Merge branch 'Dev' into feat/ci-cd-implementation

Reviewed-on: #57

.gitattributes

@@ -0,0 +1,10 @@
+# Deployment assets execute on the Linux runner / VPS. Force LF no matter which OS commits them:
+# a CRLF script fails with "/usr/bin/env: 'bash\r': No such file or directory".
+*.sh            text eol=lf
+*.service       text eol=lf
+*.conf          text eol=lf
+*.yml           text eol=lf
+*.yaml          text eol=lf
+Dockerfile      text eol=lf
+.dockerignore   text eol=lf
+*.env.example   text eol=lf

.gitea/workflows/ci-cd.yml

@@ -0,0 +1,509 @@
+# CI/CD — ERP Core. One workflow for pull-request checks and the production deploy
+# (https://erp.hexdive.com). Runbook: docs/40-DEPLOYMENT.md, "Active".
+#
+# Which jobs run for which event:
+#   PR opened / updated into Dev or production → checks: detect → backend / frontend / e2e-typecheck /
+#                                                scripts (only the sides the PR touches) → ci-ok
+#   PR merged into production                  → build-and-deploy (checks are skipped)
+#   PR merged into Dev, or closed unmerged     → nothing (every job skipped)
+#   Run workflow (manual)                      → build-and-deploy with the deploy_backend / deploy_frontend boxes
+#
+# Checks: `ci-ok` is the single required status check for branch protection. It passes when every
+# check passed or was skipped, and rejects PRs into production that don't come from Dev or hotfix/*.
+#
+# Deploy: same shape as the Fitness workflows (publish on the host → stop → copy → fix permissions →
+# start → verify), plus: only the side whose folder changed in the PR is deployed, the database is
+# backed up when the PR changes migrations, and the verify steps FAIL the job (no automatic rollback).
+# Detection only sees the PR being merged: after a failed deploy, fix it and use "Run workflow".
+# The test environment is on hold (deploy/on-hold/).
+#
+# Security model: the dotnet/npm/tsc/eslint check work runs in capped containers without secrets, but
+# the deploy/scripts/*.sh steps come from the PR checkout and run on the host runner as root, some with
+# ERPSECRET in their environment. Acceptable only while the repo is private and every PR author is a
+# trusted team member.
+name: CI/CD - ERP Core
+
+on:
+  pull_request:
+    branches:
+      - Dev
+      - production
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - closed
+  workflow_dispatch:
+    inputs:
+      deploy_backend:
+        description: "Deploy the backend (after changing the config in this file's env: block, or after a failed deploy)"
+        type: boolean
+        default: false
+      deploy_frontend:
+        description: "Deploy the frontend"
+        type: boolean
+        default: false
+
+# One group for the whole file, never cancelled: a deploy (or its migration) must not be interrupted
+# by a PR push. Superseded check runs therefore queue instead of being cancelled; with the runner at
+# capacity 1 they would run one after another anyway.
+concurrency:
+  group: erp-core-cicd
+  cancel-in-progress: false
+
+jobs:
+  # ════════════════════════════ Pull-request checks ════════════════════════════
+  detect:
+    name: detect
+    if: github.event_name == 'pull_request' && github.event.action != 'closed'
+    runs-on: linux
+    outputs:
+      backend: ${{ steps.detect.outputs.backend }}
+      frontend: ${{ steps.detect.outputs.frontend }}
+      e2e: ${{ steps.detect.outputs.e2e }}
+      scripts: ${{ steps.detect.outputs.scripts }}
+    steps:
+      - name: Checkout PR head
+        env:
+          ERP_GIT_TOKEN: ${{ secrets.ERPSECRET }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REF: refs/pull/${{ github.event.pull_request.number }}/head
+        run: |
+          basic="$(printf 'oauth2:%s' "$ERP_GIT_TOKEN" | base64 | tr -d '\n')"
+          url="https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git"
+          git init -q .
+          git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 1 "$url" "$SHA" \
+            || git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 50 "$url" "$REF"
+          git checkout -qf "$SHA" && git clean -ffdxq
+          git log -1 --format='checked out %h %s'
+      - name: Detect changed sides
+        id: detect
+        env:
+          ERP_GIT_TOKEN: ${{ secrets.ERPSECRET }}
+          BASE_REF: ${{ github.base_ref }}
+        run: bash deploy/scripts/ci-detect.sh
+
+  backend:
+    name: backend
+    needs: detect
+    if: needs.detect.outputs.backend == 'true'
+    runs-on: linux
+    steps:
+      - name: Checkout PR head
+        env:
+          ERP_GIT_TOKEN: ${{ secrets.ERPSECRET }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REF: refs/pull/${{ github.event.pull_request.number }}/head
+        run: |
+          basic="$(printf 'oauth2:%s' "$ERP_GIT_TOKEN" | base64 | tr -d '\n')"
+          url="https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git"
+          git init -q .
+          git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 1 "$url" "$SHA" \
+            || git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 50 "$url" "$REF"
+          git checkout -qf "$SHA" && git clean -ffdxq
+      - name: Build, test, pending model changes
+        run: bash deploy/scripts/ci-backend.sh
+      - name: Destructive migration scan
+        env:
+          ERP_GIT_TOKEN: ${{ secrets.ERPSECRET }}
+          BASE_REF: ${{ github.base_ref }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: bash deploy/scripts/migration-scan.sh
+
+  frontend:
+    name: frontend
+    needs: detect
+    if: needs.detect.outputs.frontend == 'true'
+    runs-on: linux
+    steps:
+      - name: Checkout PR head
+        env:
+          ERP_GIT_TOKEN: ${{ secrets.ERPSECRET }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REF: refs/pull/${{ github.event.pull_request.number }}/head
+        run: |
+          basic="$(printf 'oauth2:%s' "$ERP_GIT_TOKEN" | base64 | tr -d '\n')"
+          url="https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git"
+          git init -q .
+          git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 1 "$url" "$SHA" \
+            || git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 50 "$url" "$REF"
+          git checkout -qf "$SHA" && git clean -ffdxq
+      # Checks only (no image): build-and-deploy builds its own image with `docker build` after the merge.
+      - name: Type-check, lint, build
+        run: |
+          z=""; if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then z=":z"; fi
+          docker run --rm --cpus=2 --memory=2500m \
+            -e CI=true -e NEXT_TELEMETRY_DISABLED=1 -e NODE_OPTIONS=--max-old-space-size=2048 \
+            -v "$PWD/Frontend/erp-system:/app$z" -v erp-npm-cache:/root/.npm -w /app node:24-alpine \
+            sh -ec 'npm ci --no-audit --no-fund && npx tsc --noEmit && npx eslint . && npm run build'
+
+  e2e-typecheck:
+    name: e2e-typecheck
+    needs: detect
+    if: needs.detect.outputs.e2e == 'true'
+    runs-on: linux
+    steps:
+      - name: Checkout PR head
+        env:
+          ERP_GIT_TOKEN: ${{ secrets.ERPSECRET }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REF: refs/pull/${{ github.event.pull_request.number }}/head
+        run: |
+          basic="$(printf 'oauth2:%s' "$ERP_GIT_TOKEN" | base64 | tr -d '\n')"
+          url="https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git"
+          git init -q .
+          git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 1 "$url" "$SHA" \
+            || git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 50 "$url" "$REF"
+          git checkout -qf "$SHA" && git clean -ffdxq
+      - name: Type-check Playwright specs
+        run: |
+          z=""; if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then z=":z"; fi
+          docker run --rm --cpus=1 --memory=768m \
+            -v "$PWD/Testing/e2e:/e2e$z" -v erp-npm-cache:/root/.npm -w /e2e node:24-alpine \
+            sh -ec 'npm ci --no-audit --no-fund && npx tsc --noEmit'
+
+  scripts:
+    name: scripts
+    needs: detect
+    if: needs.detect.outputs.scripts == 'true'
+    runs-on: linux
+    steps:
+      - name: Checkout PR head
+        env:
+          ERP_GIT_TOKEN: ${{ secrets.ERPSECRET }}
+          SHA: ${{ github.event.pull_request.head.sha }}
+          REF: refs/pull/${{ github.event.pull_request.number }}/head
+        run: |
+          basic="$(printf 'oauth2:%s' "$ERP_GIT_TOKEN" | base64 | tr -d '\n')"
+          url="https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git"
+          git init -q .
+          git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 1 "$url" "$SHA" \
+            || git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 50 "$url" "$REF"
+          git checkout -qf "$SHA" && git clean -ffdxq
+      - name: bash -n + shellcheck
+        run: |
+          for f in deploy/scripts/*.sh; do bash -n "$f"; done
+          z=""; if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then z=":z"; fi
+          files=""; for f in deploy/scripts/*.sh; do files="$files /mnt/${f#deploy/}"; done
+          # shellcheck disable=SC2086
+          docker run --rm -v "$PWD/deploy:/mnt$z" koalaman/shellcheck:stable \
+            --severity=warning --external-sources --source-path=SCRIPTDIR $files
+
+  ci-ok:
+    name: ci-ok
+    needs: [detect, backend, frontend, e2e-typecheck, scripts]
+    if: always() && github.event_name == 'pull_request' && github.event.action != 'closed'
+    runs-on: linux
+    steps:
+      - name: All required checks passed or were skipped
+        env:
+          RESULTS: >-
+            detect=${{ needs.detect.result }}
+            backend=${{ needs.backend.result }}
+            frontend=${{ needs.frontend.result }}
+            e2e-typecheck=${{ needs.e2e-typecheck.result }}
+            scripts=${{ needs.scripts.result }}
+          BASE_REF: ${{ github.base_ref }}
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          failed=0
+          for r in $RESULTS; do
+            case "${r#*=}" in
+              success|skipped) echo "ok      $r" ;;
+              *) echo "FAILED  $r"; failed=1 ;;
+            esac
+          done
+          if [ "$BASE_REF" = production ]; then
+            case "$HEAD_REF" in
+              Dev|hotfix/*) ;;
+              *) echo "PRs into production must come from Dev or hotfix/* (this one is from '$HEAD_REF')"; failed=1 ;;
+            esac
+          fi
+          exit "$failed"
+
+  # ════════════════════════════ Production deploy ════════════════════════════
+  # No `needs: ci-ok`: that job belongs to the PR-open events and is skipped on a merge, so the
+  # deploy would never run. The pre-merge gate is branch protection requiring ci-ok.
+  build-and-deploy:
+    name: Build & Deploy
+    runs-on: linux
+    # base.ref matters: without it a PR merged into Dev would deploy production.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+       github.event.pull_request.base.ref == 'production')
+    env:
+      PUBLISH_DIR: /home/erp/core/publish
+      BUILD_DIR: /tmp/erp-deploy
+      SERVICE: erpcore.service
+      SERVICE_USER: erpuser
+      BACKEND_PORT: "5220"
+      DB_NAME: ERPCore
+      DB_USER: erpcore
+      BACKUP_DIR: /var/backups/erpcore
+      WEB_IMAGE: erp-web:latest
+      WEB_CONTAINER: erp-web
+      WEB_PORT: "3020"
+      # ── Backend runtime config ────────────────────────────────────────────────────────────
+      # There is no /etc/erpcore/erpcore.env. These values are the single source of truth: the
+      # "Install unit + write config" step writes them into a systemd drop-in on every backend
+      # deploy. Change a setting here, then merge or use "Run workflow" with deploy_backend.
+      # The two secrets (DB password, GL API key) come from Gitea secrets, never from this file.
+      AUTHHEX_BASE_URL: "http://127.0.0.1:5433"
+      GL_BASE_URL: "http://127.0.0.1:5433/api/v1/"
+      STORAGE_ROOT: /var/lib/erpcore/hr-documents
+      LOG_PATH: /var/log/erpcore/erpcore-.log
+      SEED_DEMO_DATA: "false"
+      # Door policy: blank = any valid AuthHex token is admitted. Set the real AuthHex codes to
+      # restrict ERP to one user type / role (Infra/Auth/JwtAuthExtensions.cs).
+      AUTH_REQUIRED_USER_TYPE: ""
+      AUTH_REQUIRED_ROLE: ""
+
+    steps:
+      - name: Checkout code
+        env:
+          ERP_GIT_TOKEN: ${{ secrets.ERPSECRET }}
+          MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          basic="$(printf 'oauth2:%s' "$ERP_GIT_TOKEN" | base64 | tr -d '\n')"
+          url="https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git"
+          fetch() { git -c "http.extraHeader=Authorization: Basic $basic" fetch -q --depth 1 "$url" "$1"; }
+          git init -q .
+          # The exact merge commit, not the branch tip (a second merge may already have landed).
+          if [ -n "$MERGE_SHA" ] && fetch "$MERGE_SHA"; then :; else fetch production; fi
+          git checkout -qf FETCH_HEAD && git clean -ffdxq
+          # production as it was before this PR — the detect step compares against it.
+          if [ -n "$BASE_SHA" ]; then fetch "$BASE_SHA" || echo "could not fetch base $BASE_SHA — both sides will deploy"; fi
+          git log -1 --format='Deploying %h %s'
+
+      - name: Detect changes
+        id: changes
+        env:
+          EVENT: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          INPUT_BACKEND: ${{ inputs.deploy_backend }}
+          INPUT_FRONTEND: ${{ inputs.deploy_frontend }}
+        run: |
+          # A folder's git tree hash changes only when something inside it changed, so comparing
+          # production-before-the-PR with the merge result works for merge, squash and rebase merges.
+          changed() {
+            if [ -z "$BASE_SHA" ] || ! git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then echo true; return; fi
+            now="$(git rev-parse -q --verify "HEAD:$1" || true)"
+            before="$(git rev-parse -q --verify "$BASE_SHA:$1" || true)"
+            if [ "$now" != "$before" ]; then echo true; else echo false; fi
+          }
+          if [ "$EVENT" = workflow_dispatch ]; then
+            backend="${INPUT_BACKEND:-false}"
+            frontend="${INPUT_FRONTEND:-false}"
+            migrations="$backend" # unknown on a manual run → take the backup
+          else
+            backend="$(changed Backend/ERPCore)"
+            frontend="$(changed Frontend/erp-system)"
+            migrations="$(changed Backend/ERPCore/Migrations)"
+          fi
+          {
+            echo "backend=$backend"
+            echo "frontend=$frontend"
+            echo "migrations=$migrations"
+          } >> "$GITHUB_OUTPUT"
+          echo "backend=$backend  frontend=$frontend  migrations=$migrations"
+          if [ "$backend" != true ] && [ "$frontend" != true ]; then echo "Nothing to deploy."; fi
+
+      # ── Backend ──────────────────────────────────────────────────────────────────────────────
+      - name: Restore
+        if: steps.changes.outputs.backend == 'true'
+        run: dotnet restore Backend/ERPCore/ERPCore.csproj -r linux-x64
+
+      - name: Publish
+        if: steps.changes.outputs.backend == 'true'
+        run: |
+          rm -rf "$BUILD_DIR"
+          mkdir -p "$BUILD_DIR"
+          dotnet publish Backend/ERPCore/ERPCore.csproj \
+            -c Release \
+            -r linux-x64 \
+            --self-contained true \
+            --no-restore \
+            -o "$BUILD_DIR"
+
+      - name: Backup database
+        if: steps.changes.outputs.backend == 'true' && steps.changes.outputs.migrations == 'true'
+        run: |
+          mkdir -p "$BACKUP_DIR"
+          pg_dump="$(command -v pg_dump || echo /usr/pgsql-16/bin/pg_dump)"
+          file="$BACKUP_DIR/$DB_NAME-$(date -u +%Y%m%dT%H%M%SZ).dump"
+          runuser -u postgres -- "$pg_dump" -Fc "$DB_NAME" > "$file.partial"
+          mv "$file.partial" "$file"
+          echo "Backup: $file"
+          find "$BACKUP_DIR" -maxdepth 1 -name '*.dump' -mtime +30 -delete
+
+      - name: Install unit + write config
+        if: steps.changes.outputs.backend == 'true'
+        env:
+          DB_PASSWORD: ${{ secrets.ERP_DB_PASSWORD }}
+          GL_API_KEY: ${{ secrets.ERP_GL_API_KEY }}
+        run: |
+          # Config lives in this workflow's env: block, not in a file on the server. It is written
+          # to a systemd drop-in here, before the service is stopped, so a bad value fails the job
+          # while the OLD release is still serving.
+          case "$AUTHHEX_BASE_URL$GL_BASE_URL" in
+            *CHANGE_ME*) echo "❌ AUTHHEX_BASE_URL / GL_BASE_URL still hold CHANGE_ME — set the real ports in ci-cd.yml (run 'ss -ltnp' on the VPS)"; exit 1 ;;
+          esac
+          [ -n "$DB_PASSWORD" ] || { echo "❌ Gitea secret ERP_DB_PASSWORD is not set"; exit 1; }
+          [ -n "$GL_API_KEY" ]  || { echo "❌ Gitea secret ERP_GL_API_KEY is not set"; exit 1; }
+          case "$DB_PASSWORD" in
+            *";"*) echo "❌ ERP_DB_PASSWORD contains ';' — Npgsql would truncate the connection string there. Use a password without ';'"; exit 1 ;;
+          esac
+
+          # "Copy to deploy folder" empties the publish folder, so uploads and logs must live elsewhere.
+          publish="$(realpath -m "$PUBLISH_DIR")"
+          for path in "$STORAGE_ROOT" "$LOG_PATH"; do
+            case "$path" in
+              /*) ;;
+              *) echo "❌ $path is relative — it would resolve inside $PUBLISH_DIR"; exit 1 ;;
+            esac
+            case "$(realpath -m "$path")/" in
+              "$publish"/*) echo "❌ $path is inside $PUBLISH_DIR, which every deploy wipes"; exit 1 ;;
+            esac
+            echo "ok  $path"
+          done
+
+          # The unit is installed from the repo, so editing deploy/systemd/erpcore.service and
+          # deploying is enough — no manual copy step on the server.
+          install -m 644 deploy/systemd/erpcore.service /etc/systemd/system/erpcore.service
+          install -d -m 755 /etc/systemd/system/erpcore.service.d
+          conf=/etc/systemd/system/erpcore.service.d/10-erpcore-env.conf
+          # Values are quoted: systemd would otherwise split a password containing spaces.
+          umask 077
+          # Only the listening URL. Everything else is app configuration and lands in
+          # appsettings.Production.json (written after the copy step) — ASPNETCORE_URLS is host
+          # configuration, the one setting appsettings cannot reliably provide.
+          cat > "$conf" <<EOF
+          [Service]
+          Environment="ASPNETCORE_URLS=http://127.0.0.1:$BACKEND_PORT"
+          EOF
+          chmod 600 "$conf"
+          systemctl daemon-reload
+          # Idempotent: creates the multi-user.target.wants symlink so the app survives a reboot.
+          systemctl enable "$SERVICE"
+          echo "✅ unit + drop-in installed ($(grep -c '^Environment=' "$conf") settings; values not printed)"
+
+          # Data dirs must exist and belong to the service user (Serilog fails silently otherwise).
+          install -d -m 750 -o "$SERVICE_USER" -g "$SERVICE_USER" "$STORAGE_ROOT" "$(dirname "$LOG_PATH")"
+
+      - name: Stop service
+        if: steps.changes.outputs.backend == 'true'
+        run: systemctl stop "$SERVICE" || true
+
+      - name: Copy to deploy folder
+        if: steps.changes.outputs.backend == 'true'
+        run: |
+          mkdir -p "$PUBLISH_DIR"
+          rm -rf "${PUBLISH_DIR:?}"/*
+          cp -r "$BUILD_DIR"/. "$PUBLISH_DIR"/
+
+      - name: Fix ownership and permissions
+        if: steps.changes.outputs.backend == 'true'
+        run: |
+          chown -R "$SERVICE_USER:$SERVICE_USER" "$PUBLISH_DIR"
+          find "$PUBLISH_DIR" -type d -exec chmod 755 {} +
+          find "$PUBLISH_DIR" -type f -exec chmod 644 {} +
+          chmod +x "$PUBLISH_DIR/ERPCore"
+
+      # Written AFTER "Fix ownership" so it keeps mode 640 (root:erpuser) instead of being
+      # flattened to 644 — it holds the DB password and the GL API key.
+      - name: Write appsettings.Production.json
+        if: steps.changes.outputs.backend == 'true'
+        env:
+          DB_PASSWORD: ${{ secrets.ERP_DB_PASSWORD }}
+          GL_API_KEY: ${{ secrets.ERP_GL_API_KEY }}
+        run: |
+          # Deployed config lives in appsettings.Production.json, generated here from this
+          # workflow's env: block + the Gitea secrets. It is NOT in git (.gitignore ignores
+          # appsettings.*.json) and is rewritten on every backend deploy, which is why the
+          # publish folder being wiped does not matter. It MERGES over appsettings.json, so
+          # Auth:RsaPublicKeyXml, Issuer, Audience and FileStorage:MaxSizeBytes still come
+          # from the committed base file.
+          conf="$PUBLISH_DIR/appsettings.Production.json"
+          # python3 emits the JSON so a password containing " or \ is escaped correctly.
+          python3 - > "$conf" <<'PY'
+          import json, os
+          e = os.environ
+          print(json.dumps({
+            "ConnectionStrings": {
+              "DefaultConnection":
+                "Host=127.0.0.1;Port=5432;Database=%s;Username=%s;Password=%s"
+                % (e["DB_NAME"], e["DB_USER"], e["DB_PASSWORD"]),
+            },
+            "AuthHex": {"BaseUrl": e["AUTHHEX_BASE_URL"]},
+            "GeneralLedgerService": {"BaseUrl": e["GL_BASE_URL"], "ApiKey": e["GL_API_KEY"]},
+            "Auth": {
+              "RequiredUserTypeCode": e["AUTH_REQUIRED_USER_TYPE"],
+              "RequiredRoleCode": e["AUTH_REQUIRED_ROLE"],
+            },
+            "FileStorage": {"RootPath": e["STORAGE_ROOT"]},
+            "LogFile": {"Path": e["LOG_PATH"]},
+            "Seed": {"DemoData": e["SEED_DEMO_DATA"] == "true"},
+          }, indent=2))
+          PY
+          chown "root:$SERVICE_USER" "$conf"
+          chmod 640 "$conf"
+          python3 -c "import json,sys; json.load(open(sys.argv[1]))" "$conf"
+          echo "✅ appsettings.Production.json written ($(wc -c < "$conf") bytes, mode 640, values not printed)"
+
+      - name: Start service
+        if: steps.changes.outputs.backend == 'true'
+        run: |
+          systemctl reset-failed "$SERVICE" 2>/dev/null || true
+          systemctl start "$SERVICE" || echo "systemctl start returned an error — the verify step shows why"
+          # Baseline for the crash check in the verify step.
+          echo "RESTARTS_AT_START=$(systemctl show -p NRestarts --value "$SERVICE")" >> "$GITHUB_ENV"
+
+      - name: Verify backend
+        if: steps.changes.outputs.backend == 'true'
+        env:
+          HEALTH_TIMEOUT: "300" # migrations run at startup; a crash still fails within seconds
+        run: bash deploy/scripts/wait-healthy.sh
+
+      # ── Frontend (after the backend: a failed backend step stops the job here) ─────────────
+      - name: Build frontend image
+        if: steps.changes.outputs.frontend == 'true'
+        run: docker build -t "$WEB_IMAGE" Frontend/erp-system
+
+      - name: Stop & remove existing container
+        if: steps.changes.outputs.frontend == 'true'
+        run: |
+          docker stop "$WEB_CONTAINER" 2>/dev/null || true
+          docker rm "$WEB_CONTAINER" 2>/dev/null || true
+
+      - name: Start container
+        if: steps.changes.outputs.frontend == 'true'
+        run: |
+          docker run -d \
+            --name "$WEB_CONTAINER" \
+            -p "127.0.0.1:$WEB_PORT:3000" \
+            --memory=512m \
+            --restart unless-stopped \
+            "$WEB_IMAGE"
+
+      - name: Verify frontend
+        if: steps.changes.outputs.frontend == 'true'
+        run: |
+          for _ in $(seq 1 15); do
+            if curl -fsS -o /dev/null "http://127.0.0.1:$WEB_PORT/login"; then
+              echo "✅ Frontend serving on 127.0.0.1:$WEB_PORT"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "❌ Frontend did not serve /login within 30s"
+          docker ps -a --filter "name=$WEB_CONTAINER" --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
+          docker logs --tail 50 "$WEB_CONTAINER" || true
+          exit 1
+
+      - name: Remove old images
+        if: steps.changes.outputs.frontend == 'true'
+        run: |
+          docker image prune -f
+          docker builder prune -f --filter until=168h

