1/stock-transfers/{dto.TransferId}", dto);
+    }
+
+    /// <summary>Dispatch: consume source FIFO layers into in-transit. 409 STOCK_NEGATIVE_BLOCKED if short.</summary>
+    [HttpPost("{transferId:int}/dispatch")]
+    [ProducesResponseType(typeof(DispatchResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<DispatchResultDto>> Dispatch(int transferId, CancellationToken ct)
+        => Ok(await _transfers.DispatchAsync(transferId, ct));
+
+    /// <summary>Receive: create the destination layer at the inherited cost (cost-preserving).</summary>
+    [HttpPost("{transferId:int}/receive")]
+    [ProducesResponseType(typeof(ReceiveResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<ReceiveResultDto>> Receive(int transferId, [FromBody] ReceiveTransferRequest request, CancellationToken ct)
+        => Ok(await _transfers.ReceiveAsync(transferId, request, ct));
+}
@@ -0,0 +1,56 @@
+using ERPCore.Dtos.Categories;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Subcategory endpoints addressed by their own id (docs/11-BACKEND-PHASE1.md §2.3).
+/// Listing and creation live under the parent category on <see cref="CategoriesController"/>,
+/// since a subcategory only exists in the context of one.
+/// </summary>
+[Route("api/v1/subcategories")]
+public sealed class SubCategoriesController : ApiControllerBase
+{
+    private readonly ICategoryService _categories;
+
+    public SubCategoriesController(ICategoryService categories) => _categories = categories;
+
+    [HttpGet("{subCategoryId:int}")]
+    [ProducesResponseType(typeof(SubCategoryDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SubCategoryDto>> GetById(int subCategoryId, CancellationToken ct)
+    {
+        var result = await _categories.GetSubCategoryAsync(subCategoryId, ct);
+        if (result is null) return NotFound();
+
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Renames a subcategory. It cannot be moved to another category — see the request DTO.</summary>
+    [HttpPut("{subCategoryId:int}")]
+    [ProducesResponseType(typeof(SubCategoryDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SubCategoryDto>> Update(
+        int subCategoryId, [FromBody] UpdateSubCategoryRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _categories.UpdateSubCategoryAsync(subCategoryId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Deactivate/reactivate. Masters are never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{subCategoryId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(
+        int subCategoryId, [FromBody] UpdateSubCategoryStatusRequest request, CancellationToken ct)
+    {
+        await _categories.SetSubCategoryStatusAsync(subCategoryId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,65 @@
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Dtos.Users;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// User management: local shadow `User` list/detail + role assignment, and
+/// account creation orchestrated against AuthHex (see <see cref="IUserManagementService.CreateAsync"/>).
+/// </summary>
+[Route("api/v1/users")]
+public sealed class UsersController : ApiControllerBase
+{
+    private readonly IUserManagementService _users;
+    private readonly IEmployeeUserLinkService _links;
+
+    public UsersController(IUserManagementService users, IEmployeeUserLinkService links)
+    {
+        _users = users;
+        _links = links;
+    }
+
+    /// <summary>Advisory forward-direction lookup: does a Staff record already exist with this email? (docs/12-BACKEND-HRM.md A.5)</summary>
+    [HttpGet("email-lookup")]
+    [ProducesResponseType(typeof(EmployeeMatchResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<EmployeeMatchResponse>> EmailLookup([FromQuery] string email, CancellationToken ct)
+        => Ok(new EmployeeMatchResponse(await _links.FindStaffCandidateByEmailAsync(email, ct)));
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<ManagedUserDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<ManagedUserDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _users.ListAsync(query, ct));
+
+    /// <summary>AuthHex UserType options for the create-user form's select.</summary>
+    [HttpGet("user-types")]
+    [ProducesResponseType(typeof(List<UserTypeOptionDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<UserTypeOptionDto>>> ListUserTypes(CancellationToken ct)
+        => Ok(await _users.ListUserTypesAsync(ct));
+
+    [HttpGet("{userId:int}")]
+    [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ManagedUserDto>> GetById(int userId, CancellationToken ct)
+    {
+        var result = await _users.GetAsync(userId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ManagedUserDto>> Create([FromBody] CreateUserRequest request, CancellationToken ct)
+    {
+        var result = await _users.CreateAsync(request, ct);
+        return Created($"/api/v1/users/{result.UserId}", result);
+    }
+
+    [HttpPut("{userId:int}/role")]
+    [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ManagedUserDto>> UpdateRole(int userId, [FromBody] UpdateUserRoleRequest request, CancellationToken ct)
+        => Ok(await _users.UpdateRoleAsync(userId, request, ct));
+}
@@ -20,10 +20,10 @@ public sealed class VendorsController : ApiControllerBase
        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
        => Ok(await _vendors.ListAsync(query, status, ct));

-    [HttpGet("{vendorId:long}")]
+    [HttpGet("{vendorId:int}")]
    [ProducesResponseType(typeof(VendorDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<VendorDto>> GetById(long vendorId, CancellationToken ct)
+    public async Task<ActionResult<VendorDto>> GetById(int vendorId, CancellationToken ct)
    {
        var result = await _vendors.GetAsync(vendorId, ct);
        if (result is null) return NotFound();
@@ -42,11 +42,11 @@ public sealed class VendorsController : ApiControllerBase
        return Created($"/api/v1/vendors/{result.Value.VendorId}", result.Value);
    }

-    [HttpPut("{vendorId:long}")]
+    [HttpPut("{vendorId:int}")]
    [ProducesResponseType(typeof(VendorDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
-    public async Task<ActionResult<VendorDto>> Update(long vendorId, [FromBody] UpdateVendorRequest request, CancellationToken ct)
+    public async Task<ActionResult<VendorDto>> Update(int vendorId, [FromBody] UpdateVendorRequest request, CancellationToken ct)
    {
        var expected = RequireIfMatch();
        var result = await _vendors.UpdateAsync(vendorId, request, expected, ct);
@@ -54,10 +54,10 @@ public sealed class VendorsController : ApiControllerBase
        return Ok(result.Value);
    }

-    [HttpPatch("{vendorId:long}/status")]
+    [HttpPatch("{vendorId:int}/status")]
    [ProducesResponseType(StatusCodes.Status204NoContent)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<IActionResult> SetStatus(long vendorId, [FromBody] UpdateVendorStatusRequest request, CancellationToken ct)
+    public async Task<IActionResult> SetStatus(int vendorId, [FromBody] UpdateVendorStatusRequest request, CancellationToken ct)
    {
        await _vendors.SetStatusAsync(vendorId, request.Status, ct);
        return NoContent();
@@ -18,10 +18,10 @@ public sealed class WarehousesController : ApiControllerBase
    public async Task<ActionResult<PagedResponse<WarehouseDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
        => Ok(await _warehouses.ListAsync(query, ct));

-    [HttpGet("{warehouseId:long}")]
+    [HttpGet("{warehouseId:int}")]
    [ProducesResponseType(typeof(WarehouseDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<WarehouseDto>> GetById(long warehouseId, CancellationToken ct)
+    public async Task<ActionResult<WarehouseDto>> GetById(int warehouseId, CancellationToken ct)
    {
        var dto = await _warehouses.GetAsync(warehouseId, ct);
        return dto is null ? NotFound() : Ok(dto);
@@ -36,17 +36,17 @@ public sealed class WarehousesController : ApiControllerBase
        return Created($"/api/v1/warehouses/{dto.WarehouseId}", dto);
    }

-    [HttpGet("{warehouseId:long}/bins")]
+    [HttpGet("{warehouseId:int}/bins")]
    [ProducesResponseType(typeof(IReadOnlyList<BinDto>), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<IReadOnlyList<BinDto>>> ListBins(long warehouseId, CancellationToken ct)
+    public async Task<ActionResult<IReadOnlyList<BinDto>>> ListBins(int warehouseId, CancellationToken ct)
        => Ok(await _warehouses.ListBinsAsync(warehouseId, ct));

