@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/api/timesheets/reports/route.js

@@ -0,0 +1,316 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { staffTimeReportCrudEvents } from "../../../lib/crud.js";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { resolveCrudRecordId, parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
+import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { StaffTimeReport, StaffTimeReportProject } from "../../../data/entities.js";
+import { staffTimeReportCreateSchema, staffTimeReportUpdateSchema } from "../../../data/validators.js";
+import { staffTimeReportCommandIds } from "../../../commands/timesheets-reports.js";
+import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.js";
+import { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from "../../../lib/time-tracking/access.js";
+import { readTimeTrackingSettings } from "../../../lib/time-tracking/settings.js";
+import { sanitizeSearchTerm } from "../../helpers.js";
+import { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from "../../openapi.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/reports" });
+const F = {
+  id: "id",
+  tenant_id: "tenant_id",
+  organization_id: "organization_id",
+  customer_id: "customer_id",
+  customer_snapshot: "customer_snapshot",
+  reference: "reference",
+  title: "title",
+  period_kind: "period_kind",
+  period_from: "period_from",
+  period_to: "period_to",
+  currency_code: "currency_code",
+  grouping: "grouping",
+  nonbillable_mode: "nonbillable_mode",
+  include_already_reported: "include_already_reported",
+  show_rates: "show_rates",
+  rounding_unit_minutes: "rounding_unit_minutes",
+  rounding_direction: "rounding_direction",
+  status: "status",
+  total_billable_minutes: "total_billable_minutes",
+  total_nonbillable_minutes: "total_nonbillable_minutes",
+  total_amount: "total_amount",
+  closed_at: "closed_at",
+  closed_by_user_id: "closed_by_user_id",
+  created_by_user_id: "created_by_user_id",
+  created_at: "created_at",
+  updated_at: "updated_at"
+};
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ["staff.timesheets.reports.view"] },
+  POST: { requireAuth: true, requireFeatures: ["staff.timesheets.reports.manage"] },
+  PUT: { requireAuth: true, requireFeatures: ["staff.timesheets.reports.manage"] },
+  DELETE: { requireAuth: true, requireFeatures: ["staff.timesheets.reports.manage"] }
+};
+const metadata = routeMetadata;
+const rawBodySchema = z.object({}).passthrough();
+const listSchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(50),
+  q: z.string().optional(),
+  id: z.string().optional(),
+  ids: z.string().optional(),
+  customerId: z.string().uuid().optional(),
+  status: z.enum(["draft", "closed"]).optional(),
+  sortField: z.string().optional(),
+  sortDir: z.enum(["asc", "desc"]).optional()
+}).passthrough();
+const IMPOSSIBLE_ID = "00000000-0000-0000-0000-000000000000";
+const DENIED_ACCESS = { canManageAll: false, projectIds: [], staffMemberId: null };
+const accessByRequest = /* @__PURE__ */ new WeakMap();
+async function resolveAssignmentGraceDays(container, tenantId) {
+  try {
+    const configService = container.resolve("moduleConfigService");
+    const settings = await readTimeTrackingSettings(configService, { tenantId });
+    return settings.access.assignmentGraceDays;
+  } catch {
+    return null;
+  }
+}
+async function loadProjectAccess(container, userId, tenantId, organizationId) {
+  if (!tenantId || !organizationId) return { ...DENIED_ACCESS };
+  const scope = { tenantId, organizationId };
+  try {
+    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope);
+    const em = container.resolve("em");
+    return await resolveProjectAccess({
+      em: em.fork(),
+      userId,
+      tenantId,
+      organizationId,
+      canManageAll: access.allowed,
+      userFeatures: access.grantedFeatures,
+      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId)
+    });
+  } catch (err) {
+    logger.error("staff.timesheets.reports access resolution failed", { err });
+    return { ...DENIED_ACCESS };
+  }
+}
+async function resolveListProjectAccess(ctx) {
+  const tenantId = ctx.auth?.tenantId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+  const load = () => loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId);
+  const request = ctx.request;
+  if (!request) return load();
+  const cached = accessByRequest.get(request);
+  if (cached) return cached;
+  const pending = load();
+  accessByRequest.set(request, pending);
+  return pending;
+}
+function splitIdList(value) {
+  if (typeof value !== "string" || value.trim().length === 0) return null;
+  const ids = value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  return ids.length > 0 ? ids : [];
+}
+async function reportIdsForProjects(ctx, projectIds) {
+  if (projectIds.length === 0) return [];
