@open-mercato/core 0.6.8-develop.6881.1.8ea75912f2 → 0.6.8-develop.6889.1.af4501ca97

package/dist/modules/staff/api/timesheets/time-entries/[id]/timer-start/route.js

@@ -15,6 +15,7 @@ import {
   runStaffMutationGuards
 } from "../../../../guards.js";
 import { emitStaffEvent } from "../../../../../events.js";
+import { invalidateStaffTimeEntryCache } from "../../../../../lib/timesheets/timeEntryCacheInvalidation.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("staff");
 function extractEntryIdFromUrl(request) {
@@ -141,6 +142,12 @@ async function POST(req) {
       await trx.flush();
       return startedAt;
     });
+    await invalidateStaffTimeEntryCache(
+      container,
+      { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },
+      tenantId,
+      "timer_started"
+    );
     void emitStaffEvent("staff.timesheets.time_entry.timer_started", {
       id: entry.id,
       staffMemberId: entry.staffMemberId,

package/dist/modules/staff/api/timesheets/time-entries/[id]/timer-start/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/timer-start/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { emitStaffEvent } from '../../../../../events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/timer-start/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    if (entry.startedAt) {\n      return NextResponse.json(\n        { error: translate('staff.timesheets.errors.timerAlreadyStarted', 'Timer is already started for this entry.') },\n        { status: 409 },\n      )\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Start the timer inside a single transaction with a PESSIMISTIC_WRITE lock\n    // on the time entry row, re-checking startedAt under the lock so two\n    // concurrent timer-start calls on the same entry cannot both create an\n    // initial work segment (issue #2416).\n    const now = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n      if (lockedEntry.startedAt) {\n        throw new CrudHttpError(409, {\n          error: translate('staff.timesheets.errors.timerAlreadyStarted', 'Timer is already started for this entry.'),\n        })\n      }\n\n      // Single-active-timer invariant (issue #2855): reject the start when the\n      // staff member already has another running entry (started_at set,\n      // ended_at null). Without this guard a second surface (dashboard widget,\n      // another tab) could create and start a parallel timer, leaving two\n      // concurrent running entries and the \"stopped timer comes back running\"\n      // symptom reported in #2456.\n      const otherRunningEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        {\n          tenantId,\n          organizationId,\n          staffMemberId: lockedEntry.staffMemberId,\n          id: { $ne: lockedEntry.id },\n          startedAt: { $ne: null },\n          endedAt: null,\n          deletedAt: null,\n        },\n        {},\n        scopeCtx,\n      )\n      if (otherRunningEntry) {\n        throw new CrudHttpError(409, {\n          error: translate(\n            'staff.timesheets.errors.timerAlreadyRunning',\n            'Another timer is already running. Stop it before starting a new one.',\n          ),\n        })\n      }\n\n      const startedAt = new Date()\n      lockedEntry.startedAt = startedAt\n      lockedEntry.source = 'timer'\n\n      const segmentData = {\n        tenantId,\n        organizationId,\n        timeEntryId: lockedEntry.id,\n        startedAt,\n        segmentType: 'work' as const,\n      }\n      trx.create(StaffTimeEntrySegment, segmentData as never)\n\n      await trx.flush()\n      return startedAt\n    })\n\n    void emitStaffEvent('staff.timesheets.time_entry.timer_started', {\n      id: entry.id,\n      staffMemberId: entry.staffMemberId,\n      tenantId: entry.tenantId,\n      organizationId: entry.organizationId,\n      startedAt: now.toISOString(),\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit timer_started failed', { err })\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true }, { status: 200 })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.timer-start failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStart', 'Failed to start timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Start timer for a time entry',\n  methods: {\n    POST: {\n      summary: 'Start timer for a time entry',\n      description: 'Starts the timer on a time entry by setting startedAt and creating an initial work segment.',\n      responses: [\n        { status: 200, description: 'Timer started', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Timer already started, or another timer is already running for this staff member', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,sCAAsC;AACvE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAEA,QAAI,MAAM,WAAW;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,+CAA+C,0CAA0C,EAAE;AAAA,QAC9G,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,MAAM,MAAM,GAAG,cAAc,OAAO,QAAQ;AAChD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AACA,UAAI,YAAY,WAAW;AACzB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,+CAA+C,0CAA0C;AAAA,QAC5G,CAAC;AAAA,MACH;AAQA,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,YAAY;AAAA,UAC3B,IAAI,EAAE,KAAK,YAAY,GAAG;AAAA,UAC1B,WAAW,EAAE,KAAK,KAAK;AAAA,UACvB,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,QACA,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,mBAAmB;AACrB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAEA,YAAM,YAAY,oBAAI,KAAK;AAC3B,kBAAY,YAAY;AACxB,kBAAY,SAAS;AAErB,YAAM,cAAc;AAAA,QAClB;AAAA,QACA;AAAA,QACA,aAAa,YAAY;AAAA,QACzB;AAAA,QACA,aAAa;AAAA,MACf;AACA,UAAI,OAAO,uBAAuB,WAAoB;AAEtD,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAED,SAAK,eAAe,6CAA6C;AAAA,MAC/D,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW,IAAI,YAAY;AAAA,IAC7B,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,IACpE,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,oDAAoD,EAAE,IAAI,CAAC;AACxE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE;AAAA,MACnF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,oFAAoF,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACxJ,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { emitStaffEvent } from '../../../../../events'\nimport { invalidateStaffTimeEntryCache } from '../../../../../lib/timesheets/timeEntryCacheInvalidation'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/timer-start/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    if (entry.startedAt) {\n      return NextResponse.json(\n        { error: translate('staff.timesheets.errors.timerAlreadyStarted', 'Timer is already started for this entry.') },\n        { status: 409 },\n      )\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Start the timer inside a single transaction with a PESSIMISTIC_WRITE lock\n    // on the time entry row, re-checking startedAt under the lock so two\n    // concurrent timer-start calls on the same entry cannot both create an\n    // initial work segment (issue #2416).\n    const now = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n      if (lockedEntry.startedAt) {\n        throw new CrudHttpError(409, {\n          error: translate('staff.timesheets.errors.timerAlreadyStarted', 'Timer is already started for this entry.'),\n        })\n      }\n\n      // Single-active-timer invariant (issue #2855): reject the start when the\n      // staff member already has another running entry (started_at set,\n      // ended_at null). Without this guard a second surface (dashboard widget,\n      // another tab) could create and start a parallel timer, leaving two\n      // concurrent running entries and the \"stopped timer comes back running\"\n      // symptom reported in #2456.\n      const otherRunningEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        {\n          tenantId,\n          organizationId,\n          staffMemberId: lockedEntry.staffMemberId,\n          id: { $ne: lockedEntry.id },\n          startedAt: { $ne: null },\n          endedAt: null,\n          deletedAt: null,\n        },\n        {},\n        scopeCtx,\n      )\n      if (otherRunningEntry) {\n        throw new CrudHttpError(409, {\n          error: translate(\n            'staff.timesheets.errors.timerAlreadyRunning',\n            'Another timer is already running. Stop it before starting a new one.',\n          ),\n        })\n      }\n\n      const startedAt = new Date()\n      lockedEntry.startedAt = startedAt\n      lockedEntry.source = 'timer'\n\n      const segmentData = {\n        tenantId,\n        organizationId,\n        timeEntryId: lockedEntry.id,\n        startedAt,\n        segmentType: 'work' as const,\n      }\n      trx.create(StaffTimeEntrySegment, segmentData as never)\n\n      await trx.flush()\n      return startedAt\n    })\n\n    await invalidateStaffTimeEntryCache(\n      container,\n      { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },\n      tenantId,\n      'timer_started',\n    )\n\n    void emitStaffEvent('staff.timesheets.time_entry.timer_started', {\n      id: entry.id,\n      staffMemberId: entry.staffMemberId,\n      tenantId: entry.tenantId,\n      organizationId: entry.organizationId,\n      startedAt: now.toISOString(),\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit timer_started failed', { err })\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true }, { status: 200 })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.timer-start failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStart', 'Failed to start timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Start timer for a time entry',\n  methods: {\n    POST: {\n      summary: 'Start timer for a time entry',\n      description: 'Starts the timer on a time entry by setting startedAt and creating an initial work segment.',\n      responses: [\n        { status: 200, description: 'Timer started', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Timer already started, or another timer is already running for this staff member', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,sCAAsC;AACvE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAEA,QAAI,MAAM,WAAW;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,+CAA+C,0CAA0C,EAAE;AAAA,QAC9G,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,MAAM,MAAM,GAAG,cAAc,OAAO,QAAQ;AAChD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AACA,UAAI,YAAY,WAAW;AACzB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,+CAA+C,0CAA0C;AAAA,QAC5G,CAAC;AAAA,MACH;AAQA,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,YAAY;AAAA,UAC3B,IAAI,EAAE,KAAK,YAAY,GAAG;AAAA,UAC1B,WAAW,EAAE,KAAK,KAAK;AAAA,UACvB,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,QACA,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,mBAAmB;AACrB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAEA,YAAM,YAAY,oBAAI,KAAK;AAC3B,kBAAY,YAAY;AACxB,kBAAY,SAAS;AAErB,YAAM,cAAc;AAAA,QAClB;AAAA,QACA;AAAA,QACA,aAAa,YAAY;AAAA,QACzB;AAAA,QACA,aAAa;AAAA,MACf;AACA,UAAI,OAAO,uBAAuB,WAAoB;AAEtD,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAED,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,IAAI,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,MAC/E;AAAA,MACA;AAAA,IACF;AAEA,SAAK,eAAe,6CAA6C;AAAA,MAC/D,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW,IAAI,YAAY;AAAA,IAC7B,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,IACpE,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,oDAAoD,EAAE,IAAI,CAAC;AACxE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE;AAAA,MACnF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,oFAAoF,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACxJ,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/timer-stop/route.js