.gitignore

@@ -36,4 +36,8 @@ Testing/e2e/test-results/
 Testing/e2e/.auth/
 Testing/e2e/blob-report/
 
+# ── Python (Backend/smoke) ────────────────────────────────────────────
+__pycache__/
+*.pyc
+
 

Backend/ERPCore.Tests/TestSupport/NotificationConfigTestSupport.cs

@@ -11,6 +11,8 @@ internal sealed class TestCurrentUser : ICurrentUser
     public string UserId => "system";
     public int AuditUserId => User.SystemUserId;
     public bool IsAuthenticated => false;
+    public string? RoleCode => null;
+    public bool IsAdmin => false;
 }
 
 internal sealed class ThrowingUnitOfWork : ERPCore.Infra.UoW.IUnitOfWork

Backend/ERPCore.sln

@@ -5,6 +5,8 @@ VisualStudioVersion = 17.0.31903.59
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ERPCore", "ERPCore\ERPCore.csproj", "{B38203ED-80EA-41C6-8B7D-B664451299E3}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ERPCore.Tests", "ERPCore.Tests\ERPCore.Tests.csproj", "{E451472F-550F-40A0-AE82-E24ECD6C647A}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -27,6 +29,18 @@ Global
 		{B38203ED-80EA-41C6-8B7D-B664451299E3}.Release|x64.Build.0 = Release|Any CPU
 		{B38203ED-80EA-41C6-8B7D-B664451299E3}.Release|x86.ActiveCfg = Release|Any CPU
 		{B38203ED-80EA-41C6-8B7D-B664451299E3}.Release|x86.Build.0 = Release|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Debug|x64.Build.0 = Debug|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Debug|x86.Build.0 = Debug|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Release|Any CPU.Build.0 = Release|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Release|x64.ActiveCfg = Release|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Release|x64.Build.0 = Release|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Release|x86.ActiveCfg = Release|Any CPU
+		{E451472F-550F-40A0-AE82-E24ECD6C647A}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

Backend/ERPCore/Controllers/AuthController.cs

@@ -27,13 +27,15 @@ public sealed class AuthController : ControllerBase
     private readonly IAuthRecoveryService _recovery;
     private readonly IAuthAltService _alt;
     private readonly IRoleService _roles;
+    private readonly IAuditService _audit;
 
-    public AuthController(IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles)
+    public AuthController(IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles, IAuditService audit)
     {
         _users = users;
         _recovery = recovery;
         _alt = alt;
         _roles = roles;
+        _audit = audit;
     }
 
     /// <summary>
@@ -68,6 +70,7 @@ public sealed class AuthController : ControllerBase
     {
         var result = await _users.LoginAsync(request, ct);
         AuthCookieWriter.WriteSession(Response, result.AccessToken, result.RefreshToken, result.Body.ExpiresIn);
+        if (result.Body.User?.UserId is Guid authUserId) await _audit.RecordLoginAsync(authUserId, ClientIp(), ClientUserAgent(), ct);
         return Ok(result.Body);
     }
 
@@ -78,9 +81,13 @@ public sealed class AuthController : ControllerBase
     {
         var result = await _users.VerifyOtpForLoginAsync(request, ct);
         AuthCookieWriter.WriteSession(Response, result.AccessToken, result.RefreshToken, result.Body.ExpiresIn);
+        if (result.Body.User?.UserId is Guid authUserId) await _audit.RecordLoginAsync(authUserId, ClientIp(), ClientUserAgent(), ct);
         return Ok(result.Body);
     }
 
+    private string? ClientIp() => HttpContext.Connection.RemoteIpAddress?.ToString();
+    private string? ClientUserAgent() => Request.Headers.UserAgent.ToString() is { Length: > 0 } ua ? ua : null;
+
     [HttpPost("refresh-token")]
     [AllowAnonymous]
     [ProducesResponseType(typeof(AuthSessionResponse), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/BranchConfigController.cs

@@ -0,0 +1,44 @@
+using ERPCore.Dtos.Config;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Branch configuration endpoints — the singleton toggle for whether this deployment
+/// requires a branch on Employee/Warehouse records at all.
+/// <para>
+/// <b>Authorization:</b> writes are admitted by the inherited ERP door policy only, same
+/// Phase-1 posture as <see cref="ProductConfigController"/> — any ERP-admitted user can
+/// flip this flag until per-endpoint RBAC lands.
+/// </para>
+/// </summary>
+[Route("api/v1/branch-config")]
+public sealed class BranchConfigController : ApiControllerBase
+{
+    private readonly IBranchConfigService _config;
+
+    public BranchConfigController(IBranchConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(BranchConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<BranchConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut]
+    [ProducesResponseType(typeof(BranchConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<BranchConfigDto>> Update(
+        [FromBody] UpdateBranchConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}

Backend/ERPCore/Controllers/DashboardController.cs

@@ -15,6 +15,6 @@ public sealed class DashboardController : ApiControllerBase
     /// <summary>Aggregate counts for stock, GRN, and procurement.</summary>
     [HttpGet("stats")]
     [ProducesResponseType(typeof(DashboardStatsDto), StatusCodes.Status200OK)]
-    public async Task<ActionResult<DashboardStatsDto>> GetStats(CancellationToken ct)
-        => Ok(await _dashboard.GetStatsAsync(ct));
+    public async Task<ActionResult<DashboardStatsDto>> GetStats([FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _dashboard.GetStatsAsync(branchId, ct));
 }

Backend/ERPCore/Controllers/GrnsController.cs

@@ -11,12 +11,10 @@ namespace ERPCore.Controllers;
 public sealed class GrnsController : ApiControllerBase
 {
     private readonly IGrnService _grns;
-    private readonly IGrnPaymentService _payments;
 
-    public GrnsController(IGrnService grns, IGrnPaymentService payments)
+    public GrnsController(IGrnService grns)
     {
         _grns = grns;
-        _payments = payments;
     }
 
     /// <summary>List GRNs, newest first.</summary>
@@ -24,8 +22,8 @@ public sealed class GrnsController : ApiControllerBase
     [ProducesResponseType(typeof(PagedResponse<GrnSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<GrnSummaryDto>>> List(
         [FromQuery] PageQuery query, [FromQuery] GrnStatus? status, [FromQuery] int? poId,
-        [FromQuery] int? vendorId, [FromQuery] int? warehouseId, CancellationToken ct)
-        => Ok(await _grns.ListAsync(query, status, poId, vendorId, warehouseId, ct));
+        [FromQuery] int? vendorId, [FromQuery] int? warehouseId, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _grns.ListAsync(query, status, poId, vendorId, warehouseId, branchId, ct));
 
     [HttpGet("{grnId:int}")]
     [ProducesResponseType(typeof(GrnDto), StatusCodes.Status200OK)]
@@ -64,23 +62,4 @@ public sealed class GrnsController : ApiControllerBase
     public async Task<ActionResult<ReleaseLineResultDto>> Release(
         int grnId, int grnLineId, [FromBody] ReleaseLineRequest request, CancellationToken ct)
         => Ok(await _grns.ReleaseLineAsync(grnId, grnLineId, request.Action, ct));
-
-    /// <summary>Pay the vendor against this GRN's balance, in full or in installments; posts a real GL journal entry.</summary>
-    [HttpPost("{grnId:int}/payments")]
-    [ProducesResponseType(typeof(GrnPaymentDto), StatusCodes.Status201Created)]
-    [ProducesResponseType(StatusCodes.Status400BadRequest)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    [ProducesResponseType(StatusCodes.Status409Conflict)]
-    public async Task<ActionResult<GrnPaymentDto>> Pay(int grnId, [FromBody] CreateGrnPaymentRequest request, CancellationToken ct)
-    {
-        var dto = await _payments.PayAsync(grnId, request, ct);
-        return Created($"/api/v1/grns/{grnId}/payments/{dto.GrnPaymentId}", dto);
-    }
-
-    /// <summary>Payment history for this GRN, newest first.</summary>
-    [HttpGet("{grnId:int}/payments")]
-    [ProducesResponseType(typeof(IReadOnlyList<GrnPaymentDto>), StatusCodes.Status200OK)]
-    [ProducesResponseType(StatusCodes.Status404NotFound)]
-    public async Task<ActionResult<IReadOnlyList<GrnPaymentDto>>> ListPayments(int grnId, CancellationToken ct)
-        => Ok(await _payments.ListAsync(grnId, ct));
 }

Backend/ERPCore/Controllers/Hrm/BranchesController.cs

@@ -61,4 +61,14 @@ public sealed class BranchesController : ApiControllerBase
         await _branches.SetStatusAsync(branchId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{branchId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int branchId, CancellationToken ct)
+    {
+        await _branches.DeleteAsync(branchId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/DepartmentsController.cs

@@ -62,4 +62,14 @@ public sealed class DepartmentsController : ApiControllerBase
         await _departments.SetStatusAsync(departmentId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{departmentId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int departmentId, CancellationToken ct)
+    {
+        await _departments.DeleteAsync(departmentId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/DesignationsController.cs

@@ -61,4 +61,14 @@ public sealed class DesignationsController : ApiControllerBase
         await _designations.SetStatusAsync(designationId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{designationId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int designationId, CancellationToken ct)
+    {
+        await _designations.DeleteAsync(designationId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/EmployeesController.cs

@@ -83,7 +83,6 @@ public sealed class EmployeesController : ApiControllerBase
         return Ok(result.Value);
     }
 
-    /// <summary>Never a hard delete — Employee is retained forever (docs/12-BACKEND-HRM.md C.2).</summary>
     [HttpPatch("{employeeId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -93,6 +92,17 @@ public sealed class EmployeesController : ApiControllerBase
         return NoContent();
     }
 
+    /// <summary>Permanently deletes the employee and all dependent HR records. Blocked (409) if payroll history exists.</summary>
+    [HttpDelete("{employeeId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int employeeId, CancellationToken ct)
+    {
+        await _employees.DeleteAsync(employeeId, ct);
+        return NoContent();
+    }
+
     [HttpPost("{employeeId:int}/link-user")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/EmploymentTypesController.cs

@@ -61,4 +61,14 @@ public sealed class EmploymentTypesController : ApiControllerBase
         await _employmentTypes.SetStatusAsync(employmentTypeId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{employmentTypeId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int employmentTypeId, CancellationToken ct)
+    {
+        await _employmentTypes.DeleteAsync(employmentTypeId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/HrDocumentTypesController.cs

@@ -61,4 +61,14 @@ public sealed class HrDocumentTypesController : ApiControllerBase
         await _types.SetStatusAsync(hrDocumentTypeId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{hrDocumentTypeId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int hrDocumentTypeId, CancellationToken ct)
+    {
+        await _types.DeleteAsync(hrDocumentTypeId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/LeaveTypesController.cs

@@ -61,4 +61,14 @@ public sealed class LeaveTypesController : ApiControllerBase
         await _leaveTypes.SetStatusAsync(leaveTypeId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{leaveTypeId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int leaveTypeId, CancellationToken ct)
+    {
+        await _leaveTypes.DeleteAsync(leaveTypeId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/SalaryComponentsController.cs

@@ -61,4 +61,14 @@ public sealed class SalaryComponentsController : ApiControllerBase
         await _components.SetStatusAsync(salaryComponentId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{salaryComponentId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int salaryComponentId, CancellationToken ct)
+    {
+        await _components.DeleteAsync(salaryComponentId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/WorkShiftsController.cs

@@ -61,4 +61,14 @@ public sealed class WorkShiftsController : ApiControllerBase
         await _shifts.SetStatusAsync(workShiftId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{workShiftId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int workShiftId, CancellationToken ct)
+    {
+        await _shifts.DeleteAsync(workShiftId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/PurchaseInvoicesController.cs

@@ -0,0 +1,102 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Grn;
+using ERPCore.Dtos.Procurement;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Purchase invoice endpoints — vendor invoices consolidating Confirmed GRNs.</summary>
+[Route("api/v1/purchase-invoices")]
+public sealed class PurchaseInvoicesController : ApiControllerBase
+{
+    private readonly IPurchaseInvoiceService _invoices;
+    private readonly IPurchaseInvoicePaymentService _payments;
+
+    public PurchaseInvoicesController(IPurchaseInvoiceService invoices, IPurchaseInvoicePaymentService payments)
+    {
+        _invoices = invoices;
+        _payments = payments;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<PurchaseInvoiceSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<PurchaseInvoiceSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] PurchaseInvoiceStatus? status, [FromQuery] int? vendorId, CancellationToken ct)
+        => Ok(await _invoices.ListAsync(query, status, vendorId, ct));
+
+    /// <summary>Confirmed, not-yet-invoiced GRNs for a vendor — candidates for a new/edited invoice.</summary>
+    [HttpGet("eligible-grns")]
+    [ProducesResponseType(typeof(IReadOnlyList<GrnEligibleForInvoiceDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<GrnEligibleForInvoiceDto>>> EligibleGrns([FromQuery] int vendorId, CancellationToken ct)
+        => Ok(await _invoices.ListEligibleGrnsAsync(vendorId, ct));
+
+    [HttpGet("{purchaseInvoiceId:int}")]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> GetById(int purchaseInvoiceId, CancellationToken ct)
+    {
+        var result = await _invoices.GetAsync(purchaseInvoiceId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> Create([FromBody] CreatePurchaseInvoiceRequest request, CancellationToken ct)
+    {
+        var result = await _invoices.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/purchase-invoices/{result.Value.PurchaseInvoiceId}", result.Value);
+    }
+
+    [HttpPut("{purchaseInvoiceId:int}")]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> Update(int purchaseInvoiceId, [FromBody] UpdatePurchaseInvoiceRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _invoices.UpdateAsync(purchaseInvoiceId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost("{purchaseInvoiceId:int}/post")]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> Post(int purchaseInvoiceId, CancellationToken ct)
+        => Ok(await _invoices.PostAsync(purchaseInvoiceId, ct));
+
+    [HttpPost("{purchaseInvoiceId:int}/cancel")]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> Cancel(int purchaseInvoiceId, CancellationToken ct)
+        => Ok(await _invoices.CancelAsync(purchaseInvoiceId, ct));
+
+    /// <summary>Pay the vendor against this invoice's balance, in full or in installments; posts a real GL journal entry.</summary>
+    [HttpPost("{purchaseInvoiceId:int}/payments")]
+    [ProducesResponseType(typeof(PurchaseInvoicePaymentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseInvoicePaymentDto>> Pay(int purchaseInvoiceId, [FromBody] CreatePurchaseInvoicePaymentRequest request, CancellationToken ct)
+    {
+        var dto = await _payments.PayAsync(purchaseInvoiceId, request, ct);
+        return Created($"/api/v1/purchase-invoices/{purchaseInvoiceId}/payments/{dto.PurchaseInvoicePaymentId}", dto);
+    }
+
+    /// <summary>Payment history for this invoice, newest first.</summary>
+    [HttpGet("{purchaseInvoiceId:int}/payments")]
+    [ProducesResponseType(typeof(IReadOnlyList<PurchaseInvoicePaymentDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<IReadOnlyList<PurchaseInvoicePaymentDto>>> ListPayments(int purchaseInvoiceId, CancellationToken ct)
+        => Ok(await _payments.ListAsync(purchaseInvoiceId, ct));
+}

