@managemint-solutions/sdk 0.45.0 → 0.50.0

package/dist/leave/leave-requests.js

@@ -16,7 +16,7 @@ const LEAVE_REQUEST_SELECT = `
         leave_type:leave_types!leave_type_id (
           mms_id,
           name,
-          requires_document
+          document_after_days
         ),
         start_date,
         end_date,
@@ -30,6 +30,19 @@ const LEAVE_REQUEST_SELECT = `
         cancelled_by:user_profiles!cancelled_by (*),
         cancelled_at
       `;
+const LEAVE_CALENDAR_SELECT = `
+        mms_id,
+        user:user_profiles!user_id (*),
+        created_by:user_profiles!created_by (*),
+        leave_type:leave_types!leave_type_id (
+          mms_id,
+          name
+        ),
+        start_date,
+        end_date,
+        is_half_day,
+        status
+      `;
 /** The statuses that hold days: a pending request reserves them, an approved one uses them. */
 const LIVE_STATUSES = [enum_2.LeaveRequestStatus.PENDING, enum_2.LeaveRequestStatus.APPROVED];
 class LeaveRequestsResource {
@@ -110,28 +123,27 @@ class LeaveRequestsResource {
             throw (0, errors_1.mapPostgrestError)(error);
         return (count ?? 0) > 0;
     }
-    /**
-     * The days of `userId`'s requests of `leaveTypeId` in `statuses` that start inside `period` -
-     * what an entitlement's balance is checked against. `excludeId` leaves out the request being
-     * edited or approved so it is not counted against itself.
-     */
-    async sumDays(userId, leaveTypeId, period, statuses, excludeId) {
-        let daysQuery = this.supabase
-            .from('leave_requests')
-            .select('days')
-            .eq('organization_id', this.auth.organization_id)
-            .eq('user_id', userId)
-            .eq('leave_type_id', leaveTypeId)
-            .in('status', statuses)
-            .gte('start_date', period.period_start)
-            .lte('start_date', period.period_end);
-        if (excludeId) {
-            daysQuery = daysQuery.neq('mms_id', excludeId);
-        }
-        const { data, error } = await daysQuery;
-        if (error)
-            throw (0, errors_1.mapPostgrestError)(error);
-        return (data ?? []).reduce((total, row) => total + Number(row.days), 0);
+    /** Live requests touching `date_from`..`date_to`, for everyone in the organization - the leave calendar. */
+    async calendar(query) {
+        return (0, transforms_1.allRows)((from, to) => {
+            let calendarQuery = this.supabase
+                .from('leave_requests')
+                .select(LEAVE_CALENDAR_SELECT)
+                .eq('organization_id', this.auth.organization_id)
+                .in('status', LIVE_STATUSES)
+                .lte('start_date', query.date_to)
+                .gte('end_date', query.date_from)
+                .order('start_date')
+                .order('mms_id')
+                .range(from, to);
+            if (query.user_id) {
+                calendarQuery = calendarQuery.eq('user_id', query.user_id);
+            }
+            if (query.leave_type_id) {
+                calendarQuery = calendarQuery.eq('leave_type_id', query.leave_type_id);
+            }
+            return calendarQuery;
+        });
     }
     async create(input) {
         const row = await this.table.insert({
@@ -169,10 +181,13 @@ class LeaveRequestsResource {
         });
         return row ? this.getById(leaveRequestId) : null;
     }
-    /** Cancels a request while it is still pending; null when it no longer is - a decided request is final. */
-    async cancel(leaveRequestId, cancelledBy) {
+    /**
+     * Cancels a request that is still in `expected` - the status the api read and decided on.
+     * Null when it has moved on since (reviewed, or cancelled by someone else).
+     */
+    async cancel(leaveRequestId, cancelledBy, expected) {
         const now = new Date().toISOString();
-        const row = await this.table.updateWhere(leaveRequestId, (query) => query.eq('status', enum_2.LeaveRequestStatus.PENDING), {
+        const row = await this.table.updateWhere(leaveRequestId, (query) => query.eq('status', expected), {
             status: enum_2.LeaveRequestStatus.CANCELLED,
             cancelled_by: cancelledBy,
             cancelled_at: now,