@@ -15,6 +15,7 @@ import {
   runStaffMutationGuards
 } from "../../../../guards.js";
 import { emitStaffEvent } from "../../../../../events.js";
+import { invalidateStaffTimeEntryCache } from "../../../../../lib/timesheets/timeEntryCacheInvalidation.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("staff");
 function extractEntryIdFromUrl(request) {
@@ -125,6 +126,12 @@ async function POST(req) {
       await trx.flush();
       return { now: stoppedAt, durationMinutes: computedMinutes };
     });
+    await invalidateStaffTimeEntryCache(
+      container,
+      { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },
+      tenantId,
+      "timer_stopped"
+    );
     void emitStaffEvent("staff.timesheets.time_entry.timer_stopped", {
       id: entry.id,
       staffMemberId: entry.staffMemberId,

package/dist/modules/staff/api/timesheets/time-entries/[id]/timer-stop/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/timer-stop/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { emitStaffEvent } from '../../../../../events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/timer-stop/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Recompute and persist the timer state inside a single transaction with a\n    // PESSIMISTIC_WRITE lock on the time entry row, so concurrent timer-stop /\n    // segment writes on the same entry serialize instead of racing on a shared\n    // in-memory snapshot (issue #2416).\n    const { now, durationMinutes } = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n\n      const segments = await findWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { timeEntryId: lockedEntry.id, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n\n      const activeSegment = segments.find((segment) => !segment.endedAt)\n      if (!activeSegment) {\n        throw new CrudHttpError(409, {\n          error: translate('staff.timesheets.errors.noActiveSegment', 'No active timer segment found for this entry.'),\n        })\n      }\n\n      const stoppedAt = new Date()\n      activeSegment.endedAt = stoppedAt\n      lockedEntry.endedAt = stoppedAt\n\n      const allSegments = segments.map((segment) => {\n        if (segment.id === activeSegment.id) {\n          return { ...segment, endedAt: stoppedAt }\n        }\n        return segment\n      })\n\n      const totalWorkMinutes = allSegments\n        .filter((segment) => segment.segmentType === 'work' && segment.startedAt && segment.endedAt)\n        .reduce((sum, segment) => {\n          const startMs = new Date(segment.startedAt).getTime()\n          const endMs = new Date(segment.endedAt!).getTime()\n          return sum + (endMs - startMs)\n        }, 0)\n\n      const computedMinutes = Math.round(totalWorkMinutes / 60000)\n      lockedEntry.durationMinutes = computedMinutes\n\n      await trx.flush()\n      return { now: stoppedAt, durationMinutes: computedMinutes }\n    })\n\n    void emitStaffEvent('staff.timesheets.time_entry.timer_stopped', {\n      id: entry.id,\n      staffMemberId: entry.staffMemberId,\n      tenantId: entry.tenantId,\n      organizationId: entry.organizationId,\n      stoppedAt: now.toISOString(),\n      durationMinutes,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit timer_stopped failed', { err })\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true, durationMinutes }, { status: 200 })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.timer-stop failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStop', 'Failed to stop timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Stop timer for a time entry',\n  methods: {\n    POST: {\n      summary: 'Stop timer for a time entry',\n      description: 'Stops the active timer segment, recalculates total work duration in minutes, and updates the time entry.',\n      responses: [\n        {\n          status: 200,\n          description: 'Timer stopped',\n          schema: z.object({ ok: z.literal(true), durationMinutes: z.number() }),\n        },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'No active timer segment', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAE1D,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,qCAAqC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,EAAE,KAAK,gBAAgB,IAAI,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrE,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAEA,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA,EAAE,aAAa,YAAY,IAAI,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzE,CAAC;AAAA,QACD;AAAA,MACF;AAEA,YAAM,gBAAgB,SAAS,KAAK,CAAC,YAAY,CAAC,QAAQ,OAAO;AACjE,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,2CAA2C,+CAA+C;AAAA,QAC7G,CAAC;AAAA,MACH;AAEA,YAAM,YAAY,oBAAI,KAAK;AAC3B,oBAAc,UAAU;AACxB,kBAAY,UAAU;AAEtB,YAAM,cAAc,SAAS,IAAI,CAAC,YAAY;AAC5C,YAAI,QAAQ,OAAO,cAAc,IAAI;AACnC,iBAAO,EAAE,GAAG,SAAS,SAAS,UAAU;AAAA,QAC1C;AACA,eAAO;AAAA,MACT,CAAC;AAED,YAAM,mBAAmB,YACtB,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAU,QAAQ,aAAa,QAAQ,OAAO,EAC1F,OAAO,CAAC,KAAK,YAAY;AACxB,cAAM,UAAU,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ;AACpD,cAAM,QAAQ,IAAI,KAAK,QAAQ,OAAQ,EAAE,QAAQ;AACjD,eAAO,OAAO,QAAQ;AAAA,MACxB,GAAG,CAAC;AAEN,YAAM,kBAAkB,KAAK,MAAM,mBAAmB,GAAK;AAC3D,kBAAY,kBAAkB;AAE9B,YAAM,IAAI,MAAM;AAChB,aAAO,EAAE,KAAK,WAAW,iBAAiB,gBAAgB;AAAA,IAC5D,CAAC;AAED,SAAK,eAAe,6CAA6C;AAAA,MAC/D,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW,IAAI,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,IACpE,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AACvE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,qCAAqC,uBAAuB,EAAE;AAAA,MACjF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,iBAAiB,EAAE,OAAO,EAAE,CAAC;AAAA,QACvE;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC/F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { emitStaffEvent } from '../../../../../events'\nimport { invalidateStaffTimeEntryCache } from '../../../../../lib/timesheets/timeEntryCacheInvalidation'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/timer-stop/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Recompute and persist the timer state inside a single transaction with a\n    // PESSIMISTIC_WRITE lock on the time entry row, so concurrent timer-stop /\n    // segment writes on the same entry serialize instead of racing on a shared\n    // in-memory snapshot (issue #2416).\n    const { now, durationMinutes } = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n\n      const segments = await findWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { timeEntryId: lockedEntry.id, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n\n      const activeSegment = segments.find((segment) => !segment.endedAt)\n      if (!activeSegment) {\n        throw new CrudHttpError(409, {\n          error: translate('staff.timesheets.errors.noActiveSegment', 'No active timer segment found for this entry.'),\n        })\n      }\n\n      const stoppedAt = new Date()\n      activeSegment.endedAt = stoppedAt\n      lockedEntry.endedAt = stoppedAt\n\n      const allSegments = segments.map((segment) => {\n        if (segment.id === activeSegment.id) {\n          return { ...segment, endedAt: stoppedAt }\n        }\n        return segment\n      })\n\n      const totalWorkMinutes = allSegments\n        .filter((segment) => segment.segmentType === 'work' && segment.startedAt && segment.endedAt)\n        .reduce((sum, segment) => {\n          const startMs = new Date(segment.startedAt).getTime()\n          const endMs = new Date(segment.endedAt!).getTime()\n          return sum + (endMs - startMs)\n        }, 0)\n\n      const computedMinutes = Math.round(totalWorkMinutes / 60000)\n      lockedEntry.durationMinutes = computedMinutes\n\n      await trx.flush()\n      return { now: stoppedAt, durationMinutes: computedMinutes }\n    })\n\n    await invalidateStaffTimeEntryCache(\n      container,\n      { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },\n      tenantId,\n      'timer_stopped',\n    )\n\n    void emitStaffEvent('staff.timesheets.time_entry.timer_stopped', {\n      id: entry.id,\n      staffMemberId: entry.staffMemberId,\n      tenantId: entry.tenantId,\n      organizationId: entry.organizationId,\n      stoppedAt: now.toISOString(),\n      durationMinutes,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit timer_stopped failed', { err })\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true, durationMinutes }, { status: 200 })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.timer-stop failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStop', 'Failed to stop timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Stop timer for a time entry',\n  methods: {\n    POST: {\n      summary: 'Stop timer for a time entry',\n      description: 'Stops the active timer segment, recalculates total work duration in minutes, and updates the time entry.',\n      responses: [\n        {\n          status: 200,\n          description: 'Timer stopped',\n          schema: z.object({ ok: z.literal(true), durationMinutes: z.number() }),\n        },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'No active timer segment', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAE1D,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,qCAAqC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,EAAE,KAAK,gBAAgB,IAAI,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrE,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAEA,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA,EAAE,aAAa,YAAY,IAAI,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzE,CAAC;AAAA,QACD;AAAA,MACF;AAEA,YAAM,gBAAgB,SAAS,KAAK,CAAC,YAAY,CAAC,QAAQ,OAAO;AACjE,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,2CAA2C,+CAA+C;AAAA,QAC7G,CAAC;AAAA,MACH;AAEA,YAAM,YAAY,oBAAI,KAAK;AAC3B,oBAAc,UAAU;AACxB,kBAAY,UAAU;AAEtB,YAAM,cAAc,SAAS,IAAI,CAAC,YAAY;AAC5C,YAAI,QAAQ,OAAO,cAAc,IAAI;AACnC,iBAAO,EAAE,GAAG,SAAS,SAAS,UAAU;AAAA,QAC1C;AACA,eAAO;AAAA,MACT,CAAC;AAED,YAAM,mBAAmB,YACtB,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAU,QAAQ,aAAa,QAAQ,OAAO,EAC1F,OAAO,CAAC,KAAK,YAAY;AACxB,cAAM,UAAU,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ;AACpD,cAAM,QAAQ,IAAI,KAAK,QAAQ,OAAQ,EAAE,QAAQ;AACjD,eAAO,OAAO,QAAQ;AAAA,MACxB,GAAG,CAAC;AAEN,YAAM,kBAAkB,KAAK,MAAM,mBAAmB,GAAK;AAC3D,kBAAY,kBAAkB;AAE9B,YAAM,IAAI,MAAM;AAChB,aAAO,EAAE,KAAK,WAAW,iBAAiB,gBAAgB;AAAA,IAC5D,CAAC;AAED,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,IAAI,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,MAC/E;AAAA,MACA;AAAA,IACF;AAEA,SAAK,eAAe,6CAA6C;AAAA,MAC/D,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW,IAAI,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,IACpE,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AACvE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,qCAAqC,uBAAuB,EAAE;AAAA,MACjF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,iBAAiB,EAAE,OAAO,EAAE,CAAC;AAAA,QACvE;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC/F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/bulk/route.js

