@happyvertical/smrt-timesheets 0.56.0 → 0.56.2

package/AGENTS.md

@@ -48,6 +48,40 @@ files.
 through a `ServiceCommercialResolver`), and corrects. `smrt-projects` supplies
 `SubscriptionServiceCommercialResolver` for #1925 pricing.
 
+## Generated write actions (#4001)
+
+Generated CRUD writes stay closed. `ServiceTimeEntryCollection` hosts the only
+generated writes, `record` / `submit` / `approve` (`POST
+/servicetimeentries/<action>`, body `{ entryId }` for submit/approve), on REST
+only; MCP and CLI stay read-only until per-operation MCP authorization (#4004).
+`services/time-entry-actions.ts` delegates each to `ServiceEvidenceService`, so
+the trail and snapshots are set in one place. `services/action-principal.ts`
+takes identity from the tenancy ALS, then the smrt-users session ALS, never the
+body; authorizes `servicetimeentries.<action>` with `assertOperationPermission`
+(system context never bypasses; `approve` refuses super-admin bypass); and
+stamps the user's linked profile. Only the participant records/submits their
+own time unless the caller holds `approve`. `approve` prices with the host's
+`setServiceTimeEntryCommercialResolver()` — a factory called per request with
+the collection's options, so a writing resolver shares the request executor;
+without one it is a 409 and writes nothing. The runtime REST transport gates
+a collection-hosted action on the ITEM's `api.include`, SvelteKit on the
+collection's, so both list the actions;
+a consumer closing them overrides both registrations. The collection and both
+snapshot collections carry their own `@smrt()` surface: undecorated, they
+published generated create/update/delete MCP tools. `reject` waits for #3994.
+
+## Recipe
+
+`src/recipes.ts` declares one `SmrtRecipe`, `timesheets.time-entries`
+(label "Time entries", section `work`), emitted into the built
+`manifest.json` and `smrt-knowledge.json` `recipes`. It shows
+`ServiceTimeEntry` alone, with the generic work reference, evidence, agent
+and approval-trail fields hidden; attendance and rollup models stay out of
+it. `status` and its trail are hidden and locked, and the help never says to
+set them: `save()` accepts a bare transition, so submit and approve must go
+through `ServiceEvidenceService` (the recipe declares no surface for that). Help lives in `src/time-entries.recipe.md` (#3591); keep it and the recipe
+in plain language. See [core recipes](../core/agents/recipes.md).
+
 ## Invariants
 
 - **No domain foreign key on the base.** Work context is the generic

package/README.md

@@ -131,10 +131,41 @@ recording facade remains seconds-based; its shared entry view uses
 `TimeEntryApprovalQueue` are props-driven: hosts load entries and pass plain
 view objects (`TimeEntry`, `TimeEntryApprovalView`).
 
+## Generated write actions
+
+Generated CRUD writes are closed. The write path a generated app can call is
+three service-backed REST actions on `ServiceTimeEntryCollection` (#4001):
+
+| Route | Body | Permission |
+|---|---|---|
+| `POST /servicetimeentries/record` | work ref, `source` (`manual`/`timer`), times or `durationSeconds`/`durationHours`, optional `participantProfileId` | `servicetimeentries.record` |
+| `POST /servicetimeentries/submit` | `{ entryId }` | `servicetimeentries.submit` |
+| `POST /servicetimeentries/approve` | `{ entryId }` | `servicetimeentries.approve` (no super-admin bypass) |
+
+Each delegates to `ServiceEvidenceService`, so `submittedAt`/`submittedBy`,
+`approvedAt`/`approvedBy`/`approvalPath` (`operator`) and both snapshots are
+set exactly as the service sets them. The tenant and the acting profile come
+from the authenticated session, never the body. Recording or submitting
+someone else's time needs `approve` as well. Install pricing for `approve`
+as a factory, so a resolver that writes (client charges) runs on the request's
+executor and transaction:
+
+```ts
+import { setServiceTimeEntryCommercialResolver } from '@happyvertical/smrt-timesheets';
+
+setServiceTimeEntryCommercialResolver(({ options }) =>
+  SubscriptionServiceCommercialResolver.create(options, provider),
+);
+```
+
+Without a resolver, `approve` answers 409 `approval_not_configured`. MCP and
+CLI stay read-only; there is no `reject` action yet (#3994).
+
 ## Closing the generated surface
 
 The entry and both snapshots expose generated `list` / `get` on REST, CLI,
-and MCP, with optional tenant scoping. An application that routes all time
+and MCP, with optional tenant scoping, and the entry's collection the write
+actions above. An application that routes all time
 and money through its own permission-gated services can close those surfaces
 without declaring replacement models:
 