-    [HttpPost("{warehouseId:long}/bins")]
+    [HttpPost("{warehouseId:int}/bins")]
    [ProducesResponseType(typeof(BinDto), StatusCodes.Status201Created)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status409Conflict)]
-    public async Task<ActionResult<BinDto>> CreateBin(long warehouseId, [FromBody] CreateBinRequest request, CancellationToken ct)
+    public async Task<ActionResult<BinDto>> CreateBin(int warehouseId, [FromBody] CreateBinRequest request, CancellationToken ct)
    {
        var dto = await _warehouses.CreateBinAsync(warehouseId, request, ct);
        return Created($"/api/v1/warehouses/{warehouseId}/bins/{dto.BinId}", dto);
@@ -0,0 +1,40 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Per employee/day attendance row (FR-HR-ATT). <see cref="WorkShiftId"/> is
+/// snapshotted from the employee's shift at ingestion time (docs/12-BACKEND-HRM.md
+/// A.3) so a later shift reassignment never retroactively changes historical
+/// Late/OT figures. Model: docs/12-BACKEND-HRM.md Part C.4.
+/// </summary>
+public class AttendanceRecord
+{
+    public int AttendanceRecordId { get; set; }
+    public int? AttendanceUploadBatchId { get; set; }
+    public AttendanceUploadBatch? AttendanceUploadBatch { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+
+    public DateTime AttendanceDate { get; set; }
+    public TimeSpan? CheckIn { get; set; }
+    public TimeSpan? CheckOut { get; set; }
+    public int WorkShiftId { get; set; }
+    public WorkShift? WorkShift { get; set; }
+
+    public int WorkingMinutes { get; set; }
+    public int LateMinutes { get; set; }
+    public int EarlyLeaveMinutes { get; set; }
+    public int OvertimeMinutes { get; set; }
+
+    public AttendanceStatus AttendanceStatus { get; set; }
+    public RowValidationStatus RowValidationStatus { get; set; } = RowValidationStatus.Valid;
+    public int? DuplicateOfAttendanceRecordId { get; set; }
+
+    public string? Notes { get; set; }
+    public bool IsManualOverride { get; set; }
+    public int? EditedBy { get; set; }
+    public DateTime? EditedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,31 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Attendance upload batch (FR-HR-ATT) — the transactional document driving the
+/// exact status flow Draft→Validated→Confirmed→UsedInPayroll. Scoped to exactly
+/// one payroll period, numbered via <see cref="NumberSequence"/> (docType "ATT").
+/// Model: docs/12-BACKEND-HRM.md Part C.4.
+/// </summary>
+public class AttendanceUploadBatch
+{
+    public int AttendanceUploadBatchId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public DateTime PeriodStart { get; set; }
+    public DateTime PeriodEnd { get; set; }
+    public AttendanceSourceType SourceType { get; set; }
+    public string? OriginalFileName { get; set; }
+
+    public int UploadedBy { get; set; }
+    public DateTime UploadedAt { get; set; }
+    public AttendanceBatchStatus Status { get; set; } = AttendanceBatchStatus.Draft;
+    public int? ConfirmedBy { get; set; }
+    public DateTime? ConfirmedAt { get; set; }
+
+    public int RowCountTotal { get; set; }
+    public int RowCountDuplicate { get; set; }
+    public int RowCountError { get; set; }
+
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,23 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Immutable audit trail entry (FR-X-02) — the compensating control for the deferred
+/// RBAC (02-SECURITY AR-01/B.3). One row per create/update/delete of an audited
+/// entity, capturing who / when / what changed (old→new in <see cref="ChangeSet"/>).
+/// Written automatically by <c>ErpDbContext.SaveChangesAsync</c>. Append-only at the
+/// app level; DB-role revocation of UPDATE/DELETE is deferred hardening (B.3).
+/// Model: docs/10 Part C.7.
+/// </summary>
+public class AuditLog
+{
+    public int AuditId { get; set; }
+    public int UserId { get; set; }
+    public string EntityType { get; set; } = string.Empty;
+    public int EntityId { get; set; }
+    public AuditAction Action { get; set; }
+    /// <summary>JSON change set: field→value (create/delete) or field→{old,new} (update).</summary>
+    public string ChangeSet { get; set; } = "{}";
+    public DateTime CreatedAt { get; set; }
+}
@@ -0,0 +1,16 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Batch/lot for a batch-tracked item (FR-GRN-04, FR-WH-03). Expiry drives FEFO
+/// picking of perishables. Model: docs/10 Part C.4.
+/// </summary>
+public class Batch
+{
+    public int BatchId { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public string BatchNo { get; set; } = string.Empty;
+    public DateOnly? ExpiryDate { get; set; }
+}
@@ -6,9 +6,9 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class Bin
 {
-    public long BinId { get; set; }
+    public int BinId { get; set; }

-    public long WarehouseId { get; set; }
+    public int WarehouseId { get; set; }
    public Warehouse? Warehouse { get; set; }

    public string Code { get; set; } = string.Empty;
@@ -0,0 +1,23 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Branch/location master (FR-HR-MD-01) — multi-branch readiness. Referenced
+/// optionally by <see cref="Employee.BranchId"/> and <see cref="PayrollRun.BranchId"/>.
+/// Deactivated, not deleted, when referenced. Model: docs/12-BACKEND-HRM.md Part C.1.
+/// </summary>
+public class Branch
+{
+    public int BranchId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public string? Address { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,21 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Brand master (FR-MD-09). Referenced optionally by <see cref="Item.BrandId"/>.
+/// Mutable aggregate with a <see cref="RowVersion"/> ETag token. Deactivated, not
+/// deleted, when referenced (FR-MD-08). Model: docs/10-BACKEND-PHASE1.md Part C.1.
+/// </summary>
+public class Brand
+{
+    public int BrandId { get; set; }
+    public string Name { get; set; } = string.Empty;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}
@@ -1,15 +1,25 @@
+using ERPCore.Domain.Enums;
+
 namespace ERPCore.Domain.Entities;

 /// <summary>
-/// Hierarchical item category (FR-MD-04). A null <see cref="ParentId"/> denotes a
-/// root category. Model: docs/10-BACKEND-PHASE1.md Part C.1.
+/// Item category (FR-MD-04) — the top level of a two-level hierarchy. The optional level
+/// below is <see cref="SubCategory"/>; categories no longer self-nest (the former
+/// <c>parent_id</c> tree was replaced in migration #2).
+/// Mutable aggregate with a <see cref="RowVersion"/> ETag token. Deactivated, not
+/// deleted, when referenced (FR-MD-08). Model: docs/10-BACKEND-PHASE1.md Part C.1.
 /// </summary>
 public class Category
 {
-    public long CategoryId { get; set; }
+    public int CategoryId { get; set; }
    public string Name { get; set; } = string.Empty;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;