+  const tenantId = ctx.auth?.tenantId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+  if (!tenantId || !organizationId) return [];
+  const em = ctx.container.resolve("em").fork();
+  const rows = await em.find(StaffTimeReportProject, {
+    timeProjectId: { $in: [...projectIds] },
+    tenantId,
+    organizationId
+  });
+  return Array.from(new Set(rows.map((row) => row.reportId)));
+}
+async function buildReportListFilters(query, ctx) {
+  const filters = {};
+  let narrowIds = null;
+  for (const raw of [query.ids, query.id]) {
+    const parsed = splitIdList(raw);
+    if (parsed === null) continue;
+    narrowIds = narrowIds ? narrowIds.filter((id) => parsed.includes(id)) : parsed;
+  }
+  const access = await resolveListProjectAccess(ctx);
+  if (!access.canManageAll) {
+    const allowed = await reportIdsForProjects(ctx, access.projectIds);
+    narrowIds = narrowIds ? narrowIds.filter((id) => allowed.includes(id)) : allowed;
+    if (narrowIds.length === 0) {
+      filters[F.id] = { $in: [IMPOSSIBLE_ID] };
+      return filters;
+    }
+  }
+  if (narrowIds !== null) {
+    if (narrowIds.length === 0) {
+      filters[F.id] = { $in: [IMPOSSIBLE_ID] };
+      return filters;
+    }
+    filters[F.id] = { $in: narrowIds };
+  }
+  if (typeof query.customerId === "string" && query.customerId.trim().length > 0) {
+    filters[F.customer_id] = query.customerId.trim();
+  }
+  if (typeof query.status === "string" && query.status.length > 0) {
+    filters[F.status] = query.status;
+  }
+  const term = sanitizeSearchTerm(query.q);
+  if (term) {
+    filters[F.title] = { $ilike: `%${escapeLikePattern(term)}%` };
+  }
+  return filters;
+}
+const reportListFields = [
+  F.id,
+  F.organization_id,
+  F.tenant_id,
+  F.customer_id,
+  F.customer_snapshot,
+  F.reference,
+  F.title,
+  F.period_kind,
+  F.period_from,
+  F.period_to,
+  F.currency_code,
+  F.grouping,
+  F.nonbillable_mode,
+  F.include_already_reported,
+  F.show_rates,
+  F.rounding_unit_minutes,
+  F.rounding_direction,
+  F.status,
+  F.total_billable_minutes,
+  F.total_nonbillable_minutes,
+  F.total_amount,
+  F.closed_at,
+  F.closed_by_user_id,
+  F.created_by_user_id,
+  F.created_at,
+  F.updated_at
+];
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: StaffTimeReport,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId",
+    softDeleteField: "deletedAt"
+  },
+  events: staffTimeReportCrudEvents,
+  enrichers: { entityId: "staff:staff_time_report" },
+  indexer: { entityType: "staff:staff_time_report" },
+  list: {
+    schema: listSchema,
+    entityId: "staff:staff_time_report",
+    fields: [...reportListFields],
+    defaultSort: { field: F.created_at, dir: "desc" },
+    tiebreakSortField: F.id,
+    sortFieldMap: {
+      createdAt: F.created_at,
+      updatedAt: F.updated_at,
+      reference: F.reference,
+      title: F.title,
+      periodFrom: F.period_from,
+      periodTo: F.period_to,
+      status: F.status,
+      totalAmount: F.total_amount
+    },
+    buildFilters: buildReportListFilters
+  },
+  actions: {
+    create: {
+      commandId: staffTimeReportCommandIds.create,
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return parseScopedCommandInput(staffTimeReportCreateSchema, raw ?? {}, ctx, translate);
+      },
+      response: ({ result }) => ({ id: result?.reportId ?? null }),
+      status: 201
+    },
+    update: {
+      commandId: staffTimeReportCommandIds.update,
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return parseScopedCommandInput(staffTimeReportUpdateSchema, raw ?? {}, ctx, translate);
+      },
+      response: () => ({ ok: true })
+    },
+    delete: {
+      commandId: staffTimeReportCommandIds.delete,
+      schema: rawBodySchema,
+      mapInput: async ({ parsed, ctx }) => {
+        const { translate } = await resolveTranslations();
+        const id = resolveCrudRecordId(parsed, ctx, translate);
+        return { id };
+      },
+      response: () => ({ ok: true })
+    }
+  }
+});
+const GET = crud.GET;
+const POST = crud.POST;
+const PUT = crud.PUT;
+const DELETE = crud.DELETE;
+const reportListItemSchema = z.object({
+  id: z.string().uuid().nullable().optional(),
+  organization_id: z.string().uuid().nullable().optional(),
+  tenant_id: z.string().uuid().nullable().optional(),
+  customer_id: z.string().uuid().nullable().optional(),
+  customer_snapshot: z.record(z.string(), z.unknown()).nullable().optional(),
+  reference: z.string().nullable().optional(),
+  title: z.string().nullable().optional(),
+  period_kind: z.string().nullable().optional(),
+  period_from: z.string().nullable().optional(),
+  period_to: z.string().nullable().optional(),
+  currency_code: z.string().nullable().optional(),
+  grouping: z.string().nullable().optional(),
+  nonbillable_mode: z.string().nullable().optional(),
+  include_already_reported: z.boolean().nullable().optional(),
+  show_rates: z.boolean().nullable().optional(),