package/dist/leave/leave-types.js

@@ -18,9 +18,26 @@ const LEAVE_TYPE_SELECT = `
         default_days,
         is_paid,
         requires_approval,
-        requires_document,
+        document_after_days,
+        cycle_years,
+        grant_method,
+        max_carry_over_days,
+        carry_over_expiry_months,
+        min_service_months,
+        min_days_per_week,
+        initial_months,
+        initial_days_per_month,
+        paid_on_exit,
         active
       `;
+/** Postgres hands `numeric` back as a string; the entity promises numbers. */
+const toLeaveType = (row) => ({
+    ...row,
+    default_days: Number(row.default_days),
+    max_carry_over_days: Number(row.max_carry_over_days),
+    document_after_days: row.document_after_days === null ? null : Number(row.document_after_days),
+    initial_days_per_month: row.initial_days_per_month === null ? null : Number(row.initial_days_per_month),
+});
 class LeaveTypesResource {
     supabase;
     auth;
@@ -46,7 +63,7 @@ class LeaveTypesResource {
         const { data, error } = await typesQuery;
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
-        return data;
+        return (data ?? []).map(toLeaveType);
     }
     async getById(leaveTypeId) {
         const { data, error } = await this.supabase
@@ -57,7 +74,7 @@ class LeaveTypesResource {
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
-        return data;
+        return toLeaveType(data);
     }
     async create(input) {
         const row = await this.table.insert({
@@ -66,7 +83,16 @@ class LeaveTypesResource {
             default_days: input.default_days,
             is_paid: input.is_paid,
             requires_approval: input.requires_approval,
-            requires_document: input.requires_document,
+            document_after_days: input.document_after_days,
+            cycle_years: input.cycle_years,
+            grant_method: input.grant_method,
+            max_carry_over_days: input.max_carry_over_days,
+            carry_over_expiry_months: input.carry_over_expiry_months,
+            min_service_months: input.min_service_months,
+            min_days_per_week: input.min_days_per_week,
+            initial_months: input.initial_months,
+            initial_days_per_month: input.initial_days_per_month,
+            paid_on_exit: input.paid_on_exit,
             organization_id: this.auth.organization_id,
             created_by: this.auth.mms_id,
             created_at: new Date().toISOString(),
@@ -80,7 +106,16 @@ class LeaveTypesResource {
             default_days: input.default_days,
             is_paid: input.is_paid,
             requires_approval: input.requires_approval,
-            requires_document: input.requires_document,
+            document_after_days: input.document_after_days,
+            cycle_years: input.cycle_years,
+            grant_method: input.grant_method,
+            max_carry_over_days: input.max_carry_over_days,
+            carry_over_expiry_months: input.carry_over_expiry_months,
+            min_service_months: input.min_service_months,
+            min_days_per_week: input.min_days_per_week,
+            initial_months: input.initial_months,
+            initial_days_per_month: input.initial_days_per_month,
+            paid_on_exit: input.paid_on_exit,
             active: input.active,
             last_updated_by: this.auth.mms_id,
             updated_at: new Date().toISOString(),

