u

src/providers/mssql/schema.js

@@ -646,6 +646,12 @@ BEGIN
         CONSTRAINT FK_manifest_entity FOREIGN KEY (entity_id) REFERENCES entity(id) ON DELETE NO ACTION
     );
 END
+
+IF NOT EXISTS (SELECT * FROM sys.indexes WHERE name = 'UQ_manifest_company_type_number' AND object_id = OBJECT_ID('manifest'))
+BEGIN
+    CREATE UNIQUE NONCLUSTERED INDEX UQ_manifest_company_type_number
+    ON manifest (company_id, [type], [number]);
+END
 `;
 
 export const INIT_MANIFESTARTICLE = `

src/providers/sqlite3/schema.js

@@ -432,6 +432,8 @@ CREATE TABLE IF NOT EXISTS manifest (
     FOREIGN KEY (company_id) REFERENCES company(id) ON DELETE NO ACTION,
     FOREIGN KEY (entity_id) REFERENCES entity(id) ON DELETE NO ACTION
 );
+CREATE UNIQUE INDEX IF NOT EXISTS UQ_manifest_company_type_number
+    ON manifest (company_id, "type", "number");
 `;
 
 export const INIT_MANIFESTARTICLE = `

src/store/delivery/create.js

@@ -8,6 +8,7 @@ import { insertLines, normalizeLines, parseDate } from '../manifestLines.js';
 import { loadDelivery } from './helpers.js';
 import { insertAttachments } from './attachments.js';
 import { assertSupplier } from './writeLines.js';
+import { assertUniqueManifestNumber } from '../manifestDoc/helpers.js';
 import makeRunner from '../runner.js';
 
 export default function create(provider) {
@@ -35,15 +36,27 @@ export default function create(provider) {
     const { companyId } = await access(googleAuthId);
 
     const run = async (runner, tx) => {
+      const targetSupplierId = body.supplierId !== undefined ? body.supplierId : body.entityId;
+      if (targetSupplierId == null) {
+        throw new Error('No supplier selected');
+      }
+
       const supplierId = await assertSupplier(
         provider,
         tx,
         companyId,
-        body.supplierId ?? null,
+        targetSupplierId,
       );
 
       const number = await allocateNumber(companyId, queries.DELIVERY_TYPE, tx);
 
+      await assertUniqueManifestNumber(provider, tx, {
+        companyId,
+        type: queries.DELIVERY_TYPE,
+        number,
+        errorMessage: 'Delivery number already exists',
+      });
+
       const created = await runner(queries.CREATE_MANIFEST, {
         companyId,
         number,

src/store/delivery/update.js

@@ -8,6 +8,7 @@ import { insertLines, normalizeLines, parseDate } from '../manifestLines.js';
 import { loadDelivery, shapeSummary } from './helpers.js';
 import { insertAttachments } from './attachments.js';
 import { assertSupplier } from './writeLines.js';
+import { assertUniqueManifestNumber } from '../manifestDoc/helpers.js';
 import makeRunner from '../runner.js';
 
 export default function update(provider) {
@@ -28,11 +29,15 @@ export default function update(provider) {
       patch,
       'supplierId',
     );
+    const hasEntityId = Object.prototype.hasOwnProperty.call(
+      patch,
+      'entityId',
+    );
     const hasExternalNumber = Object.prototype.hasOwnProperty.call(patch, 'externalNumber');
     const hasLines = Object.prototype.hasOwnProperty.call(patch, 'lines');
     const hasFiles = Object.prototype.hasOwnProperty.call(patch, 'files');
 
-    if (!hasNumber && !hasDate && !hasCreatedAt && !hasSupplierId && !hasExternalNumber && !hasLines && !hasFiles) {
+    if (!hasNumber && !hasDate && !hasCreatedAt && !hasSupplierId && !hasEntityId && !hasExternalNumber && !hasLines && !hasFiles) {
       throw new Error('Invalid delivery');
     }
 
@@ -63,6 +68,13 @@ export default function update(provider) {
         if (!number) {
           throw new Error('Invalid delivery');
         }
+        await assertUniqueManifestNumber(provider, tx, {
+          companyId,
+          type: queries.DELIVERY_TYPE,
+          number,
+          excludeId: id,
+          errorMessage: 'Delivery number already exists',
+        });
       }
 
       let date = summary.date;
@@ -82,12 +94,16 @@ export default function update(provider) {
       }
 
       let supplierId = summary.supplierId;
-      if (hasSupplierId) {
+      if (hasSupplierId || hasEntityId) {
+        const val = hasSupplierId ? patch.supplierId : patch.entityId;
+        if (val == null) {
+          throw new Error('No supplier selected');
+        }
         supplierId = await assertSupplier(
           provider,
           tx,
           companyId,
-          patch.supplierId ?? null,
+          val,
         );
       }
 

