first attempt at fixing over-allocation bug; fix npm audit block for deploy

api/src/allocator.ts

@@ -778,8 +778,20 @@ async function applyAllocations(
 ): Promise<Array<{id: string, name: string, dueOn: Date}>> {
   // Fixed plans
   const planUpdates = new Map<string, number>();
+  const fixedAllocationRows = new Map<string, { planId: string; source: FixedAllocation["source"]; amountCents: number }>();
   result.fixedAllocations.forEach((a) => {
     planUpdates.set(a.fixedPlanId, (planUpdates.get(a.fixedPlanId) ?? 0) + a.amountCents);
+    const rowKey = `${a.fixedPlanId}:${a.source}`;
+    const existing = fixedAllocationRows.get(rowKey);
+    if (existing) {
+      existing.amountCents += a.amountCents;
+      return;
+    }
+    fixedAllocationRows.set(rowKey, {
+      planId: a.fixedPlanId,
+      source: a.source,
+      amountCents: a.amountCents,
+    });
   });
 
   const fullyFundedPlans: Array<{id: string, name: string, dueOn: Date}> = [];
@@ -834,13 +846,19 @@ async function applyAllocations(
         needsFundingThisPeriod: markFundedThisPeriod ? false : !isFullyFunded,
       },
     });
+  }
+
+  for (const row of fixedAllocationRows.values()) {
+    const rowAmount = Math.max(0, Math.floor(row.amountCents | 0));
+    if (rowAmount <= 0) continue;
     await tx.allocation.create({
       data: {
         userId,
         kind: "fixed",
-        toId: planId,
-        amountCents: BigInt(amt),
-        incomeId,
+        toId: row.planId,
+        amountCents: BigInt(rowAmount),
+        // Available-budget pulls must not be attributed to the triggering income event.
+        incomeId: row.source === "income" ? incomeId : null,
       },
     });
   }