@open-mercato/core 0.10.1-develop.7717.1.2befe9c634 → 0.10.1-develop.7721.1.b5c4a00a68

package/dist/modules/staff/api/timesheets/tasks/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/tasks/route.ts"],
-  "sourcesContent": ["/**\n * Tasks \u2014 the board of screen 6, the drawer of screen 7 and the subtask checklist\n * inside it, all served from one collection (D-2: a subtask is a child task).\n *\n * Two things this route is responsible for beyond plain CRUD:\n *\n *  1. **Project access is intersected into every query.** A caller without\n *     `staff.timesheets.projects.manage` only sees tasks belonging to projects they\n *     are an active member of \u2014 including when they ask for one id. A route that\n *     leaves that to the caller leaks another client's task titles, which is exactly\n *     the defect the projects route was fixed for; the resolution is memoised per\n *     request and fails closed, so an access decision that could not be made denies.\n *  2. **`topLevelOnly` is what the board asks for.** Children render inside their\n *     parent's drawer, never as their own card, so the board filters\n *     `parent_task_id IS NULL` rather than post-filtering a page it already paid for.\n *\n * The rollup fields (`ownMinutes`, `loggedMinutes`, `childCount`) are added by the\n * `staff.timesheets-tasks-rollup` response enricher rather than by a query in this\n * file, so the board pays one grouped aggregate per page instead of one per card.\n * `loggedMinutes` is the inclusive rollup (own + children, D-2); `ownMinutes` is this\n * task's entries alone. They are never summed together \u2014 see the enricher's note on\n * risk R10.\n */\n\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeTaskCrudEvents } from '../../../lib/crud'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeTask, StaffTimeTaskTag } from '../../../data/entities'\nimport { staffTimeTaskCreateSchema, staffTimeTaskUpdateSchema } from '../../../data/validators'\nimport { staffTimeTaskCommandIds } from '../../../commands/timesheets-tasks'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess, type ProjectAccess } from '../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { sanitizeSearchTerm, parseBooleanFlag } from '../../helpers'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks' })\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  time_project_id: 'time_project_id',\n  parent_task_id: 'parent_task_id',\n  task_status_id: 'task_status_id',\n  sequence_number: 'sequence_number',\n  reference: 'reference',\n  title: 'title',\n  description: 'description',\n  assignee_staff_member_id: 'assignee_staff_member_id',\n  position: 'position',\n  created_by_user_id: 'created_by_user_id',\n  closed_at: 'closed_at',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    q: z.string().optional(),\n    /** Prefix match on the denormalised `<CODE>-<n>` reference. */\n    reference: z.string().optional(),\n    id: z.string().optional(),\n    ids: z.string().optional(),\n    timeProjectId: z.string().uuid().optional(),\n    taskStatusId: z.string().uuid().optional(),\n    assigneeStaffMemberId: z.string().uuid().optional(),\n    parentTaskId: z.string().uuid().optional(),\n    tagIds: z.string().optional(),\n    topLevelOnly: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype TaskListQuery = z.infer<typeof listSchema>\n\n/**\n * Non-UUID sentinel used as the \"match nothing\" filter, mirroring the projects route\n * so both narrowing paths behave identically.\n */\nconst IMPOSSIBLE_ID = '00000000-0000-0000-0000-000000000000'\n\nconst DENIED_ACCESS: ProjectAccess = { canManageAll: false, projectIds: [], staffMemberId: null }\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\n/** One access decision per request, shared by every filter that needs it. */\nconst accessByRequest = new WeakMap<Request, Promise<ProjectAccess>>()\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<ProjectAccess> {\n  if (!tenantId || !organizationId) return { ...DENIED_ACCESS }\n  const scope = { tenantId, organizationId }\n  try {\n    // One lookup, one authority, and a failure that says so. The previous\n    // `catch \u2192 []` could not tell \"denied\" from \"could not ask\", so an RBAC\n    // hiccup silently demoted a manager to their own memberships.\n    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope)\n    const em = container.resolve('em') as EntityManager\n    return await resolveProjectAccess({\n      em: em.fork(),\n      userId,\n      tenantId,\n      organizationId,\n      canManageAll: access.allowed,\n      userFeatures: access.grantedFeatures,\n      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n    })\n  } catch (err) {\n    logger.error('staff.timesheets.tasks access resolution failed', { err })\n    return { ...DENIED_ACCESS }\n  }\n}\n\nexport async function resolveListProjectAccess(ctx: CrudCtx): Promise<ProjectAccess> {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const load = () => loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId)\n  const request = ctx.request\n  if (!request) return load()\n  const cached = accessByRequest.get(request)\n  if (cached) return cached\n  const pending = load()\n  accessByRequest.set(request, pending)\n  return pending\n}\n\nfunction splitIdList(value: unknown): string[] | null {\n  if (typeof value !== 'string' || value.trim().length === 0) return null\n  const ids = value\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0)\n  return ids.length > 0 ? ids : []\n}\n\n/**\n * Task ids carrying **every** requested tag (W9).\n *\n * AND rather than OR, because that is what the board's chips already mean\n * (`matchesBoardTagFilter` requires every selected tag), and a server filter that\n * disagreed with the chips would change the result set on the same selection.\n *\n * Returning `[]` narrows to nothing, which is the correct answer both when no task\n * carries the combination and when the lookup failed: a filter that cannot be\n * applied must not silently widen the page back to every task.\n */\nasync function resolveTaskIdsForTags(ctx: CrudCtx, tagIds: string[]): Promise<string[]> {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!tenantId || !organizationId) return []\n  try {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const rows = await em.find(\n      StaffTimeTaskTag,\n      { tagId: { $in: tagIds }, tenantId, organizationId },\n      { fields: ['taskId', 'tagId'] },\n    )\n    const seen = new Map<string, Set<string>>()\n    for (const row of rows) {\n      const taskId = row.taskId\n      if (!taskId) continue\n      const bucket = seen.get(taskId) ?? new Set<string>()\n      bucket.add(row.tagId)\n      seen.set(taskId, bucket)\n    }\n    const required = new Set(tagIds).size\n    return [...seen.entries()].filter(([, tags]) => tags.size >= required).map(([taskId]) => taskId)\n  } catch (err) {\n    logger.error('staff.timesheets.tasks tag filter resolution failed', { err })\n    return []\n  }\n}\n\n/**\n * Every task query narrows to the projects the caller may actually see. Exported so\n * the access intersection is testable without standing up the CRUD factory.\n */\nexport async function buildTaskListFilters(\n  query: TaskListQuery,\n  ctx: CrudCtx,\n): Promise<Record<string, unknown>> {\n  const filters: Record<string, unknown> = {}\n\n  let narrowIds: string[] | null = null\n  for (const raw of [query.ids, query.id]) {\n    const parsed = splitIdList(raw)\n    if (parsed === null) continue\n    narrowIds = narrowIds ? narrowIds.filter((id) => parsed.includes(id)) : parsed\n  }\n\n  const requestedTagIds = splitIdList(query.tagIds)\n  if (requestedTagIds !== null) {\n    const tagged = requestedTagIds.length === 0 ? [] : await resolveTaskIdsForTags(ctx, requestedTagIds)\n    narrowIds = narrowIds ? narrowIds.filter((id) => tagged.includes(id)) : tagged\n  }\n\n  const access = await resolveListProjectAccess(ctx)\n  let projectIds: string[] | null = null\n  if (!access.canManageAll) {\n    projectIds = [...access.projectIds]\n    if (typeof query.timeProjectId === 'string' && query.timeProjectId.trim().length > 0) {\n      const requested = query.timeProjectId.trim()\n      projectIds = projectIds.filter((id) => id === requested)\n    }\n    if (projectIds.length === 0) {\n      // A non-member gets no row at all \u2014 not a redacted one \u2014 so a task title and\n      // its project never leave the server.\n      filters[F.time_project_id] = { $in: [IMPOSSIBLE_ID] }\n      return filters\n    }\n    filters[F.time_project_id] = { $in: projectIds }\n  } else if (typeof query.timeProjectId === 'string' && query.timeProjectId.trim().length > 0) {\n    filters[F.time_project_id] = query.timeProjectId.trim()\n  }\n\n  if (narrowIds !== null) {\n    if (narrowIds.length === 0) {\n      filters[F.id] = { $in: [IMPOSSIBLE_ID] }\n      return filters\n    }\n    filters[F.id] = { $in: narrowIds }\n  }\n\n  if (typeof query.taskStatusId === 'string' && query.taskStatusId.trim().length > 0) {\n    filters[F.task_status_id] = query.taskStatusId.trim()\n  }\n  if (typeof query.assigneeStaffMemberId === 'string' && query.assigneeStaffMemberId.trim().length > 0) {\n    filters[F.assignee_staff_member_id] = query.assigneeStaffMemberId.trim()\n  }\n  if (typeof query.parentTaskId === 'string' && query.parentTaskId.trim().length > 0) {\n    // The drawer's checklist: one parent's children, in position order.\n    filters[F.parent_task_id] = query.parentTaskId.trim()\n  } else if (parseBooleanFlag(query.topLevelOnly)) {\n    // The board: cards only, never a child that already renders inside a drawer.\n    filters[F.parent_task_id] = { $eq: null }\n  }\n\n  const term = sanitizeSearchTerm(query.q)\n  if (term) {\n    // A reference is the thing people actually type \u2014 \"AWR-9\" is how a task is\n    // named out loud \u2014 so searching only the title made the one identifier the\n    // UI shows everywhere unusable as a search key.\n    //\n    // The query engine's filter compiler has no OR across fields (`normalizeFilters`\n    // treats a top-level `$or` array as a field name), so the term is routed by\n    // shape instead: anything that looks like a code or a code-and-number goes to\n    // `reference`, everything else to `title`. A reference is `<CODE>-<n>` with no\n    // spaces, which is not a shape task titles take.\n    filters[F.title] = { $ilike: `%${escapeLikePattern(term)}%` }\n  }\n\n  // Searching by reference is a separate parameter rather than a shape-guess on\n  // `q`, because the guess is not decidable: \"Booking\" is a title word and \"AWR\"\n  // is a code, and both are single alphanumeric tokens. The query engine's filter\n  // compiler has no OR across fields \u2014 `normalizeFilters` reads a top-level `$or`\n  // array as a field name \u2014 so a caller that wants both asks for both and merges.\n  const referenceTerm = sanitizeSearchTerm(query.reference)\n  if (referenceTerm) {\n    filters[F.reference] = { $ilike: `${escapeLikePattern(referenceTerm)}%` }\n  }\n\n  return filters\n}\n\nexport const taskListFields = [\n  F.id,\n  F.organization_id,\n  F.tenant_id,\n  F.time_project_id,\n  F.parent_task_id,\n  F.task_status_id,\n  F.sequence_number,\n  F.reference,\n  F.title,\n  F.description,\n  F.assignee_staff_member_id,\n  F.position,\n  F.created_by_user_id,\n  F.closed_at,\n  F.created_at,\n  F.updated_at,\n] as const\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeTask,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeTaskCrudEvents,\n  indexer: { entityType: 'staff:staff_time_task' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_task',\n    fields: [...taskListFields],\n    // Cards stack in `position` order inside their column, so that is the board's\n    // natural sort rather than created-at.\n    defaultSort: { field: F.position, dir: 'asc' },\n    tiebreakSortField: F.created_at,\n    sortFieldMap: {\n      position: F.position,\n      title: F.title,\n      reference: F.reference,\n      sequenceNumber: F.sequence_number,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      closedAt: F.closed_at,\n    },\n    buildFilters: buildTaskListFilters,\n  },\n  enrichers: { entityId: 'staff:staff_time_task' },\n  actions: {\n    create: {\n      commandId: staffTimeTaskCommandIds.create,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeTaskCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.taskId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: staffTimeTaskCommandIds.update,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeTaskUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: staffTimeTaskCommandIds.delete,\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nexport const taskListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  parent_task_id: z.string().uuid().nullable().optional(),\n  task_status_id: z.string().uuid().nullable().optional(),\n  sequence_number: z.number().int().nullable().optional(),\n  reference: z.string().nullable().optional(),\n  title: z.string().nullable().optional(),\n  description: z.string().nullable().optional(),\n  assignee_staff_member_id: z.string().uuid().nullable().optional(),\n  position: z.number().int().nullable().optional(),\n  created_by_user_id: z.string().uuid().nullable().optional(),\n  closed_at: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  /** This task's own entries, in raw minutes. */\n  ownMinutes: z.number().int().optional(),\n  /** The inclusive rollup: own entries plus every live child's (D-2). */\n  loggedMinutes: z.number().int().optional(),\n  /** Live children only \u2014 soft-deleted subtasks are not counted. */\n  childCount: z.number().int().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeTask',\n  pluralName: 'Time Tasks',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(taskListItemSchema),\n  create: {\n    schema: staffTimeTaskCreateSchema,\n    description:\n      'Creates a task. Only `title` is required beyond scoping and `timeProjectId`: the task lands on the project default column with the creator assigned unless the request says otherwise. Supplying `parentTaskId` creates a subtask; a parent that is itself a subtask is refused with 400 subtask_depth_exceeded.',\n  },\n  update: {\n    schema: staffTimeTaskUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Updates a task. Re-parenting under a subtask, or turning a task that already has subtasks into one, is refused with 400 subtask_depth_exceeded; moving a task to another project is refused with 400 task_project_move_unsupported. Moving into a done column stamps closed_at, moving out clears it.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Soft-deletes a task. Deleting a parent soft-deletes its subtasks in the same transaction; time entries keep pointing at the deleted task so closed reports still resolve their labels.',\n  },\n})\n"],
-  "mappings": "AAwBA,SAAS,SAAS;AAElB,SAAS,qBAAmC;AAC5C,SAAS,+BAA+B;AACxC,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,SAAS,eAAe,wBAAwB;AAChD,SAAS,2BAA2B,iCAAiC;AACrE,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,4BAAgD;AAClF,SAAS,gCAAgC;AACzC,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uBAAuB,CAAC;AAEhF,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,OAAO;AAAA,EACP,aAAa;AAAA,EACb,0BAA0B;AAAA,EAC1B,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC7E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,EACxB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAQf,MAAM,gBAAgB;AAEtB,MAAM,gBAA+B,EAAE,cAAc,OAAO,YAAY,CAAC,GAAG,eAAe,KAAK;AAYhG,MAAM,kBAAkB,oBAAI,QAAyC;AAErE,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACwB;AACxB,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,EAAE,GAAG,cAAc;AAC5D,QAAM,QAAQ,EAAE,UAAU,eAAe;AACzC,MAAI;AAIF,UAAM,SAAS,MAAM,qBAAqB,WAAW,QAAQ,CAAC,uBAAuB,GAAG,KAAK;AAC7F,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,qBAAqB;AAAA,MAChC,IAAI,GAAG,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,IAC3E,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AACvE,WAAO,EAAE,GAAG,cAAc;AAAA,EAC5B;AACF;AAEA,eAAsB,yBAAyB,KAAsC;AACnF,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,OAAO,MAAM,kBAAkB,IAAI,WAAW,IAAI,MAAM,OAAO,MAAM,UAAU,cAAc;AACnG,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAM,SAAS,gBAAgB,IAAI,OAAO;AAC1C,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,KAAK;AACrB,kBAAgB,IAAI,SAAS,OAAO;AACpC,SAAO;AACT;AAEA,SAAS,YAAY,OAAiC;AACpD,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO;AACnE,QAAM,MAAM,MACT,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,SAAO,IAAI,SAAS,IAAI,MAAM,CAAC;AACjC;AAaA,eAAe,sBAAsB,KAAc,QAAqC;AACtF,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,CAAC;AAC1C,MAAI;AACF,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,OAAO,MAAM,GAAG;AAAA,MACpB;AAAA,MACA,EAAE,OAAO,EAAE,KAAK,OAAO,GAAG,UAAU,eAAe;AAAA,MACnD,EAAE,QAAQ,CAAC,UAAU,OAAO,EAAE;AAAA,IAChC;AACA,UAAM,OAAO,oBAAI,IAAyB;AAC1C,eAAW,OAAO,MAAM;AACtB,YAAM,SAAS,IAAI;AACnB,UAAI,CAAC,OAAQ;AACb,YAAM,SAAS,KAAK,IAAI,MAAM,KAAK,oBAAI,IAAY;AACnD,aAAO,IAAI,IAAI,KAAK;AACpB,WAAK,IAAI,QAAQ,MAAM;AAAA,IACzB;AACA,UAAM,WAAW,IAAI,IAAI,MAAM,EAAE;AACjC,WAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,KAAK,QAAQ,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,MAAM,MAAM;AAAA,EACjG,SAAS,KAAK;AACZ,WAAO,MAAM,uDAAuD,EAAE,IAAI,CAAC;AAC3E,WAAO,CAAC;AAAA,EACV;AACF;AAMA,eAAsB,qBACpB,OACA,KACkC;AAClC,QAAM,UAAmC,CAAC;AAE1C,MAAI,YAA6B;AACjC,aAAW,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,GAAG;AACvC,UAAM,SAAS,YAAY,GAAG;AAC9B,QAAI,WAAW,KAAM;AACrB,gBAAY,YAAY,UAAU,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,IAAI;AAAA,EAC1E;AAEA,QAAM,kBAAkB,YAAY,MAAM,MAAM;AAChD,MAAI,oBAAoB,MAAM;AAC5B,UAAM,SAAS,gBAAgB,WAAW,IAAI,CAAC,IAAI,MAAM,sBAAsB,KAAK,eAAe;AACnG,gBAAY,YAAY,UAAU,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,IAAI;AAAA,EAC1E;AAEA,QAAM,SAAS,MAAM,yBAAyB,GAAG;AACjD,MAAI,aAA8B;AAClC,MAAI,CAAC,OAAO,cAAc;AACxB,iBAAa,CAAC,GAAG,OAAO,UAAU;AAClC,QAAI,OAAO,MAAM,kBAAkB,YAAY,MAAM,cAAc,KAAK,EAAE,SAAS,GAAG;AACpF,YAAM,YAAY,MAAM,cAAc,KAAK;AAC3C,mBAAa,WAAW,OAAO,CAAC,OAAO,OAAO,SAAS;AAAA,IACzD;AACA,QAAI,WAAW,WAAW,GAAG;AAG3B,cAAQ,EAAE,eAAe,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACpD,aAAO;AAAA,IACT;AACA,YAAQ,EAAE,eAAe,IAAI,EAAE,KAAK,WAAW;AAAA,EACjD,WAAW,OAAO,MAAM,kBAAkB,YAAY,MAAM,cAAc,KAAK,EAAE,SAAS,GAAG;AAC3F,YAAQ,EAAE,eAAe,IAAI,MAAM,cAAc,KAAK;AAAA,EACxD;AAEA,MAAI,cAAc,MAAM;AACtB,QAAI,UAAU,WAAW,GAAG;AAC1B,cAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACvC,aAAO;AAAA,IACT;AACA,YAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,UAAU;AAAA,EACnC;AAEA,MAAI,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,KAAK,EAAE,SAAS,GAAG;AAClF,YAAQ,EAAE,cAAc,IAAI,MAAM,aAAa,KAAK;AAAA,EACtD;AACA,MAAI,OAAO,MAAM,0BAA0B,YAAY,MAAM,sBAAsB,KAAK,EAAE,SAAS,GAAG;AACpG,YAAQ,EAAE,wBAAwB,IAAI,MAAM,sBAAsB,KAAK;AAAA,EACzE;AACA,MAAI,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,KAAK,EAAE,SAAS,GAAG;AAElF,YAAQ,EAAE,cAAc,IAAI,MAAM,aAAa,KAAK;AAAA,EACtD,WAAW,iBAAiB,MAAM,YAAY,GAAG;AAE/C,YAAQ,EAAE,cAAc,IAAI,EAAE,KAAK,KAAK;AAAA,EAC1C;AAEA,QAAM,OAAO,mBAAmB,MAAM,CAAC;AACvC,MAAI,MAAM;AAUR,YAAQ,EAAE,KAAK,IAAI,EAAE,QAAQ,IAAI,kBAAkB,IAAI,CAAC,IAAI;AAAA,EAC9D;AAOA,QAAM,gBAAgB,mBAAmB,MAAM,SAAS;AACxD,MAAI,eAAe;AACjB,YAAQ,EAAE,SAAS,IAAI,EAAE,QAAQ,GAAG,kBAAkB,aAAa,CAAC,IAAI;AAAA,EAC1E;AAEA,SAAO;AACT;AAEO,MAAM,iBAAiB;AAAA,EAC5B,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AACJ;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,EAAE,YAAY,wBAAwB;AAAA,EAC/C,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,CAAC,GAAG,cAAc;AAAA;AAAA;AAAA,IAG1B,aAAa,EAAE,OAAO,EAAE,UAAU,KAAK,MAAM;AAAA,IAC7C,mBAAmB,EAAE;AAAA,IACrB,cAAc;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,OAAO,EAAE;AAAA,MACT,WAAW,EAAE;AAAA,MACb,gBAAgB,EAAE;AAAA,MAClB,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,UAAU,EAAE;AAAA,IACd;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA,WAAW,EAAE,UAAU,wBAAwB;AAAA,EAC/C,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW,wBAAwB;AAAA,MACnC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,2BAA2B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACrF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,UAAU,KAAK;AAAA,MACxD,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,wBAAwB;AAAA,MACnC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,2BAA2B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACrF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,wBAAwB;AAAA,MACnC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAEpB,MAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,0BAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEtC,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACxC,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,kBAAkB;AAAA,EACpE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aACE;AAAA,EACJ;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AACF,CAAC;",
