Add company-scoped delivery store on manifest

README.md

@@ -202,6 +202,50 @@ Suppliers are `entity` rows in the company `customergroup` named `Lieferanten` (
 
 ---
 
+## `delivery`
+
+Company-scoped goods receipts on `manifest` / `manifestarticle` with fixed `type = 'delivery'`. Auth via `resolveCompanyAccess`. `manifest.company_id` scopes the list (`ON DELETE NO ACTION` — avoid SQL Server multiple cascade paths with `entity_id`).
+
+| Method | Signature | Returns |
+| --- | --- | --- |
+| `list` | `(googleAuthId, companyId)` | `DeliverySummary[]` |
+| `getById` | `(googleAuthId, companyId, id)` | `Delivery` |
+| `create` | `(googleAuthId, companyId, { number, date, supplierId?, lines })` | `Delivery` |
+| `update` | `(googleAuthId, companyId, id, { number?, date?, supplierId?, lines? })` | `Delivery` |
+| `delete` | `(googleAuthId, companyId, id)` | `void` |
+
+```ts
+type DeliverySummary = {
+  id: number,
+  number: string,
+  type: 'delivery',
+  supplierId: number | null,   // manifest.entity_id
+  date: Date,
+}
+
+type DeliveryLine = {
+  id: number,
+  articleId: number | null,
+  sku: string | null,
+  amount: number,
+  net: number,
+  transactedAmount: number,
+  rebate: number,
+  tax: number,                 // tax.rate
+  comment: string | null,
+}
+
+type Delivery = DeliverySummary & { lines: DeliveryLine[] }
+```
+
+`create` inserts header + lines in one transaction. `supplierId` null or a Lieferanten `entity` of the company (else `Supplier not found`). Each line requires `sku` (resolved in the company category tree → `Article not found`), `amount`, `net`, `tax` (rate → `tax.ensure`); `rebate` defaults `0`; `transactedAmount` defaults to `amount`. Empty/invalid `number` or `date` → `Invalid delivery`; bad line payload → `Invalid lines`.
+
+`update` patches header fields that are present. If `lines` is present, replace-all lines; if omitted, leave lines unchanged. Returns full `Delivery`.
+
+`delete` removes the manifest (`manifestarticle` cascades). Errors: `Company not found`, `Not authorized`, `Delivery not found`, `Supplier not found`, `Article not found`, `Invalid delivery`, `Invalid lines`.
+
+---
+
 ## `posterminal`
 
 Company-scoped POS terminals. Auth via `resolveCompanyAccess`.
@@ -479,6 +523,11 @@ res.set('Content-Type', thumb.contentType).send(thumb.buffer);
 | `POST /api/supplier` | `supplier.create(googleAuthId, companyId, { name })` |
 | `PATCH /api/supplier/:id` | `supplier.update(googleAuthId, companyId, id, { name })` |
 | `DELETE /api/supplier/:id` | `supplier.delete(googleAuthId, companyId, id)` |
+| `GET /api/delivery` | `delivery.list(googleAuthId, companyId)` |
+| `GET /api/delivery/:id` | `delivery.getById(googleAuthId, companyId, id)` |
+| `POST /api/delivery` | `delivery.create(googleAuthId, companyId, { number, date, supplierId?, lines })` |
+| `PATCH /api/delivery/:id` | `delivery.update(googleAuthId, companyId, id, { number?, date?, supplierId?, lines? })` |
+| `DELETE /api/delivery/:id` | `delivery.delete(googleAuthId, companyId, id)` |
 | `GET /api/posterminal` | `posterminal.list(googleAuthId, companyId)` |
 | `PUT /api/posterminal` | `posterminal.upsert(googleAuthId, companyId, { id?, name, token?, pairingpin })` |
 | `DELETE /api/posterminal/:id` | `posterminal.delete(googleAuthId, companyId, id)` |

