15. References
Source Discovery Record (Shumoul.Saas.Api)
This documentation summarizes the following architecture record, located at
docs/ARCHITECTURE/EINVOICING_DISCOVERY/ in the Shumoul.Saas.Api repository:
| Document | Covers |
|---|---|
01-Framework-Overview.md | What the framework is, where it lives, key numbers |
02-Architecture.md | Layer model, DI wiring, ApplicationPart mounting |
03-Runtime-Flows.md | Mermaid diagrams for every ZATCA lifecycle stage |
04-Packages.md | Project/package inventory, dependencies, third-party libraries |
05-Controllers.md | Full API surface — 3 controllers, 12 endpoints |
06-Services.md | Every service class, by responsibility |
07-Background-Jobs.md | Confirmed: none exist |
08-Notifications.md | Confirmed: none exist |
09-Configuration.md | Platform/tenant/secrets/certificates/env vars/feature flags |
10-Security.md | Private key handling, signing chain, storage-at-rest, duplication |
11-Dependencies.md | External subsystem coupling |
12-Technical-Debt.md | Dead code, duplication, packaging hygiene, architecture drift |
13-Boundary-Analysis.md | Framework vs. ERP vs. Shared vs. Integration classification |
14-Repository-Assessment.md | Is this a repo split candidate? |
15-Recommendations.md | Options for a future phase — not decided |
16-Phase0.1-Security-Verification.md | Independent verification of the ZATCA-auth and secrets-handling findings |
All dated 2026-07-06.
Related Platform Documentation (Developer Portal)
- Notification Framework — the platform's first Golden Reference module; referenced here for its retry-pipeline pattern (see Chapter 12 — Known Limitations).
- Background Jobs Framework — the platform's second Golden Reference module; referenced here for its recurring-job runtime pattern, which E-Invoicing does not currently use.
- WhatsApp Integration — referenced throughout this documentation as the comparison point for what an ERP-owned business integration layer and a formal ADR boundary decision look like (ADR-001), both of which E-Invoicing currently lacks.
External Standard
The framework implements ZATCA (Zakat, Tax and Customs Authority, Saudi Arabia) Fatoora Phase 2 electronic invoicing requirements: UBL 2.1 XML generation, XAdES/XML-DSig signing with ECDSA secp256k1, QR/TLV encoding, OTP-based Compliance/Production CSID onboarding, and clearance (B2B)/reporting (B2C) submission. No specific external URL is captured in the source discovery record for this documentation to cite; consult ZATCA's own published developer documentation directly for the authoritative specification.
Change History for This Framework
| Phase | Date | What happened |
|---|---|---|
| Phase 0 | 2026-07-06 | Read-only architecture discovery — no code changed |
| Phase 0.1 | 2026-07-06 | Independent verification of the ZATCA-authentication and secrets-handling findings — no code changed |
| Phase 0.2 | 2026-07-06 | Critical-fix pass: RestClient authentication attachment, secret-logging redaction, OTP-endpoint redaction, file-download path-traversal fix — package version bumped to 1.0.48 |
| Developer Portal publication | 2026-07-06 | This documentation — no new discovery, architecture decision, or code change |