-    public long? ParentId { get; set; }
-    public Category? Parent { get; set; }
-    public ICollection<Category> Children { get; set; } = new List<Category>();
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+
+    public ICollection<SubCategory> SubCategories { get; set; } = new List<SubCategory>();
 }
@@ -0,0 +1,26 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Department master (FR-HR-MD-01) — unlimited self-nesting for a real org chart
+/// (unlike the two-level-capped <see cref="Category"/>); cycle prevention is a
+/// service-level check on write, not a DB constraint. Model: docs/12-BACKEND-HRM.md Part C.1.
+/// </summary>
+public class Department
+{
+    public int DepartmentId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public int? ParentDepartmentId { get; set; }
+    public Department? ParentDepartment { get; set; }
+    public int? HeadEmployeeId { get; set; }
+    public Employee? HeadEmployee { get; set; }
+    public int? BranchId { get; set; }
+    public Branch? Branch { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,19 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Job title master (FR-HR-MD-01), standalone — not FK'd to Department, since a
+/// title like "Accountant" can exist in multiple departments. Model: docs/12-BACKEND-HRM.md Part C.1.
+/// </summary>
+public class Designation
+{
+    public int DesignationId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,76 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Staff record (FR-HR-MD-02) — distinct from <see cref="User"/> (the system login
+/// account): not every employee has a login, and not every login belongs to an
+/// employee. <see cref="UserId"/> is the optional, explicit, human-confirmed link
+/// between the two (docs/12-BACKEND-HRM.md A.5/C.2, Part B.3.2). Never hard-deleted —
+/// separation is recorded via <see cref="Status"/> + <see cref="LastWorkingDate"/>.
+/// <see cref="EmployeeCode"/> is user-entered (not <see cref="NumberSequence"/>-issued):
+/// HR departments keep their own legacy numbering scheme, and NumberSequence's
+/// year-scoping is the wrong shape for an identifier that must never look "reset".
+/// </summary>
+public class Employee
+{
+    public int EmployeeId { get; set; }
+    public string EmployeeCode { get; set; } = string.Empty;
+
+    // Identity
+    public string FullName { get; set; } = string.Empty;
+    public string? Nic { get; set; }
+    public DateTime? DateOfBirth { get; set; }
+    public Gender? Gender { get; set; }
+    public string? Nationality { get; set; }
+    public string? ProfilePhotoPath { get; set; }
+
+    // Contact
+    /// <summary>The field used for the bidirectional Employee&lt;-&gt;User email cross-check.</summary>
+    public string? Email { get; set; }
+    public string? PersonalMobile { get; set; }
+    public string? AddressLine1 { get; set; }
+    public string? AddressLine2 { get; set; }
+    public string? City { get; set; }
+    public string? PostalCode { get; set; }
+    public string? Country { get; set; }
+
+    // Emergency contact
+    public string? EmergencyContactName { get; set; }
+    public string? EmergencyContactRelationship { get; set; }
+    public string? EmergencyContactPhone { get; set; }
+
+    // Employment
+    public DateTime HireDate { get; set; }
+    public DateTime? ConfirmationDate { get; set; }
+    public DateTime? LastWorkingDate { get; set; }
+    public int DepartmentId { get; set; }
+    public Department? Department { get; set; }
+    public int DesignationId { get; set; }
+    public Designation? Designation { get; set; }
+    public int EmploymentTypeId { get; set; }
+    public EmploymentType? EmploymentType { get; set; }
+    public int? BranchId { get; set; }
+    public Branch? Branch { get; set; }
+    public int WorkShiftId { get; set; }
+    public WorkShift? WorkShift { get; set; }
+    public int? ReportingManagerId { get; set; }
+    public Employee? ReportingManager { get; set; }
+
+    // Statutory (Sri Lanka)
+    public string? EpfNumber { get; set; }
+    public string? EtfNumber { get; set; }
+    public string? TaxIdentificationNumber { get; set; }
+
+    /// <summary>Optional login account link (unique — one User backs at most one Employee).</summary>
+    public int? UserId { get; set; }
+    public User? User { get; set; }
+
+    public EmployeeStatus Status { get; set; } = EmployeeStatus.Active;
+
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public int? UpdatedBy { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,28 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Employee bank account (FR-HR-MD-03), one-to-many — a future split-payment
+/// improvement is possible since this isn't a 1:1 scalar set. Exactly one row per
+/// employee is <see cref="IsPrimary"/>; payroll disbursement targets it.
+/// Model: docs/12-BACKEND-HRM.md Part C.2.
+/// </summary>
+public class EmployeeBankDetail
+{
+    public int EmployeeBankDetailId { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+
+    public string BankName { get; set; } = string.Empty;
+    public string BranchName { get; set; } = string.Empty;
+    public string AccountNumber { get; set; } = string.Empty;
+    public string AccountHolderName { get; set; } = string.Empty;
+    public string? SwiftCode { get; set; }
+    public bool IsPrimary { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,36 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Uploaded staff document (FR-HR-DOC-02..04) — the user's "Doc". <see cref="StoredFileName"/>/
+/// <see cref="RelativePath"/> are server-generated (never the client's filename), so the
+/// file is only ever reachable through <see cref="Services.Interfaces.IFileStorageService"/>,
+/// never a guessable static path. Archived, not deleted, so the audit trail of what was
+/// once on file is retained. Model: docs/12-BACKEND-HRM.md Part C.3.
+/// </summary>
+public class EmployeeDocument
+{
+    public int EmployeeDocumentId { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+    public int HrDocumentTypeId { get; set; }
+    public HrDocumentType? HrDocumentType { get; set; }
+
+    public string OriginalFileName { get; set; } = string.Empty;
+    public string StoredFileName { get; set; } = string.Empty;
+    public string RelativePath { get; set; } = string.Empty;
+    public string ContentType { get; set; } = string.Empty;
+    public long SizeBytes { get; set; }
+    public DateTime? IssueDate { get; set; }
+    public DateTime? ExpiryDate { get; set; }
+    public string? Notes { get; set; }
+
+    public int UploadedBy { get; set; }
+    public DateTime UploadedAt { get; set; }
+    public int? VerifiedBy { get; set; }
+    public DateTime? VerifiedAt { get; set; }
+
+    public EmployeeDocumentStatus Status { get; set; } = EmployeeDocumentStatus.Active;
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,35 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Loan/Advance (FR-HR-PAY-03) — <see cref="LoanKind"/> discriminates, structurally
+/// identical otherwise. <see cref="OutstandingBalance"/> is denormalized (parallel to
+/// <c>StockLayer.QtyRemaining</c>). Numbered via <see cref="NumberSequence"/> (docType "LOAN").
+/// Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class EmployeeLoan
+{
+    public int EmployeeLoanId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+    public LoanKind LoanKind { get; set; }
+
+    public decimal PrincipalAmount { get; set; }
+    public decimal InterestRate { get; set; }
+    public decimal InstallmentAmount { get; set; }
+    public int NumberOfInstallments { get; set; }
+    public int StartYear { get; set; }
+    public int StartMonth { get; set; }
+    public decimal OutstandingBalance { get; set; }
+    public LoanStatus Status { get; set; } = LoanStatus.Active;
+
+    public int ApprovedBy { get; set; }
+    public DateTime ApprovedAt { get; set; }
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public List<LoanInstallment> Installments { get; set; } = new();
+}
@@ -0,0 +1,30 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Effective-dated salary structure header (FR-HR-PAY-02) — the audit trail a
+/// salary revision needs (docs/12-BACKEND-HRM.md §13): exactly one row with
+/// <see cref="EffectiveTo"/> null (the current one) per employee at a time.
+/// Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class EmployeeSalaryStructure
+{
+    public int EmployeeSalaryStructureId { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+
+    public DateTime EffectiveFrom { get; set; }
+    public DateTime? EffectiveTo { get; set; }
+    public decimal BasicSalary { get; set; }
+    public string Currency { get; set; } = "LKR";
+    public SalaryStructureStatus Status { get; set; } = SalaryStructureStatus.Active;
+
+    public int ApprovedBy { get; set; }
+    public DateTime ApprovedAt { get; set; }
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public List<EmployeeSalaryStructureLine> Lines { get; set; } = new();
+}
@@ -0,0 +1,12 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>Allowance/other-deduction line on a salary structure. Model: docs/12-BACKEND-HRM.md Part C.6.</summary>
+public class EmployeeSalaryStructureLine
+{
+    public int EmployeeSalaryStructureLineId { get; set; }
+    public int EmployeeSalaryStructureId { get; set; }
+    public EmployeeSalaryStructure? EmployeeSalaryStructure { get; set; }
+    public int SalaryComponentId { get; set; }
+    public SalaryComponent? SalaryComponent { get; set; }
+    public decimal Amount { get; set; }
+}
@@ -0,0 +1,20 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Labor category master (FR-HR-MD-01) — a master, not an enum, mirroring
+/// <see cref="Brand"/>: employment categories change with company/labor-law
+/// policy without wanting a code deploy. Model: docs/12-BACKEND-HRM.md Part C.1.
+/// </summary>
+public class EmploymentType
+{
+    public int EmploymentTypeId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,37 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Goods Receipt Note header (FR-GRN-01/02). Raised against a PO or direct
+/// (<see cref="PoId"/> null). On confirm each line creates a FIFO layer and posts
+/// an inbound ledger entry. Mutable aggregate with an <see cref="RowVersion"/>
+/// concurrency token (docs/10 C.10). Model: docs/10 Part C.3.
+/// </summary>
+public class Grn
+{
+    public int GrnId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int? PoId { get; set; }
+    public PurchaseOrder? PurchaseOrder { get; set; }
+
+    public int VendorId { get; set; }
+    public Vendor? Vendor { get; set; }
+
+    public int WarehouseId { get; set; }
+    public Warehouse? Warehouse { get; set; }
+
+    public GrnStatus Status { get; set; } = GrnStatus.Draft;
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? PostedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token.</summary>
+    public uint RowVersion { get; set; }
+
+    public ICollection<GrnLine> Lines { get; set; } = new List<GrnLine>();
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// GRN line (FR-GRN-04..08). <see cref="UnitCost"/> is the gross cost received at:
+/// entered on the line, defaulting to the PO price when omitted (a per-receipt price
+/// override is now permitted — see docs/02-SECURITY C.3, revised). <see cref="PoUnitPrice"/>
+/// snapshots the PO price at receipt so the variance survives later PO edits.
+/// <see cref="NetUnitCost"/> = unitCost after trade discount — this is what the FIFO layer
+/// costs at (VAT never enters stock value; it is recoverable input tax).
+/// <see cref="ReceivedValue"/> = qty × netUnitCost (after discount, before VAT).
+/// <see cref="HoldStatus"/> gates issuability. Model: docs/10 Part C.3.
+/// </summary>
+public class GrnLine
+{
+    public int GrnLineId { get; set; }
+
+    public int GrnId { get; set; }
+    public Grn? Grn { get; set; }
+
+    public int? PoLineId { get; set; }
+    public PoLine? PoLine { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public int UomId { get; set; }
+    public Uom? Uom { get; set; }
+
+    public int? BinId { get; set; }
+    public Bin? Bin { get; set; }
+
+    public int? BatchId { get; set; }
+    public Batch? Batch { get; set; }
+
+    public decimal Qty { get; set; }
+
+    /// <summary>Gross unit cost received at (entered, or PO price when omitted).</summary>
+    public decimal UnitCost { get; set; }
+
+    /// <summary>Snapshot of the PO line price at receipt; null for direct receipts.</summary>
+    public decimal? PoUnitPrice { get; set; }
+
+    /// <summary>Trade discount percentage (0–100), entered.</summary>
+    public decimal DiscountPct { get; set; }
+
+    /// <summary>UnitCost × (1 − DiscountPct/100) — the inventory (FIFO layer) cost.</summary>
+    public decimal NetUnitCost { get; set; }
+
+    /// <summary>VAT percentage (0–100), entered. Recoverable — does not affect stock value.</summary>
+    public decimal VatPct { get; set; }
+
+    /// <summary>Qty × NetUnitCost × VatPct/100.</summary>
+    public decimal VatAmount { get; set; }
+
+    /// <summary>Qty × NetUnitCost (after discount, before VAT).</summary>
+    public decimal ReceivedValue { get; set; }
+
+    /// <summary>Qty × NetUnitCost + VatAmount — payable to the vendor.</summary>
+    public decimal LineTotal { get; set; }
+
+    public HoldStatus HoldStatus { get; set; } = HoldStatus.Available;
+}
@@ -0,0 +1,24 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Staff document catalog (FR-HR-DOC-01) — the user's "DocType": a category of
+/// document (NIC, contract, certificate...), not the uploaded file itself (see
+/// <see cref="EmployeeDocument"/>, the "Doc"). Deactivated, not deleted, when
+/// referenced. Model: docs/12-BACKEND-HRM.md Part C.3.
+/// </summary>
+public class HrDocumentType
+{
+    public int HrDocumentTypeId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public HrDocumentCategory Category { get; set; }
+    public bool RequiredAtOnboarding { get; set; }
+    public bool ExpiryTracked { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -9,23 +9,38 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class Item
 {
-    public long ItemId { get; set; }
+    public int ItemId { get; set; }
    public string Sku { get; set; } = string.Empty;
    public string Name { get; set; } = string.Empty;
    public string? Description { get; set; }