@@ -11,6 +11,7 @@ import { emitCrudSideEffects, flushCrudSideEffects } from "@open-mercato/shared/
 import { StaffTimeEntry, StaffTeamMember, StaffTimeProject } from "../../../../data/entities.js";
 import { staffTimeEntryBulkSaveSchema } from "../../../../data/validators.js";
 import { staffTimeEntryCrudEvents } from "../../../../lib/crud.js";
+import { invalidateStaffTimeEntryCache } from "../../../../lib/timesheets/timeEntryCacheInvalidation.js";
 import {
   resolveUserFeatures,
   runStaffMutationGuardAfterSuccess,
@@ -193,6 +194,21 @@ async function POST(req) {
       });
     }
     await flushCrudSideEffects(dataEngine);
+    const invalidatedRecordIds = /* @__PURE__ */ new Set();
+    for (const change of pendingChanges) {
+      if (invalidatedRecordIds.has(change.entity.id)) continue;
+      invalidatedRecordIds.add(change.entity.id);
+      await invalidateStaffTimeEntryCache(
+        container,
+        {
+          id: change.entity.id,
+          organizationId: change.entity.organizationId,
+          tenantId: change.entity.tenantId
+        },
+        tenantId,
+        `bulk:${change.action}`
+      );
+    }
     if (guardResult.afterSuccessCallbacks.length) {
       await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
         tenantId,