+  "sourcesContent": ["/**\n * Tasks \u2014 the board of screen 6, the drawer of screen 7 and the subtask checklist\n * inside it, all served from one collection (D-2: a subtask is a child task).\n *\n * Two things this route is responsible for beyond plain CRUD:\n *\n *  1. **Project access is intersected into every query.** A caller without\n *     `staff.timesheets.projects.manage` only sees tasks belonging to projects they\n *     are an active member of \u2014 including when they ask for one id. A route that\n *     leaves that to the caller leaks another client's task titles, which is exactly\n *     the defect the projects route was fixed for; the resolution is memoised per\n *     request and fails closed, so an access decision that could not be made denies.\n *  2. **`topLevelOnly` is what the board asks for.** Children render inside their\n *     parent's drawer, never as their own card, so the board filters\n *     `parent_task_id IS NULL` rather than post-filtering a page it already paid for.\n *\n * The rollup fields (`ownMinutes`, `loggedMinutes`, `childCount`) are added by the\n * `staff.timesheets-tasks-rollup` response enricher rather than by a query in this\n * file, so the board pays one grouped aggregate per page instead of one per card.\n * `loggedMinutes` is the inclusive rollup (own + children, D-2); `ownMinutes` is this\n * task's entries alone. They are never summed together \u2014 see the enricher's note on\n * risk R10.\n */\n\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeTaskCrudEvents } from '../../../lib/crud'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { StaffSupportTicket, StaffTimeTask, StaffTimeTaskStatus, StaffTimeTaskTag } from '../../../data/entities'\nimport { staffTimeTaskCreateSchema, staffTimeTaskUpdateSchema } from '../../../data/validators'\nimport { staffTimeTaskCommandIds } from '../../../commands/timesheets-tasks'\nimport { resolveListProjectAccess } from '../../../lib/time-tracking/listProjectAccess'\nimport { sanitizeSearchTerm, parseBooleanFlag } from '../../helpers'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks' })\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  time_project_id: 'time_project_id',\n  parent_task_id: 'parent_task_id',\n  task_status_id: 'task_status_id',\n  sequence_number: 'sequence_number',\n  reference: 'reference',\n  title: 'title',\n  description: 'description',\n  assignee_staff_member_id: 'assignee_staff_member_id',\n  position: 'position',\n  created_by_user_id: 'created_by_user_id',\n  closed_at: 'closed_at',\n  source: 'source',\n  customer_id: 'customer_id',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    q: z.string().optional(),\n    /** Prefix match on the denormalised `<CODE>-<n>` reference. */\n    reference: z.string().optional(),\n    id: z.string().optional(),\n    ids: z.string().optional(),\n    timeProjectId: z.string().uuid().optional(),\n    taskStatusId: z.string().uuid().optional(),\n    assigneeStaffMemberId: z.string().uuid().optional(),\n    parentTaskId: z.string().uuid().optional(),\n    tagIds: z.string().optional(),\n    topLevelOnly: z.string().optional(),\n    unassigned: z.string().optional(),\n    source: z.enum(['internal', 'portal']).optional(),\n    customerId: z.string().uuid().optional(),\n    supportCategory: z.string().optional(),\n    supportReference: z.string().optional(),\n    portalStatus: z.enum(['received', 'in_progress', 'resolved']).optional(),\n    supportUnnotified: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype TaskListQuery = z.infer<typeof listSchema>\n\n/**\n * Non-UUID sentinel used as the \"match nothing\" filter, mirroring the projects route\n * so both narrowing paths behave identically.\n */\nconst IMPOSSIBLE_ID = '00000000-0000-0000-0000-000000000000'\n\nexport { resolveListProjectAccess }\n\n/**\n * Upper bound on the task ids the support filters materialize into the `id IN (...)`\n * narrowing. The newest matching tickets win; an older match beyond the cap drops out\n * of the filtered list instead of growing an unbounded parameter list.\n */\nexport const SUPPORT_FILTER_MAX_TASK_IDS = 1000\n\n/**\n * Requests whose support-filter narrowing hit `SUPPORT_FILTER_MAX_TASK_IDS`. The list's\n * `afterList` hook reports them as `totalIsCapped`, so a truncated support filter is\n * never presented as the complete result.\n */\nconst supportFilterTruncatedRequests = new WeakSet<Request>()\n\nexport function markTaskListTotalCapped(payload: Record<string, unknown>, ctx: { request?: Request }): void {\n  if (ctx.request && supportFilterTruncatedRequests.has(ctx.request)) payload.totalIsCapped = true\n}\n\nfunction intersectIds(current: string[] | null, next: string[]): string[] {\n  if (current === null) return next\n  const allowed = new Set(next)\n  return current.filter((id) => allowed.has(id))\n}\n\nfunction splitIdList(value: unknown): string[] | null {\n  if (typeof value !== 'string' || value.trim().length === 0) return null\n  const ids = value\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0)\n  return ids.length > 0 ? ids : []\n}\n\n/**\n * Task ids carrying **every** requested tag (W9).\n *\n * AND rather than OR, because that is what the board's chips already mean\n * (`matchesBoardTagFilter` requires every selected tag), and a server filter that\n * disagreed with the chips would change the result set on the same selection.\n *\n * Returning `[]` narrows to nothing, which is the correct answer both when no task\n * carries the combination and when the lookup failed: a filter that cannot be\n * applied must not silently widen the page back to every task.\n */\nasync function resolveTaskIdsForTags(ctx: CrudCtx, tagIds: string[]): Promise<string[]> {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!tenantId || !organizationId) return []\n  try {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const rows = await em.find(\n      StaffTimeTaskTag,\n      { tagId: { $in: tagIds }, tenantId, organizationId },\n      { fields: ['taskId', 'tagId'] },\n    )\n    const seen = new Map<string, Set<string>>()\n    for (const row of rows) {\n      const taskId = row.taskId\n      if (!taskId) continue\n      const bucket = seen.get(taskId) ?? new Set<string>()\n      bucket.add(row.tagId)\n      seen.set(taskId, bucket)\n    }\n    const required = new Set(tagIds).size\n    return [...seen.entries()].filter(([, tags]) => tags.size >= required).map(([taskId]) => taskId)\n  } catch (err) {\n    logger.error('staff.timesheets.tasks tag filter resolution failed', { err })\n    getTelemetryRuntime()?.reportError(err, { module: 'staff', code: 'staff.task_tag_filter_failed' })\n    return []\n  }\n}\n\ntype SupportFilterCriteria = {\n  supportCategory?: string\n  supportReference?: string\n  supportUnnotified?: boolean\n}\n\n/**\n * Task ids whose support ticket row matches the requested support criteria. Like the\n * tag lookup, a failed lookup narrows to nothing rather than widening the page.\n */\nasync function resolveTaskIdsForSupport(ctx: CrudCtx, criteria: SupportFilterCriteria): Promise<string[]> {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!tenantId || !organizationId) return []\n  try {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const where: Record<string, unknown> = { tenantId, organizationId, deletedAt: null }\n    if (criteria.supportCategory) where.categoryValue = criteria.supportCategory\n    if (criteria.supportReference) where.supportReference = { $ilike: `${escapeLikePattern(criteria.supportReference)}%` }\n    if (criteria.supportUnnotified) where.unnotifiedAt = { $ne: null }\n    const rows = await findWithDecryption(\n      em,\n      StaffSupportTicket,\n      where,\n      { fields: ['taskId'], limit: SUPPORT_FILTER_MAX_TASK_IDS + 1, orderBy: { createdAt: 'desc' } },\n      { tenantId, organizationId },\n    )\n    if (rows.length > SUPPORT_FILTER_MAX_TASK_IDS && ctx.request) supportFilterTruncatedRequests.add(ctx.request)\n    return Array.from(new Set(rows.slice(0, SUPPORT_FILTER_MAX_TASK_IDS).map((row) => row.taskId)))\n  } catch (err) {\n    logger.error('staff.timesheets.tasks support filter resolution failed', { err })\n    getTelemetryRuntime()?.reportError(err, { module: 'staff', code: 'staff.task_support_filter_failed' })\n    return []\n  }\n}\n\nasync function resolveStatusIdsForPortalStatus(\n  ctx: CrudCtx,\n  portalStatus: 'received' | 'in_progress' | 'resolved',\n): Promise<string[]> {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!tenantId || !organizationId) return []\n  try {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const where: Record<string, unknown> = { tenantId, organizationId, deletedAt: null }\n    if (portalStatus === 'resolved') where.isDone = true\n    else if (portalStatus === 'received') Object.assign(where, { isDone: false, isDefault: true })\n    else Object.assign(where, { isDone: false, isDefault: false })\n    const rows = await em.find(StaffTimeTaskStatus, where, { fields: ['id'] })\n    return rows.map((row) => row.id)\n  } catch (err) {\n    logger.error('staff.timesheets.tasks portal status filter resolution failed', { err })\n    getTelemetryRuntime()?.reportError(err, { module: 'staff', code: 'staff.task_portal_status_filter_failed' })\n    return []\n  }\n}\n\n/**\n * Every task query narrows to the projects the caller may actually see. Exported so\n * the access intersection is testable without standing up the CRUD factory.\n */\nexport async function buildTaskListFilters(\n  query: TaskListQuery,\n  ctx: CrudCtx,\n): Promise<Record<string, unknown>> {\n  const filters: Record<string, unknown> = {}\n\n  let narrowIds: string[] | null = null\n  for (const raw of [query.ids, query.id]) {\n    const parsed = splitIdList(raw)\n    if (parsed === null) continue\n    narrowIds = intersectIds(narrowIds, parsed)\n  }\n\n  const requestedTagIds = splitIdList(query.tagIds)\n  if (requestedTagIds !== null) {\n    const tagged = requestedTagIds.length === 0 ? [] : await resolveTaskIdsForTags(ctx, requestedTagIds)\n    narrowIds = intersectIds(narrowIds, tagged)\n  }\n\n  const supportCategory = typeof query.supportCategory === 'string' ? query.supportCategory.trim() : ''\n  const supportReference = sanitizeSearchTerm(query.supportReference) ?? ''\n  const supportUnnotified = parseBooleanFlag(query.supportUnnotified)\n  if (supportCategory || supportReference || supportUnnotified) {\n    const supportTaskIds = await resolveTaskIdsForSupport(ctx, {\n      supportCategory: supportCategory || undefined,\n      supportReference: supportReference || undefined,\n      supportUnnotified,\n    })\n    narrowIds = intersectIds(narrowIds, supportTaskIds)\n  }\n\n  const access = await resolveListProjectAccess(ctx)\n  let projectIds: string[] | null = null\n  if (!access.canManageAll) {\n    projectIds = [...access.projectIds]\n    if (typeof query.timeProjectId === 'string' && query.timeProjectId.trim().length > 0) {\n      const requested = query.timeProjectId.trim()\n      projectIds = projectIds.filter((id) => id === requested)\n    }\n    if (projectIds.length === 0) {\n      // A non-member gets no row at all \u2014 not a redacted one \u2014 so a task title and\n      // its project never leave the server.\n      filters[F.time_project_id] = { $in: [IMPOSSIBLE_ID] }\n      return filters\n    }\n    filters[F.time_project_id] = { $in: projectIds }\n  } else if (typeof query.timeProjectId === 'string' && query.timeProjectId.trim().length > 0) {\n    filters[F.time_project_id] = query.timeProjectId.trim()\n  }\n\n  if (narrowIds !== null) {\n    if (narrowIds.length === 0) {\n      filters[F.id] = { $in: [IMPOSSIBLE_ID] }\n      return filters\n    }\n    filters[F.id] = { $in: narrowIds }\n  }\n\n  if (typeof query.taskStatusId === 'string' && query.taskStatusId.trim().length > 0) {\n    filters[F.task_status_id] = query.taskStatusId.trim()\n  } else if (query.portalStatus) {\n    const statusIds = await resolveStatusIdsForPortalStatus(ctx, query.portalStatus)\n    filters[F.task_status_id] = { $in: statusIds.length > 0 ? statusIds : [IMPOSSIBLE_ID] }\n  }\n  if (typeof query.assigneeStaffMemberId === 'string' && query.assigneeStaffMemberId.trim().length > 0) {\n    filters[F.assignee_staff_member_id] = query.assigneeStaffMemberId.trim()\n  } else if (parseBooleanFlag(query.unassigned)) {\n    filters[F.assignee_staff_member_id] = { $eq: null }\n  }\n  if (query.source) filters[F.source] = query.source\n  if (query.customerId) filters[F.customer_id] = query.customerId\n  if (typeof query.parentTaskId === 'string' && query.parentTaskId.trim().length > 0) {\n    // The drawer's checklist: one parent's children, in position order.\n    filters[F.parent_task_id] = query.parentTaskId.trim()\n  } else if (parseBooleanFlag(query.topLevelOnly)) {\n    // The board: cards only, never a child that already renders inside a drawer.\n    filters[F.parent_task_id] = { $eq: null }\n  }\n\n  const term = sanitizeSearchTerm(query.q)\n  if (term) {\n    // A reference is the thing people actually type \u2014 \"AWR-9\" is how a task is\n    // named out loud \u2014 so searching only the title made the one identifier the\n    // UI shows everywhere unusable as a search key.\n    //\n    // The query engine's filter compiler has no OR across fields (`normalizeFilters`\n    // treats a top-level `$or` array as a field name), so the term is routed by\n    // shape instead: anything that looks like a code or a code-and-number goes to\n    // `reference`, everything else to `title`. A reference is `<CODE>-<n>` with no\n    // spaces, which is not a shape task titles take.\n    filters[F.title] = { $ilike: `%${escapeLikePattern(term)}%` }\n  }\n\n  // Searching by reference is a separate parameter rather than a shape-guess on\n  // `q`, because the guess is not decidable: \"Booking\" is a title word and \"AWR\"\n  // is a code, and both are single alphanumeric tokens. The query engine's filter\n  // compiler has no OR across fields \u2014 `normalizeFilters` reads a top-level `$or`\n  // array as a field name \u2014 so a caller that wants both asks for both and merges.\n  const referenceTerm = sanitizeSearchTerm(query.reference)\n  if (referenceTerm) {\n    filters[F.reference] = { $ilike: `${escapeLikePattern(referenceTerm)}%` }\n  }\n\n  return filters\n}\n\nexport const taskListFields = [\n  F.id,\n  F.organization_id,\n  F.tenant_id,\n  F.time_project_id,\n  F.parent_task_id,\n  F.task_status_id,\n  F.sequence_number,\n  F.reference,\n  F.title,\n  F.description,\n  F.assignee_staff_member_id,\n  F.position,\n  F.created_by_user_id,\n  F.closed_at,\n  F.source,\n  F.customer_id,\n  F.created_at,\n  F.updated_at,\n] as const\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeTask,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeTaskCrudEvents,\n  indexer: { entityType: 'staff:staff_time_task' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_task',\n    fields: [...taskListFields],\n    // Cards stack in `position` order inside their column, so that is the board's\n    // natural sort rather than created-at.\n    defaultSort: { field: F.position, dir: 'asc' },\n    tiebreakSortField: F.created_at,\n    sortFieldMap: {\n      position: F.position,\n      title: F.title,\n      reference: F.reference,\n      sequenceNumber: F.sequence_number,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      closedAt: F.closed_at,\n    },\n    buildFilters: buildTaskListFilters,\n  },\n  enrichers: { entityId: 'staff:staff_time_task' },\n  hooks: {\n    afterList: (payload, ctx) => markTaskListTotalCapped(payload, ctx),\n  },\n  actions: {\n    create: {\n      commandId: staffTimeTaskCommandIds.create,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeTaskCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.taskId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: staffTimeTaskCommandIds.update,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeTaskUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: staffTimeTaskCommandIds.delete,\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nexport const taskListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  parent_task_id: z.string().uuid().nullable().optional(),\n  task_status_id: z.string().uuid().nullable().optional(),\n  sequence_number: z.number().int().nullable().optional(),\n  reference: z.string().nullable().optional(),\n  title: z.string().nullable().optional(),\n  description: z.string().nullable().optional(),\n  assignee_staff_member_id: z.string().uuid().nullable().optional(),\n  position: z.number().int().nullable().optional(),\n  created_by_user_id: z.string().uuid().nullable().optional(),\n  closed_at: z.string().nullable().optional(),\n  source: z.enum(['internal', 'portal']).nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  /** This task's own entries, in raw minutes. */\n  ownMinutes: z.number().int().optional(),\n  /** The inclusive rollup: own entries plus every live child's (D-2). */\n  loggedMinutes: z.number().int().optional(),\n  /** Live children only \u2014 soft-deleted subtasks are not counted. */\n  childCount: z.number().int().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeTask',\n  pluralName: 'Time Tasks',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(taskListItemSchema),\n  create: {\n    schema: staffTimeTaskCreateSchema,\n    description:\n      'Creates a task. Only `title` is required beyond scoping and `timeProjectId`: the task lands on the project default column with the creator assigned unless the request says otherwise. Supplying `parentTaskId` creates a subtask; a parent that is itself a subtask is refused with 400 subtask_depth_exceeded.',\n  },\n  update: {\n    schema: staffTimeTaskUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Updates a task. Re-parenting under a subtask, or turning a task that already has subtasks into one, is refused with 400 subtask_depth_exceeded; moving a task to another project is refused with 400 task_project_move_unsupported. Moving into a done column stamps closed_at, moving out clears it.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Soft-deletes a task. Deleting a parent soft-deletes its subtasks in the same transaction; time entries keep pointing at the deleted task so closed reports still resolve their labels.',\n  },\n})\n"],