package/dist/leave/working-days.d.ts

@@ -4,6 +4,8 @@ import type { LeavePeriod } from '@managemint-solutions/entities/leave';
  * customer is South African; this is the one place to change when a column arrives.
  */
 export declare const LEAVE_TIME_ZONE = "Africa/Johannesburg";
+/** `users.working_days`' default: ISO weekdays, Monday (1) to Friday (5). */
+export declare const MONDAY_TO_FRIDAY: readonly number[];
 /** A `Date` at UTC midnight of a `YYYY-MM-DD` string (a longer ISO string is cut to its date). */
 export declare const parseIsoDate: (value: string) => Date;
 /** The `YYYY-MM-DD` of a `Date`'s UTC calendar day. */
@@ -12,22 +14,24 @@ export declare const toIsoDate: (date: Date) => string;
 export declare const todayInJohannesburg: (now?: Date) => string;
 /** Every calendar date from `start` to `end` inclusive; empty when `end` is before `start`. */
 export declare const eachDate: (start: string, end: string) => string[];
-/** Monday to Friday and not one of the organization's holidays. */
-export declare const isWorkingDay: (isoDate: string, holidays: ReadonlySet<string>) => boolean;
+/** One of the person's `workingDays` (ISO weekdays) and not a public holiday. */
+export declare const isWorkingDay: (isoDate: string, holidays: ReadonlySet<string>, workingDays?: readonly number[]) => boolean;
 /**
  * The days a request is worth: the working days from `start` to `end` inclusive, halved for a
  * half day. A half day is only meaningful on a single working day, so it yields 0.5 there and 0
- * on a weekend or holiday - the caller rejects a zero either way.
+ * on a day off or holiday - the caller rejects a zero either way.
  */
-export declare const countWorkingDays: (start: string, end: string, holidays: ReadonlySet<string>, isHalfDay?: boolean) => number;
+export declare const countWorkingDays: (start: string, end: string, holidays: ReadonlySet<string>, isHalfDay?: boolean, workingDays?: readonly number[]) => number;
 /** `isoDate` moved by `days` calendar days, either way; `shiftDays('2026-03-01', -1)` is Feb 28. */
 export declare const shiftDays: (isoDate: string, days: number) => string;
-/** The day before the same date next year - the end of a period that starts on `isoDate`. */
-export declare const addOneYearMinusDay: (isoDate: string) => string;
 /**
- * The leave year containing `date` for an organization whose year starts on the first of
- * `startMonth` (1-12, `organizations.leave_calendar_start_month`). A March start puts
- * 2026-02-10 in the year that began 2025-03-01.
+ * `isoDate` moved by `months` calendar months, the day clamped to the target month's length:
+ * `addMonths('2026-01-31', 1)` is Feb 28.
  */
-export declare const leavePeriodFor: (date: string, startMonth: number) => LeavePeriod;
+export declare const addMonths: (isoDate: string, months: number) => string;
+/**
+ * Whole months from `start` completed by the end of `asOf`: 0 until the day before the
+ * one-month mark, 1 from then. A month counts once its last day has been lived.
+ */
+export declare const completedMonths: (start: string, asOf: string) => number;
 export declare const isWithinPeriod: (date: string, period: LeavePeriod) => boolean;