package/dist/modules/staff/api/timesheets/time-entries/bulk/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/time-entries/bulk/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTeamMember, StaffTimeProject } from '../../../../data/entities'\nimport { staffTimeEntryBulkSaveSchema } from '../../../../data/validators'\nimport { staffTimeEntryCrudEvents } from '../../../../lib/crud'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const body = await readJsonSafe(req, {})\n    const parsed = staffTimeEntryBulkSaveSchema.safeParse(body)\n    if (!parsed.success) {\n      const errors = parsed.error.issues.map((issue) => ({\n        path: issue.path.join('.'),\n        message: issue.message,\n      }))\n      return NextResponse.json({ ok: false, errors }, { status: 422 })\n    }\n\n    const { entries } = parsed.data\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.') })\n    }\n    const staffMemberId = staffMember.id\n\n    // Validate that all referenced timeProjectIds exist and are in-scope\n    const referencedProjectIds = [\n      ...new Set(\n        entries\n          .map((e) => e.timeProjectId)\n          .filter((id): id is string => typeof id === 'string' && id.length > 0),\n      ),\n    ]\n    if (referencedProjectIds.length > 0) {\n      const validProjects = await em.find(StaffTimeProject, {\n        id: { $in: referencedProjectIds },\n        tenantId,\n        organizationId,\n        deletedAt: null,\n      }, { fields: ['id'] })\n      const validIds = new Set(validProjects.map((p) => p.id))\n      const invalidIds = referencedProjectIds.filter((id) => !validIds.has(id))\n      if (invalidIds.length > 0) {\n        return NextResponse.json(\n          {\n            ok: false,\n            errors: invalidIds.map((id) => ({\n              path: 'entries[].timeProjectId',\n              message: translate('staff.timesheets.errors.projectNotFound', 'Time project not found or not accessible.'),\n              value: id,\n            })),\n          },\n          { status: 422 },\n        )\n      }\n    }\n\n    const guardInput = {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'staff.timesheets.time_entry',\n      resourceId: staffMemberId,\n      operation: 'update' as const,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    }\n    const guardResult = await runStaffMutationGuards(container, guardInput, resolveUserFeatures(auth))\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const existingIds = entries\n      .map((entry) => entry.id)\n      .filter((id): id is string => typeof id === 'string' && id.length > 0)\n\n    // Validate referenced entry IDs upfront: a stale or foreign UUID would\n    // otherwise fall through to the create branch in the loop below and insert\n    // a duplicate row with that ID-less new identity. Reject as 422 instead.\n    if (existingIds.length > 0) {\n      const resolvedExisting = await em.find(\n        StaffTimeEntry,\n        { id: { $in: existingIds }, tenantId, organizationId, staffMemberId, deletedAt: null },\n        { fields: ['id'] },\n      )\n      const resolvedIdSet = new Set(resolvedExisting.map((entry) => entry.id))\n      const invalidIds = existingIds.filter((id) => !resolvedIdSet.has(id))\n      if (invalidIds.length > 0) {\n        return NextResponse.json(\n          {\n            ok: false,\n            errors: invalidIds.map((id) => ({\n              path: 'entries[].id',\n              message: translate(\n                'staff.timesheets.errors.entryNotFound',\n                'Time entry not found, deleted, or not owned by you.',\n              ),\n              value: id,\n            })),\n          },\n          { status: 422 },\n        )\n      }\n    }\n\n    type PendingChange = {\n      action: 'created' | 'updated' | 'deleted'\n      entity: StaffTimeEntry\n    }\n\n    const { counts, pendingChanges } = await em.transactional(async (trx) => {\n      let created = 0\n      let updated = 0\n      let deleted = 0\n      const changes: PendingChange[] = []\n\n      const existingEntries = existingIds.length > 0\n        ? await findWithDecryption(\n            trx,\n            StaffTimeEntry,\n            { id: { $in: existingIds }, tenantId, organizationId, staffMemberId, deletedAt: null },\n            {},\n            scopeCtx,\n          )\n        : []\n\n      const existingMap = new Map(existingEntries.map((entry) => [entry.id, entry]))\n\n      for (const entry of entries) {\n        if (entry.id && existingMap.has(entry.id)) {\n          const existing = existingMap.get(entry.id)!\n          if (entry.durationMinutes === 0) {\n            existing.deletedAt = new Date()\n            deleted++\n            changes.push({ action: 'deleted', entity: existing })\n          } else {\n            existing.date = entry.date\n            existing.timeProjectId = entry.timeProjectId\n            existing.durationMinutes = entry.durationMinutes\n            existing.notes = entry.notes ?? existing.notes\n            existing.updatedAt = new Date()\n            updated++\n            changes.push({ action: 'updated', entity: existing })\n          }\n        } else {\n          const now = new Date()\n          const newEntry = trx.create(StaffTimeEntry, {\n            tenantId,\n            organizationId,\n            staffMemberId,\n            date: entry.date,\n            timeProjectId: entry.timeProjectId,\n            durationMinutes: entry.durationMinutes,\n            notes: entry.notes ?? null,\n            source: 'manual',\n            createdAt: now,\n            updatedAt: now,\n          })\n          created++\n          changes.push({ action: 'created', entity: newEntry })\n        }\n      }\n\n      await trx.flush()\n      return { counts: { created, updated, deleted }, pendingChanges: changes }\n    })\n\n    const dataEngine = container.resolve<DataEngine>('dataEngine')\n    for (const change of pendingChanges) {\n      await emitCrudSideEffects({\n        dataEngine,\n        action: change.action,\n        entity: change.entity,\n        identifiers: {\n          id: change.entity.id,\n          organizationId: change.entity.organizationId,\n          tenantId: change.entity.tenantId,\n        },\n        events: staffTimeEntryCrudEvents,\n      })\n    }\n    await flushCrudSideEffects(dataEngine)\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: staffMemberId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true, ...counts }, { status: 200 })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.bulk failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.bulkSave', 'Failed to bulk save time entries.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Bulk save time entries',\n  methods: {\n    POST: {\n      summary: 'Bulk save time entries',\n      description: 'Creates, updates, or soft-deletes multiple time entries in a single request. Entries with durationMinutes=0 and an existing id are soft-deleted.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntryBulkSaveSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Bulk save completed',\n          schema: z.object({\n            ok: z.literal(true),\n            created: z.number(),\n            updated: z.number(),\n            deleted: z.number(),\n          }),\n        },\n        {\n          status: 422,\n          description: 'Validation error',\n          schema: z.object({\n            ok: z.literal(false),\n            errors: z.array(z.object({ path: z.string(), message: z.string() })),\n          }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB,4BAA4B;AAI1D,SAAS,gBAAgB,iBAAiB,wBAAwB;AAClE,SAAS,oCAAoC;AAC7C,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,OAAO,MAAM,aAAa,KAAK,CAAC,CAAC;AACvC,UAAM,SAAS,6BAA6B,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,SAAS,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,QACjD,MAAM,MAAM,KAAK,KAAK,GAAG;AAAA,QACzB,SAAS,MAAM;AAAA,MACjB,EAAE;AACF,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjE;AAEA,UAAM,EAAE,QAAQ,IAAI,OAAO;AAE3B,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,yCAAyC,EAAE,CAAC;AAAA,IACvI;AACA,UAAM,gBAAgB,YAAY;AAGlC,UAAM,uBAAuB;AAAA,MAC3B,GAAG,IAAI;AAAA,QACL,QACG,IAAI,CAAC,MAAM,EAAE,aAAa,EAC1B,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,MACzE;AAAA,IACF;AACA,QAAI,qBAAqB,SAAS,GAAG;AACnC,YAAM,gBAAgB,MAAM,GAAG,KAAK,kBAAkB;AAAA,QACpD,IAAI,EAAE,KAAK,qBAAqB;AAAA,QAChC;AAAA,QACA;AAAA,QACA,WAAW;AAAA,MACb,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AACrB,YAAM,WAAW,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACvD,YAAM,aAAa,qBAAqB,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;AACxE,UAAI,WAAW,SAAS,GAAG;AACzB,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,IAAI;AAAA,YACJ,QAAQ,WAAW,IAAI,CAAC,QAAQ;AAAA,cAC9B,MAAM;AAAA,cACN,SAAS,UAAU,2CAA2C,2CAA2C;AAAA,cACzG,OAAO;AAAA,YACT,EAAE;AAAA,UACJ;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AACA,UAAM,cAAc,MAAM,uBAAuB,WAAW,YAAY,oBAAoB,IAAI,CAAC;AACjG,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,cAAc,QACjB,IAAI,CAAC,UAAU,MAAM,EAAE,EACvB,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAKvE,QAAI,YAAY,SAAS,GAAG;AAC1B,YAAM,mBAAmB,MAAM,GAAG;AAAA,QAChC;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,YAAY,GAAG,UAAU,gBAAgB,eAAe,WAAW,KAAK;AAAA,QACrF,EAAE,QAAQ,CAAC,IAAI,EAAE;AAAA,MACnB;AACA,YAAM,gBAAgB,IAAI,IAAI,iBAAiB,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC;AACvE,YAAM,aAAa,YAAY,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;AACpE,UAAI,WAAW,SAAS,GAAG;AACzB,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,IAAI;AAAA,YACJ,QAAQ,WAAW,IAAI,CAAC,QAAQ;AAAA,cAC9B,MAAM;AAAA,cACN,SAAS;AAAA,gBACP;AAAA,gBACA;AAAA,cACF;AAAA,cACA,OAAO;AAAA,YACT,EAAE;AAAA,UACJ;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAOA,UAAM,EAAE,QAAQ,eAAe,IAAI,MAAM,GAAG,cAAc,OAAO,QAAQ;AACvE,UAAI,UAAU;AACd,UAAI,UAAU;AACd,UAAI,UAAU;AACd,YAAM,UAA2B,CAAC;AAElC,YAAM,kBAAkB,YAAY,SAAS,IACzC,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,YAAY,GAAG,UAAU,gBAAgB,eAAe,WAAW,KAAK;AAAA,QACrF,CAAC;AAAA,QACD;AAAA,MACF,IACA,CAAC;AAEL,YAAM,cAAc,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAE7E,iBAAW,SAAS,SAAS;AAC3B,YAAI,MAAM,MAAM,YAAY,IAAI,MAAM,EAAE,GAAG;AACzC,gBAAM,WAAW,YAAY,IAAI,MAAM,EAAE;AACzC,cAAI,MAAM,oBAAoB,GAAG;AAC/B,qBAAS,YAAY,oBAAI,KAAK;AAC9B;AACA,oBAAQ,KAAK,EAAE,QAAQ,WAAW,QAAQ,SAAS,CAAC;AAAA,UACtD,OAAO;AACL,qBAAS,OAAO,MAAM;AACtB,qBAAS,gBAAgB,MAAM;AAC/B,qBAAS,kBAAkB,MAAM;AACjC,qBAAS,QAAQ,MAAM,SAAS,SAAS;AACzC,qBAAS,YAAY,oBAAI,KAAK;AAC9B;AACA,oBAAQ,KAAK,EAAE,QAAQ,WAAW,QAAQ,SAAS,CAAC;AAAA,UACtD;AAAA,QACF,OAAO;AACL,gBAAM,MAAM,oBAAI,KAAK;AACrB,gBAAM,WAAW,IAAI,OAAO,gBAAgB;AAAA,YAC1C;AAAA,YACA;AAAA,YACA;AAAA,YACA,MAAM,MAAM;AAAA,YACZ,eAAe,MAAM;AAAA,YACrB,iBAAiB,MAAM;AAAA,YACvB,OAAO,MAAM,SAAS;AAAA,YACtB,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,WAAW;AAAA,UACb,CAAC;AACD;AACA,kBAAQ,KAAK,EAAE,QAAQ,WAAW,QAAQ,SAAS,CAAC;AAAA,QACtD;AAAA,MACF;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO,EAAE,QAAQ,EAAE,SAAS,SAAS,QAAQ,GAAG,gBAAgB,QAAQ;AAAA,IAC1E,CAAC;AAED,UAAM,aAAa,UAAU,QAAoB,YAAY;AAC7D,eAAW,UAAU,gBAAgB;AACnC,YAAM,oBAAoB;AAAA,QACxB;AAAA,QACA,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO;AAAA,QACf,aAAa;AAAA,UACX,IAAI,OAAO,OAAO;AAAA,UAClB,gBAAgB,OAAO,OAAO;AAAA,UAC9B,UAAU,OAAO,OAAO;AAAA,QAC1B;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,UAAM,qBAAqB,UAAU;AAErC,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,GAAG,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,6CAA6C,EAAE,IAAI,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,oCAAoC,mCAAmC,EAAE;AAAA,MAC5F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,IAAI;AAAA,YAClB,SAAS,EAAE,OAAO;AAAA,YAClB,SAAS,EAAE,OAAO;AAAA,YAClB,SAAS,EAAE,OAAO;AAAA,UACpB,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,KAAK;AAAA,YACnB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,UACrE,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTeamMember, StaffTimeProject } from '../../../../data/entities'\nimport { staffTimeEntryBulkSaveSchema } from '../../../../data/validators'\nimport { staffTimeEntryCrudEvents } from '../../../../lib/crud'\nimport { invalidateStaffTimeEntryCache } from '../../../../lib/timesheets/timeEntryCacheInvalidation'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const body = await readJsonSafe(req, {})\n    const parsed = staffTimeEntryBulkSaveSchema.safeParse(body)\n    if (!parsed.success) {\n      const errors = parsed.error.issues.map((issue) => ({\n        path: issue.path.join('.'),\n        message: issue.message,\n      }))\n      return NextResponse.json({ ok: false, errors }, { status: 422 })\n    }\n\n    const { entries } = parsed.data\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.') })\n    }\n    const staffMemberId = staffMember.id\n\n    // Validate that all referenced timeProjectIds exist and are in-scope\n    const referencedProjectIds = [\n      ...new Set(\n        entries\n          .map((e) => e.timeProjectId)\n          .filter((id): id is string => typeof id === 'string' && id.length > 0),\n      ),\n    ]\n    if (referencedProjectIds.length > 0) {\n      const validProjects = await em.find(StaffTimeProject, {\n        id: { $in: referencedProjectIds },\n        tenantId,\n        organizationId,\n        deletedAt: null,\n      }, { fields: ['id'] })\n      const validIds = new Set(validProjects.map((p) => p.id))\n      const invalidIds = referencedProjectIds.filter((id) => !validIds.has(id))\n      if (invalidIds.length > 0) {\n        return NextResponse.json(\n          {\n            ok: false,\n            errors: invalidIds.map((id) => ({\n              path: 'entries[].timeProjectId',\n              message: translate('staff.timesheets.errors.projectNotFound', 'Time project not found or not accessible.'),\n              value: id,\n            })),\n          },\n          { status: 422 },\n        )\n      }\n    }\n\n    const guardInput = {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'staff.timesheets.time_entry',\n      resourceId: staffMemberId,\n      operation: 'update' as const,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    }\n    const guardResult = await runStaffMutationGuards(container, guardInput, resolveUserFeatures(auth))\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const existingIds = entries\n      .map((entry) => entry.id)\n      .filter((id): id is string => typeof id === 'string' && id.length > 0)\n\n    // Validate referenced entry IDs upfront: a stale or foreign UUID would\n    // otherwise fall through to the create branch in the loop below and insert\n    // a duplicate row with that ID-less new identity. Reject as 422 instead.\n    if (existingIds.length > 0) {\n      const resolvedExisting = await em.find(\n        StaffTimeEntry,\n        { id: { $in: existingIds }, tenantId, organizationId, staffMemberId, deletedAt: null },\n        { fields: ['id'] },\n      )\n      const resolvedIdSet = new Set(resolvedExisting.map((entry) => entry.id))\n      const invalidIds = existingIds.filter((id) => !resolvedIdSet.has(id))\n      if (invalidIds.length > 0) {\n        return NextResponse.json(\n          {\n            ok: false,\n            errors: invalidIds.map((id) => ({\n              path: 'entries[].id',\n              message: translate(\n                'staff.timesheets.errors.entryNotFound',\n                'Time entry not found, deleted, or not owned by you.',\n              ),\n              value: id,\n            })),\n          },\n          { status: 422 },\n        )\n      }\n    }\n\n    type PendingChange = {\n      action: 'created' | 'updated' | 'deleted'\n      entity: StaffTimeEntry\n    }\n\n    const { counts, pendingChanges } = await em.transactional(async (trx) => {\n      let created = 0\n      let updated = 0\n      let deleted = 0\n      const changes: PendingChange[] = []\n\n      const existingEntries = existingIds.length > 0\n        ? await findWithDecryption(\n            trx,\n            StaffTimeEntry,\n            { id: { $in: existingIds }, tenantId, organizationId, staffMemberId, deletedAt: null },\n            {},\n            scopeCtx,\n          )\n        : []\n\n      const existingMap = new Map(existingEntries.map((entry) => [entry.id, entry]))\n\n      for (const entry of entries) {\n        if (entry.id && existingMap.has(entry.id)) {\n          const existing = existingMap.get(entry.id)!\n          if (entry.durationMinutes === 0) {\n            existing.deletedAt = new Date()\n            deleted++\n            changes.push({ action: 'deleted', entity: existing })\n          } else {\n            existing.date = entry.date\n            existing.timeProjectId = entry.timeProjectId\n            existing.durationMinutes = entry.durationMinutes\n            existing.notes = entry.notes ?? existing.notes\n            existing.updatedAt = new Date()\n            updated++\n            changes.push({ action: 'updated', entity: existing })\n          }\n        } else {\n          const now = new Date()\n          const newEntry = trx.create(StaffTimeEntry, {\n            tenantId,\n            organizationId,\n            staffMemberId,\n            date: entry.date,\n            timeProjectId: entry.timeProjectId,\n            durationMinutes: entry.durationMinutes,\n            notes: entry.notes ?? null,\n            source: 'manual',\n            createdAt: now,\n            updatedAt: now,\n          })\n          created++\n          changes.push({ action: 'created', entity: newEntry })\n        }\n      }\n\n      await trx.flush()\n      return { counts: { created, updated, deleted }, pendingChanges: changes }\n    })\n\n    const dataEngine = container.resolve<DataEngine>('dataEngine')\n    for (const change of pendingChanges) {\n      await emitCrudSideEffects({\n        dataEngine,\n        action: change.action,\n        entity: change.entity,\n        identifiers: {\n          id: change.entity.id,\n          organizationId: change.entity.organizationId,\n          tenantId: change.entity.tenantId,\n        },\n        events: staffTimeEntryCrudEvents,\n      })\n    }\n    await flushCrudSideEffects(dataEngine)\n\n    const invalidatedRecordIds = new Set<string>()\n    for (const change of pendingChanges) {\n      if (invalidatedRecordIds.has(change.entity.id)) continue\n      invalidatedRecordIds.add(change.entity.id)\n      await invalidateStaffTimeEntryCache(\n        container,\n        {\n          id: change.entity.id,\n          organizationId: change.entity.organizationId,\n          tenantId: change.entity.tenantId,\n        },\n        tenantId,\n        `bulk:${change.action}`,\n      )\n    }\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry',\n        resourceId: staffMemberId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true, ...counts }, { status: 200 })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.bulk failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.bulkSave', 'Failed to bulk save time entries.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Bulk save time entries',\n  methods: {\n    POST: {\n      summary: 'Bulk save time entries',\n      description: 'Creates, updates, or soft-deletes multiple time entries in a single request. Entries with durationMinutes=0 and an existing id are soft-deleted.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntryBulkSaveSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Bulk save completed',\n          schema: z.object({\n            ok: z.literal(true),\n            created: z.number(),\n            updated: z.number(),\n            deleted: z.number(),\n          }),\n        },\n        {\n          status: 422,\n          description: 'Validation error',\n          schema: z.object({\n            ok: z.literal(false),\n            errors: z.array(z.object({ path: z.string(), message: z.string() })),\n          }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB,4BAA4B;AAI1D,SAAS,gBAAgB,iBAAiB,wBAAwB;AAClE,SAAS,oCAAoC;AAC7C,SAAS,gCAAgC;AACzC,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,OAAO,MAAM,aAAa,KAAK,CAAC,CAAC;AACvC,UAAM,SAAS,6BAA6B,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,SAAS,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,QACjD,MAAM,MAAM,KAAK,KAAK,GAAG;AAAA,QACzB,SAAS,MAAM;AAAA,MACjB,EAAE;AACF,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjE;AAEA,UAAM,EAAE,QAAQ,IAAI,OAAO;AAE3B,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,yCAAyC,EAAE,CAAC;AAAA,IACvI;AACA,UAAM,gBAAgB,YAAY;AAGlC,UAAM,uBAAuB;AAAA,MAC3B,GAAG,IAAI;AAAA,QACL,QACG,IAAI,CAAC,MAAM,EAAE,aAAa,EAC1B,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,MACzE;AAAA,IACF;AACA,QAAI,qBAAqB,SAAS,GAAG;AACnC,YAAM,gBAAgB,MAAM,GAAG,KAAK,kBAAkB;AAAA,QACpD,IAAI,EAAE,KAAK,qBAAqB;AAAA,QAChC;AAAA,QACA;AAAA,QACA,WAAW;AAAA,MACb,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AACrB,YAAM,WAAW,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AACvD,YAAM,aAAa,qBAAqB,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;AACxE,UAAI,WAAW,SAAS,GAAG;AACzB,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,IAAI;AAAA,YACJ,QAAQ,WAAW,IAAI,CAAC,QAAQ;AAAA,cAC9B,MAAM;AAAA,cACN,SAAS,UAAU,2CAA2C,2CAA2C;AAAA,cACzG,OAAO;AAAA,YACT,EAAE;AAAA,UACJ;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AACA,UAAM,cAAc,MAAM,uBAAuB,WAAW,YAAY,oBAAoB,IAAI,CAAC;AACjG,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,cAAc,QACjB,IAAI,CAAC,UAAU,MAAM,EAAE,EACvB,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAKvE,QAAI,YAAY,SAAS,GAAG;AAC1B,YAAM,mBAAmB,MAAM,GAAG;AAAA,QAChC;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,YAAY,GAAG,UAAU,gBAAgB,eAAe,WAAW,KAAK;AAAA,QACrF,EAAE,QAAQ,CAAC,IAAI,EAAE;AAAA,MACnB;AACA,YAAM,gBAAgB,IAAI,IAAI,iBAAiB,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC;AACvE,YAAM,aAAa,YAAY,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;AACpE,UAAI,WAAW,SAAS,GAAG;AACzB,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,IAAI;AAAA,YACJ,QAAQ,WAAW,IAAI,CAAC,QAAQ;AAAA,cAC9B,MAAM;AAAA,cACN,SAAS;AAAA,gBACP;AAAA,gBACA;AAAA,cACF;AAAA,cACA,OAAO;AAAA,YACT,EAAE;AAAA,UACJ;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAOA,UAAM,EAAE,QAAQ,eAAe,IAAI,MAAM,GAAG,cAAc,OAAO,QAAQ;AACvE,UAAI,UAAU;AACd,UAAI,UAAU;AACd,UAAI,UAAU;AACd,YAAM,UAA2B,CAAC;AAElC,YAAM,kBAAkB,YAAY,SAAS,IACzC,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,YAAY,GAAG,UAAU,gBAAgB,eAAe,WAAW,KAAK;AAAA,QACrF,CAAC;AAAA,QACD;AAAA,MACF,IACA,CAAC;AAEL,YAAM,cAAc,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAE7E,iBAAW,SAAS,SAAS;AAC3B,YAAI,MAAM,MAAM,YAAY,IAAI,MAAM,EAAE,GAAG;AACzC,gBAAM,WAAW,YAAY,IAAI,MAAM,EAAE;AACzC,cAAI,MAAM,oBAAoB,GAAG;AAC/B,qBAAS,YAAY,oBAAI,KAAK;AAC9B;AACA,oBAAQ,KAAK,EAAE,QAAQ,WAAW,QAAQ,SAAS,CAAC;AAAA,UACtD,OAAO;AACL,qBAAS,OAAO,MAAM;AACtB,qBAAS,gBAAgB,MAAM;AAC/B,qBAAS,kBAAkB,MAAM;AACjC,qBAAS,QAAQ,MAAM,SAAS,SAAS;AACzC,qBAAS,YAAY,oBAAI,KAAK;AAC9B;AACA,oBAAQ,KAAK,EAAE,QAAQ,WAAW,QAAQ,SAAS,CAAC;AAAA,UACtD;AAAA,QACF,OAAO;AACL,gBAAM,MAAM,oBAAI,KAAK;AACrB,gBAAM,WAAW,IAAI,OAAO,gBAAgB;AAAA,YAC1C;AAAA,YACA;AAAA,YACA;AAAA,YACA,MAAM,MAAM;AAAA,YACZ,eAAe,MAAM;AAAA,YACrB,iBAAiB,MAAM;AAAA,YACvB,OAAO,MAAM,SAAS;AAAA,YACtB,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,WAAW;AAAA,UACb,CAAC;AACD;AACA,kBAAQ,KAAK,EAAE,QAAQ,WAAW,QAAQ,SAAS,CAAC;AAAA,QACtD;AAAA,MACF;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO,EAAE,QAAQ,EAAE,SAAS,SAAS,QAAQ,GAAG,gBAAgB,QAAQ;AAAA,IAC1E,CAAC;AAED,UAAM,aAAa,UAAU,QAAoB,YAAY;AAC7D,eAAW,UAAU,gBAAgB;AACnC,YAAM,oBAAoB;AAAA,QACxB;AAAA,QACA,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO;AAAA,QACf,aAAa;AAAA,UACX,IAAI,OAAO,OAAO;AAAA,UAClB,gBAAgB,OAAO,OAAO;AAAA,UAC9B,UAAU,OAAO,OAAO;AAAA,QAC1B;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,UAAM,qBAAqB,UAAU;AAErC,UAAM,uBAAuB,oBAAI,IAAY;AAC7C,eAAW,UAAU,gBAAgB;AACnC,UAAI,qBAAqB,IAAI,OAAO,OAAO,EAAE,EAAG;AAChD,2BAAqB,IAAI,OAAO,OAAO,EAAE;AACzC,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,IAAI,OAAO,OAAO;AAAA,UAClB,gBAAgB,OAAO,OAAO;AAAA,UAC9B,UAAU,OAAO,OAAO;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,QAAQ,OAAO,MAAM;AAAA,MACvB;AAAA,IACF;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,GAAG,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,6CAA6C,EAAE,IAAI,CAAC;AACjE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,oCAAoC,mCAAmC,EAAE;AAAA,MAC5F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,IAAI;AAAA,YAClB,SAAS,EAAE,OAAO;AAAA,YAClB,SAAS,EAAE,OAAO;AAAA,YAClB,SAAS,EAAE,OAAO;AAAA,UACpB,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,KAAK;AAAA,YACnB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,UACrE,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/route.js