-    public long CategoryId { get; set; }
+    public int CategoryId { get; set; }
    public Category? Category { get; set; }

-    public long BaseUomId { get; set; }
+    /// <summary>Optional second level below <see cref="CategoryId"/>; must belong to it.</summary>
+    public int? SubCategoryId { get; set; }
+    public SubCategory? SubCategory { get; set; }
+
+    public int? BrandId { get; set; }
+    public Brand? Brand { get; set; }
+
+    public int BaseUomId { get; set; }
    public Uom? BaseUom { get; set; }

-    public long? DefaultVendorId { get; set; }
+    public int? DefaultVendorId { get; set; }
    public Vendor? DefaultVendor { get; set; }

-    public ItemType ItemType { get; set; }
+    public StockNature StockNature { get; set; }
    public TrackingMode TrackingMode { get; set; }
    public string? TaxClass { get; set; }
+
+    /// <summary>
+    /// Optional fixed selling price used by Sales only. <c>null</c> means "use stock value"
+    /// (the item is sold at its FIFO stock cost at sale time); a value is the fixed sale price.
+    /// Never enters costing/GRN/FIFO (docs/10 Part C.1, C.9).
+    /// </summary>
+    public decimal? SalePrice { get; set; }
+
    public EntityStatus Status { get; set; } = EntityStatus.Active;

    public DateTime CreatedAt { get; set; }
@@ -7,12 +7,12 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class ItemReorder
 {
-    public long ReorderId { get; set; }
+    public int ReorderId { get; set; }

-    public long ItemId { get; set; }
+    public int ItemId { get; set; }
    public Item? Item { get; set; }

-    public long WarehouseId { get; set; }
+    public int WarehouseId { get; set; }
    public Warehouse? Warehouse { get; set; }