+  rounding_unit_minutes: z.number().int().nullable().optional(),
+  rounding_direction: z.string().nullable().optional(),
+  status: z.string().nullable().optional(),
+  total_billable_minutes: z.number().int().nullable().optional(),
+  total_nonbillable_minutes: z.number().int().nullable().optional(),
+  total_amount: z.union([z.string(), z.number()]).nullable().optional(),
+  closed_at: z.string().nullable().optional(),
+  closed_by_user_id: z.string().uuid().nullable().optional(),
+  created_by_user_id: z.string().uuid().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional()
+});
+const openApi = createStaffCrudOpenApi({
+  resourceName: "TimeReport",
+  pluralName: "Time Reports",
+  querySchema: listSchema,
+  listResponseSchema: createPagedListResponseSchema(reportListItemSchema),
+  create: {
+    schema: staffTimeReportCreateSchema,
+    description: "Creates a draft customer report and allocates its RAP-<year>-<seq> reference. Every selected project must belong to `customerId` and the projects must agree on a currency; a mismatch is refused with 422 report_currency_conflict naming the offenders."
+  },
+  update: {
+    schema: staffTimeReportUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description: "Updates a draft report. A closed report is refused with 409 report_closed \u2014 unlock it first. Replacing `timeProjectIds` re-asserts the single-customer and single-currency rules."
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description: "Soft-deletes a draft report. A closed report is refused with 409 report_closed, because deleting it would strand the entries it froze."
+  }
+});
+export {
+  DELETE,
+  GET,
+  POST,
+  PUT,
+  buildReportListFilters,
+  metadata,
+  openApi,
+  reportListFields,
+  reportListItemSchema,
+  resolveListProjectAccess
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/reports/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/reports/route.ts"],
+  "sourcesContent": ["/**\n * Customer reports \u2014 the collection behind screens 13, 14 and 15.\n *\n * Two things beyond plain CRUD:\n *\n *  1. **Project access is intersected into the list.** `reports.view` is a Team\n *     Leader feature and a Team Leader normally also holds\n *     `staff.timesheets.projects.manage`, so the common path is unrestricted.\n *     A caller granted `reports.view` WITHOUT `projects.manage` is nonetheless\n *     narrowed to reports that include at least one project they are a member\n *     of \u2014 the same fail-closed shape the tasks and projects routes use, so a\n *     future grant can never turn this route into a customer-list oracle.\n *  2. **Writes go through the report commands**, which own the single-customer\n *     and single-currency assertions (risk R2) and the `RAP-<year>-<seq>`\n *     allocation. The factory's command path is also the mutation-guard wiring,\n *     so this file deliberately does not call `runRouteMutationGuards` itself.\n */\n\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeReportCrudEvents } from '../../../lib/crud'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeReport, StaffTimeReportProject } from '../../../data/entities'\nimport { staffTimeReportCreateSchema, staffTimeReportUpdateSchema } from '../../../data/validators'\nimport { staffTimeReportCommandIds } from '../../../commands/timesheets-reports'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess, type ProjectAccess } from '../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { sanitizeSearchTerm } from '../../helpers'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports' })\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  customer_id: 'customer_id',\n  customer_snapshot: 'customer_snapshot',\n  reference: 'reference',\n  title: 'title',\n  period_kind: 'period_kind',\n  period_from: 'period_from',\n  period_to: 'period_to',\n  currency_code: 'currency_code',\n  grouping: 'grouping',\n  nonbillable_mode: 'nonbillable_mode',\n  include_already_reported: 'include_already_reported',\n  show_rates: 'show_rates',\n  rounding_unit_minutes: 'rounding_unit_minutes',\n  rounding_direction: 'rounding_direction',\n  status: 'status',\n  total_billable_minutes: 'total_billable_minutes',\n  total_nonbillable_minutes: 'total_nonbillable_minutes',\n  total_amount: 'total_amount',\n  closed_at: 'closed_at',\n  closed_by_user_id: 'closed_by_user_id',\n  created_by_user_id: 'created_by_user_id',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    q: z.string().optional(),\n    id: z.string().optional(),\n    ids: z.string().optional(),\n    customerId: z.string().uuid().optional(),\n    status: z.enum(['draft', 'closed']).optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype ReportListQuery = z.infer<typeof listSchema>\n\nconst IMPOSSIBLE_ID = '00000000-0000-0000-0000-000000000000'\n\nconst DENIED_ACCESS: ProjectAccess = { canManageAll: false, projectIds: [], staffMemberId: null }\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nconst accessByRequest = new WeakMap<Request, Promise<ProjectAccess>>()\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<ProjectAccess> {\n  if (!tenantId || !organizationId) return { ...DENIED_ACCESS }\n  const scope = { tenantId, organizationId }\n  try {\n    // One lookup, one authority, and a failure that says so. The previous\n    // `catch \u2192 []` could not tell \"denied\" from \"could not ask\", so an RBAC\n    // hiccup silently demoted a manager to their own memberships.