Backend/ERPCore/Controllers/SalesInvoicesController.cs

@@ -25,8 +25,9 @@ public sealed class SalesInvoicesController : ApiControllerBase
         [FromQuery] SalesInvoiceStatus? status,
         [FromQuery] int? customerId,
         [FromQuery] int? warehouseId,
+        [FromQuery] int? branchId,
         CancellationToken ct)
-        => Ok(await _invoices.ListAsync(query, status, customerId, warehouseId, ct));
+        => Ok(await _invoices.ListAsync(query, status, customerId, warehouseId, branchId, ct));
 
     [HttpGet("{salesInvoiceId:int}")]
     [ProducesResponseType(typeof(SalesInvoiceDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/StockAdjustmentsController.cs

@@ -17,8 +17,8 @@ public sealed class StockAdjustmentsController : ApiControllerBase
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<AdjustmentSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<AdjustmentSummaryDto>>> List(
-        [FromQuery] PageQuery query, [FromQuery] int? warehouseId, [FromQuery] int? reasonCodeId, CancellationToken ct)
-        => Ok(await _adjustments.ListAsync(query, warehouseId, reasonCodeId, ct));
+        [FromQuery] PageQuery query, [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] int? reasonCodeId, CancellationToken ct)
+        => Ok(await _adjustments.ListAsync(query, warehouseId, branchId, reasonCodeId, ct));
 
     /// <summary>Get one adjustment with its lines and the ledger entries it posted.</summary>
     [HttpGet("{adjustmentId:int}")]

Backend/ERPCore/Controllers/StockController.cs

@@ -28,8 +28,8 @@ public sealed class StockController : ApiControllerBase
     [HttpGet("on-hand/list")]
     [ProducesResponseType(typeof(PagedResponse<StockOnHandDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<StockOnHandDto>>> OnHandList(
-        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _stock.GetOnHandListAsync(itemId, warehouseId, query, ct));
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _stock.GetOnHandListAsync(itemId, warehouseId, branchId, query, ct));
 
     /// <summary>
     /// Immutable movement history. <c>sourceDocType</c>/<c>sourceDocId</c> answer "what did
@@ -39,11 +39,11 @@ public sealed class StockController : ApiControllerBase
     [HttpGet("ledger")]
     [ProducesResponseType(typeof(PagedResponse<StockLedgerRowDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<StockLedgerRowDto>>> Ledger(
-        [FromQuery] int? itemId, [FromQuery] int? warehouseId,
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] int? branchId,
         [FromQuery] DateOnly? from, [FromQuery] DateOnly? to,
         [FromQuery] string? sourceDocType, [FromQuery] int? sourceDocId,
         [FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _stock.GetLedgerAsync(itemId, warehouseId, from, to, sourceDocType, sourceDocId, query, ct));
+        => Ok(await _stock.GetLedgerAsync(itemId, warehouseId, branchId, from, to, sourceDocType, sourceDocId, query, ct));
 
     [HttpGet("valuation")]
     [ProducesResponseType(typeof(StockValuationDto), StatusCodes.Status200OK)]
@@ -54,8 +54,8 @@ public sealed class StockController : ApiControllerBase
     [HttpGet("reorder-alerts")]
     [ProducesResponseType(typeof(PagedResponse<ReorderAlertDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<ReorderAlertDto>>> ReorderAlerts(
-        [FromQuery] int? warehouseId, [FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _reorder.GetAlertsAsync(warehouseId, query, ct));
+        [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _reorder.GetAlertsAsync(warehouseId, branchId, query, ct));
 
     /// <summary>Create a draft requisition for an item's suggested reorder quantity.</summary>
     [HttpPost("reorder-alerts/{itemId:int}/requisition")]

Backend/ERPCore/Controllers/StockCountsController.cs

@@ -18,8 +18,8 @@ public sealed class StockCountsController : ApiControllerBase
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<CountSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<CountSummaryDto>>> List(
-        [FromQuery] PageQuery query, [FromQuery] CountStatus? status, [FromQuery] int? warehouseId, CancellationToken ct)
-        => Ok(await _counts.ListAsync(query, status, warehouseId, ct));
+        [FromQuery] PageQuery query, [FromQuery] CountStatus? status, [FromQuery] int? warehouseId, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _counts.ListAsync(query, status, warehouseId, branchId, ct));
 
     [HttpGet("{countId:int}")]
     [ProducesResponseType(typeof(CountDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/StockTransfersController.cs

@@ -19,8 +19,8 @@ public sealed class StockTransfersController : ApiControllerBase
     [ProducesResponseType(typeof(PagedResponse<TransferSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<TransferSummaryDto>>> List(
         [FromQuery] PageQuery query, [FromQuery] TransferStatus? status,
-        [FromQuery] int? srcWarehouseId, [FromQuery] int? destWarehouseId, CancellationToken ct)
-        => Ok(await _transfers.ListAsync(query, status, srcWarehouseId, destWarehouseId, ct));
+        [FromQuery] int? srcWarehouseId, [FromQuery] int? destWarehouseId, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _transfers.ListAsync(query, status, srcWarehouseId, destWarehouseId, branchId, ct));
 
     [HttpGet("{transferId:int}")]
     [ProducesResponseType(typeof(TransferDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/UsersController.cs

@@ -1,6 +1,9 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Audit;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
 using ERPCore.Dtos.Users;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
 
@@ -15,11 +18,15 @@ public sealed class UsersController : ApiControllerBase
 {
     private readonly IUserManagementService _users;
     private readonly IEmployeeUserLinkService _links;
+    private readonly IAuditService _audit;
+    private readonly ICurrentUser _currentUser;
 
-    public UsersController(IUserManagementService users, IEmployeeUserLinkService links)
+    public UsersController(IUserManagementService users, IEmployeeUserLinkService links, IAuditService audit, ICurrentUser currentUser)
     {
         _users = users;
         _links = links;
+        _audit = audit;
+        _currentUser = currentUser;
     }
 
     /// <summary>Advisory forward-direction lookup: does a Staff record already exist with this email? (docs/12-BACKEND-HRM.md A.5)</summary>
@@ -30,8 +37,8 @@ public sealed class UsersController : ApiControllerBase
 
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<ManagedUserDto>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedResponse<ManagedUserDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _users.ListAsync(query, ct));
+    public async Task<ActionResult<PagedResponse<ManagedUserDto>>> List([FromQuery] PageQuery query, [FromQuery] EntityStatus? status, [FromQuery] string? roleCode, CancellationToken ct)
+        => Ok(await _users.ListAsync(query, status, roleCode, ct));
 
     /// <summary>AuthHex UserType options for the create-user form's select.</summary>
     [HttpGet("user-types")]
@@ -53,7 +60,7 @@ public sealed class UsersController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<ManagedUserDto>> Create([FromBody] CreateUserRequest request, CancellationToken ct)
     {
-        var result = await _users.CreateAsync(request, ct);
+        var result = await _users.CreateAsync(request, _currentUser.AuditUserId, ct);
         return Created($"/api/v1/users/{result.UserId}", result);
     }
 
@@ -62,4 +69,18 @@ public sealed class UsersController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     public async Task<ActionResult<ManagedUserDto>> UpdateRole(int userId, [FromBody] UpdateUserRoleRequest request, CancellationToken ct)
         => Ok(await _users.UpdateRoleAsync(userId, request, ct));
+
+    /// <summary>Revokes/restores standing inside ERPCore only — see <see cref="IUserManagementService.SetStatusAsync"/>.</summary>
+    [HttpPatch("{userId:int}/status")]
+    [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ManagedUserDto>> UpdateStatus(int userId, [FromBody] UpdateUserStatusRequest request, CancellationToken ct)
+        => Ok(await _users.SetStatusAsync(userId, request.Status, ct));
+
+    /// <summary>Device/login history ERPCore captures itself — not AuthHex's "currently active sessions"
+    /// (which only ever reports the caller's own). See <see cref="IAuditService.ListLoginDevicesAsync"/>.</summary>
+    [HttpGet("{userId:int}/login-devices")]
+    [ProducesResponseType(typeof(PagedResponse<LoginActivityDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<LoginActivityDto>>> ListLoginDevices(int userId, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _audit.ListLoginDevicesAsync(userId, query, ct));
 }

Backend/ERPCore/Controllers/WarehousesController.cs

@@ -15,8 +15,9 @@ public sealed class WarehousesController : ApiControllerBase
 
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<WarehouseDto>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedResponse<WarehouseDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _warehouses.ListAsync(query, ct));
+    public async Task<ActionResult<PagedResponse<WarehouseDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _warehouses.ListAsync(query, branchId, ct));
 
     [HttpGet("{warehouseId:int}")]
     [ProducesResponseType(typeof(WarehouseDto), StatusCodes.Status200OK)]

Backend/ERPCore/Domain/DocumentTypes.cs

@@ -10,6 +10,7 @@ public static class DocumentTypes
     public const string Rfq = "RFQ";
     public const string PurchaseOrder = "PO";
     public const string Grn = "GRN";
+    public const string PurchaseInvoice = "PINV";
     public const string Transfer = "TRF";
     public const string Adjustment = "ADJ";
     public const string Count = "CNT";

Backend/ERPCore/Domain/Entities/Branch.cs

@@ -3,16 +3,19 @@ using ERPCore.Domain.Enums;
 namespace ERPCore.Domain.Entities;
 
 /// <summary>
-/// Branch/location master (FR-HR-MD-01) — multi-branch readiness. Referenced
-/// optionally by <see cref="Employee.BranchId"/> and <see cref="PayrollRun.BranchId"/>.
+/// Branch/location master (FR-HR-MD-01) — multi-branch readiness. Required by
+/// <see cref="Employee.BranchId"/>, optionally referenced by <see cref="PayrollRun.BranchId"/>.
 /// Deactivated, not deleted, when referenced. Model: docs/12-BACKEND-HRM.md Part C.1.
 /// </summary>
 public class Branch
 {
     public int BranchId { get; set; }
+
+    /// <summary>Server-generated on create ("BR-001", "BR-002", ...) — never accepted from the client.</summary>
     public string Code { get; set; } = string.Empty;
     public string Name { get; set; } = string.Empty;
     public string? Address { get; set; }
+    public string? PhoneNumber { get; set; }
     public EntityStatus Status { get; set; } = EntityStatus.Active;
 
     public DateTime CreatedAt { get; set; }

Backend/ERPCore/Domain/Entities/BranchConfig.cs

@@ -0,0 +1,27 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Branch configuration — a singleton row (single-tenant, docs/00-CORE §1) gating whether
+/// this deployment uses branches at all. When <see cref="BranchingEnabled"/> is off, the
+/// Employee/Warehouse create forms stop asking for a branch and every new record is
+/// silently assigned to the deployment's one default branch instead — schema-wise
+/// <c>Employee.BranchId</c>/<c>Warehouse.BranchId</c> stay <c>NOT NULL</c> either way, only
+/// the UI/UX requirement toggles. See <see cref="Services.BranchConfigService.ResolveBranchIdAsync"/>.
+/// </summary>
+public class BranchConfig
+{
+    /// <summary>Always 1 - the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    public int ConfigId { get; set; }
+
+    public bool BranchingEnabled { get; set; } = true;
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}

Backend/ERPCore/Domain/Entities/Employee.cs

@@ -6,8 +6,10 @@ namespace ERPCore.Domain.Entities;
 /// Staff record (FR-HR-MD-02) — distinct from <see cref="User"/> (the system login
 /// account): not every employee has a login, and not every login belongs to an
 /// employee. <see cref="UserId"/> is the optional, explicit, human-confirmed link
-/// between the two (docs/12-BACKEND-HRM.md A.5/C.2, Part B.3.2). Never hard-deleted —
-/// separation is recorded via <see cref="Status"/> + <see cref="LastWorkingDate"/>.
+/// between the two (docs/12-BACKEND-HRM.md A.5/C.2, Part B.3.2). Normal separation is
+/// recorded via <see cref="Status"/> + <see cref="LastWorkingDate"/> rather than deletion;
+/// an explicit hard delete is also available (<see cref="Services.Interfaces.IEmployeeService.DeleteAsync"/>)
+/// and cascades to every dependent HR record, blocked only if payroll history exists.
 /// <see cref="EmployeeCode"/> is user-entered (not <see cref="NumberSequence"/>-issued):
 /// HR departments keep their own legacy numbering scheme, and NumberSequence's
 /// year-scoping is the wrong shape for an identifier that must never look "reset".
@@ -50,7 +52,7 @@ public class Employee
     public Designation? Designation { get; set; }
     public int EmploymentTypeId { get; set; }
     public EmploymentType? EmploymentType { get; set; }
-    public int? BranchId { get; set; }
+    public int BranchId { get; set; }
     public Branch? Branch { get; set; }
     public int WorkShiftId { get; set; }
     public WorkShift? WorkShift { get; set; }

Backend/ERPCore/Domain/Entities/Grn.cs

@@ -22,6 +22,11 @@ public class Grn
     public int WarehouseId { get; set; }
     public Warehouse? Warehouse { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from <see cref="Warehouse"/>.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public GrnStatus Status { get; set; } = GrnStatus.Draft;
 
     public int CreatedBy { get; set; }
@@ -34,14 +39,14 @@ public class Grn
     public string? GlJournalNo { get; set; }
     public DateTime? GlPostedAt { get; set; }
 
-    /// <summary>Sum of vendor payments made against this GRN's total payable (<see cref="GrnLine.LineTotal"/>).</summary>
-    public decimal PaidAmount { get; set; }
-    /// <summary>Total payable minus <see cref="PaidAmount"/>; installments accrue against this until it reaches zero.</summary>
-    public decimal BalanceAmount { get; set; }
+    /// <summary>The Purchase Invoice this GRN has been consolidated into, if any (null until
+    /// invoiced). Vendor settlement is tracked on the invoice, not per-GRN — see
+    /// <see cref="PurchaseInvoice"/>.</summary>
+    public int? PurchaseInvoiceId { get; set; }
+    public PurchaseInvoice? PurchaseInvoice { get; set; }
 
     /// <summary>PostgreSQL xmin-backed optimistic concurrency token.</summary>
     public uint RowVersion { get; set; }
 
     public ICollection<GrnLine> Lines { get; set; } = new List<GrnLine>();
-    public ICollection<GrnPayment> Payments { get; set; } = new List<GrnPayment>();
 }

Backend/ERPCore/Domain/Entities/LoginActivity.cs

@@ -0,0 +1,22 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// One row per successful sign-in, captured directly by ERPCore (not AuthHex) so an
+/// admin can see a user's device/login history — AuthHex's own session listing only
+/// ever reports the currently-authenticated caller's own sessions, with no admin-scoped
+/// call to inspect anyone else's. This is a history of past logins, not a live "currently
+/// active sessions" view (that would need AuthHex to expose one).
+/// </summary>
+public class LoginActivity
+{
+    public int LoginActivityId { get; set; }
+    public int UserId { get; set; }
+    public User? User { get; set; }
+
+    public string? IpAddress { get; set; }
+    public string? UserAgent { get; set; }
+    /// <summary>Best-effort "Browser on OS" label parsed from <see cref="UserAgent"/> for display.</summary>
+    public string? DeviceLabel { get; set; }
+
+    public DateTime LoginAt { get; set; }
+}

Backend/ERPCore/Domain/Entities/PurchaseInvoice.cs

@@ -0,0 +1,50 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Vendor invoice consolidating one or more Confirmed GRNs for the same vendor
+/// (each linked GRN becomes one <see cref="PurchaseInvoiceLine"/>, not re-itemized).
+/// Draft is editable (GRNs can be re-selected); Posted reclassifies the GRN clearing
+/// balance to Accounts Payable (see PurchaseInvoiceService.PostAsync); vendor payments
+/// are then recorded against this aggregate rather than against the individual GRNs.
+/// </summary>
+public class PurchaseInvoice
+{
+    public int PurchaseInvoiceId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public string VendorInvoiceNo { get; set; } = string.Empty;
+    public DateTime VendorInvoiceDate { get; set; }
+
+    public int VendorId { get; set; }
+    public Vendor? Vendor { get; set; }
+
+    public string VendorSnapshotName { get; set; } = string.Empty;
+    public string? VendorSnapshotTaxNo { get; set; }
+
+    public PurchaseInvoiceStatus Status { get; set; } = PurchaseInvoiceStatus.Draft;
+
+    public decimal Subtotal { get; set; }
+    public decimal VatTotal { get; set; }
+    public decimal GrandTotal { get; set; }
+    public decimal PaidAmount { get; set; }
+    public decimal BalanceAmount { get; set; }
+
+    /// <summary>Journal number of the AP-recognition GL journal entry posted when this
+    /// invoice is Posted (Debit GRN Clearing / Credit Accounts Payable) — see
+    /// PurchaseInvoiceService.PostAsync.</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public ICollection<PurchaseInvoiceLine> Lines { get; set; } = new List<PurchaseInvoiceLine>();
+    public ICollection<PurchaseInvoicePayment> Payments { get; set; } = new List<PurchaseInvoicePayment>();
+}

Backend/ERPCore/Domain/Entities/PurchaseInvoiceLine.cs

@@ -0,0 +1,21 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// One row per consolidated GRN on a <see cref="PurchaseInvoice"/> — a straight
+/// consolidation of that GRN's line totals, not a re-itemization (docs: Purchase
+/// Invoice consolidates GRNs, it does not re-enter item lines).
+/// </summary>
+public class PurchaseInvoiceLine
+{
+    public int PurchaseInvoiceLineId { get; set; }
+
+    public int PurchaseInvoiceId { get; set; }
+    public PurchaseInvoice? PurchaseInvoice { get; set; }
+
+    public int GrnId { get; set; }
+    public Grn? Grn { get; set; }
+
+    public decimal Subtotal { get; set; }
+    public decimal VatTotal { get; set; }
+    public decimal LineTotal { get; set; }
+}

Backend/ERPCore/Domain/Entities/PurchaseInvoicePayment.cs

@@ -1,16 +1,17 @@
 namespace ERPCore.Domain.Entities;
 
 /// <summary>
-/// A vendor payment made against a confirmed GRN's balance (installments allowed —
-/// see GrnPaymentService.PayAsync). Posts its own real GL journal entry (Debit GRN
-/// Clearing / Credit the selected bank-or-cash account) before being recorded here.
+/// A vendor payment made against a Posted purchase invoice's balance (installments
+/// allowed — see PurchaseInvoicePaymentService.PayAsync). Posts its own real GL
+/// journal entry (Debit Accounts Payable / Credit the selected bank-or-cash account)
+/// before being recorded here.
 /// </summary>
-public class GrnPayment
+public class PurchaseInvoicePayment
 {
-    public int GrnPaymentId { get; set; }
+    public int PurchaseInvoicePaymentId { get; set; }
 