src/store/manifestDoc/helpers.js

@@ -104,3 +104,32 @@ export async function loadDoc(runnerOrPool, txOrParams, maybeParams) {
     lines: lines.rows.map(shapeLine),
   };
 }
+
+export async function assertUniqueManifestNumber(runnerOrPool, txOrParams, maybeParams) {
+  let runner;
+  let params;
+
+  if (maybeParams !== undefined) {
+    runner = makeRunner(runnerOrPool, txOrParams);
+    params = maybeParams;
+  } else {
+    runner = makeRunner(runnerOrPool);
+    params = txOrParams;
+  }
+
+  const { companyId, type, number, excludeId, errorMessage } = params;
+  if (!number) {
+    return;
+  }
+
+  const isSqlite = runner?.dialect === 'sqlite3';
+  const sql = isSqlite
+    ? 'SELECT id FROM manifest WHERE company_id = @companyId AND "type" = @type AND "number" = @number'
+    : 'SELECT id FROM manifest WHERE company_id = @companyId AND [type] = @type AND [number] = @number';
+
+  const res = await runner.query(sql, { companyId, type, number });
+  const row = res.rows[0];
+  if (row && (!excludeId || row.id !== excludeId)) {
+    throw new Error(errorMessage || `${type.charAt(0).toUpperCase() + type.slice(1)} number already exists`);
+  }
+}

src/store/order/create.js

@@ -15,7 +15,7 @@ import {
 import resolveSelectedCompanyAccess from '../companyuser/resolveSelectedCompanyAccess.js';
 import taxEnsure from '../tax/ensure.js';
 import { insertLines, normalizeLines, parseDate } from '../manifestLines.js';
-import { assertCustomerEntity, loadDoc } from '../manifestDoc/helpers.js';
+import { assertCustomerEntity, assertUniqueManifestNumber, loadDoc } from '../manifestDoc/helpers.js';
 import { recordOrderHistory } from '../articlehistory/record.js';
 import { syncOrderSummary } from './syncSummary.js';
 import makeRunner from '../runner.js';
@@ -36,12 +36,12 @@ export default function create(provider) {
    * @param {object} body - The order input.
    * @param {string} body.number - The order number.
    * @param {string} body.date - The order date.
-   * @param {number} [body.entityId] - The id of the customer entity.
+   * @param {number} body.entityId - The id of the customer entity.
    * @param {string} [body.externalNumber] - An external (customer) reference number.
    * @param {Array<{sku?: string, name?: string, pu?: number, amount: number, net: number, rebate?: number, taxrate: number, comment?: string|null}>} [body.lines] - The order lines.
    * @param {object} [tx] - Optional transaction to run within.
-   * @returns {Promise<{id: number, number: string, type: string, entityId: number|null, externalNumber: string|null, date: string, lines: Array<{id: number, sku: string|null, name: string|null, pu: number, amount: number, net: number, rebate: number, taxrate: number, comment: string|null}>}>} The created order.
-   * @throws {Error} If the order is invalid.
+   * @returns {Promise<{id: number, number: string, type: string, entityId: number, externalNumber: string|null, date: string, lines: Array<{id: number, sku: string|null, name: string|null, pu: number, amount: number, net: number, rebate: number, taxrate: number, comment: string|null}>}>} The created order.
+   * @throws {Error} If the order is invalid, no entity is selected, or entity not found.
    *
    * @example
    * const order = await store.order.create(42, { number: 'B-2026-001', date: '2026-09-15', entityId: 12, lines: [...] });
@@ -66,12 +66,23 @@ export default function create(provider) {
     const runCreate = async (runner) => {
       const { companyId, companyuserId } = await access(googleAuthId, runner);
 
+      if (body.entityId == null) {
+        throw new Error('No entity selected');
+      }
+
       const entityId = await assertCustomerEntity(
         runner,
         companyId,
-        body.entityId ?? null,
+        body.entityId,
       );
 
+      await assertUniqueManifestNumber(runner, {
+        companyId,
+        type: orderType,
+        number,
+        errorMessage: 'Order number already exists',
+      });
+
       const created = await runner.query(createManifestSql, {
         companyId,
         number,

src/store/order/createFromQuote.js

@@ -18,7 +18,7 @@ import resolveSelectedCompanyAccess from '../companyuser/resolveSelectedCompanyA
 import nextNumber from '../numbers/nextNumber.js';
 import taxEnsure from '../tax/ensure.js';
 import { insertLines, normalizeLines, parseDate } from '../manifestLines.js';
-import { assertCustomerEntity, loadDoc } from '../manifestDoc/helpers.js';
+import { assertCustomerEntity, assertUniqueManifestNumber, loadDoc } from '../manifestDoc/helpers.js';
 import { recordOrderHistory } from '../articlehistory/record.js';
 import { syncOrderSummary } from './syncSummary.js';
 import makeRunner from '../runner.js';
@@ -90,6 +90,13 @@ export default function createFromQuote(provider) {
         number = await allocateNumber(companyId, orderType, runner);
       }
 