+  "mappings": "AAwBA,SAAS,SAAS;AAElB,SAAS,qBAAmC;AAC5C,SAAS,+BAA+B;AACxC,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB,eAAe,qBAAqB,wBAAwB;AACzF,SAAS,2BAA2B,iCAAiC;AACrE,SAAS,+BAA+B;AACxC,SAAS,gCAAgC;AACzC,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uBAAuB,CAAC;AAEhF,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,OAAO;AAAA,EACP,aAAa;AAAA,EACb,0BAA0B;AAAA,EAC1B,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC7E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,EACxB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,QAAQ,EAAE,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,SAAS;AAAA,EAChD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,cAAc,EAAE,KAAK,CAAC,YAAY,eAAe,UAAU,CAAC,EAAE,SAAS;AAAA,EACvE,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAQf,MAAM,gBAAgB;AASf,MAAM,8BAA8B;AAO3C,MAAM,iCAAiC,oBAAI,QAAiB;AAErD,SAAS,wBAAwB,SAAkC,KAAkC;AAC1G,MAAI,IAAI,WAAW,+BAA+B,IAAI,IAAI,OAAO,EAAG,SAAQ,gBAAgB;AAC9F;AAEA,SAAS,aAAa,SAA0B,MAA0B;AACxE,MAAI,YAAY,KAAM,QAAO;AAC7B,QAAM,UAAU,IAAI,IAAI,IAAI;AAC5B,SAAO,QAAQ,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC/C;AAEA,SAAS,YAAY,OAAiC;AACpD,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO;AACnE,QAAM,MAAM,MACT,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,SAAO,IAAI,SAAS,IAAI,MAAM,CAAC;AACjC;AAaA,eAAe,sBAAsB,KAAc,QAAqC;AACtF,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,CAAC;AAC1C,MAAI;AACF,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,OAAO,MAAM,GAAG;AAAA,MACpB;AAAA,MACA,EAAE,OAAO,EAAE,KAAK,OAAO,GAAG,UAAU,eAAe;AAAA,MACnD,EAAE,QAAQ,CAAC,UAAU,OAAO,EAAE;AAAA,IAChC;AACA,UAAM,OAAO,oBAAI,IAAyB;AAC1C,eAAW,OAAO,MAAM;AACtB,YAAM,SAAS,IAAI;AACnB,UAAI,CAAC,OAAQ;AACb,YAAM,SAAS,KAAK,IAAI,MAAM,KAAK,oBAAI,IAAY;AACnD,aAAO,IAAI,IAAI,KAAK;AACpB,WAAK,IAAI,QAAQ,MAAM;AAAA,IACzB;AACA,UAAM,WAAW,IAAI,IAAI,MAAM,EAAE;AACjC,WAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,KAAK,QAAQ,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,MAAM,MAAM;AAAA,EACjG,SAAS,KAAK;AACZ,WAAO,MAAM,uDAAuD,EAAE,IAAI,CAAC;AAC3E,wBAAoB,GAAG,YAAY,KAAK,EAAE,QAAQ,SAAS,MAAM,+BAA+B,CAAC;AACjG,WAAO,CAAC;AAAA,EACV;AACF;AAYA,eAAe,yBAAyB,KAAc,UAAoD;AACxG,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,CAAC;AAC1C,MAAI;AACF,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,QAAiC,EAAE,UAAU,gBAAgB,WAAW,KAAK;AACnF,QAAI,SAAS,gBAAiB,OAAM,gBAAgB,SAAS;AAC7D,QAAI,SAAS,iBAAkB,OAAM,mBAAmB,EAAE,QAAQ,GAAG,kBAAkB,SAAS,gBAAgB,CAAC,IAAI;AACrH,QAAI,SAAS,kBAAmB,OAAM,eAAe,EAAE,KAAK,KAAK;AACjE,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,CAAC,QAAQ,GAAG,OAAO,8BAA8B,GAAG,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,MAC7F,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,QAAI,KAAK,SAAS,+BAA+B,IAAI,QAAS,gCAA+B,IAAI,IAAI,OAAO;AAC5G,WAAO,MAAM,KAAK,IAAI,IAAI,KAAK,MAAM,GAAG,2BAA2B,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;AAAA,EAChG,SAAS,KAAK;AACZ,WAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAC/E,wBAAoB,GAAG,YAAY,KAAK,EAAE,QAAQ,SAAS,MAAM,mCAAmC,CAAC;AACrG,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,gCACb,KACA,cACmB;AACnB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,CAAC;AAC1C,MAAI;AACF,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,QAAiC,EAAE,UAAU,gBAAgB,WAAW,KAAK;AACnF,QAAI,iBAAiB,WAAY,OAAM,SAAS;AAAA,aACvC,iBAAiB,WAAY,QAAO,OAAO,OAAO,EAAE,QAAQ,OAAO,WAAW,KAAK,CAAC;AAAA,QACxF,QAAO,OAAO,OAAO,EAAE,QAAQ,OAAO,WAAW,MAAM,CAAC;AAC7D,UAAM,OAAO,MAAM,GAAG,KAAK,qBAAqB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzE,WAAO,KAAK,IAAI,CAAC,QAAQ,IAAI,EAAE;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,MAAM,iEAAiE,EAAE,IAAI,CAAC;AACrF,wBAAoB,GAAG,YAAY,KAAK,EAAE,QAAQ,SAAS,MAAM,yCAAyC,CAAC;AAC3G,WAAO,CAAC;AAAA,EACV;AACF;AAMA,eAAsB,qBACpB,OACA,KACkC;AAClC,QAAM,UAAmC,CAAC;AAE1C,MAAI,YAA6B;AACjC,aAAW,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,GAAG;AACvC,UAAM,SAAS,YAAY,GAAG;AAC9B,QAAI,WAAW,KAAM;AACrB,gBAAY,aAAa,WAAW,MAAM;AAAA,EAC5C;AAEA,QAAM,kBAAkB,YAAY,MAAM,MAAM;AAChD,MAAI,oBAAoB,MAAM;AAC5B,UAAM,SAAS,gBAAgB,WAAW,IAAI,CAAC,IAAI,MAAM,sBAAsB,KAAK,eAAe;AACnG,gBAAY,aAAa,WAAW,MAAM;AAAA,EAC5C;AAEA,QAAM,kBAAkB,OAAO,MAAM,oBAAoB,WAAW,MAAM,gBAAgB,KAAK,IAAI;AACnG,QAAM,mBAAmB,mBAAmB,MAAM,gBAAgB,KAAK;AACvE,QAAM,oBAAoB,iBAAiB,MAAM,iBAAiB;AAClE,MAAI,mBAAmB,oBAAoB,mBAAmB;AAC5D,UAAM,iBAAiB,MAAM,yBAAyB,KAAK;AAAA,MACzD,iBAAiB,mBAAmB;AAAA,MACpC,kBAAkB,oBAAoB;AAAA,MACtC;AAAA,IACF,CAAC;AACD,gBAAY,aAAa,WAAW,cAAc;AAAA,EACpD;AAEA,QAAM,SAAS,MAAM,yBAAyB,GAAG;AACjD,MAAI,aAA8B;AAClC,MAAI,CAAC,OAAO,cAAc;AACxB,iBAAa,CAAC,GAAG,OAAO,UAAU;AAClC,QAAI,OAAO,MAAM,kBAAkB,YAAY,MAAM,cAAc,KAAK,EAAE,SAAS,GAAG;AACpF,YAAM,YAAY,MAAM,cAAc,KAAK;AAC3C,mBAAa,WAAW,OAAO,CAAC,OAAO,OAAO,SAAS;AAAA,IACzD;AACA,QAAI,WAAW,WAAW,GAAG;AAG3B,cAAQ,EAAE,eAAe,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACpD,aAAO;AAAA,IACT;AACA,YAAQ,EAAE,eAAe,IAAI,EAAE,KAAK,WAAW;AAAA,EACjD,WAAW,OAAO,MAAM,kBAAkB,YAAY,MAAM,cAAc,KAAK,EAAE,SAAS,GAAG;AAC3F,YAAQ,EAAE,eAAe,IAAI,MAAM,cAAc,KAAK;AAAA,EACxD;AAEA,MAAI,cAAc,MAAM;AACtB,QAAI,UAAU,WAAW,GAAG;AAC1B,cAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACvC,aAAO;AAAA,IACT;AACA,YAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,UAAU;AAAA,EACnC;AAEA,MAAI,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,KAAK,EAAE,SAAS,GAAG;AAClF,YAAQ,EAAE,cAAc,IAAI,MAAM,aAAa,KAAK;AAAA,EACtD,WAAW,MAAM,cAAc;AAC7B,UAAM,YAAY,MAAM,gCAAgC,KAAK,MAAM,YAAY;AAC/E,YAAQ,EAAE,cAAc,IAAI,EAAE,KAAK,UAAU,SAAS,IAAI,YAAY,CAAC,aAAa,EAAE;AAAA,EACxF;AACA,MAAI,OAAO,MAAM,0BAA0B,YAAY,MAAM,sBAAsB,KAAK,EAAE,SAAS,GAAG;AACpG,YAAQ,EAAE,wBAAwB,IAAI,MAAM,sBAAsB,KAAK;AAAA,EACzE,WAAW,iBAAiB,MAAM,UAAU,GAAG;AAC7C,YAAQ,EAAE,wBAAwB,IAAI,EAAE,KAAK,KAAK;AAAA,EACpD;AACA,MAAI,MAAM,OAAQ,SAAQ,EAAE,MAAM,IAAI,MAAM;AAC5C,MAAI,MAAM,WAAY,SAAQ,EAAE,WAAW,IAAI,MAAM;AACrD,MAAI,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,KAAK,EAAE,SAAS,GAAG;AAElF,YAAQ,EAAE,cAAc,IAAI,MAAM,aAAa,KAAK;AAAA,EACtD,WAAW,iBAAiB,MAAM,YAAY,GAAG;AAE/C,YAAQ,EAAE,cAAc,IAAI,EAAE,KAAK,KAAK;AAAA,EAC1C;AAEA,QAAM,OAAO,mBAAmB,MAAM,CAAC;AACvC,MAAI,MAAM;AAUR,YAAQ,EAAE,KAAK,IAAI,EAAE,QAAQ,IAAI,kBAAkB,IAAI,CAAC,IAAI;AAAA,EAC9D;AAOA,QAAM,gBAAgB,mBAAmB,MAAM,SAAS;AACxD,MAAI,eAAe;AACjB,YAAQ,EAAE,SAAS,IAAI,EAAE,QAAQ,GAAG,kBAAkB,aAAa,CAAC,IAAI;AAAA,EAC1E;AAEA,SAAO;AACT;AAEO,MAAM,iBAAiB;AAAA,EAC5B,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AACJ;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,EAAE,YAAY,wBAAwB;AAAA,EAC/C,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,CAAC,GAAG,cAAc;AAAA;AAAA;AAAA,IAG1B,aAAa,EAAE,OAAO,EAAE,UAAU,KAAK,MAAM;AAAA,IAC7C,mBAAmB,EAAE;AAAA,IACrB,cAAc;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,OAAO,EAAE;AAAA,MACT,WAAW,EAAE;AAAA,MACb,gBAAgB,EAAE;AAAA,MAClB,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,UAAU,EAAE;AAAA,IACd;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA,WAAW,EAAE,UAAU,wBAAwB;AAAA,EAC/C,OAAO;AAAA,IACL,WAAW,CAAC,SAAS,QAAQ,wBAAwB,SAAS,GAAG;AAAA,EACnE;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW,wBAAwB;AAAA,MACnC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,2BAA2B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACrF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,UAAU,KAAK;AAAA,MACxD,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,wBAAwB;AAAA,MACnC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,2BAA2B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACrF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,wBAAwB;AAAA,MACnC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAEpB,MAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,0BAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,QAAQ,EAAE,KAAK,CAAC,YAAY,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3D,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEtC,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACxC,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,kBAAkB;AAAA,EACpE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aACE;AAAA,EACJ;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AACF,CAAC;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-projects/[id]/employees/route.js

@@ -29,6 +29,7 @@ const F = {
   status: "status",
   assigned_start_date: "assigned_start_date",
   assigned_end_date: "assigned_end_date",
+  is_assigner: "is_assigner",
   created_at: "created_at",
   updated_at: "updated_at",
   deleted_at: "deleted_at"
@@ -79,6 +80,7 @@ const crud = makeCrudRoute({
       F.status,
       F.assigned_start_date,
       F.assigned_end_date,
+      F.is_assigner,
       F.created_at,
       F.updated_at
     ],
@@ -182,6 +184,7 @@ const projectMemberListItemSchema = z.object({
   status: z.string().nullable().optional(),
   assigned_start_date: z.string().nullable().optional(),
   assigned_end_date: z.string().nullable().optional(),
+  is_assigner: z.boolean().nullable().optional(),
   created_at: z.string().nullable().optional(),
   updated_at: z.string().nullable().optional()
 });

package/dist/modules/staff/api/timesheets/time-projects/[id]/employees/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-projects/%5Bid%5D/employees/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeProjectMemberCrudEvents } from '../../../../../lib/crud'\nimport { emitStaffEvent } from '../../../../../events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { StaffTimeProjectMember } from '../../../../../data/entities'\nimport { staffTimeProjectMemberAssignSchema, staffTimeProjectMemberUpdateSchema } from '../../../../../data/validators'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../../../openapi'\n\nfunction extractProjectIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-projects\\/([^/]+)\\/employees/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  time_project_id: 'time_project_id',\n  staff_member_id: 'staff_member_id',\n  role: 'role',\n  status: 'status',\n  assigned_start_date: 'assigned_start_date',\n  assigned_end_date: 'assigned_end_date',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    timeProjectId: z.string().uuid().optional(),\n    status: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-projects/employees' })\n\nfunction readMemberId(result: unknown): string | null {\n  if (!result || typeof result !== 'object') return null\n  const value = (result as { timeProjectMemberId?: unknown }).timeProjectMemberId\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeProjectMember,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeProjectMemberCrudEvents,\n  indexer: { entityType: 'staff:staff_time_project_member' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_project_member',\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.time_project_id,\n      F.staff_member_id,\n      F.role,\n      F.status,\n      F.assigned_start_date,\n      F.assigned_end_date,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      assignedStartDate: F.assigned_start_date,\n    },\n    buildFilters: async (query, ctx) => {\n      const filters: Record<string, unknown> = {}\n      const projectId = query.timeProjectId ?? extractProjectIdFromUrl(ctx?.request) ?? null\n      if (typeof projectId === 'string' && projectId.trim().length > 0) {\n        filters[F.time_project_id] = projectId.trim()\n      }\n      if (typeof query.status === 'string' && query.status.trim().length > 0) {\n        filters[F.status] = query.status.trim()\n      }\n      return filters\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.timesheets.time_project_members.assign',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const projectId = extractProjectIdFromUrl(ctx?.request) ?? null\n        const body = { ...raw, timeProjectId: raw?.timeProjectId ?? projectId }\n        return parseScopedCommandInput(staffTimeProjectMemberAssignSchema, body, ctx, translate)\n      },\n      // The assignment IS the grant: `timeTrackingAccessResolver` reads exactly this\n      // table, so a module wiring an approval workflow onto `access-requests` learns\n      // the outcome here rather than by polling the membership list.\n      response: ({ result, ctx }) => {\n        const timeProjectMemberId = readMemberId(result)\n        if (timeProjectMemberId) {\n          void emitStaffEvent('staff.timesheets.time_project_access.granted', {\n            id: timeProjectMemberId,\n            tenantId: ctx.auth?.tenantId ?? null,\n            organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n          }, { persistent: true }).catch((err) => {\n            logger.error('staff.timesheets emit time_project_access.granted failed', { err })\n          })\n        }\n        return { id: timeProjectMemberId }\n      },\n      status: 201,\n    },\n    // Re-dating an assignment (D-12) is an update of the existing row, not a\n    // replacement pair, so the audit trail reads as a change to\n    // `assignedEndDate`. `timeProjectId` comes from the URL, never from the\n    // body: the command uses it to refuse a membership id belonging to another\n    // project. Guard wiring, tenant/org scoping and the optimistic-lock header\n    // come from `makeCrudRoute`'s command path \u2014 this route MUST NOT hand-roll\n    // them (see `runRouteMutationGuards` for the non-factory equivalent).\n    update: {\n      commandId: 'staff.timesheets.time_project_members.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id =\n          raw?.id ??\n          (ctx.request ? new URL(ctx.request.url).searchParams.get('id') : null)\n        if (!id) {\n          throw new CrudHttpError(400, {\n            error: translate('staff.timesheets.errors.memberRequired', 'Time project member id is required.'),\n          })\n        }\n        const parsed = staffTimeProjectMemberUpdateSchema.parse({ ...raw, id })\n        const projectId = extractProjectIdFromUrl(ctx?.request)\n        return projectId ? { ...parsed, timeProjectId: projectId } : parsed\n      },\n      response: ({ result }) => ({ id: result?.timeProjectMemberId ?? null }),\n    },\n    delete: {\n      commandId: 'staff.timesheets.time_project_members.unassign',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id =\n          parsed?.body?.id ??\n          parsed?.id ??\n          parsed?.query?.id ??\n          (ctx.request ? new URL(ctx.request.url).searchParams.get('id') : null)\n        if (!id) {\n          throw new CrudHttpError(400, {\n            error: translate('staff.timesheets.errors.memberRequired', 'Time project member id is required.'),\n          })\n        }\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst projectMemberListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  staff_member_id: z.string().uuid().nullable().optional(),\n  role: z.string().nullable().optional(),\n  status: z.string().nullable().optional(),\n  assigned_start_date: z.string().nullable().optional(),\n  assigned_end_date: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeProjectMember',\n  pluralName: 'Time Project Members',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(projectMemberListItemSchema),\n  create: {\n    schema: staffTimeProjectMemberAssignSchema,\n    description: 'Assigns an employee to a time project.',\n  },\n  update: {\n    schema: staffTimeProjectMemberUpdateSchema,\n    responseSchema: z.object({ id: z.string().uuid().nullable() }),\n    description: 'Updates an existing assignment (role, status, assignment end date) without unassigning the employee.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Unassigns an employee from a time project.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,wCAAwC;AACjD,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AACvC,SAAS,oCAAoC,0CAA0C;AACvF,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,SAAS,wBAAwB,SAAkC;AACjE,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,qCAAqC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAAA,EAC9E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EACjF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EAChF,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AACrF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAEf,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,yCAAyC,CAAC;AAElG,SAAS,aAAa,QAAgC;AACpD,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,QAAS,OAA6C;AAC5D,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,EAAE,YAAY,kCAAkC;AAAA,EACzD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,mBAAmB,EAAE;AAAA,IACvB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,UAAmC,CAAC;AAC1C,YAAM,YAAY,MAAM,iBAAiB,wBAAwB,KAAK,OAAO,KAAK;AAClF,UAAI,OAAO,cAAc,YAAY,UAAU,KAAK,EAAE,SAAS,GAAG;AAChE,gBAAQ,EAAE,eAAe,IAAI,UAAU,KAAK;AAAA,MAC9C;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,KAAK,EAAE,SAAS,GAAG;AACtE,gBAAQ,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK;AAAA,MACxC;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,YAAY,wBAAwB,KAAK,OAAO,KAAK;AAC3D,cAAM,OAAO,EAAE,GAAG,KAAK,eAAe,KAAK,iBAAiB,UAAU;AACtE,eAAO,wBAAwB,oCAAoC,MAAM,KAAK,SAAS;AAAA,MACzF;AAAA;AAAA;AAAA;AAAA,MAIA,UAAU,CAAC,EAAE,QAAQ,IAAI,MAAM;AAC7B,cAAM,sBAAsB,aAAa,MAAM;AAC/C,YAAI,qBAAqB;AACvB,eAAK,eAAe,gDAAgD;AAAA,YAClE,IAAI;AAAA,YACJ,UAAU,IAAI,MAAM,YAAY;AAAA,YAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,UACnE,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,mBAAO,MAAM,4DAA4D,EAAE,IAAI,CAAC;AAAA,UAClF,CAAC;AAAA,QACH;AACA,eAAO,EAAE,IAAI,oBAAoB;AAAA,MACnC;AAAA,MACA,QAAQ;AAAA,IACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KACJ,KAAK,OACJ,IAAI,UAAU,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,IAAI,IAAI;AACnE,YAAI,CAAC,IAAI;AACP,gBAAM,IAAI,cAAc,KAAK;AAAA,YAC3B,OAAO,UAAU,0CAA0C,qCAAqC;AAAA,UAClG,CAAC;AAAA,QACH;AACA,cAAM,SAAS,mCAAmC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC;AACtE,cAAM,YAAY,wBAAwB,KAAK,OAAO;AACtD,eAAO,YAAY,EAAE,GAAG,QAAQ,eAAe,UAAU,IAAI;AAAA,MAC/D;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,uBAAuB,KAAK;AAAA,IACvE;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KACJ,QAAQ,MAAM,MACd,QAAQ,MACR,QAAQ,OAAO,OACd,IAAI,UAAU,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,IAAI,IAAI;AACnE,YAAI,CAAC,IAAI;AACP,gBAAM,IAAI,cAAc,KAAK;AAAA,YAC3B,OAAO,UAAU,0CAA0C,qCAAqC;AAAA,UAClG,CAAC;AAAA,QACH;AACA,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,2BAA2B;AAAA,EAC7E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAAA,IAC7D,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeProjectMemberCrudEvents } from '../../../../../lib/crud'\nimport { emitStaffEvent } from '../../../../../events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { StaffTimeProjectMember } from '../../../../../data/entities'\nimport { staffTimeProjectMemberAssignSchema, staffTimeProjectMemberUpdateSchema } from '../../../../../data/validators'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../../../openapi'\n\nfunction extractProjectIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-projects\\/([^/]+)\\/employees/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  time_project_id: 'time_project_id',\n  staff_member_id: 'staff_member_id',\n  role: 'role',\n  status: 'status',\n  assigned_start_date: 'assigned_start_date',\n  assigned_end_date: 'assigned_end_date',\n  is_assigner: 'is_assigner',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    timeProjectId: z.string().uuid().optional(),\n    status: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-projects/employees' })\n\nfunction readMemberId(result: unknown): string | null {\n  if (!result || typeof result !== 'object') return null\n  const value = (result as { timeProjectMemberId?: unknown }).timeProjectMemberId\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeProjectMember,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeProjectMemberCrudEvents,\n  indexer: { entityType: 'staff:staff_time_project_member' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_project_member',\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.time_project_id,\n      F.staff_member_id,\n      F.role,\n      F.status,\n      F.assigned_start_date,\n      F.assigned_end_date,\n      F.is_assigner,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      assignedStartDate: F.assigned_start_date,\n    },\n    buildFilters: async (query, ctx) => {\n      const filters: Record<string, unknown> = {}\n      const projectId = query.timeProjectId ?? extractProjectIdFromUrl(ctx?.request) ?? null\n      if (typeof projectId === 'string' && projectId.trim().length > 0) {\n        filters[F.time_project_id] = projectId.trim()\n      }\n      if (typeof query.status === 'string' && query.status.trim().length > 0) {\n        filters[F.status] = query.status.trim()\n      }\n      return filters\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.timesheets.time_project_members.assign',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const projectId = extractProjectIdFromUrl(ctx?.request) ?? null\n        const body = { ...raw, timeProjectId: raw?.timeProjectId ?? projectId }\n        return parseScopedCommandInput(staffTimeProjectMemberAssignSchema, body, ctx, translate)\n      },\n      // The assignment IS the grant: `timeTrackingAccessResolver` reads exactly this\n      // table, so a module wiring an approval workflow onto `access-requests` learns\n      // the outcome here rather than by polling the membership list.