@@ -144,6 +175,8 @@ import '@happyvertical/smrt-timesheets';
 
 for (const name of [
   'ServiceTimeEntry',
+  // Hosts the record/submit/approve actions on generated SvelteKit routes.
+  'ServiceTimeEntryCollection',
   'ServiceChargeSnapshot',
   'ServiceCompensationSnapshot',
 ]) {

package/dist/attendance.js

@@ -1,3 +1,3 @@
-import { a as AttendanceReplay, c as AttendanceSegmentCollection, i as AttendancePunchCollection, n as AttendanceBreakCollection, o as AttendanceReplayCollection, r as AttendancePunch, s as AttendanceSegment, t as AttendanceBreak } from "./chunks/models-0-YD5F_o.js";
-import { a as continueSegment, c as openSegment, d as validateAttendanceWork, f as ATTENDANCE_CORRECTION_KINDS, i as closeOpenSegment, l as replaceSegment, m as AttendanceCorrectionCollection, n as AttendanceService, o as endSegment, p as AttendanceCorrection, r as beginSegment, s as listSegments, t as AttendanceCorrectionService, u as AttendanceConflict } from "./chunks/attendance-DGVy-iHI.js";
+import { a as AttendanceReplay, c as AttendanceSegmentCollection, i as AttendancePunchCollection, n as AttendanceBreakCollection, o as AttendanceReplayCollection, r as AttendancePunch, s as AttendanceSegment, t as AttendanceBreak } from "./chunks/models-C1krjn40.js";
+import { a as continueSegment, c as openSegment, d as validateAttendanceWork, f as ATTENDANCE_CORRECTION_KINDS, i as closeOpenSegment, l as replaceSegment, m as AttendanceCorrectionCollection, n as AttendanceService, o as endSegment, p as AttendanceCorrection, r as beginSegment, s as listSegments, t as AttendanceCorrectionService, u as AttendanceConflict } from "./chunks/attendance-CDfhph1R.js";
 export { ATTENDANCE_CORRECTION_KINDS, AttendanceBreak, AttendanceBreakCollection, AttendanceConflict, AttendanceCorrection, AttendanceCorrectionCollection, AttendanceCorrectionService, AttendancePunch, AttendancePunchCollection, AttendanceReplay, AttendanceReplayCollection, AttendanceSegment, AttendanceSegmentCollection, AttendanceService, beginSegment, closeOpenSegment, continueSegment, endSegment, listSegments, openSegment, replaceSegment, validateAttendanceWork };

package/dist/chunks/{attendance-DGVy-iHI.js → attendance-CDfhph1R.js}

@@ -1,5 +1,5 @@
-import { i as ServiceTimeEntryCollection, o as parseTimesheetJson } from "./service-time-entry-t7P-bkOQ.js";
-import { c as AttendanceSegmentCollection, d as persistAutoClose, f as persistCorrection, i as AttendancePunchCollection, l as deleteCorrection, n as AttendanceBreakCollection, o as AttendanceReplayCollection, r as AttendancePunch, s as AttendanceSegment, t as AttendanceBreak, u as isCorrectionWrite } from "./models-0-YD5F_o.js";
+import { i as ServiceTimeEntryCollection, o as parseTimesheetJson } from "./service-time-entry-Cxh0pt0J.js";
+import { c as AttendanceSegmentCollection, d as persistAutoClose, f as persistCorrection, i as AttendancePunchCollection, l as deleteCorrection, n as AttendanceBreakCollection, o as AttendanceReplayCollection, r as AttendancePunch, s as AttendanceSegment, t as AttendanceBreak, u as isCorrectionWrite } from "./models-C1krjn40.js";
 import { SmrtCollection, SmrtObject, crossPackageRef, field, foreignKey, isEmbeddedDatabase, isPostgresDatabase, smrt, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { TenantScoped, getTenantId, tenantId, withTenant } from "@happyvertical/smrt-tenancy";
 //#region src/attendance/correction-models.ts
@@ -1243,4 +1243,4 @@ var AttendanceCorrectionService = class {
 //#endregion
 export { continueSegment as a, openSegment as c, validateAttendanceWork as d, ATTENDANCE_CORRECTION_KINDS as f, closeOpenSegment as i, replaceSegment as l, AttendanceCorrectionCollection as m, AttendanceService as n, endSegment as o, AttendanceCorrection as p, beginSegment as r, listSegments as s, AttendanceCorrectionService as t, AttendanceConflict as u };
 
-//# sourceMappingURL=attendance-DGVy-iHI.js.map
+//# sourceMappingURL=attendance-CDfhph1R.js.map