\n    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope)\n    const em = container.resolve('em') as EntityManager\n    return await resolveProjectAccess({\n      em: em.fork(),\n      userId,\n      tenantId,\n      organizationId,\n      canManageAll: access.allowed,\n      userFeatures: access.grantedFeatures,\n      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n    })\n  } catch (err) {\n    logger.error('staff.timesheets.reports access resolution failed', { err })\n    return { ...DENIED_ACCESS }\n  }\n}\n\nexport async function resolveListProjectAccess(ctx: CrudCtx): Promise<ProjectAccess> {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const load = () => loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId)\n  const request = ctx.request\n  if (!request) return load()\n  const cached = accessByRequest.get(request)\n  if (cached) return cached\n  const pending = load()\n  accessByRequest.set(request, pending)\n  return pending\n}\n\nfunction splitIdList(value: unknown): string[] | null {\n  if (typeof value !== 'string' || value.trim().length === 0) return null\n  const ids = value\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0)\n  return ids.length > 0 ? ids : []\n}\n\n/**\n * Reports the caller may see when they are not a project manager: those whose\n * selection touches at least one project they are an active member of.\n */\nasync function reportIdsForProjects(\n  ctx: CrudCtx,\n  projectIds: readonly string[],\n): Promise<string[]> {\n  if (projectIds.length === 0) return []\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!tenantId || !organizationId) return []\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const rows = await em.find(StaffTimeReportProject, {\n    timeProjectId: { $in: [...projectIds] },\n    tenantId,\n    organizationId,\n  })\n  return Array.from(new Set(rows.map((row) => row.reportId)))\n}\n\nexport async function buildReportListFilters(\n  query: ReportListQuery,\n  ctx: CrudCtx,\n): Promise<Record<string, unknown>> {\n  const filters: Record<string, unknown> = {}\n\n  let narrowIds: string[] | null = null\n  for (const raw of [query.ids, query.id]) {\n    const parsed = splitIdList(raw)\n    if (parsed === null) continue\n    narrowIds = narrowIds ? narrowIds.filter((id) => parsed.includes(id)) : parsed\n  }\n\n  const access = await resolveListProjectAccess(ctx)\n  if (!access.canManageAll) {\n    const allowed = await reportIdsForProjects(ctx, access.projectIds)\n    narrowIds = narrowIds ? narrowIds.filter((id) => allowed.includes(id)) : allowed\n    if (narrowIds.length === 0) {\n      filters[F.id] = { $in: [IMPOSSIBLE_ID] }\n      return filters\n    }\n  }\n\n  if (narrowIds !== null) {\n    if (narrowIds.length === 0) {\n      filters[F.id] = { $in: [IMPOSSIBLE_ID] }\n      return filters\n    }\n    filters[F.id] = { $in: narrowIds }\n  }\n\n  if (typeof query.customerId === 'string' && query.customerId.trim().length > 0) {\n    filters[F.customer_id] = query.customerId.trim()\n  }\n  if (typeof query.status === 'string' && query.status.length > 0) {\n    filters[F.status] = query.status\n  }\n\n  const term = sanitizeSearchTerm(query.q)\n  if (term) {\n    filters[F.title] = { $ilike: `%${escapeLikePattern(term)}%` }\n  }\n\n  return filters\n}\n\nexport const reportListFields = [\n  F.id,\n  F.organization_id,\n  F.tenant_id,\n  F.customer_id,\n  F.customer_snapshot,\n  F.reference,\n  F.title,\n  F.period_kind,\n  F.period_from,\n  F.period_to,\n  F.currency_code,\n  F.grouping,\n  F.nonbillable_mode,\n  F.include_already_reported,\n  F.show_rates,\n  F.rounding_unit_minutes,\n  F.rounding_direction,\n  F.status,\n  F.total_billable_minutes,\n  F.total_nonbillable_minutes,\n  F.total_amount,\n  F.closed_at,\n  F.closed_by_user_id,\n  F.created_by_user_id,\n  F.created_at,\n  F.updated_at,\n] as const\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeReport,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeReportCrudEvents,\n  enrichers: { entityId: 'staff:staff_time_report' },\n  indexer: { entityType: 'staff:staff_time_report' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_report',\n    fields: [...reportListFields],\n    defaultSort: { field: F.created_at, dir: 'desc' },\n    tiebreakSortField: F.id,\n    sortFieldMap: {\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      reference: F.reference,\n      title: F.title,\n      periodFrom: F.period_from,\n      periodTo: F.period_to,\n      status: F.status,\n      totalAmount: F.total_amount,\n    },\n    buildFilters: buildReportListFilters,\n  },\n  actions: {\n    create: {\n      commandId: staffTimeReportCommandIds.create,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeReportCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.reportId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: staffTimeReportCommandIds.update,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeReportUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: staffTimeReportCommandIds.delete,\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nexport const reportListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  customer_snapshot: z.record(z.string(), z.unknown()).nullable().optional(),\n  reference: z.string().nullable().optional(),\n  title: z.string().nullable().optional(),\n  period_kind: z.string().nullable().optional(),\n  period_from: z.string().nullable().optional(),\n  period_to: z.string().nullable().optional(),\n  currency_code: z.string().nullable().optional(),\n  grouping: z.string().nullable().optional(),\n  nonbillable_mode: z.string().nullable().optional(),\n  include_already_reported: z.boolean().nullable().optional(),\n  show_rates: z.boolean().nullable().optional(),\n  rounding_unit_minutes: z.number().int().nullable().optional(),\n  rounding_direction: z.string().nullable().optional(),\n  status: z.string().nullable().optional(),\n  total_billable_minutes: z.number().int().nullable().optional(),\n  total_nonbillable_minutes: z.number().int().nullable().optional(),\n  total_amount: z.union([z.string(), z.number()]).nullable().optional(),\n  closed_at: z.string().nullable().optional(),\n  closed_by_user_id: z.string().uuid().nullable().optional(),\n  created_by_user_id: z.string().uuid().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeReport',\n  pluralName: 'Time Reports',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(reportListItemSchema),\n  create: {\n    schema: staffTimeReportCreateSchema,\n    description:\n      'Creates a draft customer report and allocates its RAP-<year>-<seq> reference. Every selected project must belong to `customerId` and the projects must agree on a currency; a mismatch is refused with 422 report_currency_conflict naming the offenders.',\n  },\n  update: {\n    schema: staffTimeReportUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Updates a draft report. A closed report is refused with 409 report_closed \u2014 unlock it first. Replacing `timeProjectIds` re-asserts the single-customer and single-currency rules.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Soft-deletes a draft report. A closed report is refused with 409 report_closed, because deleting it would strand the entries it froze.',\n  },\n})\n"],
+  "mappings": "AAkBA,SAAS,SAAS;AAElB,SAAS,qBAAmC;AAC5C,SAAS,iCAAiC;AAC1C,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,SAAS,iBAAiB,8BAA8B;AACxD,SAAS,6BAA6B,mCAAmC;AACzE,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,4BAAgD;AAClF,SAAS,gCAAgC;AACzC,SAAS,0BAA0B;AACnC,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAElF,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,WAAW;AAAA,EACX,OAAO;AAAA,EACP,aAAa;AAAA,EACb,aAAa;AAAA,EACb,WAAW;AAAA,EACX,eAAe;AAAA,EACf,UAAU;AAAA,EACV,kBAAkB;AAAA,EAClB,0BAA0B;AAAA,EAC1B,YAAY;AAAA,EACZ,uBAAuB;AAAA,EACvB,oBAAoB;AAAA,EACpB,QAAQ;AAAA,EACR,wBAAwB;AAAA,EACxB,2BAA2B;AAAA,EAC3B,cAAc;AAAA,EACd,WAAW;AAAA,EACX,mBAAmB;AAAA,EACnB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC7E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAChF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAC/E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACpF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA,EACvB,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,EACxB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAIf,MAAM,gBAAgB;AAEtB,MAAM,gBAA+B,EAAE,cAAc,OAAO,YAAY,CAAC,GAAG,eAAe,KAAK;AAWhG,MAAM,kBAAkB,oBAAI,QAAyC;AAErE,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACwB;AACxB,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,EAAE,GAAG,cAAc;AAC5D,QAAM,QAAQ,EAAE,UAAU,eAAe;AACzC,MAAI;AAIF,UAAM,SAAS,MAAM,qBAAqB,WAAW,QAAQ,CAAC,uBAAuB,GAAG,KAAK;AAC7F,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,qBAAqB;AAAA,MAChC,IAAI,GAAG,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,IAC3E,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AACzE,WAAO,EAAE,GAAG,cAAc;AAAA,EAC5B;AACF;AAEA,eAAsB,yBAAyB,KAAsC;AACnF,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,OAAO,MAAM,kBAAkB,IAAI,WAAW,IAAI,MAAM,OAAO,MAAM,UAAU,cAAc;AACnG,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAM,SAAS,gBAAgB,IAAI,OAAO;AAC1C,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