\n      response: ({ result, ctx }) => {\n        const timeProjectMemberId = readMemberId(result)\n        if (timeProjectMemberId) {\n          void emitStaffEvent('staff.timesheets.time_project_access.granted', {\n            id: timeProjectMemberId,\n            tenantId: ctx.auth?.tenantId ?? null,\n            organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n          }, { persistent: true }).catch((err) => {\n            logger.error('staff.timesheets emit time_project_access.granted failed', { err })\n          })\n        }\n        return { id: timeProjectMemberId }\n      },\n      status: 201,\n    },\n    // Re-dating an assignment (D-12) is an update of the existing row, not a\n    // replacement pair, so the audit trail reads as a change to\n    // `assignedEndDate`. `timeProjectId` comes from the URL, never from the\n    // body: the command uses it to refuse a membership id belonging to another\n    // project. Guard wiring, tenant/org scoping and the optimistic-lock header\n    // come from `makeCrudRoute`'s command path \u2014 this route MUST NOT hand-roll\n    // them (see `runRouteMutationGuards` for the non-factory equivalent).\n    update: {\n      commandId: 'staff.timesheets.time_project_members.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id =\n          raw?.id ??\n          (ctx.request ? new URL(ctx.request.url).searchParams.get('id') : null)\n        if (!id) {\n          throw new CrudHttpError(400, {\n            error: translate('staff.timesheets.errors.memberRequired', 'Time project member id is required.'),\n          })\n        }\n        const parsed = staffTimeProjectMemberUpdateSchema.parse({ ...raw, id })\n        const projectId = extractProjectIdFromUrl(ctx?.request)\n        return projectId ? { ...parsed, timeProjectId: projectId } : parsed\n      },\n      response: ({ result }) => ({ id: result?.timeProjectMemberId ?? null }),\n    },\n    delete: {\n      commandId: 'staff.timesheets.time_project_members.unassign',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id =\n          parsed?.body?.id ??\n          parsed?.id ??\n          parsed?.query?.id ??\n          (ctx.request ? new URL(ctx.request.url).searchParams.get('id') : null)\n        if (!id) {\n          throw new CrudHttpError(400, {\n            error: translate('staff.timesheets.errors.memberRequired', 'Time project member id is required.'),\n          })\n        }\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst projectMemberListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  staff_member_id: z.string().uuid().nullable().optional(),\n  role: z.string().nullable().optional(),\n  status: z.string().nullable().optional(),\n  assigned_start_date: z.string().nullable().optional(),\n  assigned_end_date: z.string().nullable().optional(),\n  is_assigner: z.boolean().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeProjectMember',\n  pluralName: 'Time Project Members',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(projectMemberListItemSchema),\n  create: {\n    schema: staffTimeProjectMemberAssignSchema,\n    description: 'Assigns an employee to a time project.',\n  },\n  update: {\n    schema: staffTimeProjectMemberUpdateSchema,\n    responseSchema: z.object({ id: z.string().uuid().nullable() }),\n    description: 'Updates an existing assignment (role, status, assignment end date) without unassigning the employee.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Unassigns an employee from a time project.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,wCAAwC;AACjD,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AACvC,SAAS,oCAAoC,0CAA0C;AACvF,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,SAAS,wBAAwB,SAAkC;AACjE,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,qCAAqC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAAA,EAC9E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EACjF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EAChF,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AACrF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAEf,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,yCAAyC,CAAC;AAElG,SAAS,aAAa,QAAgC;AACpD,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,QAAS,OAA6C;AAC5D,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,EAAE,YAAY,kCAAkC;AAAA,EACzD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,mBAAmB,EAAE;AAAA,IACvB;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,UAAmC,CAAC;AAC1C,YAAM,YAAY,MAAM,iBAAiB,wBAAwB,KAAK,OAAO,KAAK;AAClF,UAAI,OAAO,cAAc,YAAY,UAAU,KAAK,EAAE,SAAS,GAAG;AAChE,gBAAQ,EAAE,eAAe,IAAI,UAAU,KAAK;AAAA,MAC9C;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,KAAK,EAAE,SAAS,GAAG;AACtE,gBAAQ,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK;AAAA,MACxC;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,YAAY,wBAAwB,KAAK,OAAO,KAAK;AAC3D,cAAM,OAAO,EAAE,GAAG,KAAK,eAAe,KAAK,iBAAiB,UAAU;AACtE,eAAO,wBAAwB,oCAAoC,MAAM,KAAK,SAAS;AAAA,MACzF;AAAA;AAAA;AAAA;AAAA,MAIA,UAAU,CAAC,EAAE,QAAQ,IAAI,MAAM;AAC7B,cAAM,sBAAsB,aAAa,MAAM;AAC/C,YAAI,qBAAqB;AACvB,eAAK,eAAe,gDAAgD;AAAA,YAClE,IAAI;AAAA,YACJ,UAAU,IAAI,MAAM,YAAY;AAAA,YAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,UACnE,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,mBAAO,MAAM,4DAA4D,EAAE,IAAI,CAAC;AAAA,UAClF,CAAC;AAAA,QACH;AACA,eAAO,EAAE,IAAI,oBAAoB;AAAA,MACnC;AAAA,MACA,QAAQ;AAAA,IACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KACJ,KAAK,OACJ,IAAI,UAAU,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,IAAI,IAAI;AACnE,YAAI,CAAC,IAAI;AACP,gBAAM,IAAI,cAAc,KAAK;AAAA,YAC3B,OAAO,UAAU,0CAA0C,qCAAqC;AAAA,UAClG,CAAC;AAAA,QACH;AACA,cAAM,SAAS,mCAAmC,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC;AACtE,cAAM,YAAY,wBAAwB,KAAK,OAAO;AACtD,eAAO,YAAY,EAAE,GAAG,QAAQ,eAAe,UAAU,IAAI;AAAA,MAC/D;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,uBAAuB,KAAK;AAAA,IACvE;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KACJ,QAAQ,MAAM,MACd,QAAQ,MACR,QAAQ,OAAO,OACd,IAAI,UAAU,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,IAAI,IAAI;AACnE,YAAI,CAAC,IAAI;AACP,gBAAM,IAAI,cAAc,KAAK;AAAA,YAC3B,OAAO,UAAU,0CAA0C,qCAAqC;AAAA,UAClG,CAAC;AAAA,QACH;AACA,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAClD,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,2BAA2B;AAAA,EAC7E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAAA,IAC7D,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-projects/route.js

@@ -43,6 +43,7 @@ const F = {
   budget_kind: "budget_kind",
   budget_value: "budget_value",
   budget_warn_at_percent: "budget_warn_at_percent",
+  default_assignee_staff_member_id: "default_assignee_staff_member_id",
   created_at: "created_at",
   updated_at: "updated_at",
   deleted_at: "deleted_at"
@@ -213,6 +214,7 @@ const timeProjectListFields = [
   F.budget_kind,
   F.budget_value,
   F.budget_warn_at_percent,
+  F.default_assignee_staff_member_id,
   F.created_at,
   F.updated_at
 ];
@@ -407,6 +409,7 @@ const timeProjectListItemSchema = z.object({
   budget_kind: z.string().nullable().optional(),
   budget_value: z.union([z.string(), z.number()]).nullable().optional(),
   budget_warn_at_percent: z.number().int().nullable().optional(),
+  default_assignee_staff_member_id: z.string().uuid().nullable().optional(),
   created_at: z.string().nullable().optional(),
   updated_at: z.string().nullable().optional(),
   entryCount: z.number().int().optional(),

package/dist/modules/staff/api/timesheets/time-projects/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/time-projects/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeProjectCrudEvents } from '../../../lib/crud'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isIdsParamProvided, parseIdsParam } from '@open-mercato/shared/lib/crud/ids'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeProject, StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { staffTimeProjectCreateSchema, staffTimeProjectUpdateSchema } from '../../../data/validators'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess, type ProjectAccess } from '../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { buildSqlInClause } from '../../../lib/time-tracking/sqlInClause'\nimport { sanitizeSearchTerm, parseBooleanFlag } from '../../helpers'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\nimport { E } from '#generated/entities.ids.generated'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-projects' })\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  name: 'name',\n  code: 'code',\n  description: 'description',\n  project_type: 'project_type',\n  color: 'color',\n  status: 'status',\n  customer_id: 'customer_id',\n  customer_snapshot: 'customer_snapshot',\n  owner_user_id: 'owner_user_id',\n  cost_center: 'cost_center',\n  start_date: 'start_date',\n  hourly_rate: 'hourly_rate',\n  currency_code: 'currency_code',\n  billable_by_default: 'billable_by_default',\n  budget_kind: 'budget_kind',\n  budget_value: 'budget_value',\n  budget_warn_at_percent: 'budget_warn_at_percent',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    q: z.string().optional(),\n    ids: z.string().optional(),\n    projectType: z.string().optional(),\n    status: z.string().optional(),\n    customerId: z.string().uuid().optional(),\n    mine: z.string().optional(),\n    include: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\n/**\n * Discriminator returned with the 404 a project-scoped read answers when the\n * caller may not see the record. It is the whole body besides a generic error\n * string: naming the project or the customer here would confirm the resource to\n * someone who has no right to it (screen 17 note 1).\n *\n * Denied and genuinely-missing are deliberately indistinguishable for a caller\n * without `staff.timesheets.projects.manage` \u2014 both answer this same 404 \u2014 so the\n * endpoint cannot be used to enumerate which project ids exist. The discriminator\n * only tells the client \"you are not a member\", which is what screen 17 needs to\n * render the request-access affordance; a manager still gets a plain 200-empty\n * for an id that really does not exist.\n */\nexport const NO_PROJECT_ACCESS_REASON = 'no_project_access'\n\n/**\n * Non-UUID sentinel used as the \"match nothing\" id filter. Kept in the shape the\n * `mine=true` branch has always used so both narrowing paths behave identically.\n */\nconst IMPOSSIBLE_PROJECT_ID = '00000000-0000-0000-0000-000000000000'\n\nconst DENIED_ACCESS: ProjectAccess = { canManageAll: false, projectIds: [], staffMemberId: null }\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n  userHasAllFeatures?: (\n    userId: string,\n    required: string[],\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\n/**\n * Both entry points into a single request \u2014 the denial probe on `GET` and the\n * list narrowing in `buildFilters` \u2014 must agree on what the caller may see, and\n * neither should pay for the other's lookups. The resolved access is therefore\n * memoised per `Request`; the factory hands `buildFilters` the same object the\n * route received.\n */\nconst accessByRequest = new WeakMap<Request, Promise<ProjectAccess>>()\n\nasync function resolveGrantedFeatures(\n  container: ContainerLike,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<string[]> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getGrantedFeatures) return []\n    return (await rbac.getGrantedFeatures(userId, scope)) ?? []\n  } catch {\n    // Fail closed: an unreadable grant set is no grant set, so the caller falls\n    // back to their project memberships instead of being treated as a manager.\n    return []\n  }\n}\n\nasync function resolveUnrestricted(\n  container: ContainerLike,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<boolean> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.userHasAllFeatures) return false\n    return (await rbac.userHasAllFeatures(userId, [MANAGE_PROJECTS_FEATURE], scope)) === true\n  } catch {\n    // Fail closed, exactly as the grant lookup does.\n    return false\n  }\n}\n\nasync function resolveAssignmentGraceDays(\n  container: ContainerLike,\n  tenantId: string,\n): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<ProjectAccess> {\n  if (!tenantId || !organizationId) return { ...DENIED_ACCESS }\n  const scope = { tenantId, organizationId }\n  try {\n    // One lookup, one authority, and a failure that says so. The two-call version\n    // this replaces rescued `canManageAll` but still fed a possibly-empty array\n    // into `userFeatures`, which the guards downstream read.\n    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope)\n    const em = container.resolve('em') as EntityManager\n    return await resolveProjectAccess({\n      em: em.fork(),\n      userId,\n      tenantId,\n      organizationId,\n      canManageAll: access.allowed,\n      userFeatures: access.grantedFeatures,\n      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n    })\n  } catch (err) {\n    logger.error('staff.timesheets.time-projects access resolution failed', { err })\n    return { ...DENIED_ACCESS }\n  }\n}\n\nfunction resolveRequestProjectAccess(\n  request: Request | undefined,\n  load: () => Promise<ProjectAccess>,\n): Promise<ProjectAccess> {\n  if (!request) return load()\n  const cached = accessByRequest.get(request)\n  if (cached) return cached\n  const pending = load()\n  accessByRequest.set(request, pending)\n  return pending\n}\n\nfunction resolveCtxScope(ctx: CrudCtx): { tenantId: string | null; organizationId: string | null } {\n  return {\n    tenantId: ctx.auth?.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n  }\n}\n\nasync function resolveListProjectAccess(ctx: CrudCtx): Promise<ProjectAccess> {\n  const { tenantId, organizationId } = resolveCtxScope(ctx)\n  return resolveRequestProjectAccess(ctx.request, () =>\n    loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId),\n  )\n}\n\nasync function resolveCallerAssignedProjectIds(\n  em: EntityManager,\n  userId: string,\n  tenantId: string,\n  organizationId: string,\n): Promise<string[]> {\n  const scopeCtx = { tenantId, organizationId }\n  const staffMember = await findOneWithDecryption(\n    em.fork(),\n    StaffTeamMember,\n    { userId, tenantId, organizationId, deletedAt: null },\n    {},\n    scopeCtx,\n  )\n  if (!staffMember) return []\n  const memberships = await em.fork().find(StaffTimeProjectMember, {\n    staffMemberId: staffMember.id,\n    tenantId,\n    organizationId,\n    status: 'active',\n    deletedAt: null,\n  })\n  return Array.from(new Set(memberships.map((m) => m.timeProjectId)))\n}\n\ntype ProjectEntryCountRow = {\n  time_project_id: string\n  entry_count: string | number\n  locked_entry_count: string | number\n}\n\ntype ProjectListItem = {\n  id?: unknown\n  entryCount?: number\n  lockedEntryCount?: number\n  currencyLocked?: boolean\n}\n\nfunction toCount(value: string | number | null | undefined): number {\n  const parsed = typeof value === 'number' ? value : Number(value ?? 0)\n  return Number.isFinite(parsed) ? parsed : 0\n}\n\n/**\n * D-3 read-side signal: currency is read-only once hours have been logged, so the\n * project list/detail response carries the reason alongside the value.\n * `currencyLocked` tells the form to render the field read-only behind the explicit\n * change action, `entryCount` names why, and `lockedEntryCount` says whether even\n * that action will be refused (entries frozen in a closed report).\n *\n * One grouped aggregate for the whole page \u2014 never a per-row count.\n */\nexport async function decorateProjectCurrencyLock(\n  items: ProjectListItem[],\n  em: EntityManager,\n  scope: { tenantId: string; organizationId: string },\n): Promise<void> {\n  const ids = Array.from(\n    new Set(items.map((item) => item.id).filter((value): value is string => typeof value === 'string' && value.length > 0)),\n  )\n  if (ids.length === 0) return\n\n  const projectIn = buildSqlInClause('time_project_id', ids)\n  const rows = (await em.getConnection().execute(\n    `\n      SELECT time_project_id,\n             COUNT(*)::bigint AS entry_count,\n             COUNT(locked_report_id)::bigint AS locked_entry_count\n      FROM staff_time_entries\n      WHERE tenant_id = ?\n        AND organization_id = ?\n        AND deleted_at IS NULL\n        AND ${projectIn.sql}\n      GROUP BY time_project_id\n    `,\n    [scope.tenantId, scope.organizationId, ...projectIn.params],\n  )) as ProjectEntryCountRow[]\n\n  const counts = new Map(rows.map((row) => [row.time_project_id, row]))\n  for (const item of items) {\n    const row = typeof item.id === 'string' ? counts.get(item.id) : undefined\n    const entryCount = toCount(row?.entry_count)\n    item.entryCount = entryCount\n    item.lockedEntryCount = toCount(row?.locked_entry_count)\n    item.currencyLocked = entryCount > 0\n  }\n}\n\n/**\n * The list projection doubles as the detail projection (the edit page re-reads this\n * route with `?id=`), so every column the project form round-trips has to be here.\n */\nexport const timeProjectListFields = [\n  F.id,\n  F.organization_id,\n  F.tenant_id,\n  F.name,\n  F.code,\n  F.description,\n  F.project_type,\n  F.color,\n  F.status,\n  F.customer_id,\n  F.customer_snapshot,\n  F.owner_user_id,\n  F.cost_center,\n  F.start_date,\n  F.hourly_rate,\n  F.currency_code,\n  F.billable_by_default,\n  F.budget_kind,\n  F.budget_value,\n  F.budget_warn_at_percent,\n  F.created_at,\n  F.updated_at,\n] as const\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeProject,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeProjectCrudEvents,\n  indexer: { entityType: 'staff:staff_time_project' },\n  enrichers: { entityId: 'staff:staff_time_project' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_project',\n    fields: [...timeProjectListFields],\n    decorateCustomFields: { entityIds: [E.staff.staff_time_project] },\n    sortFieldMap: {\n      name: F.name,\n      code: F.code,\n      status: F.status,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      startDate: F.start_date,\n    },\n    buildFilters: async (query, ctx) => {\n      const filters: Record<string, unknown> = {}\n      let narrowIds: string[] | null = null\n      if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n        narrowIds = query.ids\n          .split(',')\n          .map((value) => value.trim())\n          .filter((value) => value.length > 0)\n      }\n      if (parseBooleanFlag(query.mine) && ctx.auth) {\n        const em = ctx.container.resolve('em') as EntityManager\n        const tenantId = ctx.auth.tenantId ?? ''\n        const organizationId = ctx.selectedOrganizationId ?? ctx.auth.orgId ?? ''\n        const assigned = await resolveCallerAssignedProjectIds(\n          em,\n          ctx.auth.sub,\n          tenantId,\n          organizationId,\n        )\n        narrowIds = narrowIds\n          ? narrowIds.filter((id) => assigned.includes(id))\n          : assigned\n        if (narrowIds.length === 0) {\n          filters[F.id] = { $in: [IMPOSSIBLE_PROJECT_ID] }\n          return filters\n        }\n      }\n      // Every project-scoped read filters through the one resolver: a caller\n      // without `staff.timesheets.projects.manage` only ever sees the projects\n      // they are an active member of. A non-member gets no row at all \u2014 not a\n      // redacted one \u2014 so the customer and project name never leave the server.