scripts/test-api.js

@@ -183,6 +183,36 @@ const MENU = {
       },
     ],
   },
+  delivery: {
+    label: 'delivery',
+    items: [
+      {
+        value: 'delivery.list',
+        label: 'list',
+        hint: 'googleAuthId, companyId → summaries',
+      },
+      {
+        value: 'delivery.getById',
+        label: 'getById',
+        hint: 'googleAuthId, companyId, id → delivery',
+      },
+      {
+        value: 'delivery.create',
+        label: 'create',
+        hint: 'googleAuthId, companyId, JSON body → delivery',
+      },
+      {
+        value: 'delivery.update',
+        label: 'update',
+        hint: 'googleAuthId, companyId, id, JSON patch → delivery',
+      },
+      {
+        value: 'delivery.delete',
+        label: 'delete',
+        hint: 'googleAuthId, companyId, id',
+      },
+    ],
+  },
   category: {
     label: 'category',
     items: [
@@ -712,6 +742,108 @@ async function runMethod(client, action) {
       );
       return ['ok', true];
     }
+    case 'delivery.list': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      return [
+        'result[]',
+        await client.delivery.list(Number(googleAuthId), Number(companyId)),
+      ];
+    }
+    case 'delivery.getById': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const id = await askInt('delivery id');
+      if (id == null) return;
+      return [
+        'result',
+        await client.delivery.getById(
+          Number(googleAuthId),
+          Number(companyId),
+          Number(id),
+        ),
+      ];
+    }
+    case 'delivery.create': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const bodyJson = await askText('delivery JSON', {
+        placeholder:
+          '{"number":"DHL-123","date":"2026-08-10","supplierId":1,"lines":[{"sku":"1","amount":10,"net":99.5,"tax":19}]}',
+        validate: (v) => {
+          if (!v?.trim()) return 'Required';
+          try {
+            const parsed = JSON.parse(v);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+              return 'Must be a JSON object';
+            }
+          } catch {
+            return 'Invalid JSON';
+          }
+        },
+      });
+      if (bodyJson == null) return;
+      return [
+        'result',
+        await client.delivery.create(
+          Number(googleAuthId),
+          Number(companyId),
+          JSON.parse(bodyJson),
+        ),
+      ];
+    }
+    case 'delivery.update': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const id = await askInt('delivery id');
+      if (id == null) return;
+      const patchJson = await askText('patch JSON', {
+        placeholder: '{"number":"DHL-124","lines":[]}',
+        validate: (v) => {
+          if (!v?.trim()) return 'Required';
+          try {
+            const parsed = JSON.parse(v);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+              return 'Must be a JSON object';
+            }
+          } catch {
+            return 'Invalid JSON';
+          }
+        },
+      });
+      if (patchJson == null) return;
+      return [
+        'result',
+        await client.delivery.update(
+          Number(googleAuthId),
+          Number(companyId),
+          Number(id),
+          JSON.parse(patchJson),
+        ),
+      ];
+    }
+    case 'delivery.delete': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const id = await askInt('delivery id');
+      if (id == null) return;
+      await client.delivery.delete(
+        Number(googleAuthId),
+        Number(companyId),
+        Number(id),
+      );
+      return ['ok', true];
+    }
     case 'lang.create': {
       const iso639 = await askText('ISO 639', {
         placeholder: 'de',

src/index.js

@@ -43,6 +43,11 @@ import supplierList from './store/supplier/list.js';
 import supplierCreate from './store/supplier/create.js';
 import supplierUpdate from './store/supplier/update.js';
 import supplierDelete from './store/supplier/delete.js';
+import deliveryList from './store/delivery/list.js';
+import deliveryGetById from './store/delivery/getById.js';
+import deliveryCreate from './store/delivery/create.js';
+import deliveryUpdate from './store/delivery/update.js';
+import deliveryDelete from './store/delivery/delete.js';
 import posterminalList from './store/posterminal/list.js';
 import posterminalUpsert from './store/posterminal/upsert.js';
 import posterminalDelete from './store/posterminal/delete.js';
@@ -160,6 +165,14 @@ export default class LibDashStore {
       delete: supplierDelete(pool),
     };
 