+      await assertUniqueManifestNumber(runner, {
+        companyId,
+        type: orderType,
+        number,
+        errorMessage: 'Order number already exists',
+      });
+
       const targetEntityId = body.entityId !== undefined ? body.entityId : quoteDoc.entityId;
       if (targetEntityId == null) {
         throw new Error('No entity selected');

src/store/order/update.js

@@ -13,7 +13,7 @@ import {
 import resolveSelectedCompanyAccess from '../companyuser/resolveSelectedCompanyAccess.js';
 import taxEnsure from '../tax/ensure.js';
 import { insertLines, normalizeLines, parseDate } from '../manifestLines.js';
-import { assertCustomerEntity, loadDoc, shapeSummary } from '../manifestDoc/helpers.js';
+import { assertCustomerEntity, assertUniqueManifestNumber, loadDoc, shapeSummary } from '../manifestDoc/helpers.js';
 import { syncOrderSummary } from './syncSummary.js';
 import makeRunner from '../runner.js';
 
@@ -89,6 +89,13 @@ export default function update(provider) {
         if (!number) {
           throw new Error('Invalid order');
         }
+        await assertUniqueManifestNumber(runner, {
+          companyId,
+          type: orderType,
+          number,
+          excludeId: id,
+          errorMessage: 'Order number already exists',
+        });
       }
 
       let date = summary.date;
@@ -109,10 +116,13 @@ export default function update(provider) {
 
       let entityId = summary.entityId;
       if (hasEntityId) {
+        if (patch.entityId == null) {
+          throw new Error('No entity selected');
+        }
         entityId = await assertCustomerEntity(
           runner,
           companyId,
-          patch.entityId ?? null,
+          patch.entityId,
         );
       }
 

src/store/quote/create.js

@@ -9,7 +9,7 @@ import {
 import resolveSelectedCompanyAccess from '../companyuser/resolveSelectedCompanyAccess.js';
 import taxEnsure from '../tax/ensure.js';
 import { insertLines, normalizeLines, parseDate } from '../manifestLines.js';
-import { assertCustomerEntity, loadDoc } from '../manifestDoc/helpers.js';
+import { assertCustomerEntity, assertUniqueManifestNumber, loadDoc } from '../manifestDoc/helpers.js';
 import { syncQuoteSummary } from './syncSummary.js';
 import makeRunner from '../runner.js';
 
@@ -64,6 +64,13 @@ export default function create(provider) {
         body.entityId ?? null,
       );
 
+      await assertUniqueManifestNumber(runner, {
+        companyId,
+        type: quoteType,
+        number,
+        errorMessage: 'Quote number already exists',
+      });
+
       const created = await runner.query(createManifestSql, {
         companyId,
         number,

src/store/quote/update.js

@@ -13,7 +13,7 @@ import {
 import resolveSelectedCompanyAccess from '../companyuser/resolveSelectedCompanyAccess.js';
 import taxEnsure from '../tax/ensure.js';
 import { insertLines, normalizeLines, parseDate } from '../manifestLines.js';
-import { assertCustomerEntity, loadDoc, shapeSummary } from '../manifestDoc/helpers.js';
+import { assertCustomerEntity, assertUniqueManifestNumber, loadDoc, shapeSummary } from '../manifestDoc/helpers.js';
 import { syncQuoteSummary } from './syncSummary.js';
 import makeRunner from '../runner.js';
 
@@ -89,6 +89,13 @@ export default function update(provider) {
         if (!number) {
           throw new Error('Invalid quote');
         }
+        await assertUniqueManifestNumber(runner, {
+          companyId,
+          type: quoteType,
+          number,
+          excludeId: id,
+          errorMessage: 'Quote number already exists',
+        });
       }
 
       let date = summary.date;

src/store/shipment/create.js

@@ -1,6 +1,7 @@
 import resolveSelectedCompanyAccess from '../companyuser/resolveSelectedCompanyAccess.js';
 import taxEnsure from '../tax/ensure.js';
 import { insertLines, parseDate } from '../manifestLines.js';
+import { assertUniqueManifestNumber } from '../manifestDoc/helpers.js';
 import makeRunner from '../runner.js';
 import { loadShipment, queriesFor } from './helpers.js';
 import { syncOrderSummary } from '../order/syncSummary.js';
@@ -212,6 +213,13 @@ export default function create(provider) {
       const nextY = Math.max(existingShipments.length + 1, maxY + 1);
       const shipmentNumber = `${order.number}${shipmentPrefix}${nextY}`;
 
+      await assertUniqueManifestNumber(runner, {
+        companyId,
+        type: 'shipment',
+        number: shipmentNumber,
+        errorMessage: 'Shipment number already exists',
+      });
+
       // 7. Create shipment manifest header
       const createdRes = await runner.query(q.CREATE_MANIFEST, {
         companyId,