    public decimal ReorderPoint { get; set; }
@@ -0,0 +1,31 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Item type master (FR-MD-10) — a selectable dimension name such as Color, Size or
+/// Material.
+/// <para>
+/// <b>Deliberately unlinked.</b> Nothing references this entity and it references
+/// nothing: there is no value table and no join to <see cref="Item"/>. Its only job is
+/// to feed the frontend's item-builder dropdown via <c>GET /item-types</c>. The chosen
+/// values (Red, S, M) are encoded by the client into the generated SKU
+/// (e.g. <c>BL-100-0003</c>) and are never stored or parsed server-side — the item list
+/// is the record of what was built. See the accepted trade-off in docs/10 Part C.9.
+/// </para>
+/// Not to be confused with <see cref="Enums.StockNature"/> (Stocked/NonStocked/Service),
+/// which is what the old <c>ItemType</c> enum became.
+/// Model: docs/10-BACKEND-PHASE1.md Part C.1.
+/// </summary>
+public class ItemType
+{
+    public int ItemTypeId { get; set; }
+    public string Name { get; set; } = string.Empty;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,18 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// GL-ready journal entry emitted per stock movement (FR-STK-13) — data only, no
+/// posting in Phase 1 (the Accounting module consumes these later). One row per
+/// ledger entry, referencing the same source document polymorphically. Account
+/// codes are Phase-1 placeholders until a chart of accounts exists.
+/// Model: docs/10 Part C.7.
+/// </summary>
+public class JournalEntryStub
+{
+    public int JournalId { get; set; }
+    public string SourceDocType { get; set; } = string.Empty;
+    public int SourceDocId { get; set; }
+    public string DebitAccount { get; set; } = string.Empty;
+    public string CreditAccount { get; set; } = string.Empty;
+    public decimal Amount { get; set; }
+}
@@ -0,0 +1,24 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Per employee/type/year leave entitlement (FR-HR-LV-03). Unique on
+/// (EmployeeId, LeaveTypeId, Year). RemainingDays is a computed projection, not
+/// stored. Model: docs/12-BACKEND-HRM.md Part C.5.
+/// </summary>
+public class LeaveBalance
+{
+    public int LeaveBalanceId { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+    public int LeaveTypeId { get; set; }
+    public LeaveType? LeaveType { get; set; }
+    public int Year { get; set; }
+
+    public decimal EntitledDays { get; set; }
+    public decimal TakenDays { get; set; }
+    public decimal CarriedForwardDays { get; set; }
+    public decimal AdjustmentDays { get; set; }
+
+    public uint RowVersion { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+}
@@ -0,0 +1,31 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Leave request (FR-HR-LV-02) — transactional document, numbered via
+/// <see cref="NumberSequence"/> (docType "LV"). Model: docs/12-BACKEND-HRM.md Part C.5.
+/// </summary>
+public class LeaveRequest
+{
+    public int LeaveRequestId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+    public int LeaveTypeId { get; set; }
+    public LeaveType? LeaveType { get; set; }
+
+    public DateTime StartDate { get; set; }
+    public DateTime EndDate { get; set; }
+    public decimal DaysCount { get; set; }
+    public string? Reason { get; set; }
+
+    public LeaveRequestStatus Status { get; set; } = LeaveRequestStatus.Draft;
+    public int? ApprovedBy { get; set; }
+    public DateTime? ApprovedAt { get; set; }
+    public string? RejectionReason { get; set; }
+
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,23 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>Leave type master (FR-HR-LV-01). Model: docs/12-BACKEND-HRM.md Part C.5.</summary>
+public class LeaveType
+{
+    public int LeaveTypeId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public bool IsPaid { get; set; } = true;
+    /// <summary>Feeds Payroll's No-Pay deduction when true (docs/12-BACKEND-HRM.md §6).</summary>
+    public bool CountsAsNoPay { get; set; }
+    public decimal AccrualPerYear { get; set; }
+    public bool CarryForwardAllowed { get; set; }
+    public int? MaxCarryForwardDays { get; set; }
+    public bool RequiresApproval { get; set; } = true;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,26 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Loan installment ledger row. <see cref="PayrollRunId"/> is stamped only when the
+/// consuming <see cref="PayrollRun"/> reaches Locked (docs/12-BACKEND-HRM.md A.4).
+/// Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class LoanInstallment
+{
+    public int LoanInstallmentId { get; set; }
+    public int EmployeeLoanId { get; set; }
+    public EmployeeLoan? EmployeeLoan { get; set; }
+
+    public int InstallmentNumber { get; set; }
+    public int DueYear { get; set; }
+    public int DueMonth { get; set; }
+    public decimal ScheduledAmount { get; set; }
+    public decimal? PaidAmount { get; set; }
+    public int? PayrollRunId { get; set; }
+    public PayrollRun? PayrollRun { get; set; }
+    public LoanInstallmentStatus Status { get; set; } = LoanInstallmentStatus.Pending;
+
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,22 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A top-level sidebar entry (mirrors the frontend's hardcoded nav list,
+/// components/Layouts/AppSidebar.tsx). Seeded to match the current app routes;
+/// per-role visibility is controlled via <see cref="Permission"/>/<see cref="RolePermission"/>,
+/// not by editing these rows through the UI.
+/// </summary>
+public class NavItem
+{
+    public int NavItemId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Label { get; set; } = string.Empty;
+    public string? Icon { get; set; }
+    public string? Href { get; set; }
+    public int SortOrder { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public ICollection<SubNavItem> Children { get; set; } = new List<SubNavItem>();
+}
@@ -8,8 +8,8 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class NumberSequence
 {
-    public long SequenceId { get; set; }
+    public int SequenceId { get; set; }
    public string DocType { get; set; } = string.Empty;
    public int Year { get; set; }
-    public long LastNumber { get; set; }
+    public int LastNumber { get; set; }
 }
@@ -0,0 +1,41 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Per-employee payroll summary row (FR-HR-PAY-05). EpfEmployerAmount/EtfEmployerAmount
+/// are informational/liability only, never subtracted from NetSalary
+/// (docs/12-BACKEND-HRM.md B.4). Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class PayrollLine
+{
+    public int PayrollLineId { get; set; }
+    public int PayrollRunId { get; set; }
+    public PayrollRun? PayrollRun { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+
+    public decimal BasicSalary { get; set; }
+    public decimal TotalAllowances { get; set; }
+    public decimal OvertimeAmount { get; set; }
+    public decimal GrossSalary { get; set; }
+
+    public decimal LateDeductionAmount { get; set; }
+    public decimal NoPayAmount { get; set; }
+    public decimal LoanDeductionAmount { get; set; }
+    public decimal EpfEmployeeAmount { get; set; }
+    public decimal EpfEmployerAmount { get; set; }
+    public decimal EtfEmployerAmount { get; set; }
+    public decimal TaxAmount { get; set; }
+    public decimal OtherDeductionsAmount { get; set; }
+    public decimal NetSalary { get; set; }
+
+    public int WorkingDays { get; set; }
+    public int PresentDays { get; set; }
+    public int AbsentDays { get; set; }
+    public int LeaveDays { get; set; }
+    public int OtMinutesTotal { get; set; }
+    public int LateMinutesTotal { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public List<PayrollLineComponent> Components { get; set; } = new();
+}
@@ -0,0 +1,18 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>The detailed Basic/Transport/Meal/OT/Late/No-Pay/Loan/EPF/ETF/Tax breakdown. Model: docs/12-BACKEND-HRM.md Part C.6.</summary>
+public class PayrollLineComponent
+{
+    public int PayrollLineComponentId { get; set; }
+    public int PayrollLineId { get; set; }
+    public PayrollLine? PayrollLine { get; set; }
+    public PayrollLineComponentCategory ComponentCategory { get; set; }
+    /// <summary>Set only for structure-sourced Allowance/OtherDeduction lines; null for system-computed lines.</summary>
+    public int? SalaryComponentId { get; set; }
+    public SalaryComponent? SalaryComponent { get; set; }
+    public string Label { get; set; } = string.Empty;
+    public decimal Amount { get; set; }
+    public int SortOrder { get; set; }
+}
@@ -0,0 +1,33 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Payroll run (FR-HR-PAY-05/06) — the transactional document. Numbered via
+/// <see cref="NumberSequence"/> (docType "PAY"). Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class PayrollRun
+{
+    public int PayrollRunId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public int PeriodYear { get; set; }
+    public int PeriodMonth { get; set; }
+    /// <summary>Null = company-wide run.</summary>
+    public int? BranchId { get; set; }
+    public Branch? Branch { get; set; }
+    public PayrollRunStatus Status { get; set; } = PayrollRunStatus.Draft;
+
+    public int GeneratedBy { get; set; }
+    public DateTime GeneratedAt { get; set; }
+    public int? ApprovedBy { get; set; }
+    public DateTime? ApprovedAt { get; set; }
+    public int? LockedBy { get; set; }
+    public DateTime? LockedAt { get; set; }
+    public int? UnlockedBy { get; set; }
+    public DateTime? UnlockedAt { get; set; }
+    public string? UnlockReason { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public List<PayrollLine> Lines { get; set; } = new();
+}
@@ -0,0 +1,21 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Effective-dated EPF/ETF rates (FR-HR-PAY-04) — Sri Lanka defaults (EPF 8%
+/// employee / 12% employer, ETF 3% employer-only), configurable since government
+/// rates can change. Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class PayrollStatutorySetting
+{
+    public int PayrollStatutorySettingId { get; set; }
+    public decimal EpfEmployeeRate { get; set; } = 0.08m;
+    public decimal EpfEmployerRate { get; set; } = 0.12m;
+    public decimal EtfEmployerRate { get; set; } = 0.03m;
+    public decimal OtMultiplierDefault { get; set; } = 1.5m;
+    public DateTime EffectiveFrom { get; set; }
+    public DateTime? EffectiveTo { get; set; }
+
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,16 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Thin generation/release marker over a <see cref="PayrollLine"/> — ships as an
+/// HTML print view in this phase, per the confirmed decision (no PDF dependency).
+/// Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class Payslip
+{
+    public int PayslipId { get; set; }
+    public int PayrollLineId { get; set; }
+    public PayrollLine? PayrollLine { get; set; }
+    public DateTime GeneratedAt { get; set; }
+    public DateTime? ReleasedAt { get; set; }
+    public int? ReleasedBy { get; set; }
+}
@@ -0,0 +1,18 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A grantable sidebar-visibility unit — exactly one of <see cref="NavItemId"/> /
+/// <see cref="SubNavItemId"/> is set (enforced in <c>NavSeedService</c>/service layer,
+/// not by a DB constraint). One row is seeded per <see cref="NavItem"/>/<see cref="SubNavItem"/>;
+/// <see cref="RolePermission"/> grants it to a role.
+/// </summary>
+public class Permission
+{
+    public int PermissionId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public int? NavItemId { get; set; }
+    public int? SubNavItemId { get; set; }
+
+    public NavItem? NavItem { get; set; }
+    public SubNavItem? SubNavItem { get; set; }
+}
@@ -7,22 +7,22 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class PoLine
 {
-    public long PoLineId { get; set; }
+    public int PoLineId { get; set; }

-    public long PoId { get; set; }
+    public int PoId { get; set; }
    public PurchaseOrder? PurchaseOrder { get; set; }

-    public long ItemId { get; set; }
+    public int ItemId { get; set; }
    public Item? Item { get; set; }

-    public long UomId { get; set; }
+    public int UomId { get; set; }
    public Uom? Uom { get; set; }

-    public long WarehouseId { get; set; }
+    public int WarehouseId { get; set; }
    public Warehouse? Warehouse { get; set; }

    public decimal Qty { get; set; }
-    public decimal UnitPrice { get; set; }
+    public decimal UnitPrice { get; set; }//
    public decimal Tax { get; set; }
    public decimal QtyReceived { get; set; }
 }
@@ -0,0 +1,35 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Product configuration (FR-MD-11) — a <b>singleton row</b> (single-tenant, docs/00-CORE §1)
+/// gating optional product master-data features.
+/// <para>
+/// <see cref="SubcategoriesEnabled"/> and <see cref="BrandsEnabled"/> are enforced
+/// server-side: an Item write carrying a subcategory/brand while the flag is off is
+/// rejected with <c>CONFIG_DISABLED</c>. <see cref="ItemTypesEnabled"/> is
+/// <b>advisory only</b> — items carry no item-type reference (see <see cref="ItemType"/>),
+/// so there is nothing on a write to reject; the frontend honours it by hiding the
+/// builder's type section. Reads are never gated, so existing data stays visible after a
+/// flag is switched off.
+/// </para>
+/// Model: docs/10-BACKEND-PHASE1.md Part C.1.
+/// </summary>
+public class ProductConfig
+{
+    /// <summary>Always 1 — the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    public int ConfigId { get; set; }
+
+    public bool SubcategoriesEnabled { get; set; } = true;
+    public bool BrandsEnabled { get; set; } = true;
+    public bool ItemTypesEnabled { get; set; } = true;
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}
@@ -11,19 +11,19 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class PurchaseOrder
 {
-    public long PoId { get; set; }
+    public int PoId { get; set; }
    public string DocNo { get; set; } = string.Empty;