\n      const access = await resolveListProjectAccess(ctx)\n      if (!access.canManageAll) {\n        narrowIds = narrowIds\n          ? narrowIds.filter((id) => access.projectIds.includes(id))\n          : [...access.projectIds]\n        if (narrowIds.length === 0) {\n          filters[F.id] = { $in: [IMPOSSIBLE_PROJECT_ID] }\n          return filters\n        }\n      }\n      if (narrowIds && narrowIds.length > 0) {\n        filters[F.id] = { $in: narrowIds }\n      }\n      const term = sanitizeSearchTerm(query.q)\n      if (term) {\n        filters[F.name] = { $ilike: `%${escapeLikePattern(term)}%` }\n      }\n      if (typeof query.projectType === 'string' && query.projectType.trim().length > 0) {\n        filters[F.project_type] = query.projectType.trim()\n      }\n      if (typeof query.status === 'string' && query.status.trim().length > 0) {\n        filters[F.status] = query.status.trim()\n      }\n      if (typeof query.customerId === 'string' && query.customerId.trim().length > 0) {\n        filters[F.customer_id] = query.customerId.trim()\n      }\n      return filters\n    },\n  },\n  hooks: {\n    afterList: async (res, ctx) => {\n      const items = Array.isArray((res as { items?: unknown })?.items)\n        ? ((res as { items: ProjectListItem[] }).items)\n        : []\n      if (items.length === 0) return\n      const tenantId = ctx.auth?.tenantId ?? null\n      const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n      if (!tenantId || !organizationId) return\n      const em = ctx.container.resolve('em') as EntityManager\n      await decorateProjectCurrencyLock(items, em.fork(), { tenantId, organizationId })\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.timesheets.time_projects.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeProjectCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.timeProjectId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'staff.timesheets.time_projects.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeProjectUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'staff.timesheets.time_projects.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nasync function buildAccessDenialResponse(): Promise<Response> {\n  const { translate } = await resolveTranslations()\n  return NextResponse.json(\n    {\n      // Same string a genuinely missing record gets: the body must not tell the\n      // caller which of the two it is beyond the membership discriminator.\n      error: translate('staff.timesheets.projects.errors.notFound', 'Project not found.'),\n      reason: NO_PROJECT_ACCESS_REASON,\n    },\n    { status: 404 },\n  )\n}\n\n/**\n * The list route doubles as the detail read (`?ids=<id>`, and defensively `?id=`),\n * so a caller asking for one specific project needs an answer the UI can turn\n * into screen 17 rather than an indistinguishable empty page. Returning 404 for\n * denied *and* unknown ids alike keeps the endpoint useless for enumeration; the\n * `reason` discriminator carries only \"you are not a member of this project\",\n * never the project or customer it is refusing to describe.\n */\nasync function resolveProjectAccessDenial(req: Request): Promise<Response | null> {\n  const url = new URL(req.url)\n  const rawIds = url.searchParams.get('ids') ?? url.searchParams.get('id')\n  if (!isIdsParamProvided(rawIds)) return null\n  const requestedIds = parseIdsParam(rawIds)\n  // Malformed ids match nothing on their own; the factory answers an empty list.\n  if (requestedIds.length === 0) return null\n\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    // Unauthenticated and unscoped requests are the factory's to reject.\n    if (!auth) return null\n    const orgScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = orgScope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(orgScope, auth) ?? null\n    if (!tenantId || !organizationId) return null\n\n    const access = await resolveRequestProjectAccess(req, () =>\n      loadProjectAccess(\n        container,\n        typeof auth.sub === 'string' ? auth.sub : null,\n        tenantId,\n        organizationId,\n      ),\n    )\n    if (access.canManageAll) return null\n    if (requestedIds.some((id) => access.projectIds.includes(id))) return null\n    return await buildAccessDenialResponse()\n  } catch (err) {\n    // Fail closed: an access decision that could not be made is a denial.\n    logger.error('staff.timesheets.time-projects denial probe failed', { err })\n    return await buildAccessDenialResponse()\n  }\n}\n\nexport async function GET(req: Request): Promise<Response> {\n  const denial = await resolveProjectAccessDenial(req)\n  if (denial) return denial\n  return crud.GET(req)\n}\n\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nexport const timeProjectListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  name: z.string().nullable().optional(),\n  code: z.string().nullable().optional(),\n  description: z.string().nullable().optional(),\n  project_type: z.string().nullable().optional(),\n  color: z.string().nullable().optional(),\n  status: z.string().nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  customer_snapshot: z.record(z.string(), z.unknown()).nullable().optional(),\n  owner_user_id: z.string().uuid().nullable().optional(),\n  cost_center: z.string().nullable().optional(),\n  start_date: z.string().nullable().optional(),\n  // numeric(14,4) reaches the client as a decimal string; a number stays accepted\n  // for callers that read the column through a numeric-casting driver.\n  hourly_rate: z.union([z.string(), z.number()]).nullable().optional(),\n  currency_code: z.string().nullable().optional(),\n  billable_by_default: z.boolean().nullable().optional(),\n  budget_kind: z.string().nullable().optional(),\n  budget_value: z.union([z.string(), z.number()]).nullable().optional(),\n  budget_warn_at_percent: z.number().int().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  entryCount: z.number().int().optional(),\n  lockedEntryCount: z.number().int().optional(),\n  currencyLocked: z.boolean().optional(),\n})\n\nexport const projectAccessDeniedResponseSchema = z.object({\n  error: z.string(),\n  reason: z.literal(NO_PROJECT_ACCESS_REASON),\n})\n\nconst baseOpenApi = createStaffCrudOpenApi({\n  resourceName: 'TimeProject',\n  pluralName: 'Time Projects',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(timeProjectListItemSchema),\n  create: {\n    schema: staffTimeProjectCreateSchema,\n    description: 'Creates a time project.',\n  },\n  update: {\n    schema: staffTimeProjectUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a time project by id.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes a time project by id.',\n  },\n})\n\nexport const openApi = {\n  ...baseOpenApi,\n  methods: {\n    ...baseOpenApi.methods,\n    ...(baseOpenApi.methods?.GET\n      ? {\n          GET: {\n            ...baseOpenApi.methods.GET,\n            description: `${baseOpenApi.methods.GET.description ?? ''} Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),\n            responses: [\n              ...(baseOpenApi.methods.GET.responses ?? []),\n              {\n                status: 404,\n                description: 'The caller is not a member of the requested project (or it does not exist)',\n                schema: projectAccessDeniedResponseSchema,\n              },\n            ],\n          },\n        }\n      : {}),\n  },\n} satisfies typeof baseOpenApi\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,qBAAmC;AAC5C,SAAS,kCAAkC;AAC3C,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,oBAAoB,qBAAqB;AAClD,SAAS,oBAAoB;AAE7B,SAAS,kBAAkB,wBAAwB,uBAAuB;AAC1E,SAAS,8BAA8B,oCAAoC;AAC3E,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,4BAAgD;AAClF,SAAS,gCAAgC;AACzC,SAAS,wBAAwB;AACjC,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,wBAAwB,+BAA+B,+BAA+B;AAC/F,SAAS,SAAS;AAElB,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAExF,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,MAAM;AAAA,EACN,aAAa;AAAA,EACb,cAAc;AAAA,EACd,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,cAAc;AAAA,EACd,wBAAwB;AAAA,EACxB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAAA,EAC9E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EACjF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EAChF,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AACrF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA,EACvB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAeR,MAAM,2BAA2B;AAMxC,MAAM,wBAAwB;AAE9B,MAAM,gBAA+B,EAAE,cAAc,OAAO,YAAY,CAAC,GAAG,eAAe,KAAK;AAuBhG,MAAM,kBAAkB,oBAAI,QAAyC;AAErE,eAAe,uBACb,WACA,QACA,OACmB;AACnB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,mBAAoB,QAAO,CAAC;AACvC,WAAQ,MAAM,KAAK,mBAAmB,QAAQ,KAAK,KAAM,CAAC;AAAA,EAC5D,QAAQ;AAGN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,oBACb,WACA,QACA,OACkB;AAClB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,mBAAoB,QAAO;AACtC,WAAQ,MAAM,KAAK,mBAAmB,QAAQ,CAAC,uBAAuB,GAAG,KAAK,MAAO;AAAA,EACvF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,2BACb,WACA,UACwB;AACxB,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACwB;AACxB,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,EAAE,GAAG,cAAc;AAC5D,QAAM,QAAQ,EAAE,UAAU,eAAe;AACzC,MAAI;AAIF,UAAM,SAAS,MAAM,qBAAqB,WAAW,QAAQ,CAAC,uBAAuB,GAAG,KAAK;AAC7F,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,qBAAqB;AAAA,MAChC,IAAI,GAAG,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,IAC3E,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAC/E,WAAO,EAAE,GAAG,cAAc;AAAA,EAC5B;AACF;AAEA,SAAS,4BACP,SACA,MACwB;AACxB,MAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAM,SAAS,gBAAgB,IAAI,OAAO;AAC1C,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,KAAK;AACrB,kBAAgB,IAAI,SAAS,OAAO;AACpC,SAAO;AACT;AAEA,SAAS,gBAAgB,KAA0E;AACjG,SAAO;AAAA,IACL,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,EACnE;AACF;AAEA,eAAe,yBAAyB,KAAsC;AAC5E,QAAM,EAAE,UAAU,eAAe,IAAI,gBAAgB,GAAG;AACxD,SAAO;AAAA,IAA4B,IAAI;AAAA,IAAS,MAC9C,kBAAkB,IAAI,WAAW,IAAI,MAAM,OAAO,MAAM,UAAU,cAAc;AAAA,EAClF;AACF;AAEA,eAAe,gCACb,IACA,QACA,UACA,gBACmB;AACnB,QAAM,WAAW,EAAE,UAAU,eAAe;AAC5C,QAAM,cAAc,MAAM;AAAA,IACxB,GAAG,KAAK;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,UAAU,gBAAgB,WAAW,KAAK;AAAA,IACpD,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa,QAAO,CAAC;AAC1B,QAAM,cAAc,MAAM,GAAG,KAAK,EAAE,KAAK,wBAAwB;AAAA,IAC/D,eAAe,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC;AACD,SAAO,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACpE;AAeA,SAAS,QAAQ,OAAmD;AAClE,QAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AACpE,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAWA,eAAsB,4BACpB,OACA,IACA,OACe;AACf,QAAM,MAAM,MAAM;AAAA,IAChB,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,CAAC;AAAA,EACxH;AACA,MAAI,IAAI,WAAW,EAAG;AAEtB,QAAM,YAAY,iBAAiB,mBAAmB,GAAG;AACzD,QAAM,OAAQ,MAAM,GAAG,cAAc,EAAE;AAAA,IACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAQU,UAAU,GAAG;AAAA;AAAA;AAAA,IAGvB,CAAC,MAAM,UAAU,MAAM,gBAAgB,GAAG,UAAU,MAAM;AAAA,EAC5D;AAEA,QAAM,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,iBAAiB,GAAG,CAAC,CAAC;AACpE,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,OAAO,KAAK,OAAO,WAAW,OAAO,IAAI,KAAK,EAAE,IAAI;AAChE,UAAM,aAAa,QAAQ,KAAK,WAAW;AAC3C,SAAK,aAAa;AAClB,SAAK,mBAAmB,QAAQ,KAAK,kBAAkB;AACvD,SAAK,iBAAiB,aAAa;AAAA,EACrC;AACF;AAMO,MAAM,wBAAwB;AAAA,EACnC,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AACJ;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,EAAE,YAAY,2BAA2B;AAAA,EAClD,WAAW,EAAE,UAAU,2BAA2B;AAAA,EAClD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,CAAC,GAAG,qBAAqB;AAAA,IACjC,sBAAsB,EAAE,WAAW,CAAC,EAAE,MAAM,kBAAkB,EAAE;AAAA,IAChE,cAAc;AAAA,MACZ,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,MACV,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,UAAmC,CAAC;AAC1C,UAAI,YAA6B;AACjC,UAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,oBAAY,MAAM,IACf,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,MACvC;AACA,UAAI,iBAAiB,MAAM,IAAI,KAAK,IAAI,MAAM;AAC5C,cAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,cAAM,WAAW,IAAI,KAAK,YAAY;AACtC,cAAM,iBAAiB,IAAI,0BAA0B,IAAI,KAAK,SAAS;AACvE,cAAM,WAAW,MAAM;AAAA,UACrB;AAAA,UACA,IAAI,KAAK;AAAA,UACT;AAAA,UACA;AAAA,QACF;AACA,oBAAY,YACR,UAAU,OAAO,CAAC,OAAO,SAAS,SAAS,EAAE,CAAC,IAC9C;AACJ,YAAI,UAAU,WAAW,GAAG;AAC1B,kBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,qBAAqB,EAAE;AAC/C,iBAAO;AAAA,QACT;AAAA,MACF;AAKA,YAAM,SAAS,MAAM,yBAAyB,GAAG;AACjD,UAAI,CAAC,OAAO,cAAc;AACxB,oBAAY,YACR,UAAU,OAAO,CAAC,OAAO,OAAO,WAAW,SAAS,EAAE,CAAC,IACvD,CAAC,GAAG,OAAO,UAAU;AACzB,YAAI,UAAU,WAAW,GAAG;AAC1B,kBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,qBAAqB,EAAE;AAC/C,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,aAAa,UAAU,SAAS,GAAG;AACrC,gBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,UAAU;AAAA,MACnC;AACA,YAAM,OAAO,mBAAmB,MAAM,CAAC;AACvC,UAAI,MAAM;AACR,gBAAQ,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,kBAAkB,IAAI,CAAC,IAAI;AAAA,MAC7D;AACA,UAAI,OAAO,MAAM,gBAAgB,YAAY,MAAM,YAAY,KAAK,EAAE,SAAS,GAAG;AAChF,gBAAQ,EAAE,YAAY,IAAI,MAAM,YAAY,KAAK;AAAA,MACnD;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,KAAK,EAAE,SAAS,GAAG;AACtE,gBAAQ,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,KAAK,EAAE,SAAS,GAAG;AAC9E,gBAAQ,EAAE,WAAW,IAAI,MAAM,WAAW,KAAK;AAAA,MACjD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,WAAW,OAAO,KAAK,QAAQ;AAC7B,YAAM,QAAQ,MAAM,QAAS,KAA6B,KAAK,IACzD,IAAqC,QACvC,CAAC;AACL,UAAI,MAAM,WAAW,EAAG;AACxB,YAAM,WAAW,IAAI,MAAM,YAAY;AACvC,YAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,UAAI,CAAC,YAAY,CAAC,eAAgB;AAClC,YAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,YAAM,4BAA4B,OAAO,GAAG,KAAK,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAClF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,8BAA8B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACxF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,iBAAiB,KAAK;AAAA,MAC/D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,8BAA8B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACxF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,eAAe,4BAA+C;AAC5D,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,SAAO,aAAa;AAAA,IAClB;AAAA;AAAA;AAAA,MAGE,OAAO,UAAU,6CAA6C,oBAAoB;AAAA,MAClF,QAAQ;AAAA,IACV;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAUA,eAAe,2BAA2B,KAAwC;AAChF,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,IAAI,aAAa,IAAI,KAAK,KAAK,IAAI,aAAa,IAAI,IAAI;AACvE,MAAI,CAAC,mBAAmB,MAAM,EAAG,QAAO;AACxC,QAAM,eAAe,cAAc,MAAM;AAEzC,MAAI,aAAa,WAAW,EAAG,QAAO;AAEtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AAEzC,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAC3F,UAAM,WAAW,UAAU,YAAY,KAAK,YAAY;AACxD,UAAM,iBAAiB,kCAAkC,UAAU,IAAI,KAAK;AAC5E,QAAI,CAAC,YAAY,CAAC,eAAgB,QAAO;AAEzC,UAAM,SAAS,MAAM;AAAA,MAA4B;AAAA,MAAK,MACpD;AAAA,QACE;AAAA,QACA,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,QAC1C;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAc,QAAO;AAChC,QAAI,aAAa,KAAK,CAAC,OAAO,OAAO,WAAW,SAAS,EAAE,CAAC,EAAG,QAAO;AACtE,WAAO,MAAM,0BAA0B;AAAA,EACzC,SAAS,KAAK;AAEZ,WAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAC1E,WAAO,MAAM,0BAA0B;AAAA,EACzC;AACF;AAEA,eAAsB,IAAI,KAAiC;AACzD,QAAM,SAAS,MAAM,2BAA2B,GAAG;AACnD,MAAI,OAAQ,QAAO;AACnB,SAAO,KAAK,IAAI,GAAG;AACrB;AAEO,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAEpB,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACzE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG3C,aAAa,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,QAAQ,wBAAwB;AAC5C,CAAC;AAED,MAAM,cAAc,uBAAuB;AAAA,EACzC,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;AAEM,MAAM,UAAU;AAAA,EACrB,GAAG;AAAA,EACH,SAAS;AAAA,IACP,GAAG,YAAY;AAAA,IACf,GAAI,YAAY,SAAS,MACrB;AAAA,MACE,KAAK;AAAA,QACH,GAAG,YAAY,QAAQ;AAAA,QACvB,aAAa,GAAG,YAAY,QAAQ,IAAI,eAAe,EAAE,wOAAwO,wBAAwB,iJAAiJ,KAAK;AAAA,QAC/c,WAAW;AAAA,UACT,GAAI,YAAY,QAAQ,IAAI,aAAa,CAAC;AAAA,UAC1C;AAAA,YACE,QAAQ;AAAA,YACR,aAAa;AAAA,YACb,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF,IACA,CAAC;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeProjectCrudEvents } from '../../../lib/crud'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isIdsParamProvided, parseIdsParam } from '@open-mercato/shared/lib/crud/ids'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeProject, StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { staffTimeProjectCreateSchema, staffTimeProjectUpdateSchema } from '../../../data/validators'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess, type ProjectAccess } from '../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { buildSqlInClause } from '../../../lib/time-tracking/sqlInClause'\nimport { sanitizeSearchTerm, parseBooleanFlag } from '../../helpers'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\nimport { E } from '#generated/entities.ids.generated'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-projects' })\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  name: 'name',\n  code: 'code',\n  description: 'description',\n  project_type: 'project_type',\n  color: 'color',\n  status: 'status',\n  customer_id: 'customer_id',\n  customer_snapshot: 'customer_snapshot',\n  owner_user_id: 'owner_user_id',\n  cost_center: 'cost_center',\n  start_date: 'start_date',\n  hourly_rate: 'hourly_rate',\n  currency_code: 'currency_code',\n  billable_by_default: 'billable_by_default',\n  budget_kind: 'budget_kind',\n  budget_value: 'budget_value',\n  budget_warn_at_percent: 'budget_warn_at_percent',\n  default_assignee_staff_member_id: 'default_assignee_staff_member_id',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    q: z.string().optional(),\n    ids: z.string().optional(),\n    projectType: z.string().optional(),\n    status: z.string().optional(),\n    customerId: z.string().uuid().optional(),\n    mine: z.string().optional(),\n    include: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\n/**\n * Discriminator returned with the 404 a project-scoped read answers when the\n * caller may not see the record. It is the whole body besides a generic error\n * string: naming the project or the customer here would confirm the resource to\n * someone who has no right to it (screen 17 note 1).\n *\n * Denied and genuinely-missing are deliberately indistinguishable for a caller\n * without `staff.timesheets.projects.manage` \u2014 both answer this same 404 \u2014 so the\n * endpoint cannot be used to enumerate which project ids exist. The discriminator\n * only tells the client \"you are not a member\", which is what screen 17 needs to\n * render the request-access affordance; a manager still gets a plain 200-empty\n * for an id that really does not exist.\n */\nexport const NO_PROJECT_ACCESS_REASON = 'no_project_access'\n\n/**\n * Non-UUID sentinel used as the \"match nothing\" id filter. Kept in the shape the\n * `mine=true` branch has always used so both narrowing paths behave identically.\n */\nconst IMPOSSIBLE_PROJECT_ID = '00000000-0000-0000-0000-000000000000'\n\nconst DENIED_ACCESS: ProjectAccess = { canManageAll: false, projectIds: [], staffMemberId: null }\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n  userHasAllFeatures?: (\n    userId: string,\n    required: string[],\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\n/**\n * Both entry points into a single request \u2014 the denial probe on `GET` and the\n * list narrowing in `buildFilters` \u2014 must agree on what the caller may see, and\n * neither should pay for the other's lookups. The resolved access is therefore\n * memoised per `Request`; the factory hands `buildFilters` the same object the\n * route received.\n */\nconst accessByRequest = new WeakMap<Request, Promise<ProjectAccess>>()\n\nasync function resolveGrantedFeatures(\n  container: ContainerLike,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<string[]> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getGrantedFeatures) return []\n    return (await rbac.getGrantedFeatures(userId, scope)) ?? []\n  } catch {\n    // Fail closed: an unreadable grant set is no grant set, so the caller falls\n    // back to their project memberships instead of being treated as a manager.\n    return []\n  }\n}\n\nasync function resolveUnrestricted(\n  container: ContainerLike,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<boolean> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.userHasAllFeatures) return false\n    return (await rbac.userHasAllFeatures(userId, [MANAGE_PROJECTS_FEATURE], scope)) === true\n  } catch {\n    // Fail closed, exactly as the grant lookup does.\n    return false\n  }\n}\n\nasync function resolveAssignmentGraceDays(\n  container: ContainerLike,\n  tenantId: string,\n): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<ProjectAccess> {\n  if (!tenantId || !organizationId) return { ...DENIED_ACCESS }\n  const scope = { tenantId, organizationId }\n  try {\n    // One lookup, one authority, and a failure that says so. The two-call version\n    // this replaces rescued `canManageAll` but still fed a possibly-empty array\n    // into `userFeatures`, which the guards downstream read.