package/dist/leave/working-days.js

@@ -1,16 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isWithinPeriod = exports.leavePeriodFor = exports.addOneYearMinusDay = exports.shiftDays = exports.countWorkingDays = exports.isWorkingDay = exports.eachDate = exports.todayInJohannesburg = exports.toIsoDate = exports.parseIsoDate = exports.LEAVE_TIME_ZONE = void 0;
-// The calendar arithmetic behind leave: which days of a request count, and which leave year a
-// date belongs to. Pure functions over `YYYY-MM-DD` strings - the columns are `date`, so a
+exports.isWithinPeriod = exports.completedMonths = exports.addMonths = exports.shiftDays = exports.countWorkingDays = exports.isWorkingDay = exports.eachDate = exports.todayInJohannesburg = exports.toIsoDate = exports.parseIsoDate = exports.MONDAY_TO_FRIDAY = exports.LEAVE_TIME_ZONE = void 0;
+// The calendar arithmetic behind leave: which days of a request count, and how dates move by
+// days and months. Pure functions over `YYYY-MM-DD` strings - the columns are `date`, so a
 // request never carries a time and nothing here depends on the caller's clock zone.
 /**
  * Where "today" is read for the cancel rule. Organizations carry no time zone yet, and every
  * customer is South African; this is the one place to change when a column arrives.
  */
 exports.LEAVE_TIME_ZONE = 'Africa/Johannesburg';
-/** Saturday and Sunday. Not configurable yet - a working-week setting is a later feature. */
-const WEEKEND_DAYS = new Set([0, 6]);
+/** `users.working_days`' default: ISO weekdays, Monday (1) to Friday (5). */
+exports.MONDAY_TO_FRIDAY = [1, 2, 3, 4, 5];
 const pad = (value) => String(value).padStart(2, '0');
 /** A `Date` at UTC midnight of a `YYYY-MM-DD` string (a longer ISO string is cut to its date). */
 const parseIsoDate = (value) => {
@@ -41,16 +41,16 @@ const eachDate = (start, end) => {
     return dates;
 };
 exports.eachDate = eachDate;
-/** Monday to Friday and not one of the organization's holidays. */
-const isWorkingDay = (isoDate, holidays) => !WEEKEND_DAYS.has((0, exports.parseIsoDate)(isoDate).getUTCDay()) && !holidays.has(isoDate.slice(0, 10));
+/** One of the person's `workingDays` (ISO weekdays) and not a public holiday. */
+const isWorkingDay = (isoDate, holidays, workingDays = exports.MONDAY_TO_FRIDAY) => workingDays.includes((0, exports.parseIsoDate)(isoDate).getUTCDay() || 7) && !holidays.has(isoDate.slice(0, 10));
 exports.isWorkingDay = isWorkingDay;
 /**
  * The days a request is worth: the working days from `start` to `end` inclusive, halved for a
  * half day. A half day is only meaningful on a single working day, so it yields 0.5 there and 0
- * on a weekend or holiday - the caller rejects a zero either way.
+ * on a day off or holiday - the caller rejects a zero either way.
  */
-const countWorkingDays = (start, end, holidays, isHalfDay = false) => {
-    const working = (0, exports.eachDate)(start, end).filter((date) => (0, exports.isWorkingDay)(date, holidays)).length;
+const countWorkingDays = (start, end, holidays, isHalfDay = false, workingDays = exports.MONDAY_TO_FRIDAY) => {
+    const working = (0, exports.eachDate)(start, end).filter((date) => (0, exports.isWorkingDay)(date, holidays, workingDays)).length;
     return isHalfDay ? working * 0.5 : working;
 };
 exports.countWorkingDays = countWorkingDays;
@@ -61,26 +61,33 @@ const shiftDays = (isoDate, days) => {
     return (0, exports.toIsoDate)(date);
 };
 exports.shiftDays = shiftDays;
-/** The day before the same date next year - the end of a period that starts on `isoDate`. */
-const addOneYearMinusDay = (isoDate) => {
+/**
+ * `isoDate` moved by `months` calendar months, the day clamped to the target month's length:
+ * `addMonths('2026-01-31', 1)` is Feb 28.
+ */
+const addMonths = (isoDate, months) => {
     const date = (0, exports.parseIsoDate)(isoDate);
-    date.setUTCFullYear(date.getUTCFullYear() + 1);
-    date.setUTCDate(date.getUTCDate() - 1);
+    const day = date.getUTCDate();
+    date.setUTCDate(1);
+    date.setUTCMonth(date.getUTCMonth() + months);
+    const lastDay = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 1, 0)).getUTCDate();
+    date.setUTCDate(Math.min(day, lastDay));
     return (0, exports.toIsoDate)(date);
 };
-exports.addOneYearMinusDay = addOneYearMinusDay;
+exports.addMonths = addMonths;
 /**
- * The leave year containing `date` for an organization whose year starts on the first of
- * `startMonth` (1-12, `organizations.leave_calendar_start_month`). A March start puts
- * 2026-02-10 in the year that began 2025-03-01.
+ * Whole months from `start` completed by the end of `asOf`: 0 until the day before the
+ * one-month mark, 1 from then. A month counts once its last day has been lived.
  */
-const leavePeriodFor = (date, startMonth) => {
-    const parsed = (0, exports.parseIsoDate)(date);
-    const year = parsed.getUTCMonth() + 1 >= startMonth ? parsed.getUTCFullYear() : parsed.getUTCFullYear() - 1;
-    const period_start = (0, exports.toIsoDate)(new Date(Date.UTC(year, startMonth - 1, 1)));
-    return { period_start, period_end: (0, exports.addOneYearMinusDay)(period_start) };
+const completedMonths = (start, asOf) => {
+    const dayAfter = (0, exports.shiftDays)(asOf, 1);
+    let months = 0;
+    while ((0, exports.addMonths)(start, months + 1) <= dayAfter) {
+        months += 1;
+    }
+    return months;
 };
-exports.leavePeriodFor = leavePeriodFor;
+exports.completedMonths = completedMonths;
 const isWithinPeriod = (date, period) => {
     const day = date.slice(0, 10);
     return day >= period.period_start && day <= period.period_end;