+    this.delivery = {
+      list: deliveryList(pool),
+      getById: deliveryGetById(pool),
+      create: deliveryCreate(pool),
+      update: deliveryUpdate(pool),
+      delete: deliveryDelete(pool),
+    };
+
     this.posterminal = {
       list: posterminalList(pool),
       upsert: posterminalUpsert(pool),

src/schema.js

@@ -468,10 +468,12 @@ IF NOT EXISTS (SELECT * FROM sys.tables WHERE name = 'manifest')
 BEGIN
     CREATE TABLE manifest (
         id INT IDENTITY(1,1) PRIMARY KEY,
+        company_id INT NOT NULL,
         [number] NVARCHAR(100) NOT NULL,
         [type] NVARCHAR(100) NOT NULL,
         entity_id INT NULL,
         [date] DATETIME2 NOT NULL CONSTRAINT DF_manifest_date DEFAULT SYSUTCDATETIME(),
+        CONSTRAINT FK_manifest_company FOREIGN KEY (company_id) REFERENCES company(id) ON DELETE NO ACTION,
         CONSTRAINT FK_manifest_entity FOREIGN KEY (entity_id) REFERENCES entity(id) ON DELETE SET NULL
     );
 END

src/sql/delivery.js

@@ -0,0 +1,122 @@
+export const DELIVERY_TYPE = 'delivery';
+
+export const LIST_DELIVERIES = `
+SELECT
+    m.id,
+    m.[number],
+    m.[type],
+    m.entity_id AS supplierId,
+    m.[date]
+FROM manifest m
+WHERE m.company_id = @companyId
+  AND m.[type] = @type
+ORDER BY m.[date] DESC, m.id DESC
+`;
+
+export const GET_DELIVERY_HEADER = `
+SELECT
+    m.id,
+    m.[number],
+    m.[type],
+    m.entity_id AS supplierId,
+    m.[date]
+FROM manifest m
+WHERE m.id = @id
+  AND m.company_id = @companyId
+  AND m.[type] = @type
+`;
+
+export const GET_DELIVERY_LINES = `
+SELECT
+    ma.id,
+    ma.article_id AS articleId,
+    a.sku,
+    ma.amount,
+    ma.net,
+    ma.transactedamount AS transactedAmount,
+    ma.rebate,
+    t.rate AS tax,
+    ma.comment
+FROM manifestarticle ma
+LEFT JOIN article a ON a.id = ma.article_id
+INNER JOIN tax t ON t.id = ma.tax_id
+WHERE ma.manifest_id = @manifestId
+ORDER BY ma.id
+`;
+
+export const CREATE_MANIFEST = `
+INSERT INTO manifest (company_id, [number], [type], entity_id, [date])
+OUTPUT INSERTED.id
+VALUES (@companyId, @number, @type, @entityId, @date)
+`;
+
+export const UPDATE_MANIFEST = `
+UPDATE manifest
+SET
+    [number] = @number,
+    entity_id = @entityId,
+    [date] = @date
+WHERE id = @id
+  AND company_id = @companyId
+  AND [type] = @type
+`;
+
+export const DELETE_MANIFEST = `
+DELETE FROM manifest
+WHERE id = @id
+  AND company_id = @companyId
+  AND [type] = @type
+`;
+
+export const DELETE_LINES_BY_MANIFEST = `
+DELETE FROM manifestarticle
+WHERE manifest_id = @manifestId
+`;
+
+export const CREATE_LINE = `
+INSERT INTO manifestarticle (
+    manifest_id,
+    article_id,
+    amount,
+    net,
+    transactedamount,
+    comment,
+    rebate,
+    tax_id
+)
+OUTPUT INSERTED.id
+VALUES (
+    @manifestId,
+    @articleId,
+    @amount,
+    @net,
+    @transactedAmount,
+    @comment,
+    @rebate,
+    @taxId
+)
+`;
+
+/** Resolve SKU to article id if reachable via the company category tree. */
+export const RESOLVE_ARTICLE_ID_BY_SKU = `
+;WITH category_tree AS (
+    SELECT id
+    FROM category
+    WHERE id = @rootCategoryId
+
+    UNION ALL
+
+    SELECT c.id
+    FROM category c
+    INNER JOIN category_tree ct ON c.parent_id = ct.id
+)
+SELECT TOP 1 a.id
+FROM article a
+WHERE a.sku = @sku
+  AND EXISTS (
+    SELECT 1
+    FROM categoryarticle ca
+    INNER JOIN category_tree ct ON ct.id = ca.category_id
+    WHERE ca.article_id = a.id
+)
+`;