\n    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope)\n    const em = container.resolve('em') as EntityManager\n    return await resolveProjectAccess({\n      em: em.fork(),\n      userId,\n      tenantId,\n      organizationId,\n      canManageAll: access.allowed,\n      userFeatures: access.grantedFeatures,\n      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n    })\n  } catch (err) {\n    logger.error('staff.timesheets.time-projects access resolution failed', { err })\n    return { ...DENIED_ACCESS }\n  }\n}\n\nfunction resolveRequestProjectAccess(\n  request: Request | undefined,\n  load: () => Promise<ProjectAccess>,\n): Promise<ProjectAccess> {\n  if (!request) return load()\n  const cached = accessByRequest.get(request)\n  if (cached) return cached\n  const pending = load()\n  accessByRequest.set(request, pending)\n  return pending\n}\n\nfunction resolveCtxScope(ctx: CrudCtx): { tenantId: string | null; organizationId: string | null } {\n  return {\n    tenantId: ctx.auth?.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n  }\n}\n\nasync function resolveListProjectAccess(ctx: CrudCtx): Promise<ProjectAccess> {\n  const { tenantId, organizationId } = resolveCtxScope(ctx)\n  return resolveRequestProjectAccess(ctx.request, () =>\n    loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId),\n  )\n}\n\nasync function resolveCallerAssignedProjectIds(\n  em: EntityManager,\n  userId: string,\n  tenantId: string,\n  organizationId: string,\n): Promise<string[]> {\n  const scopeCtx = { tenantId, organizationId }\n  const staffMember = await findOneWithDecryption(\n    em.fork(),\n    StaffTeamMember,\n    { userId, tenantId, organizationId, deletedAt: null },\n    {},\n    scopeCtx,\n  )\n  if (!staffMember) return []\n  const memberships = await em.fork().find(StaffTimeProjectMember, {\n    staffMemberId: staffMember.id,\n    tenantId,\n    organizationId,\n    status: 'active',\n    deletedAt: null,\n  })\n  return Array.from(new Set(memberships.map((m) => m.timeProjectId)))\n}\n\ntype ProjectEntryCountRow = {\n  time_project_id: string\n  entry_count: string | number\n  locked_entry_count: string | number\n}\n\ntype ProjectListItem = {\n  id?: unknown\n  entryCount?: number\n  lockedEntryCount?: number\n  currencyLocked?: boolean\n}\n\nfunction toCount(value: string | number | null | undefined): number {\n  const parsed = typeof value === 'number' ? value : Number(value ?? 0)\n  return Number.isFinite(parsed) ? parsed : 0\n}\n\n/**\n * D-3 read-side signal: currency is read-only once hours have been logged, so the\n * project list/detail response carries the reason alongside the value.\n * `currencyLocked` tells the form to render the field read-only behind the explicit\n * change action, `entryCount` names why, and `lockedEntryCount` says whether even\n * that action will be refused (entries frozen in a closed report).\n *\n * One grouped aggregate for the whole page \u2014 never a per-row count.\n */\nexport async function decorateProjectCurrencyLock(\n  items: ProjectListItem[],\n  em: EntityManager,\n  scope: { tenantId: string; organizationId: string },\n): Promise<void> {\n  const ids = Array.from(\n    new Set(items.map((item) => item.id).filter((value): value is string => typeof value === 'string' && value.length > 0)),\n  )\n  if (ids.length === 0) return\n\n  const projectIn = buildSqlInClause('time_project_id', ids)\n  const rows = (await em.getConnection().execute(\n    `\n      SELECT time_project_id,\n             COUNT(*)::bigint AS entry_count,\n             COUNT(locked_report_id)::bigint AS locked_entry_count\n      FROM staff_time_entries\n      WHERE tenant_id = ?\n        AND organization_id = ?\n        AND deleted_at IS NULL\n        AND ${projectIn.sql}\n      GROUP BY time_project_id\n    `,\n    [scope.tenantId, scope.organizationId, ...projectIn.params],\n  )) as ProjectEntryCountRow[]\n\n  const counts = new Map(rows.map((row) => [row.time_project_id, row]))\n  for (const item of items) {\n    const row = typeof item.id === 'string' ? counts.get(item.id) : undefined\n    const entryCount = toCount(row?.entry_count)\n    item.entryCount = entryCount\n    item.lockedEntryCount = toCount(row?.locked_entry_count)\n    item.currencyLocked = entryCount > 0\n  }\n}\n\n/**\n * The list projection doubles as the detail projection (the edit page re-reads this\n * route with `?id=`), so every column the project form round-trips has to be here.\n */\nexport const timeProjectListFields = [\n  F.id,\n  F.organization_id,\n  F.tenant_id,\n  F.name,\n  F.code,\n  F.description,\n  F.project_type,\n  F.color,\n  F.status,\n  F.customer_id,\n  F.customer_snapshot,\n  F.owner_user_id,\n  F.cost_center,\n  F.start_date,\n  F.hourly_rate,\n  F.currency_code,\n  F.billable_by_default,\n  F.budget_kind,\n  F.budget_value,\n  F.budget_warn_at_percent,\n  F.default_assignee_staff_member_id,\n  F.created_at,\n  F.updated_at,\n] as const\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeProject,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeProjectCrudEvents,\n  indexer: { entityType: 'staff:staff_time_project' },\n  enrichers: { entityId: 'staff:staff_time_project' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_project',\n    fields: [...timeProjectListFields],\n    decorateCustomFields: { entityIds: [E.staff.staff_time_project] },\n    sortFieldMap: {\n      name: F.name,\n      code: F.code,\n      status: F.status,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      startDate: F.start_date,\n    },\n    buildFilters: async (query, ctx) => {\n      const filters: Record<string, unknown> = {}\n      let narrowIds: string[] | null = null\n      if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n        narrowIds = query.ids\n          .split(',')\n          .map((value) => value.trim())\n          .filter((value) => value.length > 0)\n      }\n      if (parseBooleanFlag(query.mine) && ctx.auth) {\n        const em = ctx.container.resolve('em') as EntityManager\n        const tenantId = ctx.auth.tenantId ?? ''\n        const organizationId = ctx.selectedOrganizationId ?? ctx.auth.orgId ?? ''\n        const assigned = await resolveCallerAssignedProjectIds(\n          em,\n          ctx.auth.sub,\n          tenantId,\n          organizationId,\n        )\n        narrowIds = narrowIds\n          ? narrowIds.filter((id) => assigned.includes(id))\n          : assigned\n        if (narrowIds.length === 0) {\n          filters[F.id] = { $in: [IMPOSSIBLE_PROJECT_ID] }\n          return filters\n        }\n      }\n      // Every project-scoped read filters through the one resolver: a caller\n      // without `staff.timesheets.projects.manage` only ever sees the projects\n      // they are an active member of. A non-member gets no row at all \u2014 not a\n      // redacted one \u2014 so the customer and project name never leave the server.\n      const access = await resolveListProjectAccess(ctx)\n      if (!access.canManageAll) {\n        narrowIds = narrowIds\n          ? narrowIds.filter((id) => access.projectIds.includes(id))\n          : [...access.projectIds]\n        if (narrowIds.length === 0) {\n          filters[F.id] = { $in: [IMPOSSIBLE_PROJECT_ID] }\n          return filters\n        }\n      }\n      if (narrowIds && narrowIds.length > 0) {\n        filters[F.id] = { $in: narrowIds }\n      }\n      const term = sanitizeSearchTerm(query.q)\n      if (term) {\n        filters[F.name] = { $ilike: `%${escapeLikePattern(term)}%` }\n      }\n      if (typeof query.projectType === 'string' && query.projectType.trim().length > 0) {\n        filters[F.project_type] = query.projectType.trim()\n      }\n      if (typeof query.status === 'string' && query.status.trim().length > 0) {\n        filters[F.status] = query.status.trim()\n      }\n      if (typeof query.customerId === 'string' && query.customerId.trim().length > 0) {\n        filters[F.customer_id] = query.customerId.trim()\n      }\n      return filters\n    },\n  },\n  hooks: {\n    afterList: async (res, ctx) => {\n      const items = Array.isArray((res as { items?: unknown })?.items)\n        ? ((res as { items: ProjectListItem[] }).items)\n        : []\n      if (items.length === 0) return\n      const tenantId = ctx.auth?.tenantId ?? null\n      const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n      if (!tenantId || !organizationId) return\n      const em = ctx.container.resolve('em') as EntityManager\n      await decorateProjectCurrencyLock(items, em.fork(), { tenantId, organizationId })\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.timesheets.time_projects.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeProjectCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.timeProjectId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'staff.timesheets.time_projects.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeProjectUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'staff.timesheets.time_projects.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nasync function buildAccessDenialResponse(): Promise<Response> {\n  const { translate } = await resolveTranslations()\n  return NextResponse.json(\n    {\n      // Same string a genuinely missing record gets: the body must not tell the\n      // caller which of the two it is beyond the membership discriminator.\n      error: translate('staff.timesheets.projects.errors.notFound', 'Project not found.'),\n      reason: NO_PROJECT_ACCESS_REASON,\n    },\n    { status: 404 },\n  )\n}\n\n/**\n * The list route doubles as the detail read (`?ids=<id>`, and defensively `?id=`),\n * so a caller asking for one specific project needs an answer the UI can turn\n * into screen 17 rather than an indistinguishable empty page. Returning 404 for\n * denied *and* unknown ids alike keeps the endpoint useless for enumeration; the\n * `reason` discriminator carries only \"you are not a member of this project\",\n * never the project or customer it is refusing to describe.\n */\nasync function resolveProjectAccessDenial(req: Request): Promise<Response | null> {\n  const url = new URL(req.url)\n  const rawIds = url.searchParams.get('ids') ?? url.searchParams.get('id')\n  if (!isIdsParamProvided(rawIds)) return null\n  const requestedIds = parseIdsParam(rawIds)\n  // Malformed ids match nothing on their own; the factory answers an empty list.\n  if (requestedIds.length === 0) return null\n\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    // Unauthenticated and unscoped requests are the factory's to reject.\n    if (!auth) return null\n    const orgScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = orgScope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(orgScope, auth) ?? null\n    if (!tenantId || !organizationId) return null\n\n    const access = await resolveRequestProjectAccess(req, () =>\n      loadProjectAccess(\n        container,\n        typeof auth.sub === 'string' ? auth.sub : null,\n        tenantId,\n        organizationId,\n      ),\n    )\n    if (access.canManageAll) return null\n    if (requestedIds.some((id) => access.projectIds.includes(id))) return null\n    return await buildAccessDenialResponse()\n  } catch (err) {\n    // Fail closed: an access decision that could not be made is a denial.\n    logger.error('staff.timesheets.time-projects denial probe failed', { err })\n    return await buildAccessDenialResponse()\n  }\n}\n\nexport async function GET(req: Request): Promise<Response> {\n  const denial = await resolveProjectAccessDenial(req)\n  if (denial) return denial\n  return crud.GET(req)\n}\n\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nexport const timeProjectListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  name: z.string().nullable().optional(),\n  code: z.string().nullable().optional(),\n  description: z.string().nullable().optional(),\n  project_type: z.string().nullable().optional(),\n  color: z.string().nullable().optional(),\n  status: z.string().nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  customer_snapshot: z.record(z.string(), z.unknown()).nullable().optional(),\n  owner_user_id: z.string().uuid().nullable().optional(),\n  cost_center: z.string().nullable().optional(),\n  start_date: z.string().nullable().optional(),\n  // numeric(14,4) reaches the client as a decimal string; a number stays accepted\n  // for callers that read the column through a numeric-casting driver.\n  hourly_rate: z.union([z.string(), z.number()]).nullable().optional(),\n  currency_code: z.string().nullable().optional(),\n  billable_by_default: z.boolean().nullable().optional(),\n  budget_kind: z.string().nullable().optional(),\n  budget_value: z.union([z.string(), z.number()]).nullable().optional(),\n  budget_warn_at_percent: z.number().int().nullable().optional(),\n  default_assignee_staff_member_id: z.string().uuid().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  entryCount: z.number().int().optional(),\n  lockedEntryCount: z.number().int().optional(),\n  currencyLocked: z.boolean().optional(),\n})\n\nexport const projectAccessDeniedResponseSchema = z.object({\n  error: z.string(),\n  reason: z.literal(NO_PROJECT_ACCESS_REASON),\n})\n\nconst baseOpenApi = createStaffCrudOpenApi({\n  resourceName: 'TimeProject',\n  pluralName: 'Time Projects',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(timeProjectListItemSchema),\n  create: {\n    schema: staffTimeProjectCreateSchema,\n    description: 'Creates a time project.',\n  },\n  update: {\n    schema: staffTimeProjectUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a time project by id.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes a time project by id.',\n  },\n})\n\nexport const openApi = {\n  ...baseOpenApi,\n  methods: {\n    ...baseOpenApi.methods,\n    ...(baseOpenApi.methods?.GET\n      ? {\n          GET: {\n            ...baseOpenApi.methods.GET,\n            description: `${baseOpenApi.methods.GET.description ?? ''} Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),\n            responses: [\n              ...(baseOpenApi.methods.GET.responses ?? []),\n              {\n                status: 404,\n                description: 'The caller is not a member of the requested project (or it does not exist)',\n                schema: projectAccessDeniedResponseSchema,\n              },\n            ],\n          },\n        }\n      : {}),\n  },\n} satisfies typeof baseOpenApi\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,qBAAmC;AAC5C,SAAS,kCAAkC;AAC3C,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,oBAAoB,qBAAqB;AAClD,SAAS,oBAAoB;AAE7B,SAAS,kBAAkB,wBAAwB,uBAAuB;AAC1E,SAAS,8BAA8B,oCAAoC;AAC3E,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,4BAAgD;AAClF,SAAS,gCAAgC;AACzC,SAAS,wBAAwB;AACjC,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,wBAAwB,+BAA+B,+BAA+B;AAC/F,SAAS,SAAS;AAElB,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAExF,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,MAAM;AAAA,EACN,aAAa;AAAA,EACb,cAAc;AAAA,EACd,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,cAAc;AAAA,EACd,wBAAwB;AAAA,EACxB,kCAAkC;AAAA,EAClC,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAAA,EAC9E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EACjF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EAChF,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AACrF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA,EACvB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAeR,MAAM,2BAA2B;AAMxC,MAAM,wBAAwB;AAE9B,MAAM,gBAA+B,EAAE,cAAc,OAAO,YAAY,CAAC,GAAG,eAAe,KAAK;AAuBhG,MAAM,kBAAkB,oBAAI,QAAyC;AAErE,eAAe,uBACb,WACA,QACA,OACmB;AACnB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,mBAAoB,QAAO,CAAC;AACvC,WAAQ,MAAM,KAAK,mBAAmB,QAAQ,KAAK,KAAM,CAAC;AAAA,EAC5D,QAAQ;AAGN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,oBACb,WACA,QACA,OACkB;AAClB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,mBAAoB,QAAO;AACtC,WAAQ,MAAM,KAAK,mBAAmB,QAAQ,CAAC,uBAAuB,GAAG,KAAK,MAAO;AAAA,EACvF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,2BACb,WACA,UACwB;AACxB,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACwB;AACxB,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,EAAE,GAAG,cAAc;AAC5D,QAAM,QAAQ,EAAE,UAAU,eAAe;AACzC,MAAI;AAIF,UAAM,SAAS,MAAM,qBAAqB,WAAW,QAAQ,CAAC,uBAAuB,GAAG,KAAK;AAC7F,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,qBAAqB;AAAA,MAChC,IAAI,GAAG,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,IAC3E,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAC/E,WAAO,EAAE,GAAG,cAAc;AAAA,EAC5B;AACF;AAEA,SAAS,4BACP,SACA,MACwB;AACxB,MAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAM,SAAS,gBAAgB,IAAI,OAAO;AAC1C,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,KAAK;AACrB,kBAAgB,IAAI,SAAS,OAAO;AACpC,SAAO;AACT;AAEA,SAAS,gBAAgB,KAA0E;AACjG,SAAO;AAAA,IACL,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,EACnE;AACF;AAEA,eAAe,yBAAyB,KAAsC;AAC5E,QAAM,EAAE,UAAU,eAAe,IAAI,gBAAgB,GAAG;AACxD,SAAO;AAAA,IAA4B,IAAI;AAAA,IAAS,MAC9C,kBAAkB,IAAI,WAAW,IAAI,MAAM,OAAO,MAAM,UAAU,cAAc;AAAA,EAClF;AACF;AAEA,eAAe,gCACb,IACA,QACA,UACA,gBACmB;AACnB,QAAM,WAAW,EAAE,UAAU,eAAe;AAC5C,QAAM,cAAc,MAAM;AAAA,IACxB,GAAG,KAAK;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,UAAU,gBAAgB,WAAW,KAAK;AAAA,IACpD,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa,QAAO,CAAC;AAC1B,QAAM,cAAc,MAAM,GAAG,KAAK,EAAE,KAAK,wBAAwB;AAAA,IAC/D,eAAe,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC;AACD,SAAO,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACpE;AAeA,SAAS,QAAQ,OAAmD;AAClE,QAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AACpE,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAWA,eAAsB,4BACpB,OACA,IACA,OACe;AACf,QAAM,MAAM,MAAM;AAAA,IAChB,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,CAAC;AAAA,EACxH;AACA,MAAI,IAAI,WAAW,EAAG;AAEtB,QAAM,YAAY,iBAAiB,mBAAmB,GAAG;AACzD,QAAM,OAAQ,MAAM,GAAG,cAAc,EAAE;AAAA,IACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAQU,UAAU,GAAG;AAAA;AAAA;AAAA,IAGvB,CAAC,MAAM,UAAU,MAAM,gBAAgB,GAAG,UAAU,MAAM;AAAA,EAC5D;AAEA,QAAM,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,iBAAiB,GAAG,CAAC,CAAC;AACpE,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,OAAO,KAAK,OAAO,WAAW,OAAO,IAAI,KAAK,EAAE,IAAI;AAChE,UAAM,aAAa,QAAQ,KAAK,WAAW;AAC3C,SAAK,aAAa;AAClB,SAAK,mBAAmB,QAAQ,KAAK,kBAAkB;AACvD,SAAK,iBAAiB,aAAa;AAAA,EACrC;AACF;AAMO,MAAM,wBAAwB;AAAA,EACnC,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AACJ;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,EAAE,YAAY,2BAA2B;AAAA,EAClD,WAAW,EAAE,UAAU,2BAA2B;AAAA,EAClD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,CAAC,GAAG,qBAAqB;AAAA,IACjC,sBAAsB,EAAE,WAAW,CAAC,EAAE,MAAM,kBAAkB,EAAE;AAAA,IAChE,cAAc;AAAA,MACZ,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,MACV,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,UAAmC,CAAC;AAC1C,UAAI,YAA6B;AACjC,UAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,oBAAY,MAAM,IACf,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,MACvC;AACA,UAAI,iBAAiB,MAAM,IAAI,KAAK,IAAI,MAAM;AAC5C,cAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,cAAM,WAAW,IAAI,KAAK,YAAY;AACtC,cAAM,iBAAiB,IAAI,0BAA0B,IAAI,KAAK,SAAS;AACvE,cAAM,WAAW,MAAM;AAAA,UACrB;AAAA,UACA,IAAI,KAAK;AAAA,UACT;AAAA,UACA;AAAA,QACF;AACA,oBAAY,YACR,UAAU,OAAO,CAAC,OAAO,SAAS,SAAS,EAAE,CAAC,IAC9C;AACJ,YAAI,UAAU,WAAW,GAAG;AAC1B,kBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,qBAAqB,EAAE;AAC/C,iBAAO;AAAA,QACT;AAAA,MACF;AAKA,YAAM,SAAS,MAAM,yBAAyB,GAAG;AACjD,UAAI,CAAC,OAAO,cAAc;AACxB,oBAAY,YACR,UAAU,OAAO,CAAC,OAAO,OAAO,WAAW,SAAS,EAAE,CAAC,IACvD,CAAC,GAAG,OAAO,UAAU;AACzB,YAAI,UAAU,WAAW,GAAG;AAC1B,kBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,qBAAqB,EAAE;AAC/C,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,aAAa,UAAU,SAAS,GAAG;AACrC,gBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,UAAU;AAAA,MACnC;AACA,YAAM,OAAO,mBAAmB,MAAM,CAAC