package/dist/organizations/dto.d.ts

@@ -59,4 +59,5 @@ export declare class UpdateOrganizationDto implements UpdateOrganizationDtoType
     readonly industry?: string | null;
     readonly marketing_consent?: boolean;
     readonly currency?: string;
+    readonly leave_calendar_start_month?: number;
 }

package/dist/organizations/dto.js

@@ -225,6 +225,7 @@ class UpdateOrganizationDto {
     industry;
     marketing_consent;
     currency;
+    leave_calendar_start_month;
 }
 exports.UpdateOrganizationDto = UpdateOrganizationDto;
 __decorate([
@@ -442,3 +443,10 @@ __decorate([
     (0, class_validator_1.MaxLength)(255, { message: 'Organization currency must be less than 255 characters' }),
     __metadata("design:type", String)
 ], UpdateOrganizationDto.prototype, "currency", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)({ message: 'Leave year start month must be a whole number' }),
+    (0, class_validator_1.Min)(1, { message: 'Leave year start month must be between 1 and 12' }),
+    (0, class_validator_1.Max)(12, { message: 'Leave year start month must be between 1 and 12' }),
+    __metadata("design:type", Number)
+], UpdateOrganizationDto.prototype, "leave_calendar_start_month", void 0);

package/dist/service-client/index.d.ts

@@ -46,6 +46,11 @@ export declare class SupabaseOrganizationScope {
      * subscriptions and both webhook handler services.
      */
     table(options: AuditedTableOptions): AuditedTable;
+    /**
+     * Gives `userId` a new leave calendar feed token (stored as its SHA-256), which also retires
+     * any address they subscribed with before. Service role only: the token is a credential.
+     */
+    replaceLeaveCalendarFeed(userId: string, tokenHash: string): Promise<void>;
     /**
      * Clients written service-role on a user's behalf: converting a lead needs only
      * `update_leads`, so the client it becomes is created here rather than through the caller's
@@ -97,14 +102,23 @@ export declare class SupabaseServiceClient {
      */
     organizationsWithPaystackCustomer(): Promise<string[]>;
     /**
-     * Every organization whose leave year starts on the first of `month` (1-12) - the tenants the
-     * nightly rollover visits on that day. Unscoped like the reconcile: the cron picks its tenants
-     * from here. `modules` comes along so the caller can skip an organization without HR.
+     * Every organization subscribed to `moduleKey`, with its leave-year start month - the tenants
+     * the nightly leave rollover visits. Unscoped like the reconcile: the cron picks its tenants
+     * from here.
      */
-    organizationsWithLeaveYearStartingIn(month: number): Promise<{
+    organizationsWithModule(moduleKey: string): Promise<{
         mms_id: string;
-        modules: string[];
+        leave_calendar_start_month: number;
     }[]>;
+    /**
+     * Whose leave calendar feed a token opens, by the token's SHA-256. Unscoped by necessity: the
+     * feed is fetched by a calendar app with no session, and the row is what says which tenant
+     * and person it belongs to. `leave_calendar_feeds` has no `authenticated` grant at all.
+     */
+    leaveCalendarFeedFor(tokenHash: string): Promise<{
+        user_id: string;
+        organization_id: string;
+    } | null>;
     /**
      * A ledger row by id alone. Also unscoped by necessity: a `charge.success` carries the
      * transaction id in its metadata, and the row is what says which tenant it belongs to.