@@ -5,6 +5,7 @@ import { resolveCrudRecordId, parseScopedCommandInput } from "@open-mercato/shar
 import { StaffTimeEntry } from "../../../data/entities.js";
 import { staffTimeEntryCreateSchema, staffTimeEntryUpdateSchema } from "../../../data/validators.js";
 import { buildTimeEntryListFilters, isParseableDateFilter } from "../../../lib/timesheets/timeEntryListFilters.js";
+import { staffTimeEntryCommandIds } from "../../../lib/crud.js";
 import { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from "../../openapi.js";
 const F = {
   id: "id",
@@ -87,7 +88,7 @@ const crud = makeCrudRoute({
   },
   actions: {
     create: {
-      commandId: "staff.timesheets.time_entries.create",
+      commandId: staffTimeEntryCommandIds.create,
       schema: rawBodySchema,
       mapInput: async ({ raw, ctx }) => {
         const { translate } = await resolveTranslations();
@@ -97,7 +98,7 @@ const crud = makeCrudRoute({
       status: 201
     },
     update: {
-      commandId: "staff.timesheets.time_entries.update",
+      commandId: staffTimeEntryCommandIds.update,
       schema: rawBodySchema,
       mapInput: async ({ raw, ctx }) => {
         const { translate } = await resolveTranslations();
@@ -106,7 +107,7 @@ const crud = makeCrudRoute({
       response: () => ({ ok: true })
     },
     delete: {
-      commandId: "staff.timesheets.time_entries.delete",
+      commandId: staffTimeEntryCommandIds.delete,
       schema: rawBodySchema,
       mapInput: async ({ parsed, ctx }) => {
         const { translate } = await resolveTranslations();