;AACvC,UAAI,MAAM;AACR,gBAAQ,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,kBAAkB,IAAI,CAAC,IAAI;AAAA,MAC7D;AACA,UAAI,OAAO,MAAM,gBAAgB,YAAY,MAAM,YAAY,KAAK,EAAE,SAAS,GAAG;AAChF,gBAAQ,EAAE,YAAY,IAAI,MAAM,YAAY,KAAK;AAAA,MACnD;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,KAAK,EAAE,SAAS,GAAG;AACtE,gBAAQ,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,KAAK,EAAE,SAAS,GAAG;AAC9E,gBAAQ,EAAE,WAAW,IAAI,MAAM,WAAW,KAAK;AAAA,MACjD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,WAAW,OAAO,KAAK,QAAQ;AAC7B,YAAM,QAAQ,MAAM,QAAS,KAA6B,KAAK,IACzD,IAAqC,QACvC,CAAC;AACL,UAAI,MAAM,WAAW,EAAG;AACxB,YAAM,WAAW,IAAI,MAAM,YAAY;AACvC,YAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,UAAI,CAAC,YAAY,CAAC,eAAgB;AAClC,YAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,YAAM,4BAA4B,OAAO,GAAG,KAAK,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAClF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,8BAA8B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACxF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,iBAAiB,KAAK;AAAA,MAC/D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,8BAA8B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACxF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,eAAe,4BAA+C;AAC5D,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,SAAO,aAAa;AAAA,IAClB;AAAA;AAAA;AAAA,MAGE,OAAO,UAAU,6CAA6C,oBAAoB;AAAA,MAClF,QAAQ;AAAA,IACV;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAUA,eAAe,2BAA2B,KAAwC;AAChF,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,IAAI,aAAa,IAAI,KAAK,KAAK,IAAI,aAAa,IAAI,IAAI;AACvE,MAAI,CAAC,mBAAmB,MAAM,EAAG,QAAO;AACxC,QAAM,eAAe,cAAc,MAAM;AAEzC,MAAI,aAAa,WAAW,EAAG,QAAO;AAEtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AAEzC,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAC3F,UAAM,WAAW,UAAU,YAAY,KAAK,YAAY;AACxD,UAAM,iBAAiB,kCAAkC,UAAU,IAAI,KAAK;AAC5E,QAAI,CAAC,YAAY,CAAC,eAAgB,QAAO;AAEzC,UAAM,SAAS,MAAM;AAAA,MAA4B;AAAA,MAAK,MACpD;AAAA,QACE;AAAA,QACA,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,QAC1C;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAc,QAAO;AAChC,QAAI,aAAa,KAAK,CAAC,OAAO,OAAO,WAAW,SAAS,EAAE,CAAC,EAAG,QAAO;AACtE,WAAO,MAAM,0BAA0B;AAAA,EACzC,SAAS,KAAK;AAEZ,WAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAC1E,WAAO,MAAM,0BAA0B;AAAA,EACzC;AACF;AAEA,eAAsB,IAAI,KAAiC;AACzD,QAAM,SAAS,MAAM,2BAA2B,GAAG;AACnD,MAAI,OAAQ,QAAO;AACnB,SAAO,KAAK,IAAI,GAAG;AACrB;AAEO,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAEpB,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACzE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG3C,aAAa,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,kCAAkC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,QAAQ,wBAAwB;AAC5C,CAAC;AAED,MAAM,cAAc,uBAAuB;AAAA,EACzC,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;AAEM,MAAM,UAAU;AAAA,EACrB,GAAG;AAAA,EACH,SAAS;AAAA,IACP,GAAG,YAAY;AAAA,IACf,GAAI,YAAY,SAAS,MACrB;AAAA,MACE,KAAK;AAAA,QACH,GAAG,YAAY,QAAQ;AAAA,QACvB,aAAa,GAAG,YAAY,QAAQ,IAAI,eAAe,EAAE,wOAAwO,wBAAwB,iJAAiJ,KAAK;AAAA,QAC/c,WAAW;AAAA,UACT,GAAI,YAAY,QAAQ,IAAI,aAAa,CAAC;AAAA,UAC1C;AAAA,YACE,QAAQ;AAAA,YACR,aAAa;AAAA,YACb,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF,IACA,CAAC;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/staff/backend/staff/time-tracking/projects/[id]/edit/page.js

@@ -70,6 +70,7 @@ function toValues(record) {
     budgetKind: budgetKind === "none" ? "hours" : budgetKind,
     budgetValue: readString(record, "budgetValue", "budget_value"),
     budgetWarnAtPercent: readString(record, "budgetWarnAtPercent", "budget_warn_at_percent") ?? String(DEFAULT_BUDGET_WARN_AT_PERCENT),
+    defaultAssigneeStaffMemberId: readString(record, "defaultAssigneeStaffMemberId", "default_assignee_staff_member_id") ?? null,
     projectType: readString(record, "projectType", "project_type"),
     color: readString(record, "color"),
     startDate: readString(record, "startDate", "start_date"),

package/dist/modules/staff/backend/staff/time-tracking/projects/[id]/edit/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../../src/modules/staff/backend/staff/time-tracking/projects/%5Bid%5D/edit/page.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport { extensionPoints } from '@open-mercato/core/modules/staff/extension-points'\nimport * as React from 'react'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm } from '@open-mercato/ui/backend/CrudForm'\nimport { updateCrud, deleteCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { E } from '#generated/entities.ids.generated'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { LoadingMessage, ErrorMessage, RecordNotFoundState } from '@open-mercato/ui/backend/detail'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { DEFAULT_BUDGET_WARN_AT_PERCENT, type ProjectBudgetKind } from '../../../../../../lib/time-tracking-ui/ProjectFormSections'\nimport { NoProjectAccess } from '../../../../../../lib/time-tracking-ui/NoProjectAccess'\nimport {\n  buildProjectPayload,\n  createProjectFormFields,\n  createProjectFormGroups,\n  createProjectFormSchema,\n  pickCustomFieldValues,\n  type ProjectFormValues,\n} from '../../projectFormConfig'\n\nconst LIST_HREF = '/backend/staff/time-tracking/projects'\n\n/**\n * Mirrors `NO_PROJECT_ACCESS_REASON` from\n * `api/timesheets/time-projects/route.ts`. The route module is server-only, so\n * the literal is restated here rather than imported into the client bundle;\n * `__tests__/no-project-access-contract.test.ts` pins the two together.\n */\nconst NO_PROJECT_ACCESS_REASON = 'no_project_access'\n\n/** Thrown by the loader so the caller can branch on the guard state. */\nclass ProjectAccessDeniedError extends Error {\n  constructor() {\n    super('[internal] no project access')\n    this.name = 'ProjectAccessDeniedError'\n  }\n}\n\ntype ProjectRecord = Record<string, unknown>\n\nfunction readString(record: ProjectRecord, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n    if (typeof value === 'number') return String(value)\n  }\n  return null\n}\n\nfunction readSnapshot(record: ProjectRecord): Record<string, unknown> | null {\n  const raw = record.customerSnapshot ?? record.customer_snapshot\n  if (raw && typeof raw === 'object' && !Array.isArray(raw)) return raw as Record<string, unknown>\n  return null\n}\n\nfunction toValues(record: ProjectRecord): ProjectFormValues {\n  const snapshot = readSnapshot(record)\n  const budgetKindRaw = readString(record, 'budgetKind', 'budget_kind') ?? 'none'\n  const budgetKind: ProjectBudgetKind =\n    budgetKindRaw === 'hours' || budgetKindRaw === 'amount' ? budgetKindRaw : 'none'\n  const entryCount = typeof record.entryCount === 'number' ? record.entryCount : 0\n\n  return {\n    id: String(record.id ?? ''),\n    updatedAt: readString(record, 'updatedAt', 'updated_at'),\n    name: String(record.name ?? ''),\n    code: String(record.code ?? ''),\n    // D-10: an existing project keeps the code it was saved with \u2014 the name no\n    // longer drives it.\n    codeManual: true,\n    customerId: readString(record, 'customerId', 'customer_id'),\n    customerName: typeof snapshot?.name === 'string' ? snapshot.name : null,\n    customerKind: typeof snapshot?.kind === 'string' ? snapshot.kind : null,\n    customerTaxId: typeof snapshot?.taxId === 'string' ? snapshot.taxId : null,\n    description: readString(record, 'description'),\n    hourlyRate: readString(record, 'hourlyRate', 'hourly_rate'),\n    currencyCode: readString(record, 'currencyCode', 'currency_code'),\n    currencyLocked: record.currencyLocked === true,\n    entryCount,\n    billableByDefault: (record.billableByDefault ?? record.billable_by_default) !== false,\n    budgetEnabled: budgetKind !== 'none',\n    budgetKind: budgetKind === 'none' ? 'hours' : budgetKind,\n    budgetValue: readString(record, 'budgetValue', 'budget_value'),\n    budgetWarnAtPercent:\n      readString(record, 'budgetWarnAtPercent', 'budget_warn_at_percent') ?? String(DEFAULT_BUDGET_WARN_AT_PERCENT),\n    projectType: readString(record, 'projectType', 'project_type'),\n    color: readString(record, 'color'),\n    startDate: readString(record, 'startDate', 'start_date'),\n    costCenter: readString(record, 'costCenter', 'cost_center'),\n    status: readString(record, 'status') ?? 'active',\n    // `decorateCustomFields` on the list route returns the saved values as\n    // `cf_<key>`, which is exactly what `CrudForm` looks an initial value up by.\n    ...pickCustomFieldValues(record as Record<string, unknown>),\n  }\n}\n\nexport default function TimeTrackingProjectEditPage({ params }: { params?: { id?: string } }) {\n  const projectId = params?.id\n  const t = useT()\n  const router = useRouter()\n  const scopeVersion = useOrganizationScopeVersion()\n\n  const [initialValues, setInitialValues] = React.useState<ProjectFormValues | null>(null)\n  const [loading, setLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [isNotFound, setIsNotFound] = React.useState(false)\n  const [accessDenied, setAccessDenied] = React.useState(false)\n\n  const fetchProject = React.useCallback(async (): Promise<ProjectRecord | null> => {\n    const call = await apiCall<{ items?: ProjectRecord[]; reason?: unknown }>(\n      `/api/staff/timesheets/time-projects?ids=${projectId}&pageSize=1`,\n    )\n    if (call.status === 404 && call.result?.reason === NO_PROJECT_ACCESS_REASON) {\n      throw new ProjectAccessDeniedError()\n    }\n    if (!call.ok) {\n      throw new Error(t('staff.timesheets.projects.errors.load', 'Failed to load project.'))\n    }\n    const record = Array.isArray(call.result?.items) ? call.result.items[0] : null\n    return record ?? null\n  }, [projectId, t])\n\n  /**\n   * D-3: the change-currency action writes to the project directly, so it bumped\n   * both the currency and `updated_at`. Reload the record \u2014 the form derives its\n   * optimistic-lock version from `initialValues.updatedAt`, and a stale one would\n   * fail the next save with a conflict this same user had just caused. `CrudForm`\n   * merges refreshed initial values without discarding fields being edited.\n   */\n  const handleCurrencyChanged = React.useCallback(() => {\n    if (!projectId) return\n    void fetchProject()\n      .then((record) => { if (record) setInitialValues(toValues(record)) })\n      .catch(() => {\n        // Best effort: the optimistic-lock conflict bar remains the backstop.\n      })\n  }, [fetchProject, projectId])\n\n  const formSchema = React.useMemo(() => createProjectFormSchema(), [])\n  const fields = React.useMemo(\n    () => createProjectFormFields(t, { onCurrencyChanged: handleCurrencyChanged }),\n    [t, handleCurrencyChanged],\n  )\n  const groups = React.useMemo(() => createProjectFormGroups(t), [t])\n\n  // The organization switcher settles the scope just after mount, bumping the\n  // scope version from 0 and reloading the project. A screen resolved before\n  // that stays up until the answer arrives: falling back to the full-page\n  // loader would unmount it and drop its local state \u2014 the form's unsaved\n  // edits, or an access request the user has just sent. A switch between two\n  // known scopes still goes through the loader, so no form outlives the scope\n  // it was loaded for. The decision looks at the load this one replaces,\n  // settled or not: a version-0 load cancelled by a quick second switch must\n  // not let that switch through.\n  const lastLoadRef = React.useRef<{ projectId: string; scopeVersion: number } | null>(null)\n  React.useEffect(() => {\n    if (!projectId) return\n    let cancelled = false\n    const replaced = lastLoadRef.current\n    lastLoadRef.current = { projectId, scopeVersion }\n    const keepScreen = replaced !== null && replaced.projectId === projectId && replaced.scopeVersion === 0\n    async function load() {\n      if (!keepScreen) setLoading(true)\n      const settle = (outcome: { values?: ProjectFormValues; accessDenied?: boolean; isNotFound?: boolean; error?: string }) => {\n        if (cancelled) return\n        setAccessDenied(outcome.accessDenied === true)\n        setIsNotFound(outcome.isNotFound === true)\n        setError(outcome.error ?? null)\n        if (outcome.values) setInitialValues(outcome.values)\n        setLoading(false)\n      }\n      try {\n        const record = await fetchProject()\n        if (!record) {\n          settle({ isNotFound: true })\n          return\n        }\n        settle({ values: toValues(record) })\n      } catch (err) {\n        if (err instanceof ProjectAccessDeniedError) {\n          settle({ accessDenied: true })\n          return\n        }\n        settle({\n          error: err instanceof Error\n            ? err.message\n            : t('staff.timesheets.projects.errors.load', 'Failed to load project.'),\n        })\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [projectId, fetchProject, scopeVersion, t])\n\n  if (loading) {\n    return <Page><PageBody><LoadingMessage label={t('staff.timesheets.projects.loading', 'Loading project...')} /></PageBody></Page>\n  }\n\n  // Screen 17 \u2014 the caller may not open this project. Same guard state the\n  // detail page renders; it names neither the customer nor the project.\n  if (accessDenied) {\n    return <NoProjectAccess timeProjectId={projectId} />\n  }\n\n  if (isNotFound) {\n    return (\n      <Page>\n        <PageBody>\n          <RecordNotFoundState\n            label={t('staff.timesheets.projects.errors.notFound', 'Project not found.')}\n            backHref={LIST_HREF}\n            backLabel={t('staff.timesheets.projects.actions.backToList', 'Back to projects')}\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (error || !initialValues) {\n    return <Page><PageBody><ErrorMessage label={error ?? t('staff.timesheets.projects.errors.load', 'Failed to load project.')} /></PageBody></Page>\n  }\n\n  const detailHref = `/backend/staff/time-tracking/projects/${projectId}`\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm<ProjectFormValues>\n          title={t('staff.time_tracking.projects.form.editTitle', 'Edit project')}\n          titleHeadingLevel={1}\n          backHref={detailHref}\n          cancelHref={detailHref}\n          fields={fields}\n          groups={groups}\n          schema={formSchema}\n          initialValues={initialValues}\n          entityIds={[E.staff.staff_time_project]}\n          injectionSpotId={extensionPoints.hosts.projectForm.spotId}\n          submitLabel={t('staff.timesheets.projects.form.actions.save', 'Save')}\n          onDelete={async () => {\n            await deleteCrud('staff/timesheets/time-projects', projectId!, {\n              errorMessage: t('staff.timesheets.projects.errors.delete', 'Failed to delete project.'),\n            })\n            flash(t('staff.timesheets.projects.messages.deleted', 'Project deleted.'), 'success')\n            router.push(LIST_HREF)\n          }}\n          onSubmit={async (values) => {\n            if (!values.name?.trim() || !values.code?.trim() || !values.customerId) {\n              const fieldErrors: Record<string, string> = {}\n              if (!values.name?.trim()) {\n                fieldErrors.name = t('staff.time_tracking.projects.validation.nameRequired', 'A project name is required.')\n              }\n              if (!values.code?.trim()) {\n                fieldErrors.code = t('staff.time_tracking.projects.validation.codeRequired', 'A project code is required.')\n              }\n              if (!values.customerId) {\n                fieldErrors.customerId = t('staff.time_tracking.projects.validation.customerRequired', 'A customer is required.')\n              }\n              throw createCrudFormError(\n                t('staff.time_tracking.projects.errors.required', 'Fill in the required fields.'),\n                fieldErrors,\n              )\n            }\n\n            const payload = buildProjectPayload({ ...values, id: projectId })\n\n            await updateCrud('staff/timesheets/time-projects', payload, {\n              errorMessage: t('staff.timesheets.projects.errors.save', 'Failed to save project.'),\n            })\n\n            flash(t('staff.timesheets.projects.messages.saved', 'Project saved.'), 'success')\n            router.push(detailHref)\n          }}\n          versionHistory={{\n            resourceKind: 'staff.timesheets.time_project',\n            resourceId: projectId!,\n            canUndoRedo: true,\n            autoCheckAcl: true,\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAyM2B;AAvM3B,SAAS,uBAAuB;AAChC,YAAY,WAAW;AACvB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAgB;AACzB,SAAS,YAAY,kBAAkB;AACvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,SAAS;AAClB,SAAS,aAAa;AACtB,SAAS,gBAAgB,cAAc,2BAA2B;AAClE,SAAS,YAAY;AACrB,SAAS,mCAAmC;AAC5C,SAAS,sCAA8D;AACvE,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,YAAY;AAQlB,MAAM,2BAA2B;AAGjC,MAAM,iCAAiC,MAAM;AAAA,EAC3C,cAAc;AACZ,UAAM,8BAA8B;AACpC,SAAK,OAAO;AAAA,EACd;AACF;AAIA,SAAS,WAAW,WAA0B,MAA+B;AAC3E,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAAA,EACpD;AACA,SAAO;AACT;AAEA,SAAS,aAAa,QAAuD;AAC3E,QAAM,MAAM,OAAO,oBAAoB,OAAO;AAC9C,MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,SAAO;AACT;AAEA,SAAS,SAAS,QAA0C;AAC1D,QAAM,WAAW,aAAa,MAAM;AACpC,QAAM,gBAAgB,WAAW,QAAQ,cAAc,aAAa,KAAK;AACzE,QAAM,aACJ,kBAAkB,WAAW,kBAAkB,WAAW,gBAAgB;AAC5E,QAAM,aAAa,OAAO,OAAO,eAAe,WAAW,OAAO,aAAa;AAE/E,SAAO;AAAA,IACL,IAAI,OAAO,OAAO,MAAM,EAAE;AAAA,IAC1B,WAAW,WAAW,QAAQ,aAAa,YAAY;AAAA,IACvD,MAAM,OAAO,OAAO,QAAQ,EAAE;AAAA,IAC9B,MAAM,OAAO,OAAO,QAAQ,EAAE;AAAA;AAAA;AAAA,IAG9B,YAAY;AAAA,IACZ,YAAY,WAAW,QAAQ,cAAc,aAAa;AAAA,IAC1D,cAAc,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO;AAAA,IACnE,cAAc,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO;AAAA,IACnE,eAAe,OAAO,UAAU,UAAU,WAAW,SAAS,QAAQ;AAAA,IACtE,aAAa,WAAW,QAAQ,aAAa;AAAA,IAC7C,YAAY,WAAW,QAAQ,cAAc,aAAa;AAAA,IAC1D,cAAc,WAAW,QAAQ,gBAAgB,eAAe;AAAA,IAChE,gBAAgB,OAAO,mBAAmB;AAAA,IAC1C;AAAA,IACA,oBAAoB,OAAO,qBAAqB,OAAO,yBAAyB;AAAA,IAChF,eAAe,eAAe;AAAA,IAC9B,YAAY,eAAe,SAAS,UAAU;AAAA,IAC9C,aAAa,WAAW,QAAQ,eAAe,cAAc;AAAA,IAC7D,qBACE,WAAW,QAAQ,uBAAuB,wBAAwB,KAAK,OAAO,8BAA8B;AAAA,IAC9G,aAAa,WAAW,QAAQ,eAAe,cAAc;AAAA,IAC7D,OAAO,WAAW,QAAQ,OAAO;AAAA,IACjC,WAAW,WAAW,QAAQ,aAAa,YAAY;AAAA,IACvD,YAAY,WAAW,QAAQ,cAAc,aAAa;AAAA,IAC1D,QAAQ,WAAW,QAAQ,QAAQ,KAAK;AAAA;AAAA;AAAA,IAGxC,GAAG,sBAAsB,MAAiC;AAAA,EAC5D;AACF;AAEe,SAAR,4BAA6C,EAAE,OAAO,GAAiC;AAC5F,QAAM,YAAY,QAAQ;AAC1B,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,4BAA4B;AAEjD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAmC,IAAI;AACvF,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AACxD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,eAAe,MAAM,YAAY,YAA2C;AAChF,UAAM,OAAO,MAAM;AAAA,MACjB,2CAA2C,SAAS;AAAA,IACtD;AACA,QAAI,KAAK,WAAW,OAAO,KAAK,QAAQ,WAAW,0BAA0B;AAC3E,YAAM,IAAI,yBAAyB;AAAA,IACrC;AACA,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,IAAI,MAAM,EAAE,yCAAyC,yBAAyB,CAAC;AAAA,IACvF;AACA,UAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,MAAM,CAAC,IAAI;AAC1E,WAAO,UAAU;AAAA,EACnB,GAAG,CAAC,WAAW,CAAC,CAAC;AASjB,QAAM,wBAAwB,MAAM,YAAY,MAAM;AACpD,QAAI,CAAC,UAAW;AAChB,SAAK,aAAa,EACf,KAAK,CAAC,WAAW;AAAE,UAAI,OAAQ,kBAAiB,SAAS,MAAM,CAAC;AAAA,IAAE,CAAC,EACnE,MAAM,MAAM;AAAA,IAEb,CAAC;AAAA,EACL,GAAG,CAAC,cAAc,SAAS,CAAC;AAE5B,QAAM,aAAa,MAAM,QAAQ,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACpE,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM,wBAAwB,GAAG,EAAE,mBAAmB,sBAAsB,CAAC;AAAA,IAC7E,CAAC,GAAG,qBAAqB;AAAA,EAC3B;AACA,QAAM,SAAS,MAAM,QAAQ,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;AAWlE,QAAM,cAAc,MAAM,OAA2D,IAAI;AACzF,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,UAAW;AAChB,QAAI,YAAY;AAChB,UAAM,WAAW,YAAY;AAC7B,gBAAY,UAAU,EAAE,WAAW,aAAa;AAChD,UAAM,aAAa,aAAa,QAAQ,SAAS,cAAc,aAAa,SAAS,iBAAiB;AACtG,mBAAe,OAAO;AACpB,UAAI,CAAC,WAAY,YAAW,IAAI;AAChC,YAAM,SAAS,CAAC,YAA0G;AACxH,YAAI,UAAW;AACf,wBAAgB,QAAQ,iBAAiB,IAAI;AAC7C,sBAAc,QAAQ,eAAe,IAAI;AACzC,iBAAS,QAAQ,SAAS,IAAI;AAC9B,YAAI,QAAQ,OAAQ,kBAAiB,QAAQ,MAAM;AACnD,mBAAW,KAAK;AAAA,MAClB;AACA,UAAI;AACF,cAAM,SAAS,MAAM,aAAa;AAClC,YAAI,CAAC,QAAQ;AACX,iBAAO,EAAE,YAAY,KAAK,CAAC;AAC3B;AAAA,QACF;AACA,eAAO,EAAE,QAAQ,SAAS,MAAM,EAAE,CAAC;AAAA,MACrC,SAAS,KAAK;AACZ,YAAI,eAAe,0BAA0B;AAC3C,iBAAO,EAAE,cAAc,KAAK,CAAC;AAC7B;AAAA,QACF;AACA,eAAO;AAAA,UACL,OAAO,eAAe,QAClB,IAAI,UACJ,EAAE,yCAAyC,yBAAyB;AAAA,QAC1E,CAAC;AAAA,MACH;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,WAAW,cAAc,cAAc,CAAC,CAAC;AAE7C,MAAI,SAAS;AACX,WAAO,oBAAC,QAAK,8BAAC,YAAS,8BAAC,kBAAe,OAAO,EAAE,qCAAqC,oBAAoB,GAAG,GAAE,GAAW;AAAA,EAC3H;AAIA,MAAI,cAAc;AAChB,WAAO,oBAAC,mBAAgB,eAAe,WAAW;AAAA,EACpD;AAEA,MAAI,YAAY;AACd,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,6CAA6C,oBAAoB;AAAA,QAC1E,UAAU;AAAA,QACV,WAAW,EAAE,gDAAgD,kBAAkB;AAAA;AAAA,IACjF,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,SAAS,CAAC,eAAe;AAC3B,WAAO,oBAAC,QAAK,8BAAC,YAAS,8BAAC,gBAAa,OAAO,SAAS,EAAE,yCAAyC,yBAAyB,GAAG,GAAE,GAAW;AAAA,EAC3I;AAEA,QAAM,aAAa,yCAAyC,SAAS;AAErE,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,+CAA+C,cAAc;AAAA,MACtE,mBAAmB;AAAA,MACnB,UAAU;AAAA,MACV,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,WAAW,CAAC,EAAE,MAAM,kBAAkB;AAAA,MACtC,iBAAiB,gBAAgB,MAAM,YAAY;AAAA,MACnD,aAAa,EAAE,+CAA+C,MAAM;AAAA,MACpE,UAAU,YAAY;AACpB,cAAM,WAAW,kCAAkC,WAAY;AAAA,UAC7D,cAAc,EAAE,2CAA2C,2BAA2B;AAAA,QACxF,CAAC;AACD,cAAM,EAAE,8CAA8C,kBAAkB,GAAG,SAAS;AACpF,eAAO,KAAK,SAAS;AAAA,MACvB;AAAA,MACA,UAAU,OAAO,WAAW;AAC1B,YAAI,CAAC,OAAO,MAAM,KAAK,KAAK,CAAC,OAAO,MAAM,KAAK,KAAK,CAAC,OAAO,YAAY;AACtE,gBAAM,cAAsC,CAAC;AAC7C,cAAI,CAAC,OAAO,MAAM,KAAK,GAAG;AACxB,wBAAY,OAAO,EAAE,wDAAwD,6BAA6B;AAAA,UAC5G;AACA,cAAI,CAAC,OAAO,MAAM,KAAK,GAAG;AACxB,wBAAY,OAAO,EAAE,wDAAwD,6BAA6B;AAAA,UAC5G;AACA,cAAI,CAAC,OAAO,YAAY;AACtB,wBAAY,aAAa,EAAE,4DAA4D,yBAAyB;AAAA,UAClH;AACA,gBAAM;AAAA,YACJ,EAAE,gDAAgD,8BAA8B;AAAA,YAChF;AAAA,UACF;AAAA,QACF;AAEA,cAAM,UAAU,oBAAoB,EAAE,GAAG,QAAQ,IAAI,UAAU,CAAC;AAEhE,cAAM,WAAW,kCAAkC,SAAS;AAAA,UAC1D,cAAc,EAAE,yCAAyC,yBAAyB;AAAA,QACpF,CAAC;AAED,cAAM,EAAE,4CAA4C,gBAAgB,GAAG,SAAS;AAChF,eAAO,KAAK,UAAU;AAAA,MACxB;AAAA,MACA,gBAAgB;AAAA,QACd,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,cAAc;AAAA,MAChB;AAAA;AAAA,EACF,GACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport { extensionPoints } from '@open-mercato/core/modules/staff/extension-points'\nimport * as React from 'react'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm } from '@open-mercato/ui/backend/CrudForm'\nimport { updateCrud, deleteCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { E } from '#generated/entities.ids.generated'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { LoadingMessage, ErrorMessage, RecordNotFoundState } from '@open-mercato/ui/backend/detail'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { DEFAULT_BUDGET_WARN_AT_PERCENT, type ProjectBudgetKind } from '../../../../../../lib/time-tracking-ui/ProjectFormSections'\nimport { NoProjectAccess } from '../../../../../../lib/time-tracking-ui/NoProjectAccess'\nimport {\n  buildProjectPayload,\n  createProjectFormFields,\n  createProjectFormGroups,\n  createProjectFormSchema,\n  pickCustomFieldValues,\n  type ProjectFormValues,\n} from '../../projectFormConfig'\n\nconst LIST_HREF = '/backend/staff/time-tracking/projects'\n\n/**\n * Mirrors `NO_PROJECT_ACCESS_REASON` from\n * `api/timesheets/time-projects/route.ts`. The route module is server-only, so\n * the literal is restated here rather than imported into the client bundle;\n * `__tests__/no-project-access-contract.test.ts` pins the two together.\n */\nconst NO_PROJECT_ACCESS_REASON = 'no_project_access'\n\n/** Thrown by the loader so the caller can branch on the guard state. */\nclass ProjectAccessDeniedError extends Error {\n  constructor() {\n    super('[internal] no project access')\n    this.name = 'ProjectAccessDeniedError'\n  }\n}\n\ntype ProjectRecord = Record<string, unknown>\n\nfunction readString(record: ProjectRecord, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n    if (typeof value === 'number') return String(value)\n  }\n  return null\n}\n\nfunction readSnapshot(record: ProjectRecord): Record<string, unknown> | null {\n  const raw = record.customerSnapshot ?? record.customer_snapshot\n  if (raw && typeof raw === 'object' && !Array.isArray(raw)) return raw as Record<string, unknown>\n  return null\n}\n\nfunction toValues(record: ProjectRecord): ProjectFormValues {\n  const snapshot = readSnapshot(record)\n  const budgetKindRaw = readString(record, 'budgetKind', 'budget_kind') ?? 'none'\n  const budgetKind: ProjectBudgetKind =\n    budgetKindRaw === 'hours' || budgetKindRaw === 'amount' ? budgetKindRaw : 'none'\n  const entryCount = typeof record.entryCount === 'number' ? record.entryCount : 0\n\n  return {\n    id: String(record.id ?? ''),\n    updatedAt: readString(record, 'updatedAt', 'updated_at'),\n    name: String(record.name ?? ''),\n    code: String(record.code ?? ''),\n    // D-10: an existing project keeps the code it was saved with \u2014 the name no\n    // longer drives it.\n    codeManual: true,\n    customerId: readString(record, 'customerId', 'customer_id'),\n    customerName: typeof snapshot?.name === 'string' ? snapshot.name : null,\n    customerKind: typeof snapshot?.kind === 'string' ? snapshot.kind : null,\n    customerTaxId: typeof snapshot?.taxId === 'string' ? snapshot.taxId : null,\n    description: readString(record, 'description'),\n    hourlyRate: readString(record, 'hourlyRate', 'hourly_rate'),\n    currencyCode: readString(record, 'currencyCode', 'currency_code'),\n    currencyLocked: record.currencyLocked === true,\n    entryCount,\n    billableByDefault: (record.billableByDefault ?? record.billable_by_default) !== false,\n    budgetEnabled: budgetKind !== 'none',\n    budgetKind: budgetKind === 'none' ? 'hours' : budgetKind,\n    budgetValue: readString(record, 'budgetValue', 'budget_value'),\n    budgetWarnAtPercent:\n      readString(record, 'budgetWarnAtPercent', 'budget_warn_at_percent') ?? String(DEFAULT_BUDGET_WARN_AT_PERCENT),\n    defaultAssigneeStaffMemberId: readString(record, 'defaultAssigneeStaffMemberId', 'default_assignee_staff_member_id') ?? null,\n    projectType: readString(record, 'projectType', 'project_type'),\n    color: readString(record, 'color'),\n    startDate: readString(record, 'startDate', 'start_date'),\n    costCenter: readString(record, 'costCenter', 'cost_center'),\n    status: readString(record, 'status') ?? 'active',\n    // `decorateCustomFields` on the list route returns the saved values as\n    // `cf_<key>`, which is exactly what `CrudForm` looks an initial value up by.\n    ...pickCustomFieldValues(record as Record<string, unknown>),\n  }\n}\n\nexport default function TimeTrackingProjectEditPage({ params }: { params?: { id?: string } }) {\n  const projectId = params?.id\n  const t = useT()\n  const router = useRouter()\n  const scopeVersion = useOrganizationScopeVersion()\n\n  const [initialValues, setInitialValues] = React.useState<ProjectFormValues | null>(null)\n  const [loading, setLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [isNotFound, setIsNotFound] = React.useState(false)\n  const [accessDenied, setAccessDenied] = React.useState(false)\n\n  const fetchProject = React.useCallback(async (): Promise<ProjectRecord | null> => {\n    const call = await apiCall<{ items?: ProjectRecord[]; reason?: unknown }>(\n      `/api/staff/timesheets/time-projects?ids=${projectId}&pageSize=1`,\n    )\n    if (call.status === 404 && call.result?.reason === NO_PROJECT_ACCESS_REASON) {\n      throw new ProjectAccessDeniedError()\n    }\n    if (!call.ok) {\n      throw new Error(t('staff.timesheets.projects.errors.load', 'Failed to load project.'))\n    }\n    const record = Array.isArray(call.result?.items) ? call.result.items[0] : null\n    return record ?? null\n  }, [projectId, t])\n\n  /**\n   * D-3: the change-currency action writes to the project directly, so it bumped\n   * both the currency and `updated_at`. Reload the record \u2014 the form derives its\n   * optimistic-lock version from `initialValues.updatedAt`, and a stale one would\n   * fail the next save with a conflict this same user had just caused. `CrudForm`\n   * merges refreshed initial values without discarding fields being edited.\n   */\n  const handleCurrencyChanged = React.useCallback(() => {\n    if (!projectId) return\n    void fetchProject()\n      .then((record) => { if (record) setInitialValues(toValues(record)) })\n      .catch(() => {\n        // Best effort: the optimistic-lock conflict bar remains the backstop.\n      })\n  }, [fetchProject, projectId])\n\n  const formSchema = React.useMemo(() => createProjectFormSchema(), [])\n  const fields = React.useMemo(\n    () => createProjectFormFields(t, { onCurrencyChanged: handleCurrencyChanged }),\n    [t, handleCurrencyChanged],\n  )\n  const groups = React.useMemo(() => createProjectFormGroups(t), [t])\n\n  // The organization switcher settles the scope just after mount, bumping the\n  // scope version from 0 and reloading the project. A screen resolved before\n  // that stays up until the answer arrives: falling back to the full-page\n  // loader would unmount it and drop its local state \u2014 the form's unsaved\n  // edits, or an access request the user has just sent. A switch between two\n  // known scopes still goes through the loader, so no form outlives the scope\n  // it was loaded for. The decision looks at the load this one replaces,\n  // settled or not: a version-0 load cancelled by a quick second switch must\n  // not let that switch through.\n  const lastLoadRef = React.useRef<{ projectId: string; scopeVersion: number } | null>(null)\n  React.useEffect(() => {\n    if (!projectId) return\n    let cancelled = false\n    const replaced = lastLoadRef.current\n    lastLoadRef.current = { projectId, scopeVersion }\n    const keepScreen = replaced !== null && replaced.projectId === projectId && replaced.scopeVersion === 0\n    async function load() {\n      if (!keepScreen) setLoading(true)\n      const settle = (outcome: { values?: ProjectFormValues; accessDenied?: boolean; isNotFound?: boolean; error?: string }) => {\n        if (cancelled) return\n        setAccessDenied(outcome.accessDenied === true)\n        setIsNotFound(outcome.isNotFound === true)\n        setError(outcome.error ?? null)\n        if (outcome.values) setInitialValues(outcome.values)\n        setLoading(false)\n      }\n      try {\n        const record = await fetchProject()\n        if (!record) {\n          settle({ isNotFound: true })\n          return\n        }\n        settle({ values: toValues(record) })\n      } catch (err) {\n        if (err instanceof ProjectAccessDeniedError) {\n          settle({ accessDenied: true })\n          return\n        }\n        settle({\n          error: err instanceof Error\n            ? err.message\n            : t('staff.timesheets.projects.errors.load', 'Failed to load project.'),\n        })\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [projectId, fetchProject, scopeVersion, t])\n\n  if (loading) {\n    return <Page><PageBody><LoadingMessage label={t('staff.timesheets.projects.loading', 'Loading project...')} /></PageBody></Page>\n  }\n\n  // Screen 17 \u2014 the caller may not open this project. Same guard state the\n  // detail page renders; it names neither the customer nor the project.\n  if (accessDenied) {\n    return <NoProjectAccess timeProjectId={projectId} />\n  }\n\n  if (isNotFound) {\n    return (\n      <Page>\n        <PageBody>\n          <RecordNotFoundState\n            label={t('staff.timesheets.projects.errors.notFound', 'Project not found.')}\n            backHref={LIST_HREF}\n            backLabel={t('staff.timesheets.projects.actions.backToList', 'Back to projects')}\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (error || !initialValues) {\n    return <Page><PageBody><ErrorMessage label={error ?? t('staff.timesheets.projects.errors.load', 'Failed to load project.')} /></PageBody></Page>\n  }\n\n  const detailHref = `/backend/staff/time-tracking/projects/${projectId}`\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm<ProjectFormValues>\n          title={t('staff.time_tracking.projects.form.editTitle', 'Edit project')}\n          titleHeadingLevel={1}\n          backHref={detailHref}\n          cancelHref={detailHref}\n          fields={fields}\n          groups={groups}\n          schema={formSchema}\n          initialValues={initialValues}\n          entityIds={[E.staff.staff_time_project]}\n          injectionSpotId={extensionPoints.hosts.projectForm.spotId}\n          submitLabel={t('staff.timesheets.projects.form.actions.save', 'Save')}\n          onDelete={async () => {\n            await deleteCrud('staff/timesheets/time-projects', projectId!, {\n              errorMessage: t('staff.timesheets.projects.errors.delete', 'Failed to delete project.'),\n            })\n            flash(t('staff.timesheets.projects.messages.deleted', 'Project deleted.'), 'success')\n            router.push(LIST_HREF)\n          }}\n          onSubmit={async (values) => {\n            if (!values.name?.trim() || !values.code?.trim() || !values.customerId) {\n              const fieldErrors: Record<string, string> = {}\n              if (!values.name?.trim()) {\n                fieldErrors.name = t('staff.time_tracking.projects.validation.nameRequired', 'A project name is required.')\n              }\n              if (!values.code?.trim()) {\n                fieldErrors.code = t('staff.time_tracking.projects.validation.codeRequired', 'A project code is required.')\n              }\n              if (!values.customerId) {\n                fieldErrors.customerId = t('staff.time_tracking.projects.validation.customerRequired', 'A customer is required.')\n              }\n              throw createCrudFormError(\n                t('staff.time_tracking.projects.errors.required', 'Fill in the required fields.'),\n                fieldErrors,\n              )\n            }\n\n            const payload = buildProjectPayload({ ...values, id: projectId })\n\n            await updateCrud('staff/timesheets/time-projects', payload, {\n              errorMessage: t('staff.timesheets.projects.errors.save', 'Failed to save project.'),\n            })\n\n            flash(t('staff.timesheets.projects.messages.saved', 'Project saved.'), 'success')\n            router.push(detailHref)\n          }}\n          versionHistory={{\n            resourceKind: 'staff.timesheets.time_project',\n            resourceId: projectId!,\n            canUndoRedo: true,\n            autoCheckAcl: true,\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA0M2B;AAxM3B,SAAS,uBAAuB;AAChC,YAAY,WAAW;AACvB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAgB;AACzB,SAAS,YAAY,kBAAkB;AACvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,SAAS;AAClB,SAAS,aAAa;AACtB,SAAS,gBAAgB,cAAc,2BAA2B;AAClE,SAAS,YAAY;AACrB,SAAS,mCAAmC;AAC5C,SAAS,sCAA8D;AACvE,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,YAAY;AAQlB,MAAM,2BAA2B;AAGjC,MAAM,iCAAiC,MAAM;AAAA,EAC3C,cAAc;AACZ,UAAM,8BAA8B;AACpC,SAAK,OAAO;AAAA,EACd;AACF;AAIA,SAAS,WAAW,WAA0B,MAA+B;AAC3E,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAAA,EACpD;AACA,SAAO;AACT;AAEA,SAAS,aAAa,QAAuD;AAC3E,QAAM,MAAM,OAAO,oBAAoB,OAAO;AAC9C,MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,SAAO;AACT;AAEA,SAAS,SAAS,QAA0C;AAC1D,QAAM,WAAW,aAAa,MAAM;AACpC,QAAM,gBAAgB,WAAW,QAAQ,cAAc,aAAa,KAAK;AACzE,QAAM,aACJ,kBAAkB,WAAW,kBAAkB,WAAW,gBAAgB;AAC5E,QAAM,aAAa,OAAO,OAAO,eAAe,WAAW,OAAO,aAAa;AAE/E,SAAO;AAAA,IACL,IAAI,OAAO,OAAO,MAAM,EAAE;AAAA,IAC1B,WAAW,WAAW,QAAQ,aAAa,YAAY;AAAA,IACvD,MAAM,OAAO,OAAO,QAAQ,EAAE;AAAA,IAC9B,MAAM,OAAO,OAAO,QAAQ,EAAE;AAAA;AAAA;AAAA,IAG9B,YAAY;AAAA,IACZ,YAAY,WAAW,QAAQ,cAAc,aAAa;AAAA,IAC1D,cAAc,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO;AAAA,IACnE,cAAc,OAAO,UAAU,SAAS,WAAW,SAAS,OAAO;AAAA,IACnE,eAAe,OAAO,UAAU,UAAU,WAAW,SAAS,QAAQ;AAAA,IACtE,aAAa,WAAW,QAAQ,aAAa;AAAA,IAC7C,YAAY,WAAW,QAAQ,cAAc,aAAa;AAAA,IAC1D,cAAc,WAAW,QAAQ,gBAAgB,eAAe;AAAA,IAChE,gBAAgB,OAAO,mBAAmB;AAAA,IAC1C;AAAA,IACA,oBAAoB,OAAO,qBAAqB,OAAO,yBAAyB;AAAA,IAChF,eAAe,eAAe;AAAA,IAC9B,YAAY,eAAe,SAAS,UAAU;AAAA,IAC9C,aAAa,WAAW,QAAQ,eAAe,cAAc;AAAA,IAC7D,qBACE,WAAW,QAAQ,uBAAuB,wBAAwB,KAAK,OAAO,8BAA8B;AAAA,IAC9G,8BAA8B,WAAW,QAAQ,gCAAgC,kCAAkC,KAAK;AAAA,IACxH,aAAa,WAAW,QAAQ,eAAe,cAAc;AAAA,IAC7D,OAAO,WAAW,QAAQ,OAAO;AAAA,IACjC,WAAW,WAAW,QAAQ,aAAa,YAAY;AAAA,IACvD,YAAY,WAAW,QAAQ,cAAc,aAAa;AAAA,IAC1D,QAAQ,WAAW,QAAQ,QAAQ,KAAK;AAAA;AAAA;AAAA,IAGxC,GAAG,sBAAsB,MAAiC;AAAA,EAC5D;AACF;AAEe,SAAR,4BAA6C,EAAE,OAAO,GAAiC;AAC5F,QAAM,YAAY,QAAQ;AAC1B,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,4BAA4B;AAEjD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAmC,IAAI;AACvF,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AACxD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,eAAe,MAAM,YAAY,YAA2C;AAChF,UAAM,OAAO,MAAM;AAAA,MACjB,2CAA2C,SAAS;AAAA,IACtD;AACA,QAAI,KAAK,WAAW,OAAO,KAAK,QAAQ,WAAW,0BAA0B;AAC3E,YAAM,IAAI,yBAAyB;AAAA,IACrC;AACA,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,IAAI,MAAM,EAAE,yCAAyC,yBAAyB,CAAC;AAAA,IACvF;AACA,UAAM,SAAS,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,MAAM,CAAC,IAAI;AAC1E,WAAO,UAAU;AAAA,EACnB,GAAG,CAAC,WAAW,CAAC,CAAC;AASjB,QAAM,wBAAwB,MAAM,YAAY,MAAM;AACpD,QAAI,CAAC,UAAW;AAChB,SAAK,aAAa,EACf,KAAK,CAAC,WAAW;AAAE,UAAI,OAAQ,kBAAiB,SAAS,MAAM,CAAC;AAAA,IAAE,CAAC,EACnE,MAAM,MAAM;AAAA,IAEb,CAAC;AAAA,EACL,GAAG,CAAC,cAAc,SAAS,CAAC;AAE5B,QAAM,aAAa,MAAM,QAAQ,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACpE,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM,wBAAwB,GAAG,EAAE,mBAAmB,sBAAsB,CAAC;AAAA,IAC7E,CAAC,GAAG,qBAAqB;AAAA,EAC3B;AACA,QAAM,SAAS,MAAM,QAAQ,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;AAWlE,QAAM,cAAc,MAAM,OAA2D,IAAI;AACzF,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,UAAW;AAChB,QAAI,YAAY;AAChB,UAAM,WAAW,YAAY;AAC7B,gBAAY,UAAU,EAAE,WAAW,aAAa;AAChD,UAAM,aAAa,aAAa,QAAQ,SAAS,cAAc,aAAa,SAAS,iBAAiB;AACtG,mBAAe,OAAO;AACpB,UAAI,CAAC,WAAY,YAAW,IAAI;AAChC,YAAM,SAAS,CAAC,YAA0G;AACxH,YAAI,UAAW;AACf,wBAAgB,QAAQ,iBAAiB,IAAI;AAC7C,sBAAc,QAAQ,eAAe,IAAI;AACzC,iBAAS,QAAQ,SAAS,IAAI;AAC9B,YAAI,QAAQ,OAAQ,kBAAiB,QAAQ,MAAM;AACnD,mBAAW,KAAK;AAAA,MAClB;AACA,UAAI;AACF,cAAM,SAAS,MAAM,aAAa;AAClC,YAAI,CAAC,QAAQ;AACX,iBAAO,EAAE,YAAY,KAAK,CAAC;AAC3B;AAAA,QACF;AACA,eAAO,EAAE,QAAQ,SAAS,MAAM,EAAE,CAAC;AAAA,MACrC,SAAS,KAAK;AACZ,YAAI,eAAe,0BAA0B;AAC3C,iBAAO,EAAE,cAAc,KAAK,CAAC;AAC7B;AAAA,QACF;AACA,eAAO;AAAA,UACL,OAAO,eAAe,QAClB,IAAI,UACJ,EAAE,yCAAyC,yBAAyB;AAAA,QAC1E,CAAC;AAAA,MACH;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,WAAW,cAAc,cAAc,CAAC,CAAC;AAE7C,MAAI,SAAS;AACX,WAAO,oBAAC,QAAK,8BAAC,YAAS,8BAAC,kBAAe,OAAO,EAAE,qCAAqC,oBAAoB,GAAG,GAAE,GAAW;AAAA,EAC3H;AAIA,MAAI,cAAc;AAChB,WAAO,oBAAC,mBAAgB,eAAe,WAAW;AAAA,EACpD;AAEA,MAAI,YAAY;AACd,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,6CAA6C,oBAAoB;AAAA,QAC1E,UAAU;AAAA,QACV,WAAW,EAAE,gDAAgD,kBAAkB;AAAA;AAAA,IACjF,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,SAAS,CAAC,eAAe;AAC3B,WAAO,oBAAC,QAAK,8BAAC,YAAS,8BAAC,gBAAa,OAAO,SAAS,EAAE,yCAAyC,yBAAyB,GAAG,GAAE,GAAW;AAAA,EAC3I;AAEA,QAAM,aAAa,yCAAyC,SAAS;AAErE,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,+CAA+C,cAAc;AAAA,MACtE,mBAAmB;AAAA,MACnB,UAAU;AAAA,MACV,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,WAAW,CAAC,EAAE,MAAM,kBAAkB;AAAA,MACtC,iBAAiB,gBAAgB,MAAM,YAAY;AAAA,MACnD,aAAa,EAAE,+CAA+C,MAAM;AAAA,MACpE,UAAU,YAAY;AACpB,cAAM,WAAW,kCAAkC,WAAY;AAAA,UAC7D,cAAc,EAAE,2CAA2C,2BAA2B;AAAA,QACxF,CAAC;AACD,cAAM,EAAE,8CAA8C,kBAAkB,GAAG,SAAS;AACpF,eAAO,KAAK,SAAS;AAAA,MACvB;AAAA,MACA,UAAU,OAAO,WAAW;AAC1B,YAAI,CAAC,OAAO,MAAM,KAAK,KAAK,CAAC,OAAO,MAAM,KAAK,KAAK,CAAC,OAAO,YAAY;AACtE,gBAAM,cAAsC,CAAC;AAC7C,cAAI,CAAC,OAAO,MAAM,KAAK,GAAG;AACxB,wBAAY,OAAO,EAAE,wDAAwD,6BAA6B;AAAA,UAC5G;AACA,cAAI,CAAC,OAAO,MAAM,KAAK,GAAG;AACxB,wBAAY,OAAO,EAAE,wDAAwD,6BAA6B;AAAA,UAC5G;AACA,cAAI,CAAC,OAAO,YAAY;AACtB,wBAAY,aAAa,EAAE,4DAA4D,yBAAyB;AAAA,UAClH;AACA,gBAAM;AAAA,YACJ,EAAE,gDAAgD,8BAA8B;AAAA,YAChF;AAAA,UACF;AAAA,QACF;AAEA,cAAM,UAAU,oBAAoB,EAAE,GAAG,QAAQ,IAAI,UAAU,CAAC;AAEhE,cAAM,WAAW,kCAAkC,SAAS;AAAA,UAC1D,cAAc,EAAE,yCAAyC,yBAAyB;AAAA,QACpF,CAAC;AAED,cAAM,EAAE,4CAA4C,gBAAgB,GAAG,SAAS;AAChF,eAAO,KAAK,UAAU;AAAA,MACxB;AAAA,MACA,gBAAgB;AAAA,QACd,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,cAAc;AAAA,MAChB;AAAA;AAAA,EACF,GACF,GACF;AAEJ;",
   "names": []
 }