package/dist/service-client/index.js

@@ -61,6 +61,20 @@ class SupabaseOrganizationScope {
     table(options) {
         return (0, audit_1.auditedTable)(this.supabase, this.actor, this.audit, options);
     }
+    /**
+     * Gives `userId` a new leave calendar feed token (stored as its SHA-256), which also retires
+     * any address they subscribed with before. Service role only: the token is a credential.
+     */
+    async replaceLeaveCalendarFeed(userId, tokenHash) {
+        const { error } = await this.supabase.from('leave_calendar_feeds').upsert({
+            user_id: userId,
+            organization_id: this.actor.organization_id,
+            token_hash: tokenHash,
+            created_at: new Date().toISOString(),
+        }, { onConflict: 'user_id' });
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
     /**
      * Clients written service-role on a user's behalf: converting a lead needs only
      * `update_leads`, so the client it becomes is created here rather than through the caller's
@@ -167,19 +181,34 @@ class SupabaseServiceClient {
         return (data ?? []).map((row) => row.organization_id);
     }
     /**
-     * Every organization whose leave year starts on the first of `month` (1-12) - the tenants the
-     * nightly rollover visits on that day. Unscoped like the reconcile: the cron picks its tenants
-     * from here. `modules` comes along so the caller can skip an organization without HR.
+     * Every organization subscribed to `moduleKey`, with its leave-year start month - the tenants
+     * the nightly leave rollover visits. Unscoped like the reconcile: the cron picks its tenants
+     * from here.
      */
-    async organizationsWithLeaveYearStartingIn(month) {
+    async organizationsWithModule(moduleKey) {
         const { data, error } = await this.supabase
             .from('organizations')
-            .select('mms_id, modules')
-            .eq('leave_calendar_start_month', month);
+            .select('mms_id, leave_calendar_start_month')
+            .contains('modules', [moduleKey]);
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return (data ?? []);
     }
+    /**
+     * Whose leave calendar feed a token opens, by the token's SHA-256. Unscoped by necessity: the
+     * feed is fetched by a calendar app with no session, and the row is what says which tenant
+     * and person it belongs to. `leave_calendar_feeds` has no `authenticated` grant at all.
+     */
+    async leaveCalendarFeedFor(tokenHash) {
+        const { data, error } = await this.supabase
+            .from('leave_calendar_feeds')
+            .select('user_id, organization_id')
+            .eq('token_hash', tokenHash)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
     /**
      * A ledger row by id alone. Also unscoped by necessity: a `charge.success` carries the
      * transaction id in its metadata, and the row is what says which tenant it belongs to.

package/dist/statuses/dto.d.ts

@@ -1,4 +1,4 @@
-import type { AddStatusDto as AddStatusDtoType, GetStatusesDto as GetStatusesDtoType, StatusIdDto as StatusIdDtoType, UpdateStatusDto as UpdateStatusDtoType } from '@managemint-solutions/entities/status/dto';
+import type { AddStatusDto as AddStatusDtoType, GetStatusesDto as GetStatusesDtoType, ReorderStatusesDto as ReorderStatusesDtoType, StatusIdDto as StatusIdDtoType, UpdateStatusDto as UpdateStatusDtoType } from '@managemint-solutions/entities/status/dto';
 import { StatusEntityTypes } from '@managemint-solutions/entities/status/enum';
 export declare class StatusIdDto implements StatusIdDtoType {
     readonly statusId: string;
@@ -12,6 +12,9 @@ export declare class AddStatusDto implements AddStatusDtoType {
     readonly entity: StatusEntityTypes;
     readonly is_complete?: boolean;
 }
+export declare class ReorderStatusesDto implements ReorderStatusesDtoType {
+    readonly status_ids: string[];
+}
 export declare class UpdateStatusDto implements UpdateStatusDtoType {
     readonly label: string;
     readonly colour: string;