-    public long VendorId { get; set; }
+    public int VendorId { get; set; }
    public Vendor? Vendor { get; set; }

-    public long? RequisitionId { get; set; }
+    public int? RequisitionId { get; set; }
    public Requisition? Requisition { get; set; }

    public PurchaseOrderStatus Status { get; set; } = PurchaseOrderStatus.Draft;
    public bool ApprovalRequired { get; set; }

-    public long CreatedBy { get; set; }
+    public int CreatedBy { get; set; }
    public User? Creator { get; set; }

    public DateTime CreatedAt { get; set; }
@@ -0,0 +1,32 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Purchase return header (FR-PROC-08) — returns received goods to a vendor,
+/// generating an outbound stock movement. Auto-posts with a mandatory reason code.
+/// Model: docs/10 Part C.2.
+/// </summary>
+public class PurchaseReturn
+{
+    public int ReturnId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int VendorId { get; set; }
+    public Vendor? Vendor { get; set; }
+
+    public int WarehouseId { get; set; }
+    public Warehouse? Warehouse { get; set; }
+
+    public int ReasonCodeId { get; set; }
+    public ReasonCode? ReasonCode { get; set; }
+
+    public ReturnStatus Status { get; set; } = ReturnStatus.Posted;
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+
+    public ICollection<PurchaseReturnLine> Lines { get; set; } = new List<PurchaseReturnLine>();
+}
@@ -0,0 +1,21 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Purchase-return line (FR-PROC-08) referencing the original GRN line for
+/// traceability. <see cref="Qty"/> is in base UOM. Model: docs/10 Part C.2.
+/// </summary>
+public class PurchaseReturnLine
+{
+    public int ReturnLineId { get; set; }
+
+    public int ReturnId { get; set; }
+    public PurchaseReturn? Return { get; set; }
+
+    public int? GrnLineId { get; set; }
+    public GrnLine? GrnLine { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public decimal Qty { get; set; }
+}
@@ -0,0 +1,15 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Configurable reason code for adjustments, returns and count variances
+/// (FR-X-04). Model: docs/10 Part C.7.
+/// </summary>
+public class ReasonCode
+{
+    public int ReasonCodeId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Description { get; set; } = string.Empty;
+    public ReasonContext Context { get; set; }
+}
@@ -8,10 +8,10 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class Requisition
 {
-    public long RequisitionId { get; set; }
+    public int RequisitionId { get; set; }
    public string DocNo { get; set; } = string.Empty;

-    public long RequestedBy { get; set; }
+    public int RequestedBy { get; set; }
    public User? Requester { get; set; }

    public RequisitionStatus Status { get; set; } = RequisitionStatus.Draft;
@@ -3,12 +3,12 @@ namespace ERPCore.Domain.Entities;
 /// <summary>Requisition line (FR-PROC-01). Model: docs/10 Part C.2.</summary>
 public class RequisitionLine
 {
-    public long ReqLineId { get; set; }
+    public int ReqLineId { get; set; }

-    public long RequisitionId { get; set; }
+    public int RequisitionId { get; set; }
    public Requisition? Requisition { get; set; }

-    public long ItemId { get; set; }
+    public int ItemId { get; set; }
    public Item? Item { get; set; }

    public decimal Qty { get; set; }
@@ -8,10 +8,10 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class Rfq
 {
-    public long RfqId { get; set; }
+    public int RfqId { get; set; }
    public string DocNo { get; set; } = string.Empty;

-    public long RequisitionId { get; set; }
+    public int RequisitionId { get; set; }
    public Requisition? Requisition { get; set; }

    public RfqStatus Status { get; set; } = RfqStatus.Open;
@@ -3,12 +3,12 @@ namespace ERPCore.Domain.Entities;
 /// <summary>RFQ line — an item + quantity being quoted (FR-PROC-02). Model: docs/10 Part C.2.</summary>
 public class RfqLine
 {
-    public long RfqLineId { get; set; }
+    public int RfqLineId { get; set; }

-    public long RfqId { get; set; }
+    public int RfqId { get; set; }
    public Rfq? Rfq { get; set; }

-    public long ItemId { get; set; }
+    public int ItemId { get; set; }
    public Item? Item { get; set; }