,KAAK;AACrB,kBAAgB,IAAI,SAAS,OAAO;AACpC,SAAO;AACT;AAEA,SAAS,YAAY,OAAiC;AACpD,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO;AACnE,QAAM,MAAM,MACT,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,SAAO,IAAI,SAAS,IAAI,MAAM,CAAC;AACjC;AAMA,eAAe,qBACb,KACA,YACmB;AACnB,MAAI,WAAW,WAAW,EAAG,QAAO,CAAC;AACrC,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,CAAC;AAC1C,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,GAAG,KAAK,wBAAwB;AAAA,IACjD,eAAe,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE;AAAA,IACtC;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,MAAM,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;AAC5D;AAEA,eAAsB,uBACpB,OACA,KACkC;AAClC,QAAM,UAAmC,CAAC;AAE1C,MAAI,YAA6B;AACjC,aAAW,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,GAAG;AACvC,UAAM,SAAS,YAAY,GAAG;AAC9B,QAAI,WAAW,KAAM;AACrB,gBAAY,YAAY,UAAU,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,IAAI;AAAA,EAC1E;AAEA,QAAM,SAAS,MAAM,yBAAyB,GAAG;AACjD,MAAI,CAAC,OAAO,cAAc;AACxB,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,UAAU;AACjE,gBAAY,YAAY,UAAU,OAAO,CAAC,OAAO,QAAQ,SAAS,EAAE,CAAC,IAAI;AACzE,QAAI,UAAU,WAAW,GAAG;AAC1B,cAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACvC,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,cAAc,MAAM;AACtB,QAAI,UAAU,WAAW,GAAG;AAC1B,cAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACvC,aAAO;AAAA,IACT;AACA,YAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,UAAU;AAAA,EACnC;AAEA,MAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,KAAK,EAAE,SAAS,GAAG;AAC9E,YAAQ,EAAE,WAAW,IAAI,MAAM,WAAW,KAAK;AAAA,EACjD;AACA,MAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,SAAS,GAAG;AAC/D,YAAQ,EAAE,MAAM,IAAI,MAAM;AAAA,EAC5B;AAEA,QAAM,OAAO,mBAAmB,MAAM,CAAC;AACvC,MAAI,MAAM;AACR,YAAQ,EAAE,KAAK,IAAI,EAAE,QAAQ,IAAI,kBAAkB,IAAI,CAAC,IAAI;AAAA,EAC9D;AAEA,SAAO;AACT;AAEO,MAAM,mBAAmB;AAAA,EAC9B,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AACJ;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,WAAW,EAAE,UAAU,0BAA0B;AAAA,EACjD,SAAS,EAAE,YAAY,0BAA0B;AAAA,EACjD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,CAAC,GAAG,gBAAgB;AAAA,IAC5B,aAAa,EAAE,OAAO,EAAE,YAAY,KAAK,OAAO;AAAA,IAChD,mBAAmB,EAAE;AAAA,IACrB,cAAc;AAAA,MACZ,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,OAAO,EAAE;AAAA,MACT,YAAY,EAAE;AAAA,MACd,UAAU,EAAE;AAAA,MACZ,QAAQ,EAAE;AAAA,MACV,aAAa,EAAE;AAAA,IACjB;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW,0BAA0B;AAAA,MACrC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,6BAA6B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACvF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,YAAY,KAAK;AAAA,MAC1D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,0BAA0B;AAAA,MACrC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,6BAA6B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACvF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,0BAA0B;AAAA,MACrC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAEpB,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACzE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,0BAA0B,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,oBAAoB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAChE,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,oBAAoB;AAAA,EACtE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aACE;AAAA,EACJ;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AACF,CAAC;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/reports/shared.js

@@ -0,0 +1,63 @@
+import { RATES_FEATURE } from "../../../lib/time-tracking/moneyVisibility.js";
+import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.js";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { reportSheetLabels } from "../../../lib/timesheets-reports/reportLabels.js";
+const MAX_SHEET_ROWS = 500;
+function extractReportIdFromUrl(url, segment) {
+  if (!url) return null;
+  try {
+    const pathname = new URL(url).pathname;
+    const match = pathname.match(new RegExp(`/reports/([^/]+)/${segment}`));
+    return match?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+async function resolveReportRequestContext(req, options) {
+  const container = await createRequestContainer();
+  const auth = await getAuthFromRequest(req);
+  const { translate } = await resolveTranslations();
+  if (!auth) {
+    throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+  }
+  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+  const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null;
+  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+  if (!tenantId || !organizationId) {
+    throw new CrudHttpError(400, {
+      error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
+    });
+  }
+  const reportId = extractReportIdFromUrl(req.url, options.segment);
+  if (!reportId) {
+    throw new CrudHttpError(400, {
+      error: translate("staff.time_tracking.reports.errors.idRequired", "Report id is required.")