package/dist/statuses/dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdateStatusDto = exports.AddStatusDto = exports.GetStatusesDto = exports.StatusIdDto = void 0;
+exports.UpdateStatusDto = exports.ReorderStatusesDto = exports.AddStatusDto = exports.GetStatusesDto = exports.StatusIdDto = void 0;
 const class_validator_1 = require("class-validator");
 const enum_1 = require("@managemint-solutions/entities/status/enum");
 // class-validator versions of the shared DTO types from @managemint-solutions/entities.
@@ -62,6 +62,18 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'is_complete must be true or false' }),
     __metadata("design:type", Boolean)
 ], AddStatusDto.prototype, "is_complete", void 0);
+class ReorderStatusesDto {
+    // The whole catalogue of the entity type in its new order; the resource checks it is complete
+    // and has no repeats, which the decorators cannot (they do not know the organization).
+    status_ids;
+}
+exports.ReorderStatusesDto = ReorderStatusesDto;
+__decorate([
+    (0, class_validator_1.IsArray)({ message: 'status_ids must be an array' }),
+    (0, class_validator_1.ArrayMinSize)(1, { message: 'status_ids cannot be empty' }),
+    (0, class_validator_1.IsUUID)('7', { each: true, message: 'Invalid status ID format' }),
+    __metadata("design:type", Array)
+], ReorderStatusesDto.prototype, "status_ids", void 0);
 class UpdateStatusDto {
     label;
     // Colour must be a valid hex code (e.g., #FFFFFF)

package/dist/statuses/index.d.ts

@@ -1,5 +1,5 @@
 import type { StatusEntity } from '@managemint-solutions/entities/status';
-import type { AddStatusDto, UpdateStatusDto } from '@managemint-solutions/entities/status/dto';
+import type { AddStatusDto, ReorderStatusesDto, UpdateStatusDto } from '@managemint-solutions/entities/status/dto';
 import type { StatusEntityTypes } from '@managemint-solutions/entities/status/enum';
 import type { AuthContext } from '../auth';
 import { type AuditResource } from '../audit';
@@ -10,8 +10,17 @@ export declare class StatusesResource {
     private readonly auth;
     private readonly table;
     constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
+    /** The catalogue in its order: `position` first, then insertion order for the seeded ties. */
     list(entity: StatusEntityTypes): Promise<StatusEntity[]>;
+    /** A new status goes last: one past the highest position its entity type has. */
     create(input: AddStatusDto): Promise<StatusEntity>;
+    /**
+     * Rewrites the whole catalogue's positions from the order given. The ids must be exactly the
+     * entity type's statuses, each once - a partial list would leave positions undefined, so it is
+     * refused with a 400 before anything is written. Only the rows that move are written (and
+     * audited); the answer is the catalogue in its new order.
+     */
+    reorder(entity: StatusEntityTypes, input: ReorderStatusesDto): Promise<StatusEntity[]>;
     update(statusId: string, input: UpdateStatusDto): Promise<StatusEntity>;
     /** The Won status cannot be deleted. Every other status can. */
     remove(statusId: string): Promise<void>;

