BillFlow-AI is a full-stack business management application combining a React/TypeScript frontend with a Python Flask backend and Firebase Firestore as its database. It provides billing, invoicing, inventory tracking, and sales analytics, and includes a machine learning module that predicts next month's product demand per item.

The problem it addresses is manual billing and inventory tracking in a small manufacturing enterprise (specifically Velur Spun Pipes, per the README). It automates invoice/estimation-slip generation with GST calculations and PDF output, deducts stock on sale, tracks order lifecycle (Pending → Approved → Ready → Dispatched/Rejected), and surfaces demand forecasts to help with inventory planning.

There are two user types: admins, who manage customers, products, orders, and view analytics through a protected dashboard, and customers, who register through a portal to place orders and view invoice/order history. Both dashboards are served from the same React SPA with role-based route protection via an AuthProvider and ProtectedRoute wrapper.

Architecturally, the frontend (Vite + React 18 + shadcn/ui + Zustand + React Query) proxies /api requests to a Flask backend. The Flask app exposes REST endpoints for items, parties, sales, and invoices; generates PDFs via ReportLab; and writes to Firestore using firebase-admin. The ML pipeline (ml_model.py) uses CTGAN from the SDV library to synthesize additional training rows on top of sparse real sales data, then trains a scikit-learn RandomForestRegressor to predict next-month quantities. Predictions are cached and refreshed hourly by a background thread.

Notable observations: the repo contains a legacy 'frontend_old' folder of static HTML/JS pages, suggesting a rewrite from a vanilla frontend to React. Authentication appears to use Firebase Auth via REST (the backend imports requests for this). The README candidly notes no formal accuracy metrics are computed for the ML model and that stronger auth (hashing, JWT) is a future enhancement — an honest disclosure rather than a red flag. Nothing in the code suggests malicious behavior; it is a student/academic full-stack project.