package/dist/modules/staff/api/timesheets/time-entries/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/time-entries/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { StaffTimeEntry } from '../../../data/entities'\nimport { staffTimeEntryCreateSchema, staffTimeEntryUpdateSchema } from '../../../data/validators'\nimport { buildTimeEntryListFilters, isParseableDateFilter } from '../../../lib/timesheets/timeEntryListFilters'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  staff_member_id: 'staff_member_id',\n  date: 'date',\n  duration_minutes: 'duration_minutes',\n  started_at: 'started_at',\n  ended_at: 'ended_at',\n  notes: 'notes',\n  time_project_id: 'time_project_id',\n  customer_id: 'customer_id',\n  deal_id: 'deal_id',\n  order_id: 'order_id',\n  source: 'source',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst dateFilterSchema = z\n  .string()\n  .refine(isParseableDateFilter, { message: 'Invalid date' })\n  .optional()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    staffMemberId: z.string().uuid().optional(),\n    from: dateFilterSchema,\n    to: dateFilterSchema,\n    projectId: z.string().uuid().optional(),\n    ids: z.string().optional(),\n    running: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeEntry,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: 'staff:staff_time_entry' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_entry',\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.staff_member_id,\n      F.date,\n      F.duration_minutes,\n      F.started_at,\n      F.ended_at,\n      F.notes,\n      F.time_project_id,\n      F.customer_id,\n      F.deal_id,\n      F.order_id,\n      F.source,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      date: F.date,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      durationMinutes: F.duration_minutes,\n    },\n    buildFilters: async (query) => buildTimeEntryListFilters(query),\n  },\n  actions: {\n    create: {\n      commandId: 'staff.timesheets.time_entries.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeEntryCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.timeEntryId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'staff.timesheets.time_entries.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeEntryUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'staff.timesheets.time_entries.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst timeEntryListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  staff_member_id: z.string().uuid().nullable().optional(),\n  date: z.string().nullable().optional(),\n  duration_minutes: z.number().nullable().optional(),\n  started_at: z.string().nullable().optional(),\n  ended_at: z.string().nullable().optional(),\n  notes: z.string().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  deal_id: z.string().uuid().nullable().optional(),\n  order_id: z.string().uuid().nullable().optional(),\n  source: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeEntry',\n  pluralName: 'TimeEntries',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(timeEntryListItemSchema),\n  create: {\n    schema: staffTimeEntryCreateSchema,\n    description: 'Creates a time entry for a staff member.',\n  },\n  update: {\n    schema: staffTimeEntryUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a time entry by id.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Deletes a time entry by id.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,sBAAsB;AAC/B,SAAS,4BAA4B,kCAAkC;AACvE,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC5E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAChF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,mBAAmB,EACtB,OAAO,EACP,OAAO,uBAAuB,EAAE,SAAS,eAAe,CAAC,EACzD,SAAS;AAEZ,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAEf,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,yBAAyB;AAAA,EAChD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,EAAE;AAAA,MACR,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,iBAAiB,EAAE;AAAA,IACrB;AAAA,IACA,cAAc,OAAO,UAAU,0BAA0B,KAAK;AAAA,EAChE;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,4BAA4B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACtF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,eAAe,KAAK;AAAA,MAC7D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,4BAA4B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACtF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,uBAAuB;AAAA,EACzE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { StaffTimeEntry } from '../../../data/entities'\nimport { staffTimeEntryCreateSchema, staffTimeEntryUpdateSchema } from '../../../data/validators'\nimport { buildTimeEntryListFilters, isParseableDateFilter } from '../../../lib/timesheets/timeEntryListFilters'\nimport { staffTimeEntryCommandIds } from '../../../lib/crud'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  staff_member_id: 'staff_member_id',\n  date: 'date',\n  duration_minutes: 'duration_minutes',\n  started_at: 'started_at',\n  ended_at: 'ended_at',\n  notes: 'notes',\n  time_project_id: 'time_project_id',\n  customer_id: 'customer_id',\n  deal_id: 'deal_id',\n  order_id: 'order_id',\n  source: 'source',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst dateFilterSchema = z\n  .string()\n  .refine(isParseableDateFilter, { message: 'Invalid date' })\n  .optional()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    staffMemberId: z.string().uuid().optional(),\n    from: dateFilterSchema,\n    to: dateFilterSchema,\n    projectId: z.string().uuid().optional(),\n    ids: z.string().optional(),\n    running: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeEntry,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: 'staff:staff_time_entry' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_entry',\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.staff_member_id,\n      F.date,\n      F.duration_minutes,\n      F.started_at,\n      F.ended_at,\n      F.notes,\n      F.time_project_id,\n      F.customer_id,\n      F.deal_id,\n      F.order_id,\n      F.source,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      date: F.date,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      durationMinutes: F.duration_minutes,\n    },\n    buildFilters: async (query) => buildTimeEntryListFilters(query),\n  },\n  actions: {\n    create: {\n      commandId: staffTimeEntryCommandIds.create,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeEntryCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.timeEntryId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: staffTimeEntryCommandIds.update,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeEntryUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: staffTimeEntryCommandIds.delete,\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst timeEntryListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  staff_member_id: z.string().uuid().nullable().optional(),\n  date: z.string().nullable().optional(),\n  duration_minutes: z.number().nullable().optional(),\n  started_at: z.string().nullable().optional(),\n  ended_at: z.string().nullable().optional(),\n  notes: z.string().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  deal_id: z.string().uuid().nullable().optional(),\n  order_id: z.string().uuid().nullable().optional(),\n  source: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeEntry',\n  pluralName: 'TimeEntries',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(timeEntryListItemSchema),\n  create: {\n    schema: staffTimeEntryCreateSchema,\n    description: 'Creates a time entry for a staff member.',\n  },\n  update: {\n    schema: staffTimeEntryUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a time entry by id.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Deletes a time entry by id.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,sBAAsB;AAC/B,SAAS,4BAA4B,kCAAkC;AACvE,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,gCAAgC;AACzC,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC5E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAChF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,mBAAmB,EACtB,OAAO,EACP,OAAO,uBAAuB,EAAE,SAAS,eAAe,CAAC,EACzD,SAAS;AAEZ,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAEf,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,yBAAyB;AAAA,EAChD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,EAAE;AAAA,MACR,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,iBAAiB,EAAE;AAAA,IACrB;AAAA,IACA,cAAc,OAAO,UAAU,0BAA0B,KAAK;AAAA,EAChE;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW,yBAAyB;AAAA,MACpC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,4BAA4B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACtF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,eAAe,KAAK;AAAA,MAC7D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,yBAAyB;AAAA,MACpC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,4BAA4B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACtF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,yBAAyB;AAAA,MACpC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,uBAAuB;AAAA,EACzE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": []
 }