src/store/delivery/create.js

@@ -0,0 +1,67 @@
+import { CREATE_MANIFEST, DELIVERY_TYPE } from '../../sql/delivery.js';
+import request from '../request.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+import taxEnsure from '../tax/ensure.js';
+import {
+  loadDelivery,
+  normalizeLines,
+  parseDeliveryDate,
+} from './helpers.js';
+import { assertSupplier, insertLines } from './writeLines.js';
+
+export default function create(pool) {
+  const access = resolveCompanyAccess(pool);
+  const ensureTax = taxEnsure(pool);
+
+  return async (googleAuthId, companyId, body = {}) => {
+    const number = body.number?.trim?.() ? body.number.trim() : null;
+    const date = parseDeliveryDate(body.date);
+    if (!number || !date) {
+      throw new Error('Invalid delivery');
+    }
+
+    const lines = normalizeLines(body.lines ?? []);
+
+    const { rootCategoryId } = await access(googleAuthId, companyId);
+
+    const tx = pool.transaction();
+    await tx.begin();
+
+    try {
+      const supplierId = await assertSupplier(
+        pool,
+        tx,
+        companyId,
+        body.supplierId ?? null,
+      );
+
+      const created = await request(pool, tx)
+        .input('companyId', companyId)
+        .input('number', number)
+        .input('type', DELIVERY_TYPE)
+        .input('entityId', supplierId)
+        .input('date', date)
+        .query(CREATE_MANIFEST);
+
+      const manifestId = created.recordset[0].id;
+
+      await insertLines(pool, tx, {
+        manifestId,
+        rootCategoryId,
+        lines,
+        ensureTax,
+      });
+
+      const delivery = await loadDelivery(pool, tx, companyId, manifestId);
+      await tx.commit();
+      return delivery;
+    } catch (err) {
+      try {
+        await tx.rollback();
+      } catch {
+        // ignore
+      }
+      throw err;
+    }
+  };
+}

src/store/delivery/delete.js

@@ -0,0 +1,25 @@
+import { DELETE_MANIFEST, DELIVERY_TYPE } from '../../sql/delivery.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function del(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, id) => {
+    if (!Number.isFinite(id)) {
+      throw new Error('Delivery not found');
+    }
+
+    await access(googleAuthId, companyId);
+
+    const result = await pool
+      .request()
+      .input('id', id)
+      .input('companyId', companyId)
+      .input('type', DELIVERY_TYPE)
+      .query(DELETE_MANIFEST);
+
+    if (!result.rowsAffected[0]) {
+      throw new Error('Delivery not found');
+    }
+  };
+}

src/store/delivery/getById.js

@@ -0,0 +1,20 @@
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+import { loadDelivery } from './helpers.js';
+
+export default function getById(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, id) => {
+    if (!Number.isFinite(id)) {
+      throw new Error('Delivery not found');
+    }
+
+    await access(googleAuthId, companyId);
+
+    const delivery = await loadDelivery(pool, null, companyId, id);
+    if (!delivery) {
+      throw new Error('Delivery not found');
+    }
+    return delivery;
+  };
+}