+    });
+  }
+  const ratesAccess = await resolveFeatureAccess(container, auth.sub ?? null, [RATES_FEATURE], {
+    tenantId,
+    organizationId
+  });
+  return {
+    container,
+    auth,
+    organizationScope,
+    tenantId,
+    organizationId,
+    reportId,
+    translate,
+    grantedFeatures: ratesAccess.grantedFeatures,
+    canSeeMoney: ratesAccess.allowed
+  };
+}
+export {
+  MAX_SHEET_ROWS,
+  extractReportIdFromUrl,
+  reportSheetLabels,
+  resolveReportRequestContext
+};
+//# sourceMappingURL=shared.js.map

package/dist/modules/staff/api/timesheets/reports/shared.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/reports/shared.ts"],
+  "sourcesContent": ["/**\n * Shared boilerplate for the hand-written report sub-routes (`sheet`, `close`,\n * `unlock`, `export`).\n *\n * Four routes needing the same six lines of auth, scope, id extraction and\n * granted-feature resolution is exactly the situation where one of them\n * eventually forgets the tenant filter. Resolving it in one place makes that\n * impossible rather than unlikely.\n */\n\nimport { RATES_FEATURE } from '../../../lib/time-tracking/moneyVisibility'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { reportSheetLabels } from '../../../lib/timesheets-reports/reportLabels'\n\nexport { reportSheetLabels }\n\n/**\n * Cap on the raw rows a sheet response carries. A report covering a quarter of a\n * ten-person team can run into the thousands, and the screen paginates anyway;\n * the response says when it truncated rather than quietly serving a short list.\n */\nexport const MAX_SHEET_ROWS = 500\n\nexport type Translate = (key: string, fallback: string) => string\n\nexport type ReportRequestContext = {\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>\n  organizationScope: Awaited<ReturnType<typeof resolveOrganizationScopeForRequest>>\n  tenantId: string\n  organizationId: string\n  reportId: string\n  translate: Translate\n  /**\n   * The caller's grants, for the plumbing that takes a list: the approval\n   * policies, the interceptor context and the mutation-guard registry. Always an\n   * array, never `null` \u2014 a nullable grant list is what let \"RBAC could not\n   * answer\" read as \"no restriction\" on these routes.\n   *\n   * Empty means the same thing whether RBAC answered \"nothing\" or could not\n   * answer at all, and every consumer treats it the same fail-closed way: an\n   * approval policy that requires a feature refuses, a feature-gated interceptor\n   * does not run, and a feature-gated guard does not run. Authorization never\n   * rests on it \u2014 `canSeeMoney` and each route's own `resolveFeatureAccess` gate\n   * are the decisions, and both fail closed on their own. `resolveFeatureAccess`\n   * logs a grant list it could not read, so an outage is visible to operators\n   * without a flag here that no caller can act on.\n   */\n  grantedFeatures: string[]\n  /** Fail-closed `staff.timesheets.rates.view` decision \u2014 never re-derive it. */\n  canSeeMoney: boolean\n}\n\nexport function extractReportIdFromUrl(url: string | undefined, segment: string): string | null {\n  if (!url) return null\n  try {\n    const pathname = new URL(url).pathname\n    const match = pathname.match(new RegExp(`/reports/([^/]+)/${segment}`))\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport async function resolveReportRequestContext(\n  req: Request,\n  options: { segment: string },\n): Promise<ReportRequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) {\n    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const reportId = extractReportIdFromUrl(req.url, options.segment)\n  if (!reportId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.reports.errors.idRequired', 'Report id is required.'),\n    })\n  }\n\n  // One lookup, through the module's single RBAC authority, answering both\n  // questions the four routes ask: may this caller see money, and what is the\n  // grant list the plumbing wants. Decided here, once, so no route re-derives it\n  // and none can pick the other failure direction.\n  //\n  // `resolveFeatureAccess` fails closed on every path \u2014 an unresolvable service,\n  // a service that cannot answer, a call that throws \u2014 so an RBAC outage hides\n  // rates and costs instead of handing them to a plain report viewer.\n  const ratesAccess = await resolveFeatureAccess(container, auth.sub ?? null, [RATES_FEATURE], {\n    tenantId,\n    organizationId,\n  })\n\n  return {\n    container,\n    auth,\n    organizationScope,\n    tenantId,\n    organizationId,\n    reportId,\n    translate,\n    grantedFeatures: ratesAccess.grantedFeatures,\n    canSeeMoney: ratesAccess.allowed,\n  }\n}\n"],