    public decimal Qty { get; set; }
@@ -0,0 +1,27 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Local shadow/projection of an AuthHex <c>Role</c> row, mirroring the same
+/// pattern <see cref="User"/> uses for AuthHex identities: <see cref="AuthRoleId"/>
+/// maps to AuthHex's Guid <c>RoleId</c>, while the local <see cref="RoleId"/> (int)
+/// is what <see cref="Permission"/>/<see cref="RolePermission"/>/<see cref="User.RoleId"/>
+/// FKs reference. AuthHex remains the source of truth; writes are forwarded there
+/// first (<c>IAuthHexClient</c>) and mirrored here on success.
+/// </summary>
+public class Role
+{
+    public int RoleId { get; set; }
+    public Guid AuthRoleId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public bool IsSystemRole { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,11 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>Join row granting a <see cref="Role"/> visibility of a <see cref="Permission"/> (nav node).</summary>
+public class RolePermission
+{
+    public int RoleId { get; set; }
+    public int PermissionId { get; set; }
+
+    public Role? Role { get; set; }
+    public Permission? Permission { get; set; }
+}
@@ -0,0 +1,19 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>Allowance/ad hoc deduction master (FR-HR-PAY-01). Model: docs/12-BACKEND-HRM.md Part C.6.</summary>
+public class SalaryComponent
+{
+    public int SalaryComponentId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public SalaryComponentType ComponentType { get; set; }
+    public bool IsTaxable { get; set; }
+    public bool IsEpfEtfApplicable { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,16 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Serial number for a serial-tracked item across its lifecycle (FR-WH-04).
+/// Model: docs/10 Part C.4.
+/// </summary>
+public class Serial
+{
+    public int SerialId { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public string SerialNo { get; set; } = string.Empty;
+    public string Status { get; set; } = "InStock";
+}
@@ -0,0 +1,31 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Stock adjustment header (FR-STK-07) — the highest-risk feature in the phase
+/// (02-SECURITY C.5). Auto-posts in Phase 1 with a mandatory reason code and user
+/// stamp. Mutable aggregate with an <see cref="RowVersion"/> token (docs/10 C.10).
+/// Model: docs/10 Part C.6.
+/// </summary>
+public class StockAdjustment
+{
+    public int AdjustmentId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int WarehouseId { get; set; }
+    public Warehouse? Warehouse { get; set; }
+
+    public int ReasonCodeId { get; set; }
+    public ReasonCode? ReasonCode { get; set; }
+
+    public AdjustmentStatus Status { get; set; } = AdjustmentStatus.Posted;
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public ICollection<StockAdjustmentLine> Lines { get; set; } = new List<StockAdjustmentLine>();
+}
@@ -0,0 +1,23 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Adjustment line (FR-STK-07). <see cref="QtyDelta"/> is a signed base-UOM
+/// quantity: negative consumes FIFO layers, positive creates a layer at last cost.
+/// Model: docs/10 Part C.6.
+/// </summary>
+public class StockAdjustmentLine
+{
+    public int AdjLineId { get; set; }
+
+    public int AdjustmentId { get; set; }
+    public StockAdjustment? Adjustment { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public int? BinId { get; set; }
+    public int? BatchId { get; set; }
+    public int? SerialId { get; set; }
+
+    public decimal QtyDelta { get; set; }
+}
@@ -0,0 +1,29 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Cycle/full physical count header (FR-STK-08). System quantities are snapshotted
+/// at creation and are immutable once opened (02-SECURITY C.7); posting emits a
+/// variance adjustment. Mutable aggregate with an <see cref="RowVersion"/> token.
+/// Model: docs/10 Part C.6.
+/// </summary>
+public class StockCount
+{
+    public int CountId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int WarehouseId { get; set; }
+    public Warehouse? Warehouse { get; set; }
+
+    public CountType CountType { get; set; }
+    public CountStatus Status { get; set; } = CountStatus.Draft;
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public ICollection<StockCountLine> Lines { get; set; } = new List<StockCountLine>();
+}
@@ -0,0 +1,22 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Count line (FR-STK-08). <see cref="SystemQty"/> is the immutable snapshot;
+/// <see cref="Variance"/> = counted − system (in base UOM). Model: docs/10 Part C.6.
+/// </summary>
+public class StockCountLine
+{
+    public int CountLineId { get; set; }
+
+    public int CountId { get; set; }
+    public StockCount? Count { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public int? BinId { get; set; }
+
+    public decimal SystemQty { get; set; }
+    public decimal? CountedQty { get; set; }
+    public decimal? Variance { get; set; }
+}
@@ -0,0 +1,33 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// FIFO cost layer — a quantity received at a specific unit cost, consumed
+/// oldest-first (FR-STK-02). Keyed per item **per warehouse**; quantities and
+/// <see cref="UnitCost"/> are in the item's base UOM. Answers valuation
+/// ("what's on hand and at what cost"). Model: docs/10 Part C.5.
+/// </summary>
+public class StockLayer
+{
+    public int LayerId { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public int WarehouseId { get; set; }
+    public Warehouse? Warehouse { get; set; }
+
+    public int? BatchId { get; set; }
+    public Batch? Batch { get; set; }
+
+    public int? SerialId { get; set; }
+    public Serial? Serial { get; set; }
+
+    /// <summary>Originating GRN line — carries the inspection hold status for this stock.</summary>
+    public int? GrnLineId { get; set; }
+    public GrnLine? GrnLine { get; set; }
+
+    public decimal QtyReceived { get; set; }
+    public decimal QtyRemaining { get; set; }
+    public decimal UnitCost { get; set; }
+    public DateTime ReceiptDate { get; set; }
+}
@@ -0,0 +1,32 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Immutable, append-only stock ledger (FR-STK-01, FR-X-05). One row per costed
+/// movement; answers history ("what moved, when, by whom"). The originating
+/// document is referenced polymorphically via
+/// <see cref="SourceDocType"/>/<see cref="SourceDocId"/> (no hard FK per type) so
+/// new transaction types write here without a schema change. Model: docs/10 Part C.5.
+/// </summary>
+public class StockLedger
+{
+    public int LedgerId { get; set; }
+
+    public int ItemId { get; set; }
+    public int WarehouseId { get; set; }
+    public int? BinId { get; set; }
+    public int? BatchId { get; set; }
+    public int? SerialId { get; set; }
+    public int UserId { get; set; }
+
+    public Direction Direction { get; set; }
+    public decimal QtyBase { get; set; }
+    public decimal UnitCost { get; set; }
+    public decimal Value { get; set; }
+    public decimal RunningBalance { get; set; }
+
+    public string SourceDocType { get; set; } = string.Empty;
+    public int SourceDocId { get; set; }
+    public DateTime CreatedAt { get; set; }
+}
@@ -0,0 +1,31 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Inter-warehouse stock transfer header (FR-STK-05/06). Dispatch consumes source
+/// FIFO layers into in-transit; receive creates the destination layer at the
+/// inherited cost (cost-preserving). Mutable aggregate with an
+/// <see cref="RowVersion"/> token (docs/10 C.10). Model: docs/10 Part C.6.
+/// </summary>
+public class StockTransfer
+{
+    public int TransferId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int SrcWarehouseId { get; set; }
+    public Warehouse? SrcWarehouse { get; set; }
+
+    public int DestWarehouseId { get; set; }
+    public Warehouse? DestWarehouse { get; set; }
+
+    public TransferStatus Status { get; set; } = TransferStatus.Draft;
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public ICollection<StockTransferLine> Lines { get; set; } = new List<StockTransferLine>();
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Sasanka	cea6158cd9	Refactor: Remove unused imports and clean up code across multiple pages - Removed unused Link imports and associated code for navigation in various pages. - Simplified TableHeader components by removing unnecessary class names. - Updated alert dialog styles for better consistency with the design system. - Cleaned up imports in several components to streamline the codebase.	2026-07-31 10:26:08 +05:30
ImanThiyanga	415ac94ab2	Merge pull request 'Dashborad and prouction' (#18 ) from Dashborad-and-prouction into Dev Reviewed-on: #18	2026-07-29 17:08:57 +00:00
Sasanka	4561ef7ba8	feat: implement frontend-only mock for production lines and runs - Add ProductionTemplatesPage component for managing production templates with a visual representation using React Flow. - Create LineHeaderNode and LineStageNode components for rendering production line nodes. - Introduce RunStageNode and RunHeaderNode components for displaying run stages and headers. - Implement StageProgressStrip for visualizing stage progress in runs. - Create mock data for production runs and templates to simulate backend functionality. - Define types for production templates and runs to structure mock data. - Document frontend Phase 2 specifications for manufacturing processes, including screens, dialogs, and validation posture.	2026-07-28 22:55:56 +05:30
Sasanka	b12adebaa0	feat: add dashboard overview stats endpoint and UI integration - Implemented `GET /dashboard/stats` in `DashboardController` to provide aggregate counts for stock, GRN, and procurement. - Created `DashboardStatsDto` and `WarehouseValuationDto` to structure the response data. - Developed `DashboardService` to fetch and compute necessary statistics from the database. - Added `IDashboardService` interface for service abstraction. - Introduced API client methods in `dashboard.ts` for frontend consumption of the new endpoint. - Defined TypeScript types for dashboard data in `dashboard.ts` to ensure type safety in the frontend. - Updated UI components in the frontend to reflect changes in the dashboard, including styling adjustments and removal of unused icons.	2026-07-28 14:59:09 +05:30
ImanThiyanga	0b95d6f1cd	Merge pull request 'feat: enhance UI components and add vibrant theme support' (#17 ) from ui-fixers into Dev Reviewed-on: #17	2026-07-27 06:10:10 +00:00
ImanThiyanga	d35b076435	Merge branch 'Dev' into ui-fixers	2026-07-27 06:10:00 +00:00
Sasanka	c564916c60	feat: enhance UI components and add vibrant theme support - Updated layout and styling for various dashboard pages including stock adjustments, counts, transfers, wastage, and vendors to improve responsiveness and visual consistency. - Introduced a vibrant theme option in the theme toggle component, allowing users to switch between light, dark, and vibrant themes. - Refactored button styles across login and forgot password pages for better accessibility and visual feedback. - Improved sidebar navigation with expanded functionality for items without dedicated pages. - Enhanced data table styling for better readability and user interaction. - Added new background images to support the vibrant theme.	2026-07-27 11:11:26 +05:30