-    public int GrnId { get; set; }
-    public Grn? Grn { get; set; }
+    public int PurchaseInvoiceId { get; set; }
+    public PurchaseInvoice? PurchaseInvoice { get; set; }
 
     public decimal Amount { get; set; }
     public DateTime PaymentDate { get; set; }

Backend/ERPCore/Domain/Entities/SalesInvoice.cs

@@ -17,6 +17,11 @@ public class SalesInvoice
     public int WarehouseId { get; set; }
     public Warehouse? Warehouse { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from <see cref="Warehouse"/>.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public SalesInvoiceType InvoiceType { get; set; } = SalesInvoiceType.B2C;
     public SalesInvoiceStatus Status { get; set; } = SalesInvoiceStatus.Draft;
 

Backend/ERPCore/Domain/Entities/SalesInvoicePayment.cs

@@ -4,7 +4,7 @@ namespace ERPCore.Domain.Entities;
 /// A customer payment made against a Posted sales invoice's balance (installments
 /// allowed — see SalesInvoicePaymentService.PayAsync). Posts its own real GL journal
 /// entry (Debit the selected bank-or-cash account / Credit Accounts Receivable) before
-/// being recorded here — the mirror image of <see cref="GrnPayment"/>.
+/// being recorded here — the mirror image of <see cref="PurchaseInvoicePayment"/>.
 /// </summary>
 public class SalesInvoicePayment
 {

Backend/ERPCore/Domain/Entities/StockAdjustment.cs

@@ -19,6 +19,11 @@ public class StockAdjustment
     public int ReasonCodeId { get; set; }
     public ReasonCode? ReasonCode { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from <see cref="Warehouse"/>.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public AdjustmentStatus Status { get; set; } = AdjustmentStatus.Posted;
 
     public int CreatedBy { get; set; }

Backend/ERPCore/Domain/Entities/StockCount.cs

@@ -16,6 +16,11 @@ public class StockCount
     public int WarehouseId { get; set; }
     public Warehouse? Warehouse { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from <see cref="Warehouse"/>.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public CountType CountType { get; set; }
     public CountStatus Status { get; set; } = CountStatus.Draft;
 

Backend/ERPCore/Domain/Entities/StockTransfer.cs

@@ -19,6 +19,11 @@ public class StockTransfer
     public int DestWarehouseId { get; set; }
     public Warehouse? DestWarehouse { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from src/dest warehouse.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public TransferStatus Status { get; set; } = TransferStatus.Draft;
 
     public int CreatedBy { get; set; }

Backend/ERPCore/Domain/Entities/Warehouse.cs

@@ -9,6 +9,8 @@ public class Warehouse
     public int WarehouseId { get; set; }
     public string Code { get; set; } = string.Empty;
     public string Name { get; set; } = string.Empty;
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
 
     public ICollection<Bin> Bins { get; set; } = new List<Bin>();
 }

Backend/ERPCore/Domain/Enums/AuditAction.cs

@@ -5,5 +5,8 @@ public enum AuditAction
 {
     Create,
     Update,
-    Delete
+    Delete,
+    /// <summary>A successful sign-in — written explicitly (not via ErpDbContext's automatic
+    /// entity-change capture, since a login mutates nothing) by AuthController.</summary>
+    Login
 }

Backend/ERPCore/Domain/Enums/PurchaseInvoiceStatus.cs

@@ -0,0 +1,8 @@
+namespace ERPCore.Domain.Enums;
+
+public enum PurchaseInvoiceStatus
+{
+    Draft,
+    Posted,
+    Cancelled
+}

Backend/ERPCore/Dtos/Audit/AuditDtos.cs

@@ -10,3 +10,7 @@ public sealed record AuditLogDto(
 /// <summary>A GL-ready journal stub emitted per stock movement (FR-STK-13).</summary>
 public sealed record JournalEntryStubDto(
     int JournalId, string SourceDocType, int SourceDocId, string DebitAccount, string CreditAccount, decimal Amount);
+
+/// <summary>A captured past sign-in — device history, not a live "currently active sessions" view.</summary>
+public sealed record LoginActivityDto(
+    int LoginActivityId, string? IpAddress, string? DeviceLabel, DateTime LoginAt);

Backend/ERPCore/Dtos/Config/BranchConfigDtos.cs

@@ -0,0 +1,20 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace ERPCore.Dtos.Config;
+
+/// <summary>Branch configuration resource — the singleton toggle for whether this deployment
+/// requires a branch on Employee/Warehouse records at all.</summary>
+public sealed record BranchConfigDto(bool BranchingEnabled, DateTime? UpdatedAt, int? UpdatedBy);
+
+/// <summary>
+/// Full replacement of the flag. <c>UpdatedBy</c> is derived from the token, never posted.
+/// <para>
+/// <see cref="BranchingEnabled"/> is <see cref="bool"/>? deliberately: <c>[Required]</c> on a
+/// non-nullable bool is a no-op, so an omitted flag would otherwise silently bind to
+/// <c>false</c>. Nullable makes the requirement actually bind — an omitted flag is a 400.
+/// </para>
+/// </summary>
+public sealed class UpdateBranchConfigRequest
+{
+    [Required] public bool? BranchingEnabled { get; set; }
+}

Backend/ERPCore/Dtos/Grn/GrnDtos.cs

@@ -15,36 +15,30 @@ public sealed record GrnLineDto(
     HoldStatus HoldStatus, int? BatchId, IReadOnlyList<GrnLineWarrantyNumberDto> WarrantyNumbers);
 
 public sealed record GrnDto(
-    int GrnId, string DocNo, int? PoId, int VendorId, int WarehouseId, GrnStatus Status,
+    int GrnId, string DocNo, int? PoId, int VendorId, int WarehouseId, int BranchId, GrnStatus Status,
     int CreatedBy, DateTime CreatedAt, DateTime? PostedAt, string? GlJournalNo,
-    decimal PaidAmount, decimal BalanceAmount, IReadOnlyList<GrnLineDto> Lines);
+    int? PurchaseInvoiceId, string? PurchaseInvoiceNo, IReadOnlyList<GrnLineDto> Lines);
 
 /// <summary>Row shape for <c>GET /grns</c> — line count instead of the lines themselves.</summary>
 public sealed record GrnSummaryDto(
-    int GrnId, string DocNo, int? PoId, int VendorId, int WarehouseId, GrnStatus Status,
+    int GrnId, string DocNo, int? PoId, int VendorId, int WarehouseId, int BranchId, GrnStatus Status,
     int CreatedBy, DateTime CreatedAt, DateTime? PostedAt, int LineCount,
-    decimal PaidAmount, decimal BalanceAmount);
+    int? PurchaseInvoiceId, string? PurchaseInvoiceNo);
 
 public sealed record CreatedLayerDto(
     int LayerId, int ItemId, int WarehouseId, int? BatchId,
     decimal QtyReceived, decimal QtyRemaining, decimal UnitCost, DateTime ReceiptDate);
 
 public sealed record GrnConfirmResultDto(
-    int GrnId, GrnStatus Status, DateTime PostedAt, string GlJournalNo, decimal BalanceAmount,
+    int GrnId, GrnStatus Status, DateTime PostedAt, string GlJournalNo,
     IReadOnlyList<CreatedLayerDto> CreatedLayers, IReadOnlyList<int> LedgerRefs, PurchaseOrderStatus? PoStatus);
 
 public sealed record ReleaseLineResultDto(int GrnLineId, HoldStatus HoldStatus);
 
-public sealed record GrnPaymentDto(
-    int GrnPaymentId, int GrnId, decimal Amount, DateTime PaymentDate,
-    long GlBankAccountId, string BankAccountName, string? Reference, string? GlJournalNo, DateTime CreatedAt);
-
-public sealed class CreateGrnPaymentRequest
-{
-    [Range(0.01, double.MaxValue)] public decimal Amount { get; set; }
-    [Required] public long GlBankAccountId { get; set; }
-    [StringLength(100)] public string? Reference { get; set; }
-}
+/// <summary>A Confirmed, not-yet-invoiced GRN eligible to be consolidated onto a Purchase Invoice.</summary>
+public sealed record GrnEligibleForInvoiceDto(
+    int GrnId, string DocNo, DateTime PostedAt, int WarehouseId,
+    int LineCount, decimal Subtotal, decimal VatTotal, decimal GrandTotal);
 
 // Requests ----------------------------------------------------------------------
 
@@ -87,6 +81,9 @@ public sealed class CreateGrnRequest
     /// <summary>Required for a direct receipt (no PO); ignored otherwise (vendor derives from the PO).</summary>
     public int? VendorId { get; set; }
     [Required] public int WarehouseId { get; set; }
+    /// <summary>Owning branch for this GRN — warehouses are shared, so this is what actually
+    /// scopes the document (resolved via IBranchConfigService; required when branching is enabled).</summary>
+    [Required] public int BranchId { get; set; }
     [Required, MinLength(1)] public List<CreateGrnLineInput> Lines { get; set; } = new();
 }
 

Backend/ERPCore/Dtos/Hrm/EmployeeDtos.cs

@@ -6,7 +6,7 @@ namespace ERPCore.Dtos.Hrm;
 public sealed record EmployeeListItemDto(
     int EmployeeId, string EmployeeCode, string FullName, string? Email,
     int DepartmentId, string? DepartmentName, int DesignationId, string? DesignationName,
-    int EmploymentTypeId, string? EmploymentTypeName, int? BranchId, string? BranchName,
+    int EmploymentTypeId, string? EmploymentTypeName, int BranchId, string? BranchName,
     EmployeeStatus Status, bool HasUserLink, DateTime HireDate);
 
 public sealed record EmployeeDetailDto(
@@ -16,7 +16,7 @@ public sealed record EmployeeDetailDto(
     string? City, string? PostalCode, string? Country,
     string? EmergencyContactName, string? EmergencyContactRelationship, string? EmergencyContactPhone,
     DateTime HireDate, DateTime? ConfirmationDate, DateTime? LastWorkingDate,
-    int DepartmentId, int DesignationId, int EmploymentTypeId, int? BranchId, int WorkShiftId,
+    int DepartmentId, int DesignationId, int EmploymentTypeId, int BranchId, int WorkShiftId,
     int? ReportingManagerId, string? EpfNumber, string? EtfNumber, string? TaxIdentificationNumber,
     int? UserId, EmployeeStatus Status, DateTime CreatedAt, DateTime? UpdatedAt);
 
@@ -45,7 +45,7 @@ public sealed class CreateEmployeeRequest
     [Required] public int DepartmentId { get; set; }
     [Required] public int DesignationId { get; set; }
     [Required] public int EmploymentTypeId { get; set; }
-    public int? BranchId { get; set; }
+    [Required] public int BranchId { get; set; }
     [Required] public int WorkShiftId { get; set; }
     public int? ReportingManagerId { get; set; }
 
@@ -82,7 +82,7 @@ public sealed class UpdateEmployeeRequest
     [Required] public int DepartmentId { get; set; }
     [Required] public int DesignationId { get; set; }
     [Required] public int EmploymentTypeId { get; set; }
-    public int? BranchId { get; set; }
+    [Required] public int BranchId { get; set; }
     [Required] public int WorkShiftId { get; set; }
     public int? ReportingManagerId { get; set; }
 

Backend/ERPCore/Dtos/Hrm/OrgMasterDtos.cs

@@ -7,20 +7,22 @@ namespace ERPCore.Dtos.Hrm;
 // ids, timestamps) excluded from create/update requests (02-SECURITY B.6/C.1).
 
 public sealed record BranchDto(
-    int BranchId, string Code, string Name, string? Address, EntityStatus Status,
+    int BranchId, string Code, string Name, string? Address, string? PhoneNumber, EntityStatus Status,
     DateTime CreatedAt, DateTime? UpdatedAt);
 
+// Code is server-generated (BranchService.GenerateCodeAsync) — never accepted from the client.
 public sealed class CreateBranchRequest
 {
-    [Required, StringLength(20)] public string Code { get; set; } = string.Empty;
     [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
     [StringLength(500)] public string? Address { get; set; }
+    [StringLength(30)] public string? PhoneNumber { get; set; }
 }
 
 public sealed class UpdateBranchRequest
 {
     [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
     [StringLength(500)] public string? Address { get; set; }
+    [StringLength(30)] public string? PhoneNumber { get; set; }
 }
 
 public sealed record DepartmentDto(

Backend/ERPCore/Dtos/Procurement/PurchaseInvoiceDtos.cs

@@ -0,0 +1,50 @@
+using System.ComponentModel.DataAnnotations;
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Dtos.Procurement;
+
+public sealed record PurchaseInvoiceLineDto(
+    int PurchaseInvoiceLineId, int GrnId, string GrnDocNo, DateTime GrnPostedAt,
+    decimal Subtotal, decimal VatTotal, decimal LineTotal);
+
+public sealed record PurchaseInvoiceTotalsDto(
+    decimal Subtotal, decimal VatTotal, decimal GrandTotal, decimal PaidAmount, decimal BalanceAmount);
+
+public sealed record PurchaseInvoiceDto(
+    int PurchaseInvoiceId, string DocNo, string VendorInvoiceNo, DateTime VendorInvoiceDate,
+    int VendorId, string VendorSnapshotName, string? VendorSnapshotTaxNo,
+    PurchaseInvoiceStatus Status, int GrnCount, int CreatedBy, DateTime CreatedAt, DateTime? UpdatedAt,
+    string? GlJournalNo, DateTime? GlPostedAt,
+    PurchaseInvoiceTotalsDto Totals, IReadOnlyList<PurchaseInvoiceLineDto> Lines);
+
+public sealed record PurchaseInvoiceSummaryDto(
+    int PurchaseInvoiceId, string DocNo, string VendorInvoiceNo, DateTime VendorInvoiceDate,
+    int VendorId, string VendorSnapshotName, PurchaseInvoiceStatus Status, int GrnCount,
+    PurchaseInvoiceTotalsDto Totals, DateTime CreatedAt, string? GlJournalNo);
+
+public sealed record PurchaseInvoicePaymentDto(
+    int PurchaseInvoicePaymentId, int PurchaseInvoiceId, decimal Amount, DateTime PaymentDate,
+    long GlBankAccountId, string BankAccountName, string? Reference, string? GlJournalNo, DateTime CreatedAt);
+
+public sealed class CreatePurchaseInvoicePaymentRequest
+{
+    [Range(0.01, double.MaxValue)] public decimal Amount { get; set; }
+    [Required] public long GlBankAccountId { get; set; }
+    [StringLength(100)] public string? Reference { get; set; }
+}
+
+public sealed class CreatePurchaseInvoiceRequest
+{
+    [Required] public int VendorId { get; set; }
+    [Required, StringLength(50)] public string VendorInvoiceNo { get; set; } = string.Empty;
+    [Required] public DateTime VendorInvoiceDate { get; set; }
+    [Required, MinLength(1)] public List<int> GrnIds { get; set; } = new();
+}
+
+public sealed class UpdatePurchaseInvoiceRequest
+{
+    [Required] public int VendorId { get; set; }
+    [Required, StringLength(50)] public string VendorInvoiceNo { get; set; } = string.Empty;
+    [Required] public DateTime VendorInvoiceDate { get; set; }
+    [Required, MinLength(1)] public List<int> GrnIds { get; set; } = new();
+}

Backend/ERPCore/Dtos/Rbac/MeDtos.cs

@@ -2,5 +2,13 @@ namespace ERPCore.Dtos.Rbac;
 
 /// <summary>Response for `GET /api/v1/auth/me` — the frontend's authoritative source
 /// for the current user's role and permitted sidebar nav codes (replaces trusting
-/// the stale, client-only `roleId` cached in localStorage).</summary>
-public sealed record MeResponseDto(string? RoleCode, string? RoleName, IReadOnlyList<string> NavCodes);
+/// the stale, client-only `roleId` cached in localStorage). <see cref="BranchId"/>/
+/// <see cref="BranchName"/> come from the caller's linked <c>Employee</c> record, when
+/// one exists — null for a login with no Employee link. <see cref="IsAdmin"/> gates
+/// branch pickers client-side only (no server-side branch enforcement exists yet,
+/// see docs/BRANCH_ISOLATION_PLAN.md). <see cref="BranchingEnabled"/> mirrors the
+/// singleton <c>BranchConfig</c> toggle — when false the frontend hides branch pickers
+/// entirely rather than merely restricting them by role.</summary>
+public sealed record MeResponseDto(
+    string? RoleCode, string? RoleName, IReadOnlyList<string> NavCodes,
+    bool IsAdmin, int? BranchId, string? BranchName, bool BranchingEnabled);

Backend/ERPCore/Dtos/Sales/SalesInvoiceDtos.cs

@@ -15,14 +15,14 @@ public sealed record SalesInvoiceTotalsDto(
 
 public sealed record SalesInvoiceDto(
     int SalesInvoiceId, string InvoiceNo, DateTime InvoiceDate, int CustomerId,
-    string CustomerSnapshotName, string? CustomerSnapshotTaxNo, int WarehouseId,
+    string CustomerSnapshotName, string? CustomerSnapshotTaxNo, int WarehouseId, int BranchId,
     SalesInvoiceType InvoiceType, SalesInvoiceStatus Status, int CreatedBy, DateTime CreatedAt,
     DateTime? UpdatedAt, string? GlJournalNo, DateTime? GlPostedAt,
     SalesInvoiceTotalsDto Totals, IReadOnlyList<SalesInvoiceLineDto> Lines);
 
 public sealed record SalesInvoiceSummaryDto(
     int SalesInvoiceId, string InvoiceNo, DateTime InvoiceDate, int CustomerId,
-    string CustomerSnapshotName, int WarehouseId, SalesInvoiceType InvoiceType,
+    string CustomerSnapshotName, int WarehouseId, int BranchId, SalesInvoiceType InvoiceType,
     SalesInvoiceStatus Status, SalesInvoiceTotalsDto Totals, DateTime CreatedAt, string? GlJournalNo);
 
 public sealed record SalesInvoicePaymentDto(
@@ -65,6 +65,9 @@ public sealed class CreateSalesInvoiceRequest
 {
     [Required] public int CustomerId { get; set; }
     [Required] public int WarehouseId { get; set; }
+    /// <summary>Owning branch — warehouses are shared, so this is what actually scopes the
+    /// document (resolved via IBranchConfigService).</summary>
+    [Required] public int BranchId { get; set; }
     [Required, EnumDataType(typeof(SalesInvoiceType))] public SalesInvoiceType InvoiceType { get; set; } = SalesInvoiceType.B2C;
     [Required, MinLength(1)] public List<CreateSalesInvoiceLineRequest> Lines { get; set; } = new();
 }
@@ -73,6 +76,9 @@ public sealed class UpdateSalesInvoiceRequest
 {
     [Required] public int CustomerId { get; set; }
     [Required] public int WarehouseId { get; set; }
+    /// <summary>Owning branch — warehouses are shared, so this is what actually scopes the
+    /// document (resolved via IBranchConfigService).</summary>
+    [Required] public int BranchId { get; set; }
     [Required, EnumDataType(typeof(SalesInvoiceType))] public SalesInvoiceType InvoiceType { get; set; } = SalesInvoiceType.B2C;
     [Required, MinLength(1)] public List<CreateSalesInvoiceLineRequest> Lines { get; set; } = new();
 }