package/dist/modules/staff/lib/crud.js

@@ -18,6 +18,11 @@ const staffTeamMemberAddressCrudEvents = buildCrudEvents("address");
 const staffTeamMemberCommentCrudEvents = buildCrudEvents("comment");
 const staffTeamMemberActivityCrudEvents = buildCrudEvents("activity");
 const staffTeamMemberJobHistoryCrudEvents = buildCrudEvents("job_history");
+const staffTimeEntryCommandIds = {
+  create: "staff.timesheets.time_entries.create",
+  update: "staff.timesheets.time_entries.update",
+  delete: "staff.timesheets.time_entries.delete"
+};
 const staffTimeEntryCrudEvents = buildCrudEvents("timesheets.time_entry");
 const staffTimeProjectCrudEvents = buildCrudEvents("timesheets.time_project");
 const staffTimeProjectMemberCrudEvents = buildCrudEvents("timesheets.time_project_member");
@@ -30,6 +35,7 @@ export {
   staffTeamMemberCrudEvents,
   staffTeamMemberJobHistoryCrudEvents,
   staffTeamRoleCrudEvents,
+  staffTimeEntryCommandIds,
   staffTimeEntryCrudEvents,
   staffTimeProjectCrudEvents,
   staffTimeProjectMemberCrudEvents

package/dist/modules/staff/lib/crud.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/staff/lib/crud.ts"],
-  "sourcesContent": ["import type { CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'\nimport type {\n  StaffLeaveRequest,\n  StaffTeam,\n  StaffTeamMember,\n  StaffTeamMemberActivity,\n  StaffTeamMemberAddress,\n  StaffTeamMemberComment,\n  StaffTeamMemberJobHistory,\n  StaffTeamRole,\n  StaffTimeEntry,\n  StaffTimeProject,\n  StaffTimeProjectMember,\n} from '../data/entities'\n\nfunction buildCrudEvents<TEntity>(entity: string): CrudEventsConfig<TEntity> {\n  return {\n    module: 'staff',\n    entity,\n    persistent: true,\n    buildPayload: (ctx) => ({\n      id: ctx.identifiers.id,\n      organizationId: ctx.identifiers.organizationId,\n      tenantId: ctx.identifiers.tenantId,\n    }),\n  }\n}\n\nexport const staffTeamCrudEvents = buildCrudEvents<StaffTeam>('team')\nexport const staffTeamRoleCrudEvents = buildCrudEvents<StaffTeamRole>('team_role')\nexport const staffTeamMemberCrudEvents = buildCrudEvents<StaffTeamMember>('team_member')\nexport const staffLeaveRequestCrudEvents = buildCrudEvents<StaffLeaveRequest>('leave_request')\nexport const staffTeamMemberAddressCrudEvents = buildCrudEvents<StaffTeamMemberAddress>('address')\nexport const staffTeamMemberCommentCrudEvents = buildCrudEvents<StaffTeamMemberComment>('comment')\nexport const staffTeamMemberActivityCrudEvents = buildCrudEvents<StaffTeamMemberActivity>('activity')\nexport const staffTeamMemberJobHistoryCrudEvents = buildCrudEvents<StaffTeamMemberJobHistory>('job_history')\n\n// Timesheets\nexport const staffTimeEntryCrudEvents = buildCrudEvents<StaffTimeEntry>('timesheets.time_entry')\nexport const staffTimeProjectCrudEvents = buildCrudEvents<StaffTimeProject>('timesheets.time_project')\nexport const staffTimeProjectMemberCrudEvents = buildCrudEvents<StaffTimeProjectMember>('timesheets.time_project_member')\n"],
-  "mappings": "AAeA,SAAS,gBAAyB,QAA2C;AAC3E,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA,YAAY;AAAA,IACZ,cAAc,CAAC,SAAS;AAAA,MACtB,IAAI,IAAI,YAAY;AAAA,MACpB,gBAAgB,IAAI,YAAY;AAAA,MAChC,UAAU,IAAI,YAAY;AAAA,IAC5B;AAAA,EACF;AACF;AAEO,MAAM,sBAAsB,gBAA2B,MAAM;AAC7D,MAAM,0BAA0B,gBAA+B,WAAW;AAC1E,MAAM,4BAA4B,gBAAiC,aAAa;AAChF,MAAM,8BAA8B,gBAAmC,eAAe;AACtF,MAAM,mCAAmC,gBAAwC,SAAS;AAC1F,MAAM,mCAAmC,gBAAwC,SAAS;AAC1F,MAAM,oCAAoC,gBAAyC,UAAU;AAC7F,MAAM,sCAAsC,gBAA2C,aAAa;AAGpG,MAAM,2BAA2B,gBAAgC,uBAAuB;AACxF,MAAM,6BAA6B,gBAAkC,yBAAyB;AAC9F,MAAM,mCAAmC,gBAAwC,gCAAgC;",
+  "sourcesContent": ["import type { CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'\nimport type {\n  StaffLeaveRequest,\n  StaffTeam,\n  StaffTeamMember,\n  StaffTeamMemberActivity,\n  StaffTeamMemberAddress,\n  StaffTeamMemberComment,\n  StaffTeamMemberJobHistory,\n  StaffTeamRole,\n  StaffTimeEntry,\n  StaffTimeProject,\n  StaffTimeProjectMember,\n} from '../data/entities'\n\nfunction buildCrudEvents<TEntity>(entity: string): CrudEventsConfig<TEntity> {\n  return {\n    module: 'staff',\n    entity,\n    persistent: true,\n    buildPayload: (ctx) => ({\n      id: ctx.identifiers.id,\n      organizationId: ctx.identifiers.organizationId,\n      tenantId: ctx.identifiers.tenantId,\n    }),\n  }\n}\n\nexport const staffTeamCrudEvents = buildCrudEvents<StaffTeam>('team')\nexport const staffTeamRoleCrudEvents = buildCrudEvents<StaffTeamRole>('team_role')\nexport const staffTeamMemberCrudEvents = buildCrudEvents<StaffTeamMember>('team_member')\nexport const staffLeaveRequestCrudEvents = buildCrudEvents<StaffLeaveRequest>('leave_request')\nexport const staffTeamMemberAddressCrudEvents = buildCrudEvents<StaffTeamMemberAddress>('address')\nexport const staffTeamMemberCommentCrudEvents = buildCrudEvents<StaffTeamMemberComment>('comment')\nexport const staffTeamMemberActivityCrudEvents = buildCrudEvents<StaffTeamMemberActivity>('activity')\nexport const staffTeamMemberJobHistoryCrudEvents = buildCrudEvents<StaffTeamMemberJobHistory>('job_history')\n\n// Timesheets\n/**\n * Command ids the time-entries CRUD route registers. Exported so the route and the\n * cache-invalidation helper share one string: `makeCrudRoute` derives the CRUD cache\n * resource tag from the create id, so a second copy of it drifting apart would leave\n * custom write routes flushing a tag nothing is stored under (#4970).\n */\nexport const staffTimeEntryCommandIds = {\n  create: 'staff.timesheets.time_entries.create',\n  update: 'staff.timesheets.time_entries.update',\n  delete: 'staff.timesheets.time_entries.delete',\n} as const\n\nexport const staffTimeEntryCrudEvents = buildCrudEvents<StaffTimeEntry>('timesheets.time_entry')\nexport const staffTimeProjectCrudEvents = buildCrudEvents<StaffTimeProject>('timesheets.time_project')\nexport const staffTimeProjectMemberCrudEvents = buildCrudEvents<StaffTimeProjectMember>('timesheets.time_project_member')\n"],
+  "mappings": "AAeA,SAAS,gBAAyB,QAA2C;AAC3E,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA,YAAY;AAAA,IACZ,cAAc,CAAC,SAAS;AAAA,MACtB,IAAI,IAAI,YAAY;AAAA,MACpB,gBAAgB,IAAI,YAAY;AAAA,MAChC,UAAU,IAAI,YAAY;AAAA,IAC5B;AAAA,EACF;AACF;AAEO,MAAM,sBAAsB,gBAA2B,MAAM;AAC7D,MAAM,0BAA0B,gBAA+B,WAAW;AAC1E,MAAM,4BAA4B,gBAAiC,aAAa;AAChF,MAAM,8BAA8B,gBAAmC,eAAe;AACtF,MAAM,mCAAmC,gBAAwC,SAAS;AAC1F,MAAM,mCAAmC,gBAAwC,SAAS;AAC1F,MAAM,oCAAoC,gBAAyC,UAAU;AAC7F,MAAM,sCAAsC,gBAA2C,aAAa;AASpG,MAAM,2BAA2B;AAAA,EACtC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,MAAM,2BAA2B,gBAAgC,uBAAuB;AACxF,MAAM,6BAA6B,gBAAkC,yBAAyB;AAC9F,MAAM,mCAAmC,gBAAwC,gCAAgC;",
   "names": []
 }