package/dist/statuses/index.js

@@ -23,7 +23,7 @@ const refuseWon = (message) => new errors_1.SupabaseClientError({ status: 400, e
 // The public contract is the shared StatusEntity from @managemint-solutions/entities; the
 // `as StatusEntity` casts declare the shape the select string below produces (the columns are
 // defined in the api's supabase/migrations).
-const STATUS_SELECT = 'mms_id, label, colour, is_complete, is_fail, is_triage, is_won';
+const STATUS_SELECT = 'mms_id, label, colour, is_complete, is_fail, is_triage, is_won, position';
 // The audited write returns the whole row; the wire shape is the STATUS_SELECT columns.
 const toStatus = (row) => ({
     mms_id: row.mms_id,
@@ -33,6 +33,7 @@ const toStatus = (row) => ({
     is_fail: row.is_fail,
     is_triage: row.is_triage,
     is_won: row.is_won,
+    position: row.position,
 });
 class StatusesResource {
     supabase;
@@ -46,27 +47,75 @@ class StatusesResource {
             entityType: enum_1.AuditTrailEntityType.STATUS,
         });
     }
+    /** The catalogue in its order: `position` first, then insertion order for the seeded ties. */
     async list(entity) {
         const { data, error } = await this.supabase
             .from('statuses')
             .select(STATUS_SELECT)
             .eq('organization_id', this.auth.organization_id)
-            .eq('entity_type', entity);
+            .eq('entity_type', entity)
+            .order('position')
+            .order('created_at')
+            .order('mms_id');
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
+    /** A new status goes last: one past the highest position its entity type has. */
     async create(input) {
+        const { data, error } = await this.supabase
+            .from('statuses')
+            .select('position')
+            .eq('organization_id', this.auth.organization_id)
+            .eq('entity_type', input.entity)
+            .order('position', { ascending: false })
+            .limit(1)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        const last = data?.position;
         const row = await this.table.insert({
             label: input.label,
             colour: input.colour,
             entity_type: input.entity,
             is_complete: input.is_complete ?? false,
+            position: last === undefined ? 0 : last + 1,
             organization_id: this.auth.organization_id,
             created_by: this.auth.mms_id,
         });
         return toStatus(row);
     }
+    /**
+     * Rewrites the whole catalogue's positions from the order given. The ids must be exactly the
+     * entity type's statuses, each once - a partial list would leave positions undefined, so it is
+     * refused with a 400 before anything is written. Only the rows that move are written (and
+     * audited); the answer is the catalogue in its new order.
+     */
+    async reorder(entity, input) {
+        const current = await this.list(entity);
+        const currentIds = new Set(current.map((status) => status.mms_id));
+        const given = new Set(input.status_ids);
+        if (given.size !== input.status_ids.length ||
+            given.size !== currentIds.size ||
+            input.status_ids.some((id) => !currentIds.has(id))) {
+            throw new errors_1.SupabaseClientError({
+                status: 400,
+                error: 'Database Error',
+                message: `status_ids must list every ${entity} status exactly once`,
+            });
+        }
+        const positionOf = new Map(current.map((status) => [status.mms_id, status.position]));
+        for (const [position, id] of input.status_ids.entries()) {
+            if (positionOf.get(id) === position)
+                continue;
+            await this.table.update(id, {
+                position,
+                updated_at: new Date().toISOString(),
+                last_updated_by: this.auth.mms_id,
+            });
+        }
+        return this.list(entity);
+    }
     async update(statusId, input) {
         if (await this.isWon(statusId)) {
             throw refuseWon('The Won status is fixed and cannot be changed');

package/dist/users/dto.d.ts

@@ -26,6 +26,7 @@ export declare class GetUsersQueryDto implements Omit<GetUsersDtoType, 'active_i
     readonly page: number;
     readonly page_size: number;
     readonly active_in?: boolean[] | null;
+    readonly manager_id?: string | null;
 }
 export declare class UpdateUserDto implements UpdateUserDtoType {
     readonly name: string;
@@ -39,6 +40,7 @@ export declare class UpdateUserDto implements UpdateUserDtoType {
     readonly job_title?: string | null;
     readonly manager_id?: string | null;
     readonly secondary_manager_id?: string | null;
+    readonly working_days?: number[];
     readonly social_facebook?: string | null;
     readonly social_linkedin?: string | null;
     readonly social_twitter?: string | null;