Backend/ERPCore/Dtos/Stock/AdjustmentDtos.cs

@@ -8,13 +8,13 @@ namespace ERPCore.Dtos.Stock;
 public sealed record AdjustmentLineDto(int AdjLineId, int ItemId, int? BinId, int? BatchId, decimal QtyDelta);
 
 public sealed record AdjustmentDto(
-    int AdjustmentId, string DocNo, int WarehouseId, int ReasonCodeId, AdjustmentStatus Status,
+    int AdjustmentId, string DocNo, int WarehouseId, int BranchId, int ReasonCodeId, AdjustmentStatus Status,
     int CreatedBy, DateTime CreatedAt, string? GlJournalNo, DateTime? GlPostedAt,
     IReadOnlyList<AdjustmentLineDto> Lines, IReadOnlyList<int> LedgerRefs);
 
 /// <summary>Row shape for <c>GET /stock-adjustments</c> — no lines/ledgerRefs (those need a per-row query).</summary>
 public sealed record AdjustmentSummaryDto(
-    int AdjustmentId, string DocNo, int WarehouseId, int ReasonCodeId, AdjustmentStatus Status,
+    int AdjustmentId, string DocNo, int WarehouseId, int BranchId, int ReasonCodeId, AdjustmentStatus Status,
     int CreatedBy, DateTime CreatedAt, int LineCount, string? GlJournalNo);
 
 // Requests ----------------------------------------------------------------------
@@ -31,6 +31,9 @@ public sealed class CreateAdjustmentLineInput
 public sealed class CreateAdjustmentRequest
 {
     [Required] public int WarehouseId { get; set; }
+    /// <summary>Owning branch — warehouses are shared, so this is what actually scopes the
+    /// document (resolved via IBranchConfigService).</summary>
+    [Required] public int BranchId { get; set; }
     /// <summary>Nullable so an omitted value is a distinct <c>REASON_CODE_REQUIRED</c> error, not 0.</summary>
     public int? ReasonCodeId { get; set; }
     [Required, MinLength(1)] public List<CreateAdjustmentLineInput> Lines { get; set; } = new();

Backend/ERPCore/Dtos/Stock/CountDtos.cs

@@ -8,12 +8,12 @@ namespace ERPCore.Dtos.Stock;
 public sealed record CountLineDto(int CountLineId, int ItemId, int? BinId, decimal SystemQty, decimal? CountedQty, decimal? Variance);
 
 public sealed record CountDto(
-    int CountId, string DocNo, int WarehouseId, CountType CountType, CountStatus Status,
+    int CountId, string DocNo, int WarehouseId, int BranchId, CountType CountType, CountStatus Status,
     int CreatedBy, DateTime CreatedAt, IReadOnlyList<CountLineDto> Lines);
 
 /// <summary>Row shape for <c>GET /stock-counts</c> — line count instead of the lines themselves.</summary>
 public sealed record CountSummaryDto(
-    int CountId, string DocNo, int WarehouseId, CountType CountType, CountStatus Status,
+    int CountId, string DocNo, int WarehouseId, int BranchId, CountType CountType, CountStatus Status,
     int CreatedBy, DateTime CreatedAt, int LineCount);
 
 public sealed record CountPostResultDto(int CountId, CountStatus Status, int? AdjustmentId, string? GlJournalNo, IReadOnlyList<int> LedgerRefs);
@@ -23,6 +23,9 @@ public sealed record CountPostResultDto(int CountId, CountStatus Status, int? Ad
 public sealed class CreateCountRequest
 {
     [Required] public int WarehouseId { get; set; }
+    /// <summary>Owning branch — warehouses are shared, so this is what actually scopes the
+    /// document (resolved via IBranchConfigService).</summary>
+    [Required] public int BranchId { get; set; }
     [Required, EnumDataType(typeof(CountType))] public CountType CountType { get; set; }
     [Required, MinLength(1)] public List<int> ItemIds { get; set; } = new();
 }

Backend/ERPCore/Dtos/Stock/TransferDtos.cs

@@ -9,12 +9,12 @@ public sealed record TransferLineDto(
     int TransferLineId, int ItemId, int? SrcBinId, int? DestBinId, int? BatchId, decimal Qty, decimal QtyReceived);
 
 public sealed record TransferDto(
-    int TransferId, string DocNo, int SrcWarehouseId, int DestWarehouseId,
+    int TransferId, string DocNo, int SrcWarehouseId, int DestWarehouseId, int BranchId,
     TransferStatus Status, int CreatedBy, DateTime CreatedAt, IReadOnlyList<TransferLineDto> Lines);
 
 /// <summary>Row shape for <c>GET /stock-transfers</c> — line count instead of the lines themselves.</summary>
 public sealed record TransferSummaryDto(
-    int TransferId, string DocNo, int SrcWarehouseId, int DestWarehouseId,
+    int TransferId, string DocNo, int SrcWarehouseId, int DestWarehouseId, int BranchId,
     TransferStatus Status, int CreatedBy, DateTime CreatedAt, int LineCount);
 
 public sealed record ConsumedLayerDto(int LayerId, decimal QtyConsumed, decimal UnitCost);
@@ -42,6 +42,9 @@ public sealed class CreateTransferRequest
 {
     [Required] public int SrcWarehouseId { get; set; }
     [Required] public int DestWarehouseId { get; set; }
+    /// <summary>Owning branch for this transfer — warehouses are shared, so this is what
+    /// actually scopes the document (resolved via IBranchConfigService).</summary>
+    [Required] public int BranchId { get; set; }
     [Required, MinLength(1)] public List<CreateTransferLineInput> Lines { get; set; } = new();
 }
 

Backend/ERPCore/Dtos/Users/UserDtos.cs

@@ -30,6 +30,22 @@ public sealed class CreateUserRequest
     /// email-lookup — never automatic, even on an exact email match (docs/12-BACKEND-HRM.md A.5).
     /// </summary>
     public int? LinkEmployeeId { get; set; }
+
+    /// <summary>
+    /// Required, together with <see cref="DepartmentId"/>/<see cref="DesignationId"/>/
+    /// <see cref="EmploymentTypeId"/>/<see cref="WorkShiftId"/>/<see cref="BranchId"/>, whenever
+    /// the assigned Role is not Admin and <see cref="LinkEmployeeId"/> is not supplied: creates
+    /// the linked Employee record whose BranchId is what actually scopes this account to one
+    /// branch (see BranchAccessService.EnsureBranchVisibleAsync).
+    /// </summary>
+    public string? EmployeeCode { get; set; }
+    public int? BranchId { get; set; }
+    public int? DepartmentId { get; set; }
+    public int? DesignationId { get; set; }
+    public int? EmploymentTypeId { get; set; }
+    public int? WorkShiftId { get; set; }
+    /// <summary>Defaults to today when omitted.</summary>
+    public DateTime? HireDate { get; set; }
 }
 
 public sealed class UpdateUserRoleRequest
@@ -37,5 +53,10 @@ public sealed class UpdateUserRoleRequest
     [Required] public int RoleId { get; set; }
 }
 
+public sealed class UpdateUserStatusRequest
+{
+    [Required, EnumDataType(typeof(EntityStatus))] public EntityStatus Status { get; set; }
+}
+
 /// <summary>AuthHex UserType lookup, for populating the create-user form's select (no local shadow — read-only passthrough).</summary>
 public sealed record UserTypeOptionDto(Guid UserTypeId, string? Code, string? Description);

Backend/ERPCore/Dtos/Warehouses/WarehouseDtos.cs

@@ -2,8 +2,10 @@ using System.ComponentModel.DataAnnotations;
 
 namespace ERPCore.Dtos.Warehouses;
 
-/// <summary>Warehouse resource (docs/11-BACKEND-PHASE1.md §2.5).</summary>
-public sealed record WarehouseDto(int WarehouseId, string Code, string Name);
+/// <summary>Warehouse resource (docs/11-BACKEND-PHASE1.md §2.5). <see cref="BranchId"/> is
+/// the anchor `docs/BRANCH_ISOLATION_PLAN.md` uses to branch-scope everything that carries
+/// a `warehouseId` (Sales, GRN, stock, ...) without a column on every one of those entities.</summary>
+public sealed record WarehouseDto(int WarehouseId, string Code, string Name, int BranchId, string? BranchName);
 
 /// <summary>Bin/location resource (docs/11 §2.5).</summary>
 public sealed record BinDto(int BinId, int WarehouseId, string Code, string? BinType);
@@ -12,6 +14,7 @@ public sealed class CreateWarehouseRequest
 {
     [Required, StringLength(50)] public string Code { get; set; } = string.Empty;
     [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    [Required] public int BranchId { get; set; }
 }
 
 public sealed class CreateBinRequest

Backend/ERPCore/Infra/Auth/CurrentUser.cs

@@ -31,4 +31,8 @@ public sealed class CurrentUser : ICurrentUser
     }
 
     public int AuditUserId => int.TryParse(UserId, out var id) ? id : User.SystemUserId;
+
+    public string? RoleCode => _accessor.HttpContext?.User?.FindFirstValue(AuthHexClaims.RoleCode);
+
+    public bool IsAdmin => string.Equals(RoleCode?.Trim(), "Admin", StringComparison.OrdinalIgnoreCase);
 }

Backend/ERPCore/Infra/Auth/ICurrentUser.cs

@@ -19,4 +19,14 @@ public interface ICurrentUser
 
     /// <summary>True when the request carries an authenticated principal.</summary>
     bool IsAuthenticated { get; }
+
+    /// <summary>The AuthHex <c>RoleCode</c> claim verbatim, or null if absent/unauthenticated.</summary>
+    string? RoleCode { get; }
+
+    /// <summary>
+    /// True when <see cref="RoleCode"/> is "Admin" (case-insensitive — AuthHex mints the claim
+    /// independently of ERPCore's stored casing). Mirrors <c>RoleService.GetMeAsync</c>'s check;
+    /// the only role that bypasses branch-scoping (see <see cref="Services.Interfaces.IBranchAccessService"/>).
+    /// </summary>
+    bool IsAdmin { get; }
 }

Backend/ERPCore/Infra/Auth/UserAgentLabeler.cs

@@ -0,0 +1,39 @@
+namespace ERPCore.Infra.Auth;
+
+/// <summary>
+/// Best-effort "Browser on OS" label from a raw User-Agent string, for display in the
+/// login-device history — not a full parsing library, just enough to be readable
+/// (docs call this out: exact device model detection is out of scope).
+/// </summary>
+public static class UserAgentLabeler
+{
+    public static string Label(string? userAgent)
+    {
+        if (string.IsNullOrWhiteSpace(userAgent)) return "Unknown device";
+
+        var os = DetectOs(userAgent);
+        var browser = DetectBrowser(userAgent);
+        return $"{browser} on {os}";
+    }
+
+    private static string DetectOs(string ua)
+    {
+        if (ua.Contains("Windows", StringComparison.OrdinalIgnoreCase)) return "Windows";
+        if (ua.Contains("Mac OS X", StringComparison.OrdinalIgnoreCase) || ua.Contains("Macintosh", StringComparison.OrdinalIgnoreCase)) return "macOS";
+        if (ua.Contains("Android", StringComparison.OrdinalIgnoreCase)) return "Android";
+        if (ua.Contains("iPhone", StringComparison.OrdinalIgnoreCase) || ua.Contains("iPad", StringComparison.OrdinalIgnoreCase)) return "iOS";
+        if (ua.Contains("Linux", StringComparison.OrdinalIgnoreCase)) return "Linux";
+        return "an unknown OS";
+    }
+
+    private static string DetectBrowser(string ua)
+    {
+        // Order matters: Edge/OPR/Chrome all also contain "Safari"/"Chrome" tokens.
+        if (ua.Contains("Edg/", StringComparison.OrdinalIgnoreCase)) return "Edge";
+        if (ua.Contains("OPR/", StringComparison.OrdinalIgnoreCase) || ua.Contains("Opera", StringComparison.OrdinalIgnoreCase)) return "Opera";
+        if (ua.Contains("Firefox", StringComparison.OrdinalIgnoreCase)) return "Firefox";
+        if (ua.Contains("CriOS", StringComparison.OrdinalIgnoreCase) || ua.Contains("Chrome", StringComparison.OrdinalIgnoreCase)) return "Chrome";
+        if (ua.Contains("Safari", StringComparison.OrdinalIgnoreCase)) return "Safari";
+        return "an unknown browser";
+    }
+}

Backend/ERPCore/Infra/Gl/GeneralLedgerClient.cs

@@ -18,6 +18,11 @@ public sealed class GeneralLedgerClient(HttpClient http, IConfiguration configur
     public async Task<GeneralLedgerResponse> SendAsync(
         HttpMethod method, string path, string? queryString, string? contentType, Stream? body, CancellationToken ct)
     {
+        // The base appsettings.json ships the key blank; name it here rather than forward GL's 401
+        // for an empty X-Api-Key (deployed environments already refuse to start without it).
+        if (string.IsNullOrWhiteSpace(_apiKey))
+            throw new DomainException(ErrorCodes.GlServiceUnavailable, "GeneralLedgerService:ApiKey is not configured.", 503);
+
         var relativeUri = path.TrimStart('/') + queryString;
         using var request = new HttpRequestMessage(method, relativeUri);
         request.Headers.TryAddWithoutValidation("X-Api-Key", _apiKey);

Backend/ERPCore/Infra/Persistence/Auditing/AuditScribe.cs

@@ -21,7 +21,7 @@ public static class AuditScribe
     private static readonly HashSet<Type> Excluded =
     [
         typeof(AuditLog), typeof(JournalEntryStub), typeof(NumberSequence),
-        typeof(StockLedger), typeof(StockLayer),
+        typeof(StockLedger), typeof(StockLayer), typeof(LoginActivity),
     ];
 
     private static readonly JsonSerializerOptions Json = new()

Backend/ERPCore/Infra/Persistence/Configurations/BranchConfigConfiguration.cs

@@ -0,0 +1,33 @@
+using ERPCore.Domain.Entities;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ERPCore.Infra.Persistence.Configurations;
+
+/// <summary>
+/// Configures the singleton branch-configuration row. The check constraint is what makes
+/// "singleton" a database guarantee rather than a convention (mirrors ProductConfig).
+/// </summary>
+public sealed class BranchConfigConfiguration : IEntityTypeConfiguration<BranchConfig>
+{
+    public void Configure(EntityTypeBuilder<BranchConfig> builder)
+    {
+        builder.ToTable("branch_config", t =>
+            t.HasCheckConstraint("ck_branch_config_singleton", $"\"ConfigId\" = {BranchConfig.SingletonId}"));
+
+        builder.HasKey(c => c.ConfigId);
+
+        // The id is fixed, never generated — there is exactly one row, seeded by DataSeeder.
+        builder.Property(c => c.ConfigId).ValueGeneratedNever();
+
+        builder.Property(c => c.BranchingEnabled).IsRequired().HasDefaultValue(true);
+
+        // PostgreSQL xmin system column as the optimistic concurrency token (ETag).
+        builder.Property(c => c.RowVersion).IsRowVersion();
+
+        builder.HasOne(c => c.UpdatedByUser)
+            .WithMany()
+            .HasForeignKey(c => c.UpdatedBy)
+            .OnDelete(DeleteBehavior.Restrict);
+    }
+}

Backend/ERPCore/Infra/Persistence/Configurations/BranchConfiguration.cs

@@ -16,6 +16,7 @@ public sealed class BranchConfiguration : IEntityTypeConfiguration<Branch>
         builder.HasIndex(b => b.Code).IsUnique();
         builder.Property(b => b.Name).IsRequired().HasMaxLength(200);
         builder.Property(b => b.Address).HasMaxLength(500);
+        builder.Property(b => b.PhoneNumber).HasMaxLength(30);
 
         builder.Property(b => b.Status)
             .HasConversion<string>().HasMaxLength(20).IsRequired()

Backend/ERPCore/Infra/Persistence/Configurations/GrnConfiguration.cs

@@ -17,38 +17,18 @@ public sealed class GrnConfiguration : IEntityTypeConfiguration<Grn>
         builder.Property(g => g.Status).HasConversion<string>().HasMaxLength(20).IsRequired();
         builder.Property(g => g.CreatedAt).IsRequired();
         builder.Property(g => g.GlJournalNo).HasMaxLength(30);
-        builder.Property(g => g.PaidAmount).HasPrecision(18, 4);
-        builder.Property(g => g.BalanceAmount).HasPrecision(18, 4);
         builder.Property(g => g.RowVersion).IsRowVersion();
 
         builder.HasOne(g => g.PurchaseOrder).WithMany().HasForeignKey(g => g.PoId).OnDelete(DeleteBehavior.Restrict);
         builder.HasOne(g => g.Vendor).WithMany().HasForeignKey(g => g.VendorId).OnDelete(DeleteBehavior.Restrict);
         builder.HasOne(g => g.Warehouse).WithMany().HasForeignKey(g => g.WarehouseId).OnDelete(DeleteBehavior.Restrict);
+        builder.HasOne(g => g.Branch).WithMany().HasForeignKey(g => g.BranchId).OnDelete(DeleteBehavior.Restrict);
         builder.HasOne(g => g.Creator).WithMany().HasForeignKey(g => g.CreatedBy).OnDelete(DeleteBehavior.Restrict);
+        builder.HasOne(g => g.PurchaseInvoice).WithMany().HasForeignKey(g => g.PurchaseInvoiceId).OnDelete(DeleteBehavior.Restrict);
 
         builder.HasIndex(g => g.Status);
         builder.HasIndex(g => g.PoId);
-    }
-}
-
-public sealed class GrnPaymentConfiguration : IEntityTypeConfiguration<GrnPayment>
-{
-    public void Configure(EntityTypeBuilder<GrnPayment> builder)
-    {
-        builder.ToTable("grn_payments");
-        builder.HasKey(p => p.GrnPaymentId);
-
-        builder.Property(p => p.Amount).HasPrecision(18, 4);
-        builder.Property(p => p.PaymentDate).IsRequired();
-        builder.Property(p => p.BankAccountName).IsRequired().HasMaxLength(200);
-        builder.Property(p => p.Reference).HasMaxLength(100);
-        builder.Property(p => p.GlJournalNo).HasMaxLength(30);
-        builder.Property(p => p.CreatedAt).IsRequired();
-
-        builder.HasOne(p => p.Grn).WithMany(g => g.Payments).HasForeignKey(p => p.GrnId).OnDelete(DeleteBehavior.Restrict);
-        builder.HasOne(p => p.Creator).WithMany().HasForeignKey(p => p.CreatedBy).OnDelete(DeleteBehavior.Restrict);
-
-        builder.HasIndex(p => p.GrnId);
+        builder.HasIndex(g => g.BranchId);
     }
 }
 

Backend/ERPCore/Infra/Persistence/Configurations/LoginActivityConfiguration.cs

@@ -0,0 +1,23 @@
+using ERPCore.Domain.Entities;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ERPCore.Infra.Persistence.Configurations;
+
+public sealed class LoginActivityConfiguration : IEntityTypeConfiguration<LoginActivity>
+{
+    public void Configure(EntityTypeBuilder<LoginActivity> builder)
+    {
+        builder.ToTable("login_activities");
+        builder.HasKey(l => l.LoginActivityId);
+
+        builder.Property(l => l.IpAddress).HasMaxLength(64);
+        builder.Property(l => l.UserAgent).HasMaxLength(500);
+        builder.Property(l => l.DeviceLabel).HasMaxLength(200);
+        builder.Property(l => l.LoginAt).IsRequired();
+
+        builder.HasOne(l => l.User).WithMany().HasForeignKey(l => l.UserId).OnDelete(DeleteBehavior.Cascade);
+
+        builder.HasIndex(l => new { l.UserId, l.LoginAt });
+    }
+}