package/dist/modules/staff/lib/timesheets/timeEntryCacheInvalidation.js

@@ -0,0 +1,32 @@
+import {
+  canonicalizeResourceTag,
+  deriveResourceFromCommandId,
+  invalidateCrudCache
+} from "@open-mercato/shared/lib/crud/cache";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { staffTimeEntryCommandIds } from "../crud.js";
+const logger = createLogger("staff").child({ component: "timesheets-cache" });
+const staffTimeEntryCacheResource = canonicalizeResourceTag(deriveResourceFromCommandId(staffTimeEntryCommandIds.create)) ?? "staff.timesheet";
+async function invalidateStaffTimeEntryCache(container, identifiers, fallbackTenant, reason) {
+  try {
+    await invalidateCrudCache(
+      container,
+      staffTimeEntryCacheResource,
+      identifiers,
+      fallbackTenant,
+      reason
+    );
+  } catch (err) {
+    logger.warn("Time-entry cache invalidation failed", {
+      resource: staffTimeEntryCacheResource,
+      recordId: identifiers.id ?? null,
+      reason,
+      err
+    });
+  }
+}
+export {
+  invalidateStaffTimeEntryCache,
+  staffTimeEntryCacheResource
+};
+//# sourceMappingURL=timeEntryCacheInvalidation.js.map

package/dist/modules/staff/lib/timesheets/timeEntryCacheInvalidation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/staff/lib/timesheets/timeEntryCacheInvalidation.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport {\n  canonicalizeResourceTag,\n  deriveResourceFromCommandId,\n  invalidateCrudCache,\n  type CrudCacheIdentifiers,\n} from '@open-mercato/shared/lib/crud/cache'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { staffTimeEntryCommandIds } from '../crud'\n\nconst logger = createLogger('staff').child({ component: 'timesheets-cache' })\n\n/**\n * The resource tag the CRUD list cache stores time-entry payloads under.\n *\n * `makeCrudRoute` derives it from the create action's command id (the route declares\n * no `events` config), which singularizes the command's SECOND segment \u2014 so the tag\n * is `staff.timesheet`, NOT the `staff.time_entry` the entity name suggests. Deriving\n * it here through the same shared helpers keeps the flush tag equal to the store tag;\n * a hand-typed literal is how a custom write route silently flushes nothing (#3143,\n * #3711). The literal fallback only guards against a null derivation at runtime \u2014 the\n * unit test pins the derived value so drift fails in CI instead of in production.\n */\nexport const staffTimeEntryCacheResource =\n  canonicalizeResourceTag(deriveResourceFromCommandId(staffTimeEntryCommandIds.create)) ?? 'staff.timesheet'\n\n/**\n * Flush the cached time-entry collections and record entries after a committed write.\n *\n * Custom write routes that mutate `StaffTimeEntry` through the EntityManager bypass\n * `makeCrudRoute`'s own POST/PUT/DELETE handlers and the command bus, so neither of\n * the platform's two `invalidateCrudCache` call sites runs for them. Without this the\n * opt-in CRUD list cache (`ENABLE_CRUD_API_CACHE`) keeps serving the pre-write payload\n * and the weekly timesheet grid reloads without the rows it just saved (#4970).\n *\n * MUST be called after the transaction commits, never inside it. Because the write is\n * already committed by then, a failing cache backend is logged rather than thrown \u2014 the\n * command bus guards its own invalidation the same way. Surfacing it would turn a\n * successful write into an error response and invite a duplicating client retry, while\n * swallowing it costs at most one TTL of staleness.\n */\nexport async function invalidateStaffTimeEntryCache(\n  container: AwilixContainer,\n  identifiers: CrudCacheIdentifiers,\n  fallbackTenant: string | null,\n  reason: string,\n): Promise<void> {\n  try {\n    await invalidateCrudCache(\n      container,\n      staffTimeEntryCacheResource,\n      identifiers,\n      fallbackTenant,\n      reason,\n    )\n  } catch (err) {\n    logger.warn('Time-entry cache invalidation failed', {\n      resource: staffTimeEntryCacheResource,\n      recordId: identifiers.id ?? null,\n      reason,\n      err,\n    })\n  }\n}\n"],
+  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,mBAAmB,CAAC;AAarE,MAAM,8BACX,wBAAwB,4BAA4B,yBAAyB,MAAM,CAAC,KAAK;AAiB3F,eAAsB,8BACpB,WACA,aACA,gBACA,QACe;AACf,MAAI;AACF,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,KAAK,wCAAwC;AAAA,MAClD,UAAU;AAAA,MACV,UAAU,YAAY,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.6881.1.8ea75912f2",
+  "version": "0.6.8-develop.6889.1.af4501ca97",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6881.1.8ea75912f2",
-    "@open-mercato/shared": "0.6.8-develop.6881.1.8ea75912f2",
-    "@open-mercato/ui": "0.6.8-develop.6881.1.8ea75912f2",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6889.1.af4501ca97",
+    "@open-mercato/shared": "0.6.8-develop.6889.1.af4501ca97",
+    "@open-mercato/ui": "0.6.8-develop.6889.1.af4501ca97",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6881.1.8ea75912f2",
-    "@open-mercato/shared": "0.6.8-develop.6881.1.8ea75912f2",
-    "@open-mercato/ui": "0.6.8-develop.6881.1.8ea75912f2",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6889.1.af4501ca97",
+    "@open-mercato/shared": "0.6.8-develop.6889.1.af4501ca97",
+    "@open-mercato/ui": "0.6.8-develop.6889.1.af4501ca97",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/modules/customers/api/dashboard/widgets/customer-todos/route.ts

@@ -4,7 +4,6 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveWidgetScope, type WidgetScopeContext } from '../utils'
 import { resolveCustomerInteractionFeatureFlags } from '../../../../lib/interactionFeatureFlags'
-import { CUSTOMER_INTERACTION_TODO_ADAPTER_SOURCE } from '../../../../lib/interactionCompatibility'
 import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import {
@@ -91,7 +90,6 @@ export async function GET(req: Request) {
             organizationIds ?? null,
             {
               includeDeleted: true,
-              source: CUSTOMER_INTERACTION_TODO_ADAPTER_SOURCE,
               limit: mergedWindow,
             },
           ),

package/src/modules/customers/api/interactions/tasks/route.ts

@@ -8,7 +8,6 @@ import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
 import { createCustomersCrudOpenApi, createPagedListResponseSchema } from '../../openapi'
 import { resolveCustomerInteractionFeatureFlags } from '../../../lib/interactionFeatureFlags'
 import { resolveCustomersRequestContext } from '../../../lib/interactionRequestContext'
-import { CUSTOMER_INTERACTION_TODO_ADAPTER_SOURCE } from '../../../lib/interactionCompatibility'
 import {
   filterTodoRows,
   listCanonicalTodoRows,
@@ -33,9 +32,9 @@ export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['customers.interactions.view'] },
 }
 
-// Per-source fetch cap used when the legacy adapter must merge legacy and
-// canonical-bridge rows without DB-side union. Bounds memory on tenants with
-// large task history.
+// Per-source fetch cap used when compatibility mode must merge legacy todo
+// links and canonical task rows without DB-side union. Bounds memory on
+// tenants with large task history.
 const MERGED_TASK_FETCH_CAP = 2000
 
 export async function GET(request: Request): Promise<Response> {
@@ -91,7 +90,6 @@ export async function GET(request: Request): Promise<Response> {
         {
           entityId: query.entityId,
           includeDeleted: true,
-          source: CUSTOMER_INTERACTION_TODO_ADAPTER_SOURCE,
           limit: legacyWindow,
         },
       ),