Dhananjaya99	86bb4d4908	Merge branch 'Dev' of https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core into Dev	2026-07-24 14:33:55 +05:30
Dhananjaya99	816ffbbfb6	setting not found issue	2026-07-24 14:33:49 +05:30
ashan_rusiru	ae20bc4e34	Merge pull request 'develop full initial module' (#16 ) from Feature_HRM into Dev Reviewed-on: #16	2026-07-24 05:25:13 +00:00
Dhananjaya99	755df494fe	develop full initial module	2026-07-23 19:54:56 +05:30
Dhananjaya99	eacc21afad	Merge branch 'fixers-7/23' into Dev	2026-07-23 13:02:24 +05:30
Sasanka	7366ca93c0	feat: implement theme toggle and enhance UI components	2026-07-23 12:53:26 +05:30
ImanThiyanga	5af77fbf0a	Merge pull request 'feat: Implement fixed sale price functionality for items' (#14 ) from fix/grn-varient into Dev Reviewed-on: #14	2026-07-23 06:48:46 +00:00
ImanThiyanga	a1b3985469	feat: Implement fixed sale price functionality for items - Added a toggle for fixed sale price vs stock value in the item creation form. - Introduced validation to ensure all variants have a price greater than 0 when fixed price mode is selected. - Updated the item model to include a nullable salePrice field, which is used for sales only and does not affect GRN/FIFO/ledger. - Enhanced the GRN page to allow off-PO items and included a refresh button to update the item list without reloading the page. - Updated documentation to reflect changes in item pricing and GRN handling.	2026-07-23 12:12:32 +05:30
ImanThiyanga	5cf9588728	role code error fixed	2026-07-22 16:14:49 +05:30
ImanThiyanga	9260b4de9b	Merge branch 'production' into Dev	2026-07-22 06:12:28 +00:00
ImanThiyanga	46e971ef25	Merge pull request 'Feat/po grn' (#12 ) from feat/po-GRN into Dev Reviewed-on: #12	2026-07-21 11:04:58 +00:00
ImanThiyanga	f8b9ee8f6c	Merge branch 'feat/po-GRN' of https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core into feat/po-GRN	2026-07-21 16:27:05 +05:30
ImanThiyanga	4108062416	ui fixes	2026-07-21 16:26:32 +05:30
ImanThiyanga	03bc85b788	feat(procurement): enhance purchase order and GRN functionalities - Updated purchase order descriptions for clarity on draft and submission processes. - Implemented submit and delete functionalities for draft purchase orders, allowing users to manage their orders more effectively. - Added discount and VAT fields to GRN lines, enabling better cost tracking and reporting. - Enhanced validation for GRN lines to ensure discount and VAT percentages are within acceptable ranges. - Updated API to support new functionalities, including submitting and deleting purchase orders. - Improved UI components for better user experience in managing purchase orders and GRNs. - Documented changes in security and backend phase documentation to reflect new processes and requirements.	2026-07-21 16:26:32 +05:30
ImanThiyanga	9158cd8c82	ui fixes	2026-07-21 11:55:40 +05:30
ImanThiyanga	951961b798	Merge pull request 'feat: enhance product management features' (#11 ) from products-fixers into Dev Reviewed-on: #11	2026-07-21 04:40:18 +00:00
ImanThiyanga	f02c89b3cb	feat(procurement): enhance purchase order and GRN functionalities - Updated purchase order descriptions for clarity on draft and submission processes. - Implemented submit and delete functionalities for draft purchase orders, allowing users to manage their orders more effectively. - Added discount and VAT fields to GRN lines, enabling better cost tracking and reporting. - Enhanced validation for GRN lines to ensure discount and VAT percentages are within acceptable ranges. - Updated API to support new functionalities, including submitting and deleting purchase orders. - Improved UI components for better user experience in managing purchase orders and GRNs. - Documented changes in security and backend phase documentation to reflect new processes and requirements.	2026-07-21 10:08:32 +05:30
Sasanka	295ec5799f	feat: enhance product management features - Implement sorting and filtering for categories in the dashboard. - Add status filtering and sorting capabilities for categories. - Introduce warehouse selection and base UOM configuration in the new item creation page. - Fetch and display brands and subcategories in the items page. - Update product settings to manage subcategories and brands. - Refactor sidebar navigation to include configuration options.	2026-07-20 17:11:13 +05:30
ImanThiyanga	fe9e8a780f	ui updated	2026-07-20 12:00:03 +05:30
Dhananjaya99	92c4b14a6c	add rbac	2026-07-18 23:42:58 +05:30
ashan_rusiru	80b130dffb	Merge pull request 'Feat/be inventory' (#10 ) from feat/be-inventory into Dev Reviewed-on: #10	2026-07-18 08:38:47 +00:00
ImanThiyanga	62a5d857de	Complete all for Items	2026-07-17 14:27:51 +05:30
ImanThiyanga	f72b24fcaa	completed invetory updates	2026-07-17 00:23:33 +05:30
ImanThiyanga	7c5faabc2d	ath fix	2026-07-16 14:23:23 +05:30
ImanThiyanga	582782b0fe	Merge pull request 'feat: add brands and variant categories management' (#8 ) from inventry-and-supply-chain-management into Dev Reviewed-on: #8	2026-07-16 05:35:18 +00:00
ImanThiyanga	250cf89abb	Merge branch 'Dev' into inventry-and-supply-chain-management	2026-07-16 05:35:12 +00:00
Sasanka	c9a84e235b	feat: add brands and variant categories management - Implemented CRUD operations for brands and variant categories in the API. - Created UI components for managing brands and variant categories, including listing, creating, editing, and deleting. - Enhanced the sidebar navigation to include links for brands and variant categories. - Updated the categories API to support pagination and filtering. - Added validation for brand and variant category names. - Integrated toast notifications for user feedback on actions.	2026-07-15 18:11:35 +05:30
ImanThiyanga	baaf51ba99	Merge pull request 'Dev' (#7 ) from Dev into production Reviewed-on: #7	2026-07-15 10:08:07 +00:00
ImanThiyanga	5d18d5d576	Merge branch 'production' into Dev	2026-07-15 10:08:02 +00:00
ImanThiyanga	ed2ee87c68	Refactor code structure for int in alll ids instesd defult using long	2026-07-15 15:35:54 +05:30
ImanThiyanga	6c7f53350f	Merge pull request 'Inventry and supply chain management' (#6 ) from inventry-and-supply-chain-management into Dev Reviewed-on: #6	2026-07-15 08:04:34 +00:00
Sasanka	0e4bcf174b	Refactor API client and remove unused code - Removed the ApiError class and related functions from the api-client module. - Updated vendor detail page to handle errors without the ApiError class. - Refactored various API modules to use in-memory mock data instead of commented-out fetch implementations. - Removed the auth-token module as it was no longer needed. - Updated error handling to use a more generic error structure. - Adjusted common types to include ApiResult interface for better type management.	2026-07-15 10:28:14 +05:30
Sasanka	cb9fd7dfa8	Revert "Refactor API modules to remove mock implementations and integrate real endpoints" This reverts commit	2026-07-15 10:27:38 +05:30
ImanThiyanga	4b2914cd5d	Merge pull request 'Add migration to add auth_user_id column to users table' (#5 ) from fix/phase-01 into Dev Reviewed-on: #5	2026-07-14 11:02:51 +00:00
ImanThiyanga	ae7627fcf2	Merge branch 'Dev' into fix/phase-01	2026-07-14 11:02:44 +00:00
ImanThiyanga	67150425e4	Add migration to add auth_user_id column to users table - Introduced a new column 'auth_user_id' of type UUID to the 'users' table. - Updated existing user data to set 'auth_user_id' to null for UserId 1. - Created a unique index on 'auth_user_id' to enforce uniqueness. - Implemented rollback functionality to remove the column and index if needed.	2026-07-14 16:30:45 +05:30
Sasanka	0415794473	Refactor API modules to remove mock implementations and integrate real endpoints - Updated stock-transfers.ts to replace mock data with API requests for stock transfers. - Refactored stock.ts to utilize API calls for stock inquiries instead of mock data. - Modified uoms.ts to implement real API requests for unit of measure operations. - Transitioned vendors.ts to use actual API endpoints for vendor management, removing mock data handling. - Updated warehouses.ts to replace mock implementations with real API calls for warehouse and bin management. - Refactored wastage.ts to utilize stock adjustments and reason codes APIs, removing mock data dependencies. - Adjusted procurement.ts to align with backend DTO shapes, ensuring consistency with planned backend structures.	2026-07-14 16:01:47 +05:30
ImanThiyanga	9e1aa57987	Merge pull request 'feat: Add new services and interfaces for GRN, Purchase Return, Reason Code, Reorder, Stock, and Transfer functionalities' (#3 ) from fix/phase-01 into Dev Reviewed-on: #3	2026-07-14 05:12:25 +00:00
ImanThiyanga	22f86451e3	feat: Add new services and interfaces for GRN, Purchase Return, Reason Code, Reorder, Stock, and Transfer functionalities - Implemented IGrnService for managing goods receipts including retrieval, creation, and confirmation. - Created IPurchaseReturnService for handling purchase return operations. - Added IReasonCodeService for managing reason codes with listing and creation capabilities. - Developed IReorderService for fetching reorder alerts and creating suggested requisitions. - Introduced IStockMutator for applying stock changes and posting ledger entries. - Established IStockService for stock inquiries, ledger retrieval, and valuation. - Created ITransferService for managing inter-warehouse transfers including dispatch and receiving operations. - Implemented PurchaseReturnService to handle purchase return logic and stock adjustments. - Developed ReasonCodeService for listing and creating reason codes. - Created ReorderService for fetching reorder alerts and generating requisitions. - Implemented FifoCostingService for FIFO cost-layer management and ledger writing. - Developed StockMutator for applying stock deltas and posting ledger entries. - Created StockService for stock inquiries and ledger management. - Implemented TransferService for managing inter-warehouse transfers with dispatch and receive functionalities.	2026-07-14 10:20:38 +05:30
Sasanka	7ac30bb454	feat: add warehouse and bin management API with mock data implementation - Implemented warehouses API with methods for listing, creating, and managing bins. - Added wastage API to handle stock write-offs and integrate with stock adjustments. - Created auth token management for storing and retrieving access tokens. - Developed error mapping for consistent user-facing error messages. - Introduced client-side validations for GRN, master data, and procurement processes. - Defined common types for pagination, problem details, and various master data entities. - Established procurement and stock management types to support frontend functionality.	2026-07-13 17:11:40 +05:30
ImanThiyanga	0aa05f10f2	Merge pull request 'feat: Implement Category, Item, UOM, Vendor, and Warehouse services with CRUD operations' (#2 ) from feat/phase-implemtation into production Reviewed-on: #2	2026-07-10 05:15:59 +00:00