Backend/ERPCore/Infra/Persistence/Configurations/NavItemConfiguration.cs

@@ -29,7 +29,8 @@ public sealed class NavItemConfiguration : IEntityTypeConfiguration<NavItem>
         builder.HasData(
             new NavItem { NavItemId = 1, Code = "dashboard", Label = "Dashboard", Href = "/dashboard", SortOrder = 1 },
             new NavItem { NavItemId = 2, Code = "products", Label = "Products", Href = "/dashboard/products", SortOrder = 2 },
-            new NavItem { NavItemId = 3, Code = "vendors", Label = "Vendors", Href = "/dashboard/vendors", SortOrder = 3 },
+            // NavItemId 3 ("vendors") retired 2026-09-09 — Vendors moved under Procurement as a
+            // sub-item (see SubNavItemConfiguration/PermissionConfiguration), matching the sidebar.
             new NavItem { NavItemId = 4, Code = "procurement", Label = "Procurement", Href = "/dashboard/procurement", SortOrder = 4 },
             new NavItem { NavItemId = 5, Code = "receiving", Label = "Receiving", Href = "/dashboard/receiving/grn", SortOrder = 5 },
             new NavItem { NavItemId = 6, Code = "stock", Label = "Stock", Href = "/dashboard/stock", SortOrder = 6 },

Backend/ERPCore/Infra/Persistence/Configurations/PermissionConfiguration.cs

@@ -26,7 +26,9 @@ public sealed class PermissionConfiguration : IEntityTypeConfiguration<Permissio
         builder.HasData(
             new Permission { PermissionId = 1, Code = "NAV:dashboard", NavItemId = 1 },
             new Permission { PermissionId = 2, Code = "NAV:products", NavItemId = 2 },
-            new Permission { PermissionId = 3, Code = "NAV:vendors", NavItemId = 3 },
+            // Moved under Procurement as a sub-item (2026-09-09) — same PermissionId (3), just
+            // repointed to the new SubNavItem, so any role already granted this permission keeps it.
+            new Permission { PermissionId = 3, Code = "NAV:procurement.vendors", SubNavItemId = 30 },
             new Permission { PermissionId = 4, Code = "NAV:procurement", NavItemId = 4 },
             new Permission { PermissionId = 5, Code = "NAV:receiving", NavItemId = 5 },
             new Permission { PermissionId = 6, Code = "NAV:stock", NavItemId = 6 },
@@ -63,9 +65,25 @@ public sealed class PermissionConfiguration : IEntityTypeConfiguration<Permissio
             new Permission { PermissionId = 33, Code = "NAV:accounts.cheque-books", SubNavItemId = 21 },
             new Permission { PermissionId = 34, Code = "NAV:accounts.received-cheques", SubNavItemId = 22 },
             new Permission { PermissionId = 35, Code = "NAV:production", NavItemId = 14 },
-            new Permission { PermissionId = 36, Code = "NAV:production.templates", SubNavItemId = 24 },
+            new Permission { PermissionId = 36, Code = "NAV:production.templates", SubNavItemId = 27 },
             new Permission { PermissionId = 37, Code = "NAV:production.runs", SubNavItemId = 25 },
-            new Permission { PermissionId = 38, Code = "NAV:production.produced", SubNavItemId = 26 }
+            new Permission { PermissionId = 38, Code = "NAV:production.produced", SubNavItemId = 26 },
+            new Permission { PermissionId = 39, Code = "NAV:procurement.purchase-invoices", SubNavItemId = 28 },
+            new Permission { PermissionId = 40, Code = "NAV:settings.branches", SubNavItemId = 29 },
+            new Permission { PermissionId = 41, Code = "NAV:stock.ledger", SubNavItemId = 31 },
+            new Permission { PermissionId = 42, Code = "NAV:stock.enquiry", SubNavItemId = 32 },
+            new Permission { PermissionId = 43, Code = "NAV:stock.valuation", SubNavItemId = 33 },
+            new Permission { PermissionId = 44, Code = "NAV:stock.transfers", SubNavItemId = 34 },
+            new Permission { PermissionId = 45, Code = "NAV:stock.adjustments", SubNavItemId = 35 },
+            new Permission { PermissionId = 46, Code = "NAV:stock.counts", SubNavItemId = 36 },
+            new Permission { PermissionId = 47, Code = "NAV:stock.reorder-alerts", SubNavItemId = 37 },
+            new Permission { PermissionId = 48, Code = "NAV:stock.wastage", SubNavItemId = 38 },
+            // Sales (NavItemId 13) children — SubNavItemId 23 had no permission row before now
+            // (mirrors SubNavItemConfiguration's rename of that row to sales.bundle-templates).
+            new Permission { PermissionId = 49, Code = "NAV:sales.bundle-templates", SubNavItemId = 23 },
+            new Permission { PermissionId = 50, Code = "NAV:sales.invoices", SubNavItemId = 40 },
+            new Permission { PermissionId = 51, Code = "NAV:sales.free-issues", SubNavItemId = 41 },
+            new Permission { PermissionId = 52, Code = "NAV:sales.day-end", SubNavItemId = 42 }
         );
     }
 }

Backend/ERPCore/Infra/Persistence/Configurations/PurchaseInvoiceConfiguration.cs

@@ -0,0 +1,97 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ERPCore.Infra.Persistence.Configurations;
+
+public sealed class PurchaseInvoiceConfiguration : IEntityTypeConfiguration<PurchaseInvoice>
+{
+    public void Configure(EntityTypeBuilder<PurchaseInvoice> builder)
+    {
+        builder.ToTable("purchase_invoices");
+        builder.HasKey(x => x.PurchaseInvoiceId);
+
+        builder.Property(x => x.DocNo).IsRequired().HasMaxLength(30);
+        builder.HasIndex(x => x.DocNo).IsUnique();
+
+        builder.Property(x => x.VendorInvoiceNo).IsRequired().HasMaxLength(50);
+        builder.Property(x => x.VendorInvoiceDate).IsRequired();
+        // A vendor invoice number is only meaningful per-vendor; the service also excludes
+        // Cancelled invoices from the duplicate check, so this composite index is a coarse
+        // backstop (it does not distinguish Cancelled rows) rather than the sole enforcement.
+        builder.HasIndex(x => new { x.VendorId, x.VendorInvoiceNo });
+
+        builder.HasOne(x => x.Vendor)
+            .WithMany()
+            .HasForeignKey(x => x.VendorId)
+            .OnDelete(DeleteBehavior.Restrict);
+
+        builder.Property(x => x.VendorSnapshotName).IsRequired().HasMaxLength(200);
+        builder.Property(x => x.VendorSnapshotTaxNo).HasMaxLength(50);
+
+        builder.Property(x => x.Status)
+            .HasConversion<string>().HasMaxLength(20).IsRequired()
+            .HasDefaultValue(PurchaseInvoiceStatus.Draft);
+
+        foreach (var p in new[] { nameof(PurchaseInvoice.Subtotal), nameof(PurchaseInvoice.VatTotal), nameof(PurchaseInvoice.GrandTotal), nameof(PurchaseInvoice.PaidAmount), nameof(PurchaseInvoice.BalanceAmount) })
+            builder.Property<decimal>(p).HasPrecision(18, 4);
+        builder.Property(x => x.GlJournalNo).HasMaxLength(30);
+
+        builder.HasOne(x => x.Creator).WithMany().HasForeignKey(x => x.CreatedBy).OnDelete(DeleteBehavior.Restrict);
+        builder.Property(x => x.CreatedAt).IsRequired();
+        builder.Property(x => x.RowVersion).IsRowVersion();
+
+        builder.HasIndex(x => x.Status);
+        builder.HasIndex(x => x.VendorId);
+
+        builder.HasMany(x => x.Lines)
+            .WithOne(x => x.PurchaseInvoice)
+            .HasForeignKey(x => x.PurchaseInvoiceId)
+            .OnDelete(DeleteBehavior.Cascade);
+    }
+}
+
+public sealed class PurchaseInvoiceLineConfiguration : IEntityTypeConfiguration<PurchaseInvoiceLine>
+{
+    public void Configure(EntityTypeBuilder<PurchaseInvoiceLine> builder)
+    {
+        builder.ToTable("purchase_invoice_lines");
+        builder.HasKey(x => x.PurchaseInvoiceLineId);
+
+        builder.Property(x => x.Subtotal).HasPrecision(18, 4);
+        builder.Property(x => x.VatTotal).HasPrecision(18, 4);
+        builder.Property(x => x.LineTotal).HasPrecision(18, 4);
+
+        builder.HasOne(x => x.Grn)
+            .WithMany()
+            .HasForeignKey(x => x.GrnId)
+            .OnDelete(DeleteBehavior.Restrict);
+
+        // A GRN can be consolidated onto at most one active line at a time — cancelling the
+        // invoice removes its lines and frees the GRN (PurchaseInvoiceService.CancelAsync), so
+        // this stays enforceable rather than blocking a later re-invoice of the same GRN.
+        builder.HasIndex(x => x.GrnId).IsUnique();
+    }
+}
+
+public sealed class PurchaseInvoicePaymentConfiguration : IEntityTypeConfiguration<PurchaseInvoicePayment>
+{
+    public void Configure(EntityTypeBuilder<PurchaseInvoicePayment> builder)
+    {
+        builder.ToTable("purchase_invoice_payments");
+        builder.HasKey(p => p.PurchaseInvoicePaymentId);
+
+        builder.Property(p => p.Amount).HasPrecision(18, 4);
+        builder.Property(p => p.PaymentDate).IsRequired();
+        builder.Property(p => p.BankAccountName).IsRequired().HasMaxLength(200);
+        builder.Property(p => p.Reference).HasMaxLength(100);
+        builder.Property(p => p.GlJournalNo).HasMaxLength(30);
+        builder.Property(p => p.CreatedAt).IsRequired();
+
+        builder.HasOne(p => p.PurchaseInvoice).WithMany(x => x.Payments).HasForeignKey(p => p.PurchaseInvoiceId).OnDelete(DeleteBehavior.Restrict);
+        builder.HasOne(p => p.Creator).WithMany().HasForeignKey(p => p.CreatedBy).OnDelete(DeleteBehavior.Restrict);
+
+        builder.HasIndex(p => p.PurchaseInvoiceId);
+    }
+}

Backend/ERPCore/Infra/Persistence/Configurations/SalesInvoiceConfiguration.cs

@@ -30,6 +30,11 @@ public sealed class SalesInvoiceConfiguration : IEntityTypeConfiguration<SalesIn
             .HasForeignKey(x => x.WarehouseId)
             .OnDelete(DeleteBehavior.Restrict);
 
+        builder.HasOne(x => x.Branch)
+            .WithMany()
+            .HasForeignKey(x => x.BranchId)
+            .OnDelete(DeleteBehavior.Restrict);
+
         builder.Property(x => x.InvoiceType)
             .HasConversion<string>().HasMaxLength(20).IsRequired()
             .HasDefaultValue(SalesInvoiceType.B2C);
@@ -47,6 +52,7 @@ public sealed class SalesInvoiceConfiguration : IEntityTypeConfiguration<SalesIn
 
         builder.HasIndex(x => x.Status);
         builder.HasIndex(x => x.InvoiceDate);
+        builder.HasIndex(x => x.BranchId);
 
         builder.HasMany(x => x.Lines)
             .WithOne(x => x.SalesInvoice)

Backend/ERPCore/Infra/Persistence/Configurations/StockAdjustmentConfiguration.cs

@@ -21,7 +21,10 @@ public sealed class StockAdjustmentConfiguration : IEntityTypeConfiguration<Stoc
 
         builder.HasOne(a => a.Warehouse).WithMany().HasForeignKey(a => a.WarehouseId).OnDelete(DeleteBehavior.Restrict);
         builder.HasOne(a => a.ReasonCode).WithMany().HasForeignKey(a => a.ReasonCodeId).OnDelete(DeleteBehavior.Restrict);
+        builder.HasOne(a => a.Branch).WithMany().HasForeignKey(a => a.BranchId).OnDelete(DeleteBehavior.Restrict);
         builder.HasOne(a => a.Creator).WithMany().HasForeignKey(a => a.CreatedBy).OnDelete(DeleteBehavior.Restrict);
+
+        builder.HasIndex(a => a.BranchId);
     }
 }
 

Backend/ERPCore/Infra/Persistence/Configurations/StockCountConfiguration.cs

@@ -20,9 +20,11 @@ public sealed class StockCountConfiguration : IEntityTypeConfiguration<StockCoun
         builder.Property(c => c.RowVersion).IsRowVersion();
 
         builder.HasOne(c => c.Warehouse).WithMany().HasForeignKey(c => c.WarehouseId).OnDelete(DeleteBehavior.Restrict);
+        builder.HasOne(c => c.Branch).WithMany().HasForeignKey(c => c.BranchId).OnDelete(DeleteBehavior.Restrict);
         builder.HasOne(c => c.Creator).WithMany().HasForeignKey(c => c.CreatedBy).OnDelete(DeleteBehavior.Restrict);
 
         builder.HasIndex(c => c.Status);
+        builder.HasIndex(c => c.BranchId);
     }
 }
 

Backend/ERPCore/Infra/Persistence/Configurations/StockTransferConfiguration.cs

@@ -20,9 +20,11 @@ public sealed class StockTransferConfiguration : IEntityTypeConfiguration<StockT
 
         builder.HasOne(t => t.SrcWarehouse).WithMany().HasForeignKey(t => t.SrcWarehouseId).OnDelete(DeleteBehavior.Restrict);
         builder.HasOne(t => t.DestWarehouse).WithMany().HasForeignKey(t => t.DestWarehouseId).OnDelete(DeleteBehavior.Restrict);
+        builder.HasOne(t => t.Branch).WithMany().HasForeignKey(t => t.BranchId).OnDelete(DeleteBehavior.Restrict);
         builder.HasOne(t => t.Creator).WithMany().HasForeignKey(t => t.CreatedBy).OnDelete(DeleteBehavior.Restrict);
 
         builder.HasIndex(t => t.Status);
+        builder.HasIndex(t => t.BranchId);
     }
 }
 

Backend/ERPCore/Infra/Persistence/Configurations/SubNavItemConfiguration.cs

@@ -31,17 +31,28 @@ public sealed class SubNavItemConfiguration : IEntityTypeConfiguration<SubNavIte
             new SubNavItem { SubNavItemId = 4, NavItemId = 2, Code = "products.item-type", Label = "Item Type", Href = "/dashboard/products/item-types", SortOrder = 4 },
             new SubNavItem { SubNavItemId = 5, NavItemId = 2, Code = "products.uom", Label = "UOM", Href = "/dashboard/products/uoms", SortOrder = 5 },
             new SubNavItem { SubNavItemId = 6, NavItemId = 2, Code = "products.configuration", Label = "Configuration", Href = "/dashboard/products/settings", SortOrder = 6 },
+            new SubNavItem { SubNavItemId = 29, NavItemId = 9, Code = "settings.branches", Label = "Branches", Href = "/dashboard/settings/branches", SortOrder = 0 },
             new SubNavItem { SubNavItemId = 7, NavItemId = 9, Code = "settings.roles", Label = "Roles", Href = "/dashboard/settings/roles", SortOrder = 1 },
             new SubNavItem { SubNavItemId = 8, NavItemId = 9, Code = "settings.users", Label = "Users", Href = "/dashboard/settings/users", SortOrder = 2 },
             new SubNavItem { SubNavItemId = 24, NavItemId = 9, Code = "settings.notification-config", Label = "Notification Config", Href = "/dashboard/settings/notification-config", SortOrder = 3 },
-            new SubNavItem { SubNavItemId = 23, NavItemId = 13, Code = "sales.bundle-sales", Label = "Bundle Sales", Href = "/dashboard/sales/bundles", SortOrder = 1 },
+            // Sales (NavItemId 13) children — mirror the sidebar order (AppSidebar.tsx). SubNavItemId
+            // 23 is renamed in place (was "sales.bundle-sales" / Bundle Sales) rather than
+            // delete+recreate, so any role already granted this permission keeps it; the rest are new.
+            new SubNavItem { SubNavItemId = 40, NavItemId = 13, Code = "sales.invoices", Label = "Sales", Href = "/dashboard/sales/invoices", SortOrder = 1 },
+            new SubNavItem { SubNavItemId = 23, NavItemId = 13, Code = "sales.bundle-templates", Label = "Bundle Templates", Href = "/dashboard/sales/bundles/templates", SortOrder = 2 },
+            new SubNavItem { SubNavItemId = 41, NavItemId = 13, Code = "sales.free-issues", Label = "Free Issues", Href = "/dashboard/sales/free-issues", SortOrder = 3 },
+            new SubNavItem { SubNavItemId = 42, NavItemId = 13, Code = "sales.day-end", Label = "Day End", Href = "/dashboard/sales/day-end", SortOrder = 4 },
             // Procurement (NavItemId 4) children — mirror the hub page order.
             // IDs 17-20 (not 9-12): 9-12 were already claimed by the Ledgers sub-items below;
             // these procurement rows were never actually migrated into the database before now.
+            // Vendors (SubNavItemId 30) reuses PermissionId 3, which used to point at the retired
+            // top-level "vendors" NavItem — so any role already granted this permission keeps it.
+            new SubNavItem { SubNavItemId = 30, NavItemId = 4, Code = "procurement.vendors", Label = "Vendors", Href = "/dashboard/vendors", SortOrder = 0 },
             new SubNavItem { SubNavItemId = 17, NavItemId = 4, Code = "procurement.requisitions", Label = "Requisitions", Href = "/dashboard/procurement/requisitions", SortOrder = 1 },
             new SubNavItem { SubNavItemId = 18, NavItemId = 4, Code = "procurement.rfqs", Label = "RFQs", Href = "/dashboard/procurement/rfqs", SortOrder = 2 },
             new SubNavItem { SubNavItemId = 19, NavItemId = 4, Code = "procurement.purchase-orders", Label = "Purchase Orders", Href = "/dashboard/procurement/purchase-orders", SortOrder = 3 },
             new SubNavItem { SubNavItemId = 20, NavItemId = 4, Code = "procurement.purchase-returns", Label = "Purchase Returns", Href = "/dashboard/procurement/purchase-returns", SortOrder = 4 },
+            new SubNavItem { SubNavItemId = 28, NavItemId = 4, Code = "procurement.purchase-invoices", Label = "Purchase Invoices", Href = "/dashboard/procurement/purchase-invoices", SortOrder = 5 },
             new SubNavItem { SubNavItemId = 9, NavItemId = 11, Code = "ledgers.trial-balance", Label = "Trial Balance", Href = "/dashboard/ledgers/trial-balance", SortOrder = 1 },
             new SubNavItem { SubNavItemId = 10, NavItemId = 11, Code = "ledgers.balance-sheet", Label = "Balance Sheet", Href = "/dashboard/ledgers/balance-sheet", SortOrder = 2 },
             new SubNavItem { SubNavItemId = 11, NavItemId = 11, Code = "ledgers.general-ledger", Label = "General Ledger", Href = "/dashboard/ledgers/general-ledger", SortOrder = 3 },
@@ -56,9 +67,24 @@ public sealed class SubNavItemConfiguration : IEntityTypeConfiguration<SubNavIte
             new SubNavItem { SubNavItemId = 21, NavItemId = 12, Code = "accounts.cheque-books", Label = "Cheque Books", Href = "/dashboard/accounts/cheque-books", SortOrder = 2 },
             new SubNavItem { SubNavItemId = 22, NavItemId = 12, Code = "accounts.received-cheques", Label = "Received Cheques", Href = "/dashboard/accounts/received-cheques", SortOrder = 3 },
             // Production (NavItemId 14) children — mirror the sidebar order (AppSidebar.tsx).
-            new SubNavItem { SubNavItemId = 24, NavItemId = 14, Code = "production.templates", Label = "Templates", Href = "/dashboard/production/templates", SortOrder = 1 },
+            // ID 27 (not 24): 24 collides with settings.notification-config above — that ID was
+            // reused by mistake in migration 20260820100345, which upserts row 24 to become the
+            // notification-config item and silently overwrites this one. See migration
+            // FixProductionTemplatesSubNavItemIdConflict for the data repair.
+            new SubNavItem { SubNavItemId = 27, NavItemId = 14, Code = "production.templates", Label = "Templates", Href = "/dashboard/production/templates", SortOrder = 1 },
             new SubNavItem { SubNavItemId = 25, NavItemId = 14, Code = "production.runs", Label = "Runs", Href = "/dashboard/production/runs", SortOrder = 2 },
-            new SubNavItem { SubNavItemId = 26, NavItemId = 14, Code = "production.produced", Label = "Produced", Href = "/dashboard/production/produced", SortOrder = 3 }
+            new SubNavItem { SubNavItemId = 26, NavItemId = 14, Code = "production.produced", Label = "Produced", Href = "/dashboard/production/produced", SortOrder = 3 },
+            // Stock (NavItemId 6) children — mirror the sidebar order (AppSidebar.tsx). These rows
+            // never existed in the database before now, so "stock" is still bypassed frontend-side
+            // in AppSidebar.tsx until roles are actually granted these permissions.
+            new SubNavItem { SubNavItemId = 31, NavItemId = 6, Code = "stock.ledger", Label = "Stock Ledger", Href = "/dashboard/stock/ledger", SortOrder = 1 },
+            new SubNavItem { SubNavItemId = 32, NavItemId = 6, Code = "stock.enquiry", Label = "Stock Enquiry", Href = "/dashboard/stock/enquiry", SortOrder = 2 },
+            new SubNavItem { SubNavItemId = 33, NavItemId = 6, Code = "stock.valuation", Label = "Valuation", Href = "/dashboard/stock/valuation", SortOrder = 3 },
+            new SubNavItem { SubNavItemId = 34, NavItemId = 6, Code = "stock.transfers", Label = "Transfers", Href = "/dashboard/stock/transfers", SortOrder = 4 },
+            new SubNavItem { SubNavItemId = 35, NavItemId = 6, Code = "stock.adjustments", Label = "Adjustments", Href = "/dashboard/stock/adjustments", SortOrder = 5 },
+            new SubNavItem { SubNavItemId = 36, NavItemId = 6, Code = "stock.counts", Label = "Counts", Href = "/dashboard/stock/counts", SortOrder = 6 },
+            new SubNavItem { SubNavItemId = 37, NavItemId = 6, Code = "stock.reorder-alerts", Label = "Reorder Alerts", Href = "/dashboard/stock/reorder-alerts", SortOrder = 7 },
+            new SubNavItem { SubNavItemId = 38, NavItemId = 6, Code = "stock.wastage", Label = "Wastage", Href = "/dashboard/stock/wastage", SortOrder = 8 }
         );
     }
 }