src/store/delivery/helpers.js

@@ -0,0 +1,104 @@
+import {
+  DELIVERY_TYPE,
+  GET_DELIVERY_HEADER,
+  GET_DELIVERY_LINES,
+} from '../../sql/delivery.js';
+import request from '../request.js';
+
+export function shapeSummary(row) {
+  return {
+    id: row.id,
+    number: row.number,
+    type: DELIVERY_TYPE,
+    supplierId: row.supplierId ?? null,
+    date: row.date,
+  };
+}
+
+export function shapeLine(row) {
+  return {
+    id: row.id,
+    articleId: row.articleId ?? null,
+    sku: row.sku ?? null,
+    amount: row.amount,
+    net: row.net,
+    transactedAmount: row.transactedAmount,
+    rebate: row.rebate,
+    tax: row.tax,
+    comment: row.comment ?? null,
+  };
+}
+
+export async function loadDelivery(pool, tx, companyId, id) {
+  const header = await request(pool, tx)
+    .input('id', id)
+    .input('companyId', companyId)
+    .input('type', DELIVERY_TYPE)
+    .query(GET_DELIVERY_HEADER);
+
+  const row = header.recordset[0];
+  if (!row) {
+    return null;
+  }
+
+  const lines = await request(pool, tx)
+    .input('manifestId', id)
+    .query(GET_DELIVERY_LINES);
+
+  return {
+    ...shapeSummary(row),
+    lines: lines.recordset.map(shapeLine),
+  };
+}
+
+export function parseDeliveryDate(value) {
+  if (value instanceof Date && !Number.isNaN(value.getTime())) {
+    return value;
+  }
+  if (typeof value === 'string' && value.trim()) {
+    const d = new Date(value);
+    if (!Number.isNaN(d.getTime())) {
+      return d;
+    }
+  }
+  return null;
+}
+
+export function normalizeLines(lines) {
+  if (!Array.isArray(lines)) {
+    throw new Error('Invalid lines');
+  }
+
+  return lines.map((entry) => {
+    const sku = entry?.sku?.trim?.() ? entry.sku.trim() : null;
+    if (!sku) {
+      throw new Error('Invalid lines');
+    }
+
+    const amount = entry?.amount;
+    const net = entry?.net;
+    const rebate =
+      entry?.rebate === undefined || entry?.rebate === null ? 0 : entry.rebate;
+    const tax = entry?.tax;
+    const transactedAmount =
+      entry?.transactedAmount === undefined || entry?.transactedAmount === null
+        ? amount
+        : entry.transactedAmount;
+    const comment =
+      entry?.comment === undefined || entry?.comment === null
+        ? null
+        : String(entry.comment);
+
+    if (
+      !Number.isFinite(amount) ||
+      !Number.isFinite(net) ||
+      !Number.isFinite(rebate) ||
+      !Number.isFinite(tax) ||
+      !Number.isFinite(transactedAmount)
+    ) {
+      throw new Error('Invalid lines');
+    }
+
+    return { sku, amount, net, rebate, tax, transactedAmount, comment };
+  });
+}

src/store/delivery/list.js

@@ -0,0 +1,19 @@
+import { DELIVERY_TYPE, LIST_DELIVERIES } from '../../sql/delivery.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+import { shapeSummary } from './helpers.js';
+
+export default function list(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId) => {
+    await access(googleAuthId, companyId);
+
+    const result = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('type', DELIVERY_TYPE)
+      .query(LIST_DELIVERIES);
+
+    return result.recordset.map(shapeSummary);
+  };
+}

