NWP-101: add export options

[douglasgimli]

Ticket

Closes NWP-101

What changed

Ops can now decide what goes into a payments export before the file is created. The Export button on the payments page opens a panel with two choices: which columns to include, with the card last four switched off unless someone turns it on, and whether to export the current filter or every payment. The panel shows how many rows the file will contain, the filename says which scope and date it covers, and an empty column selection cannot produce a file.

How I verified it

All commands run in this session from build-battle/merchant-console on this branch at 6c9d36d.

• npm test — Test Files 4 passed (4) / Tests 50 passed (50). Main had 28 passing in 3 files; nothing was removed or skipped.

• npm run lint — ✔ No ESLint warnings or errors

• npm run build — ✓ Compiled successfully, exit code 0

• Browser, http://localhost:3000/payments?status=disputed — Export opens a panel titled "Export payments". With "Current filter" selected it reads "33 rows", matching the table footer; switching to "All payments" reads "1,658 rows". "Card last four" is the only unchecked column. Unchecking every column turns Download into a disabled button and shows "Select at least one column to download." Escape closes the panel. The download itself was not clicked; file contents were checked with curl instead.

• curl -sI "http://localhost:3000/api/payments/export?status=disputed" — content-disposition: attachment; filename="payments-disputed-2026-09-10.csv"; with ?scope=all the filename is payments-all-2026-09-10.csv; with ?merchantId=mch_01 it is payments-filtered-2026-09-10.csv.

• curl -s ".../export?columns=id,pan" — {"message":"Unknown column \"pan\""} with status 400; ?columns= returns 400 Select at least one column; ?scope=nope returns 400 Unknown scope "nope".

• curl -s ".../export?scope=all&status=disputed" | wc -l — 1658 rows against 33 for ?status=disputed, so scope=all ignores the filter and nothing is paginated.

• npm test passes

• New behavior is covered by a test

• Checked it in the browser

Acceptance criteria

• Ops can choose which columns are included. Card last-four is off by default. — csv.test.ts "defaults to every column except the card last four, in the standard order" and "accepts a subset and keeps the requested order"; route.test.ts "defaults to every column except the card last four"; browser: last four unchecked on open.
• Ops can choose scope: current filter or all payments. Current filter is the default, and the row count is visible before download. — csv.test.ts "defaults to the current filter when the param is absent"; route.test.ts "ignores the filters when scope is all"; browser: "Current filter" preselected, "33 rows" then "1,658 rows".
• The filename reflects the scope and the date, for example payments-disputed-2026-08-13.csv. — csv.test.ts "puts the scope token before the date, as in the ticket example" asserts that exact string; route.test.ts "names the file after the status filter and the UTC date"; curl output above.
• Amounts stay in minor units internally and are formatted once on the way out, with currency in its own column. — route.test.ts "formats the amount once and keeps the currency in its own column"; the serializer still formats through the existing money helper and the existing $250.00 and "$1,234,567.89" tests are unchanged.
• Deselecting every column disables Download rather than producing an empty file. — browser: disabled Download plus message; route.test.ts "rejects an empty column selection with a 400" so a hand-built URL cannot produce one either.

Definition of done: the column serializer tests live in the existing src/lib/csv.test.ts (9 tests before, 22 after); branch and every commit subject carry NWP-101.

Bugs fixed along the way

• build-battle/merchant-console/tailwind.config.ts — both drawer keyframes moved the panel from translateX(-100%), so a Drawer anchored on the right slid in from the left edge and crossed the screen. Root cause: the sign is flipped relative to Tremor's upstream Drawer. This is the first feature to open the Drawer on desktop, which is why nobody had seen it; the mobile sidebar uses the same panel and benefits too. Now 100%, verified by reading the live @keyframes rules in the browser.

Deliberately not done

• Amount sorting compares amounts as strings in src/data/queries.ts, so sort=amount orders 9 above 100. The export inherits it when that sort is requested. Out of this ticket; it needs its own failing-then-passing test and PR.
• The three metrics defects tracked as NWP-102 are untouched.
• CSV header names stay as the existing machine keys (created_at, last4), because the existing tests pin that contract; the panel shows readable labels instead.
• Nothing remembers the last-used column set. There is no persistence layer yet (NWP-203).
• The payments page still does its own status check instead of calling the shared filter parser. Pre-existing and unrelated to the export, so left alone to keep the diff reviewable.

Notes for the reviewer

• The plan is in docs/specs/NWP-101-export-options.md and was written before the code.
• Unknown columns, an empty list, or an unknown scope return 400 with a message rather than silently defaulting the way the list endpoint's filter parser does. That is deliberate, per the api-routes rule, and noted in the spec.
• scope=all drops the filter fields but still goes through the shared filter and sort functions, so there is one query path, and sort/direction are still honoured.
• An independent mutation check during review found the UTC filename test could not tell UTC from local time on a machine west of Greenwich; the final commit adds a 00:30Z instant so it can.

🤖 Generated with Claude Code