Backend/ERPCore/Infra/Persistence/Configurations/WarehouseConfiguration.cs

@@ -15,5 +15,9 @@ public sealed class WarehouseConfiguration : IEntityTypeConfiguration<Warehouse>
         builder.HasIndex(w => w.Code).IsUnique();
 
         builder.Property(w => w.Name).IsRequired().HasMaxLength(200);
+
+        builder.HasOne(w => w.Branch).WithMany()
+            .HasForeignKey(w => w.BranchId).OnDelete(DeleteBehavior.Restrict);
+        builder.HasIndex(w => w.BranchId);
     }
 }

Backend/ERPCore/Infra/Persistence/DataSeeder.cs

@@ -39,16 +39,29 @@ public static class DataSeeder
         ("PRD-REWORK-LOSS", "Production Rework Loss", ReasonContext.Production),
     ];
 
-    public static async Task SeedAsync(ErpDbContext db, CancellationToken ct = default)
+    /// <param name="includeDemoData">
+    /// Also seed demo rows — sample warehouses/UOMs/category/items, an on-hand stock layer,
+    /// customers, bundle and draft sales documents (<c>Seed:DemoData</c>). On for Development
+    /// and the test deployment (the E2E suite relies on MAIN/SHOP, PCS/BOX, General Goods);
+    /// never for release, which gets reference data only (docs/40-DEPLOYMENT.md).
+    /// </param>
+    public static async Task SeedAsync(ErpDbContext db, bool includeDemoData, CancellationToken ct = default)
     {
+        // Reference data — every environment.
         var dirty = await SeedReasonCodesAsync(db, ct);
         dirty |= await SeedItemTypesAsync(db, ct);
         // dirty |= await SeedCompanyProfileAsync(db, ct);
         dirty |= await SeedProductConfigAsync(db, ct);
+        dirty |= await SeedBranchConfigAsync(db, ct);
         dirty |= await SeedNotificationConfigAsync(db, ct);
-        dirty |= await SeedSalesMastersAsync(db, ct);
-        dirty |= await SeedSalesStockAsync(db, ct);
-        dirty |= await SeedSalesAsync(db, ct);
+        dirty |= await SeedSalesSequencesAsync(db, ct);
+
+        if (includeDemoData)
+        {
+            dirty |= await SeedSalesMastersAsync(db, ct);
+            dirty |= await SeedSalesStockAsync(db, ct);
+            dirty |= await SeedSalesAsync(db, ct);
+        }
 
         if (dirty) await db.SaveChangesAsync(ct);
     }
@@ -110,6 +123,23 @@ public static class DataSeeder
         return true;
     }
 
+    /// <summary>
+    /// Ensures the singleton branch-config row exists. New deployments start with branching
+    /// on — today's mandatory-branch behaviour — so nothing changes for anyone until an
+    /// admin deliberately switches it off from Settings.
+    /// </summary>
+    private static async Task<bool> SeedBranchConfigAsync(ErpDbContext db, CancellationToken ct)
+    {
+        if (await db.BranchConfig.AnyAsync(c => c.ConfigId == BranchConfig.SingletonId, ct)) return false;
+
+        db.BranchConfig.Add(new BranchConfig
+        {
+            ConfigId = BranchConfig.SingletonId,
+            BranchingEnabled = true
+        });
+        return true;
+    }
+
     private static async Task<bool> SeedNotificationConfigAsync(ErpDbContext db, CancellationToken ct)
     {
         if (await db.NotificationConfig.AnyAsync(c => c.NotificationConfigId == NotificationConfig.SingletonId, ct)) return false;
@@ -326,9 +356,9 @@ public static class DataSeeder
     }
 
     /// <summary>
-    /// Seeds the minimum sales bootstrap data needed for UI/backend development:
-    /// a couple of customer rows, current-year document counters, and a few draft
-    /// invoice/slip samples when the required master data already exists.
+    /// Seeds the demo sales data used for UI/backend development: a couple of customer
+    /// rows and a few draft invoice/slip samples when the required master data already
+    /// exists. (Current-year document counters are reference data, seeded in SeedAsync.)
     /// This intentionally never clears or rewrites any existing rows.
     /// </summary>
     private static async Task<bool> SeedSalesAsync(ErpDbContext db, CancellationToken ct)
@@ -336,7 +366,6 @@ public static class DataSeeder
         var dirty = false;
 
         dirty |= await SeedSalesCustomersAsync(db, ct);
-        dirty |= await SeedSalesSequencesAsync(db, ct);
         dirty |= await SeedSampleSalesDocsAsync(db, ct);
 
         try

Backend/ERPCore/Infra/Persistence/ErpDbContext.cs

@@ -38,6 +38,8 @@ public class ErpDbContext : DbContext
     
     /// <summary>Singleton row (FR-MD-11).</summary>
     public DbSet<ProductConfig> ProductConfig => Set<ProductConfig>();
+    /// <summary>Singleton row gating whether this deployment uses branches at all.</summary>
+    public DbSet<BranchConfig> BranchConfig => Set<BranchConfig>();
     /// <summary>Singleton row for notification delivery preferences.</summary>
     public DbSet<NotificationConfig> NotificationConfig => Set<NotificationConfig>();
     public DbSet<NotificationConfigModule> NotificationConfigModules => Set<NotificationConfigModule>();
@@ -66,7 +68,11 @@ public class ErpDbContext : DbContext
     // --- Goods Receipt (docs/10 Part C.3) ---
     public DbSet<Grn> Grns => Set<Grn>();
     public DbSet<GrnLine> GrnLines => Set<GrnLine>();
-    public DbSet<GrnPayment> GrnPayments => Set<GrnPayment>();
+
+    // --- Purchase Invoices (vendor invoices consolidating Confirmed GRNs) ---
+    public DbSet<PurchaseInvoice> PurchaseInvoices => Set<PurchaseInvoice>();
+    public DbSet<PurchaseInvoiceLine> PurchaseInvoiceLines => Set<PurchaseInvoiceLine>();
+    public DbSet<PurchaseInvoicePayment> PurchaseInvoicePayments => Set<PurchaseInvoicePayment>();
 
     // --- Batch / Serial (docs/10 Part C.4) ---
     public DbSet<Batch> Batches => Set<Batch>();
@@ -108,6 +114,7 @@ public class ErpDbContext : DbContext
     // --- Cross-cutting: audit trail + GL-ready journal (docs/10 Part C.7) ---
     public DbSet<AuditLog> AuditLogs => Set<AuditLog>();
     public DbSet<JournalEntryStub> JournalEntryStubs => Set<JournalEntryStub>();
+    public DbSet<LoginActivity> LoginActivities => Set<LoginActivity>();
 
     // --- HRM: org masters (docs/12-BACKEND-HRM.md Part C.1) ---
     public DbSet<Branch> Branches => Set<Branch>();

Backend/ERPCore/Migrations/20260825000000_FixProductionTemplatesSubNavItemIdConflict.Designer.cs

@@ -0,0 +1,24 @@
+// <auto-generated />
+using ERPCore.Infra.Persistence;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    [DbContext(typeof(ErpDbContext))]
+    [Migration("20260825000000_FixProductionTemplatesSubNavItemIdConflict")]
+    partial class FixProductionTemplatesSubNavItemIdConflict
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+            // This migration only repairs seed row data via raw SQL — no entity/column shape
+            // changes — so it does not redeclare the full model here. The single source of
+            // truth for scaffolding future migrations is ErpDbContextModelSnapshot.cs, which
+            // already reflects this fix (production.templates seeded at SubNavItemId 27).
+        }
+    }
+}

Backend/ERPCore/Migrations/20260825000000_FixProductionTemplatesSubNavItemIdConflict.cs

@@ -0,0 +1,46 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <summary>
+    /// Repairs a collision baked into migration history: 20260818090139_AddProductionNavPermissions
+    /// inserted "production.templates" as sub_nav_items row 24, then
+    /// 20260820100345_AddNotificationConfigModulePreferences reused the same literal id 24 for
+    /// "settings.notification-config" via a raw-SQL <c>INSERT ... ON CONFLICT ("SubNavItemId") DO
+    /// UPDATE</c>, silently overwriting the production.templates row instead of inserting a new
+    /// one. Row 24 now correctly holds notification-config; this migration re-creates the lost
+    /// production.templates row under a fresh id (27, matching the corrected seed data in
+    /// SubNavItemConfiguration/PermissionConfiguration) and repoints the NAV:production.templates
+    /// permission (id 36) at it.
+    /// </summary>
+    public partial class FixProductionTemplatesSubNavItemIdConflict : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql("""
+                INSERT INTO sub_nav_items ("SubNavItemId", "NavItemId", "Code", "Href", "Icon", "Label", "SortOrder")
+                VALUES (27, 14, 'production.templates', '/dashboard/production/templates', NULL, 'Templates', 1)
+                ON CONFLICT ("SubNavItemId") DO NOTHING;
+                """);
+
+            migrationBuilder.Sql("""
+                UPDATE permissions SET "SubNavItemId" = 27 WHERE "PermissionId" = 36;
+                """);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.Sql("""
+                UPDATE permissions SET "SubNavItemId" = 24 WHERE "PermissionId" = 36;
+                """);
+
+            migrationBuilder.Sql("""
+                DELETE FROM sub_nav_items WHERE "SubNavItemId" = 27;
+                """);
+        }
+    }
+}

Backend/ERPCore/Migrations/20260831060800_AddPurchaseInvoices.cs

@@ -0,0 +1,303 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddPurchaseInvoices : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "grn_payments");
+
+            migrationBuilder.DropColumn(
+                name: "BalanceAmount",
+                table: "grns");
+
+            migrationBuilder.DropColumn(
+                name: "PaidAmount",
+                table: "grns");
+
+            migrationBuilder.AddColumn<int>(
+                name: "PurchaseInvoiceId",
+                table: "grns",
+                type: "integer",
+                nullable: true);
+
+            migrationBuilder.CreateTable(
+                name: "purchase_invoices",
+                columns: table => new
+                {
+                    PurchaseInvoiceId = table.Column<int>(type: "integer", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    DocNo = table.Column<string>(type: "character varying(30)", maxLength: 30, nullable: false),
+                    VendorInvoiceNo = table.Column<string>(type: "character varying(50)", maxLength: 50, nullable: false),
+                    VendorInvoiceDate = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    VendorId = table.Column<int>(type: "integer", nullable: false),
+                    VendorSnapshotName = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: false),
+                    VendorSnapshotTaxNo = table.Column<string>(type: "character varying(50)", maxLength: 50, nullable: true),
+                    Status = table.Column<string>(type: "character varying(20)", maxLength: 20, nullable: false, defaultValue: "Draft"),
+                    Subtotal = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false),
+                    VatTotal = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false),
+                    GrandTotal = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false),
+                    PaidAmount = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false),
+                    BalanceAmount = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false),
+                    GlJournalNo = table.Column<string>(type: "character varying(30)", maxLength: 30, nullable: true),
+                    GlPostedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: true),
+                    CreatedBy = table.Column<int>(type: "integer", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    UpdatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: true),
+                    xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_purchase_invoices", x => x.PurchaseInvoiceId);
+                    table.ForeignKey(
+                        name: "FK_purchase_invoices_users_CreatedBy",
+                        column: x => x.CreatedBy,
+                        principalTable: "users",
+                        principalColumn: "UserId",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_purchase_invoices_vendors_VendorId",
+                        column: x => x.VendorId,
+                        principalTable: "vendors",
+                        principalColumn: "VendorId",
+                        onDelete: ReferentialAction.Restrict);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "purchase_invoice_lines",
+                columns: table => new
+                {
+                    PurchaseInvoiceLineId = table.Column<int>(type: "integer", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    PurchaseInvoiceId = table.Column<int>(type: "integer", nullable: false),
+                    GrnId = table.Column<int>(type: "integer", nullable: false),
+                    Subtotal = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false),
+                    VatTotal = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false),
+                    LineTotal = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_purchase_invoice_lines", x => x.PurchaseInvoiceLineId);
+                    table.ForeignKey(
+                        name: "FK_purchase_invoice_lines_grns_GrnId",
+                        column: x => x.GrnId,
+                        principalTable: "grns",
+                        principalColumn: "GrnId",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_purchase_invoice_lines_purchase_invoices_PurchaseInvoiceId",
+                        column: x => x.PurchaseInvoiceId,
+                        principalTable: "purchase_invoices",
+                        principalColumn: "PurchaseInvoiceId",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateTable(
+                name: "purchase_invoice_payments",
+                columns: table => new
+                {
+                    PurchaseInvoicePaymentId = table.Column<int>(type: "integer", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    PurchaseInvoiceId = table.Column<int>(type: "integer", nullable: false),
+                    Amount = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false),
+                    PaymentDate = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    GlBankAccountId = table.Column<long>(type: "bigint", nullable: false),
+                    BankAccountName = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: false),
+                    Reference = table.Column<string>(type: "character varying(100)", maxLength: 100, nullable: true),
+                    GlJournalNo = table.Column<string>(type: "character varying(30)", maxLength: 30, nullable: true),
+                    CreatedBy = table.Column<int>(type: "integer", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_purchase_invoice_payments", x => x.PurchaseInvoicePaymentId);
+                    table.ForeignKey(
+                        name: "FK_purchase_invoice_payments_purchase_invoices_PurchaseInvoice~",
+                        column: x => x.PurchaseInvoiceId,
+                        principalTable: "purchase_invoices",
+                        principalColumn: "PurchaseInvoiceId",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_purchase_invoice_payments_users_CreatedBy",
+                        column: x => x.CreatedBy,
+                        principalTable: "users",
+                        principalColumn: "UserId",
+                        onDelete: ReferentialAction.Restrict);
+                });
+
+            migrationBuilder.InsertData(
+                table: "sub_nav_items",
+                columns: new[] { "SubNavItemId", "Code", "Href", "Icon", "Label", "NavItemId", "SortOrder" },
+                values: new object[] { 28, "procurement.purchase-invoices", "/dashboard/procurement/purchase-invoices", null, "Purchase Invoices", 4, 5 });
+
+            migrationBuilder.InsertData(
+                table: "permissions",
+                columns: new[] { "PermissionId", "Code", "NavItemId", "SubNavItemId" },
+                values: new object[] { 39, "NAV:procurement.purchase-invoices", null, 28 });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_grns_PurchaseInvoiceId",
+                table: "grns",
+                column: "PurchaseInvoiceId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_purchase_invoice_lines_GrnId",
+                table: "purchase_invoice_lines",
+                column: "GrnId",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_purchase_invoice_lines_PurchaseInvoiceId",
+                table: "purchase_invoice_lines",
+                column: "PurchaseInvoiceId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_purchase_invoice_payments_CreatedBy",
+                table: "purchase_invoice_payments",
+                column: "CreatedBy");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_purchase_invoice_payments_PurchaseInvoiceId",
+                table: "purchase_invoice_payments",
+                column: "PurchaseInvoiceId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_purchase_invoices_CreatedBy",
+                table: "purchase_invoices",
+                column: "CreatedBy");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_purchase_invoices_DocNo",
+                table: "purchase_invoices",
+                column: "DocNo",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_purchase_invoices_Status",
+                table: "purchase_invoices",
+                column: "Status");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_purchase_invoices_VendorId",
+                table: "purchase_invoices",
+                column: "VendorId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_purchase_invoices_VendorId_VendorInvoiceNo",
+                table: "purchase_invoices",
+                columns: new[] { "VendorId", "VendorInvoiceNo" });
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_grns_purchase_invoices_PurchaseInvoiceId",
+                table: "grns",
+                column: "PurchaseInvoiceId",
+                principalTable: "purchase_invoices",
+                principalColumn: "PurchaseInvoiceId",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_grns_purchase_invoices_PurchaseInvoiceId",
+                table: "grns");
+
+            migrationBuilder.DropTable(
+                name: "purchase_invoice_lines");
+
+            migrationBuilder.DropTable(
+                name: "purchase_invoice_payments");
+
+            migrationBuilder.DropTable(
+                name: "purchase_invoices");
+
+            migrationBuilder.DropIndex(
+                name: "IX_grns_PurchaseInvoiceId",
+                table: "grns");
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 39);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 28);
+
+            migrationBuilder.DropColumn(
+                name: "PurchaseInvoiceId",
+                table: "grns");
+
+            migrationBuilder.AddColumn<decimal>(
+                name: "BalanceAmount",
+                table: "grns",
+                type: "numeric(18,4)",
+                precision: 18,
+                scale: 4,
+                nullable: false,
+                defaultValue: 0m);
+
+            migrationBuilder.AddColumn<decimal>(
+                name: "PaidAmount",
+                table: "grns",
+                type: "numeric(18,4)",
+                precision: 18,
+                scale: 4,
+                nullable: false,
+                defaultValue: 0m);
+
+            migrationBuilder.CreateTable(
+                name: "grn_payments",
+                columns: table => new
+                {
+                    GrnPaymentId = table.Column<int>(type: "integer", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    CreatedBy = table.Column<int>(type: "integer", nullable: false),
+                    GrnId = table.Column<int>(type: "integer", nullable: false),
+                    Amount = table.Column<decimal>(type: "numeric(18,4)", precision: 18, scale: 4, nullable: false),
+                    BankAccountName = table.Column<string>(type: "character varying(200)", maxLength: 200, nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    GlBankAccountId = table.Column<long>(type: "bigint", nullable: false),
+                    GlJournalNo = table.Column<string>(type: "character varying(30)", maxLength: 30, nullable: true),
+                    PaymentDate = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    Reference = table.Column<string>(type: "character varying(100)", maxLength: 100, nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_grn_payments", x => x.GrnPaymentId);
+                    table.ForeignKey(
+                        name: "FK_grn_payments_grns_GrnId",
+                        column: x => x.GrnId,
+                        principalTable: "grns",
+                        principalColumn: "GrnId",
+                        onDelete: ReferentialAction.Restrict);
+                    table.ForeignKey(
+                        name: "FK_grn_payments_users_CreatedBy",
+                        column: x => x.CreatedBy,
+                        principalTable: "users",
+                        principalColumn: "UserId",
+                        onDelete: ReferentialAction.Restrict);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_grn_payments_CreatedBy",
+                table: "grn_payments",
+                column: "CreatedBy");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_grn_payments_GrnId",
+                table: "grn_payments",
+                column: "GrnId");
+        }
+    }
+}