src/store/delivery/update.js

@@ -0,0 +1,123 @@
+import {
+  DELETE_LINES_BY_MANIFEST,
+  DELIVERY_TYPE,
+  GET_DELIVERY_HEADER,
+  UPDATE_MANIFEST,
+} from '../../sql/delivery.js';
+import request from '../request.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+import taxEnsure from '../tax/ensure.js';
+import {
+  loadDelivery,
+  normalizeLines,
+  parseDeliveryDate,
+  shapeSummary,
+} from './helpers.js';
+import { assertSupplier, insertLines } from './writeLines.js';
+
+export default function update(pool) {
+  const access = resolveCompanyAccess(pool);
+  const ensureTax = taxEnsure(pool);
+
+  return async (googleAuthId, companyId, id, patch = {}) => {
+    if (!Number.isFinite(id)) {
+      throw new Error('Delivery not found');
+    }
+
+    const hasNumber = Object.prototype.hasOwnProperty.call(patch, 'number');
+    const hasDate = Object.prototype.hasOwnProperty.call(patch, 'date');
+    const hasSupplierId = Object.prototype.hasOwnProperty.call(
+      patch,
+      'supplierId',
+    );
+    const hasLines = Object.prototype.hasOwnProperty.call(patch, 'lines');
+
+    if (!hasNumber && !hasDate && !hasSupplierId && !hasLines) {
+      throw new Error('Invalid delivery');
+    }
+
+    let normalizedLines;
+    if (hasLines) {
+      normalizedLines = normalizeLines(patch.lines);
+    }
+
+    const { rootCategoryId } = await access(googleAuthId, companyId);
+
+    const tx = pool.transaction();
+    await tx.begin();
+
+    try {
+      const existing = await request(pool, tx)
+        .input('id', id)
+        .input('companyId', companyId)
+        .input('type', DELIVERY_TYPE)
+        .query(GET_DELIVERY_HEADER);
+
+      const current = existing.recordset[0];
+      if (!current) {
+        throw new Error('Delivery not found');
+      }
+
+      const summary = shapeSummary(current);
+
+      let number = summary.number;
+      if (hasNumber) {
+        number = patch.number?.trim?.() ? patch.number.trim() : null;
+        if (!number) {
+          throw new Error('Invalid delivery');
+        }
+      }
+
+      let date = summary.date;
+      if (hasDate) {
+        date = parseDeliveryDate(patch.date);
+        if (!date) {
+          throw new Error('Invalid delivery');
+        }
+      }
+
+      let supplierId = summary.supplierId;
+      if (hasSupplierId) {
+        supplierId = await assertSupplier(
+          pool,
+          tx,
+          companyId,
+          patch.supplierId ?? null,
+        );
+      }
+
+      await request(pool, tx)
+        .input('id', id)
+        .input('companyId', companyId)
+        .input('type', DELIVERY_TYPE)
+        .input('number', number)
+        .input('entityId', supplierId)
+        .input('date', date)
+        .query(UPDATE_MANIFEST);
+
+      if (hasLines) {
+        await request(pool, tx)
+          .input('manifestId', id)
+          .query(DELETE_LINES_BY_MANIFEST);
+
+        await insertLines(pool, tx, {
+          manifestId: id,
+          rootCategoryId,
+          lines: normalizedLines,
+          ensureTax,
+        });
+      }
+
+      const delivery = await loadDelivery(pool, tx, companyId, id);
+      await tx.commit();
+      return delivery;
+    } catch (err) {
+      try {
+        await tx.rollback();
+      } catch {
+        // ignore
+      }
+      throw err;
+    }
+  };
+}

src/store/delivery/writeLines.js

@@ -0,0 +1,66 @@
+import {
+  CREATE_LINE,
+  RESOLVE_ARTICLE_ID_BY_SKU,
+} from '../../sql/delivery.js';
+import { GET_SUPPLIER_BY_ID, SUPPLIER_GROUP_NAME } from '../../sql/entity.js';
+import request from '../request.js';
+
+export async function assertSupplier(pool, tx, companyId, supplierId) {
+  if (supplierId == null) {
+    return null;
+  }
+  if (!Number.isFinite(supplierId)) {
+    throw new Error('Supplier not found');
+  }
+
+  const result = await request(pool, tx)
+    .input('id', supplierId)
+    .input('companyId', companyId)
+    .input('groupName', SUPPLIER_GROUP_NAME)
+    .query(GET_SUPPLIER_BY_ID);
+
+  if (!result.recordset[0]) {
+    throw new Error('Supplier not found');
+  }
+  return supplierId;
+}
+
+async function resolveArticleId(pool, tx, rootCategoryId, sku) {
+  const result = await request(pool, tx)
+    .input('rootCategoryId', rootCategoryId)
+    .input('sku', sku)
+    .query(RESOLVE_ARTICLE_ID_BY_SKU);
+
+  const articleId = result.recordset[0]?.id;
+  if (!articleId) {
+    throw new Error('Article not found');
+  }
+  return articleId;
+}
+
+export async function insertLines(
+  pool,
+  tx,
+  { manifestId, rootCategoryId, lines, ensureTax },
+) {
+  for (const line of lines) {
+    const articleId = await resolveArticleId(
+      pool,
+      tx,
+      rootCategoryId,
+      line.sku,
+    );
+    const taxId = await ensureTax(line.tax, tx);
+
+    await request(pool, tx)
+      .input('manifestId', manifestId)
+      .input('articleId', articleId)
+      .input('amount', line.amount)
+      .input('net', line.net)
+      .input('transactedAmount', line.transactedAmount)
+      .input('comment', line.comment)
+      .input('rebate', line.rebate)
+      .input('taxId', taxId)
+      .query(CREATE_LINE);
+  }
+}