Backend/ERPCore/Migrations/20260901104702_AddBranchPhoneNumberAndCodeAutogen.cs

@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddBranchPhoneNumberAndCodeAutogen : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "PhoneNumber",
+                table: "hr_branches",
+                type: "character varying(30)",
+                maxLength: 30,
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "PhoneNumber",
+                table: "hr_branches");
+        }
+    }
+}

Backend/ERPCore/Migrations/20260901120000_AddSettingsBranchesNavItem.cs

@@ -0,0 +1,38 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddSettingsBranchesNavItem : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.InsertData(
+                table: "sub_nav_items",
+                columns: new[] { "SubNavItemId", "Code", "Href", "Icon", "Label", "NavItemId", "SortOrder" },
+                values: new object[] { 29, "settings.branches", "/dashboard/settings/branches", null, "Branches", 9, 0 });
+
+            migrationBuilder.InsertData(
+                table: "permissions",
+                columns: new[] { "PermissionId", "Code", "NavItemId", "SubNavItemId" },
+                values: new object[] { 40, "NAV:settings.branches", null, 29 });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 40);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 29);
+        }
+    }
+}

Backend/ERPCore/Migrations/20260902055505_MakeEmployeeBranchRequired.cs

@@ -0,0 +1,50 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class MakeEmployeeBranchRequired : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            // Branch becomes a required field on Employee going forward. Any pre-existing
+            // employee left with no branch is backfilled to a "Main Branch" placeholder
+            // (created only if it doesn't already exist) so the NOT NULL below never fails
+            // on live data.
+            migrationBuilder.Sql(@"
+                INSERT INTO hr_branches (""Code"", ""Name"", ""Status"", ""CreatedAt"")
+                SELECT 'BR-000', 'Main Branch', 'Active', now()
+                WHERE NOT EXISTS (SELECT 1 FROM hr_branches WHERE ""Code"" = 'BR-000')
+                  AND EXISTS (SELECT 1 FROM hr_employees WHERE ""BranchId"" IS NULL);
+
+                UPDATE hr_employees
+                SET ""BranchId"" = (SELECT ""BranchId"" FROM hr_branches WHERE ""Code"" = 'BR-000')
+                WHERE ""BranchId"" IS NULL;
+            ");
+
+            migrationBuilder.AlterColumn<int>(
+                name: "BranchId",
+                table: "hr_employees",
+                type: "integer",
+                nullable: false,
+                oldClrType: typeof(int),
+                oldType: "integer",
+                oldNullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<int>(
+                name: "BranchId",
+                table: "hr_employees",
+                type: "integer",
+                nullable: true,
+                oldClrType: typeof(int),
+                oldType: "integer");
+        }
+    }
+}

Backend/ERPCore/Migrations/20260902094609_AddWarehouseBranch.cs

@@ -0,0 +1,73 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddWarehouseBranch : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<int>(
+                name: "BranchId",
+                table: "warehouses",
+                type: "integer",
+                nullable: true);
+
+            // Backfill any pre-existing warehouse onto the same "Main Branch" placeholder
+            // used by the earlier MakeEmployeeBranchRequired migration (created only if it
+            // doesn't already exist) — keeps a single de-facto default rather than minting
+            // a second one — before the column is locked to NOT NULL below.
+            migrationBuilder.Sql(@"
+                INSERT INTO hr_branches (""Code"", ""Name"", ""Status"", ""CreatedAt"")
+                SELECT 'BR-000', 'Main Branch', 'Active', now()
+                WHERE NOT EXISTS (SELECT 1 FROM hr_branches WHERE ""Code"" = 'BR-000')
+                  AND EXISTS (SELECT 1 FROM warehouses WHERE ""BranchId"" IS NULL);
+
+                UPDATE warehouses
+                SET ""BranchId"" = (SELECT ""BranchId"" FROM hr_branches WHERE ""Code"" = 'BR-000')
+                WHERE ""BranchId"" IS NULL;
+            ");
+
+            migrationBuilder.AlterColumn<int>(
+                name: "BranchId",
+                table: "warehouses",
+                type: "integer",
+                nullable: false,
+                oldClrType: typeof(int),
+                oldType: "integer",
+                oldNullable: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_warehouses_BranchId",
+                table: "warehouses",
+                column: "BranchId");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_warehouses_hr_branches_BranchId",
+                table: "warehouses",
+                column: "BranchId",
+                principalTable: "hr_branches",
+                principalColumn: "BranchId",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_warehouses_hr_branches_BranchId",
+                table: "warehouses");
+
+            migrationBuilder.DropIndex(
+                name: "IX_warehouses_BranchId",
+                table: "warehouses");
+
+            migrationBuilder.DropColumn(
+                name: "BranchId",
+                table: "warehouses");
+        }
+    }
+}

Backend/ERPCore/Migrations/20260902095449_AddBranchConfig.cs

@@ -0,0 +1,49 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddBranchConfig : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "branch_config",
+                columns: table => new
+                {
+                    ConfigId = table.Column<int>(type: "integer", nullable: false),
+                    BranchingEnabled = table.Column<bool>(type: "boolean", nullable: false, defaultValue: true),
+                    UpdatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: true),
+                    UpdatedBy = table.Column<int>(type: "integer", nullable: true),
+                    xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_branch_config", x => x.ConfigId);
+                    table.CheckConstraint("ck_branch_config_singleton", "\"ConfigId\" = 1");
+                    table.ForeignKey(
+                        name: "FK_branch_config_users_UpdatedBy",
+                        column: x => x.UpdatedBy,
+                        principalTable: "users",
+                        principalColumn: "UserId",
+                        onDelete: ReferentialAction.Restrict);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_branch_config_UpdatedBy",
+                table: "branch_config",
+                column: "UpdatedBy");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "branch_config");
+        }
+    }
+}

Backend/ERPCore/Migrations/20260908101847_AddBranchIdToDocuments.cs

@@ -0,0 +1,199 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddBranchIdToDocuments : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<int>(
+                name: "BranchId",
+                table: "stock_transfers",
+                type: "integer",
+                nullable: false,
+                defaultValue: 0);
+
+            migrationBuilder.AddColumn<int>(
+                name: "BranchId",
+                table: "stock_counts",
+                type: "integer",
+                nullable: false,
+                defaultValue: 0);
+
+            migrationBuilder.AddColumn<int>(
+                name: "BranchId",
+                table: "stock_adjustments",
+                type: "integer",
+                nullable: false,
+                defaultValue: 0);
+
+            migrationBuilder.AddColumn<int>(
+                name: "BranchId",
+                table: "sales_invoices",
+                type: "integer",
+                nullable: false,
+                defaultValue: 0);
+
+            migrationBuilder.AddColumn<int>(
+                name: "BranchId",
+                table: "grns",
+                type: "integer",
+                nullable: false,
+                defaultValue: 0);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_stock_transfers_BranchId",
+                table: "stock_transfers",
+                column: "BranchId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_stock_counts_BranchId",
+                table: "stock_counts",
+                column: "BranchId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_stock_adjustments_BranchId",
+                table: "stock_adjustments",
+                column: "BranchId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_sales_invoices_BranchId",
+                table: "sales_invoices",
+                column: "BranchId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_grns_BranchId",
+                table: "grns",
+                column: "BranchId");
+
+            // Backfill from each document's existing warehouse — warehouses were the sole
+            // branch anchor until now, so this preserves current branch assignment exactly.
+            // (Warehouse.BranchId is NOT NULL, so every row is resolvable; the WHERE BranchId = 0
+            // guard just keeps this idempotent if the migration is ever re-run against partial state.)
+            migrationBuilder.Sql(@"
+                UPDATE grns g SET ""BranchId"" = w.""BranchId""
+                FROM warehouses w WHERE w.""WarehouseId"" = g.""WarehouseId"" AND g.""BranchId"" = 0;
+
+                UPDATE sales_invoices x SET ""BranchId"" = w.""BranchId""
+                FROM warehouses w WHERE w.""WarehouseId"" = x.""WarehouseId"" AND x.""BranchId"" = 0;
+
+                UPDATE stock_counts c SET ""BranchId"" = w.""BranchId""
+                FROM warehouses w WHERE w.""WarehouseId"" = c.""WarehouseId"" AND c.""BranchId"" = 0;
+
+                UPDATE stock_adjustments a SET ""BranchId"" = w.""BranchId""
+                FROM warehouses w WHERE w.""WarehouseId"" = a.""WarehouseId"" AND a.""BranchId"" = 0;
+
+                UPDATE stock_transfers t SET ""BranchId"" = w.""BranchId""
+                FROM warehouses w WHERE w.""WarehouseId"" = t.""SrcWarehouseId"" AND t.""BranchId"" = 0;
+            ");
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_grns_hr_branches_BranchId",
+                table: "grns",
+                column: "BranchId",
+                principalTable: "hr_branches",
+                principalColumn: "BranchId",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_sales_invoices_hr_branches_BranchId",
+                table: "sales_invoices",
+                column: "BranchId",
+                principalTable: "hr_branches",
+                principalColumn: "BranchId",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_stock_adjustments_hr_branches_BranchId",
+                table: "stock_adjustments",
+                column: "BranchId",
+                principalTable: "hr_branches",
+                principalColumn: "BranchId",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_stock_counts_hr_branches_BranchId",
+                table: "stock_counts",
+                column: "BranchId",
+                principalTable: "hr_branches",
+                principalColumn: "BranchId",
+                onDelete: ReferentialAction.Restrict);
+
+            migrationBuilder.AddForeignKey(
+                name: "FK_stock_transfers_hr_branches_BranchId",
+                table: "stock_transfers",
+                column: "BranchId",
+                principalTable: "hr_branches",
+                principalColumn: "BranchId",
+                onDelete: ReferentialAction.Restrict);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropForeignKey(
+                name: "FK_grns_hr_branches_BranchId",
+                table: "grns");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_sales_invoices_hr_branches_BranchId",
+                table: "sales_invoices");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_stock_adjustments_hr_branches_BranchId",
+                table: "stock_adjustments");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_stock_counts_hr_branches_BranchId",
+                table: "stock_counts");
+
+            migrationBuilder.DropForeignKey(
+                name: "FK_stock_transfers_hr_branches_BranchId",
+                table: "stock_transfers");
+
+            migrationBuilder.DropIndex(
+                name: "IX_stock_transfers_BranchId",
+                table: "stock_transfers");
+
+            migrationBuilder.DropIndex(
+                name: "IX_stock_counts_BranchId",
+                table: "stock_counts");
+
+            migrationBuilder.DropIndex(
+                name: "IX_stock_adjustments_BranchId",
+                table: "stock_adjustments");
+
+            migrationBuilder.DropIndex(
+                name: "IX_sales_invoices_BranchId",
+                table: "sales_invoices");
+
+            migrationBuilder.DropIndex(
+                name: "IX_grns_BranchId",
+                table: "grns");
+
+            migrationBuilder.DropColumn(
+                name: "BranchId",
+                table: "stock_transfers");
+
+            migrationBuilder.DropColumn(
+                name: "BranchId",
+                table: "stock_counts");
+
+            migrationBuilder.DropColumn(
+                name: "BranchId",
+                table: "stock_adjustments");
+
+            migrationBuilder.DropColumn(
+                name: "BranchId",
+                table: "sales_invoices");
+
+            migrationBuilder.DropColumn(
+                name: "BranchId",
+                table: "grns");
+        }
+    }
+}

Backend/ERPCore/Migrations/20260909101932_MoveVendorsUnderProcurement.cs

@@ -0,0 +1,55 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class MoveVendorsUnderProcurement : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            // Order matters: Permission.NavItemId cascades on delete, so the permission row must be
+            // repointed off NavItemId 3 (via the new sub_nav_item) before that nav_item is deleted —
+            // otherwise the delete cascades and removes the permission row first.
+            migrationBuilder.InsertData(
+                table: "sub_nav_items",
+                columns: new[] { "SubNavItemId", "Code", "Href", "Icon", "Label", "NavItemId", "SortOrder" },
+                values: new object[] { 30, "procurement.vendors", "/dashboard/vendors", null, "Vendors", 4, 0 });
+
+            migrationBuilder.UpdateData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 3,
+                columns: new[] { "Code", "NavItemId", "SubNavItemId" },
+                values: new object[] { "NAV:procurement.vendors", null, 30 });
+
+            migrationBuilder.DeleteData(
+                table: "nav_items",
+                keyColumn: "NavItemId",
+                keyValue: 3);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 30);
+
+            migrationBuilder.InsertData(
+                table: "nav_items",
+                columns: new[] { "NavItemId", "Code", "Href", "Icon", "Label", "SortOrder", "Status" },
+                values: new object[] { 3, "vendors", "/dashboard/vendors", null, "Vendors", 3, "Active" });
+
+            migrationBuilder.UpdateData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 3,
+                columns: new[] { "Code", "NavItemId", "SubNavItemId" },
+                values: new object[] { "NAV:vendors", 3, null });
+        }
+    }
+}

Backend/ERPCore/Migrations/20260909102452_AddStockSubNavItems.cs

@@ -0,0 +1,130 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+#pragma warning disable CA1814 // Prefer jagged arrays over multidimensional
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddStockSubNavItems : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.InsertData(
+                table: "sub_nav_items",
+                columns: new[] { "SubNavItemId", "Code", "Href", "Icon", "Label", "NavItemId", "SortOrder" },
+                values: new object[,]
+                {
+                    { 31, "stock.ledger", "/dashboard/stock/ledger", null, "Stock Ledger", 6, 1 },
+                    { 32, "stock.enquiry", "/dashboard/stock/enquiry", null, "Stock Enquiry", 6, 2 },
+                    { 33, "stock.valuation", "/dashboard/stock/valuation", null, "Valuation", 6, 3 },
+                    { 34, "stock.transfers", "/dashboard/stock/transfers", null, "Transfers", 6, 4 },
+                    { 35, "stock.adjustments", "/dashboard/stock/adjustments", null, "Adjustments", 6, 5 },
+                    { 36, "stock.counts", "/dashboard/stock/counts", null, "Counts", 6, 6 },
+                    { 37, "stock.reorder-alerts", "/dashboard/stock/reorder-alerts", null, "Reorder Alerts", 6, 7 },
+                    { 38, "stock.wastage", "/dashboard/stock/wastage", null, "Wastage", 6, 8 }
+                });
+
+            migrationBuilder.InsertData(
+                table: "permissions",
+                columns: new[] { "PermissionId", "Code", "NavItemId", "SubNavItemId" },
+                values: new object[,]
+                {
+                    { 41, "NAV:stock.ledger", null, 31 },
+                    { 42, "NAV:stock.enquiry", null, 32 },
+                    { 43, "NAV:stock.valuation", null, 33 },
+                    { 44, "NAV:stock.transfers", null, 34 },
+                    { 45, "NAV:stock.adjustments", null, 35 },
+                    { 46, "NAV:stock.counts", null, 36 },
+                    { 47, "NAV:stock.reorder-alerts", null, 37 },
+                    { 48, "NAV:stock.wastage", null, 38 }
+                });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 41);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 42);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 43);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 44);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 45);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 46);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 47);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 48);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 31);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 32);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 33);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 34);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 35);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 36);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 37);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 38);
+        }
+    }
+}

Backend/ERPCore/Migrations/20260909103002_AddSalesSubNavItems.cs

@@ -0,0 +1,94 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+#pragma warning disable CA1814 // Prefer jagged arrays over multidimensional
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddSalesSubNavItems : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.InsertData(
+                table: "permissions",
+                columns: new[] { "PermissionId", "Code", "NavItemId", "SubNavItemId" },
+                values: new object[] { 49, "NAV:sales.bundle-templates", null, 23 });
+
+            migrationBuilder.UpdateData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 23,
+                columns: new[] { "Code", "Href", "Label", "SortOrder" },
+                values: new object[] { "sales.bundle-templates", "/dashboard/sales/bundles/templates", "Bundle Templates", 2 });
+
+            migrationBuilder.InsertData(
+                table: "sub_nav_items",
+                columns: new[] { "SubNavItemId", "Code", "Href", "Icon", "Label", "NavItemId", "SortOrder" },
+                values: new object[,]
+                {
+                    { 40, "sales.invoices", "/dashboard/sales/invoices", null, "Sales", 13, 1 },
+                    { 41, "sales.free-issues", "/dashboard/sales/free-issues", null, "Free Issues", 13, 3 },
+                    { 42, "sales.day-end", "/dashboard/sales/day-end", null, "Day End", 13, 4 }
+                });
+
+            migrationBuilder.InsertData(
+                table: "permissions",
+                columns: new[] { "PermissionId", "Code", "NavItemId", "SubNavItemId" },
+                values: new object[,]
+                {
+                    { 50, "NAV:sales.invoices", null, 40 },
+                    { 51, "NAV:sales.free-issues", null, 41 },
+                    { 52, "NAV:sales.day-end", null, 42 }
+                });
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 49);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 50);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 51);
+
+            migrationBuilder.DeleteData(
+                table: "permissions",
+                keyColumn: "PermissionId",
+                keyValue: 52);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 40);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 41);
+
+            migrationBuilder.DeleteData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 42);
+
+            migrationBuilder.UpdateData(
+                table: "sub_nav_items",
+                keyColumn: "SubNavItemId",
+                keyValue: 23,
+                columns: new[] { "Code", "Href", "Label", "SortOrder" },
+                values: new object[] { "sales.bundle-sales", "/dashboard/sales/bundles", "Bundle Sales", 1 });
+        }
+    }
+}