+  "mappings": "AAUA,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAS3B,MAAM,iBAAiB;AAgCvB,SAAS,uBAAuB,KAAyB,SAAgC;AAC9F,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,GAAG,EAAE;AAC9B,UAAM,QAAQ,SAAS,MAAM,IAAI,OAAO,oBAAoB,OAAO,EAAE,CAAC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,4BACpB,KACA,SAC+B;AAC/B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,EAChG;AAEA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,uBAAuB,IAAI,KAAK,QAAQ,OAAO;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,iDAAiD,wBAAwB;AAAA,IAC5F,CAAC;AAAA,EACH;AAUA,QAAM,cAAc,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,aAAa,GAAG;AAAA,IAC3F;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,YAAY;AAAA,IAC7B,aAAa,YAAY;AAAA,EAC3B;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/settings/reapply-rounding/route.js

@@ -0,0 +1,164 @@
+import { NextResponse } from "next/server";
+import { resolveFeatureAccess } from "../../../../lib/time-tracking/featureAccess.js";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { emitStaffEvent } from "../../../../events.js";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { STAFF_TIME_TRACKING_RESOURCE_KINDS } from "../../../guards.js";
+import { runTimesheetInterceptors } from "../../_shared/withTimesheetInterceptors.js";
+import {
+  STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,
+  STAFF_TIME_REAPPLY_ROUNDING_QUEUE,
+  countReapplyRoundingCandidates,
+  getStaffQueue
+} from "../../../../lib/time-tracking/reapplyRounding.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/settings/reapply-rounding" });
+const MANAGE_FEATURE = "staff.timesheets.settings.manage";
+const RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.settings;
+const RESOURCE_ID = "time_tracking";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] }
+};
+const responseSchema = z.object({
+  ok: z.boolean(),
+  progressJobId: z.string().uuid().nullable(),
+  /** Entries eligible for restatement — locked ones are not among them. */
+  candidateCount: z.number().int()
+});
+async function POST(req) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    const { translate } = await resolveTranslations();
+    if (!auth) {
+      throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+    const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null;
+    if (!tenantId) {
+      throw new CrudHttpError(400, {
+        error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
+      });
+    }
+    const actorId = typeof auth.sub === "string" && auth.sub.trim().length > 0 ? auth.sub : "system";
+    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+    const access = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId });
+    if (!access.allowed) {
+      throw forbidden(translate("staff.errors.forbidden", "Forbidden"));
+    }
+    const grantedFeatures = access.grantedFeatures;
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "POST",
+      scope: {
+        container,
+        userId: actorId,
+        tenantId,
+        organizationId,
+        userFeatures: grantedFeatures,
+        tenantGlobal: true
+      },
+      body: await readJsonSafe(req, {})
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
+    const guardResult = await runRouteMutationGuards({
+      container,
+      req,
+      auth: {
+        userId: actorId,
+        tenantId,
+        organizationId,
+        userFeatures: grantedFeatures
+      },
+      input: {
+        resourceKind: RESOURCE_KIND,
+        resourceId: RESOURCE_ID,
+        operation: "update",
+        mutationPayload: { action: "reapply-rounding" }
+      }
+    });
+    if (!guardResult.ok) return guardResult.response;
+    const scope = {
+      tenantId,
+      // `filterIds === null` means the caller may act across every organization of
+      // the tenant, which is what a tenant-global rule is about; anything narrower
+      // restates only what the caller can already see.
+      organizationIds: organizationScope?.filterIds ?? (organizationId ? [organizationId] : null),
+      userId: actorId
+    };
+    const em = container.resolve("em");
+    const candidateCount = await countReapplyRoundingCandidates(em.fork(), scope);
+    if (candidateCount === 0) {
+      await guardResult.runAfterSuccess();
+      return session.respond(200, responseSchema.parse({ ok: true, progressJobId: null, candidateCount: 0 }));
+    }
+    const progressService = container.resolve("progressService");
+    const progressJob = await progressService.createJob(
+      {
+        jobType: STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,
+        name: translate("staff.time_tracking.settings.retro.jobName", "Reapply rounding to existing entries"),
+        description: translate(
+          "staff.time_tracking.settings.retro.jobDescription",
+          "Recomputing rounded time on existing entries. Locked entries are not changed."
+        ),
+        totalCount: candidateCount,
+        cancellable: true,
+        meta: { source: "staff.timesheets.settings.reapply-rounding" }
+      },
+      { tenantId, organizationId, userId: actorId }
+    );
+    const queue = getStaffQueue(STAFF_TIME_REAPPLY_ROUNDING_QUEUE);
+    await queue.enqueue({ progressJobId: progressJob.id, scope });
+    await guardResult.runAfterSuccess();
+    void emitStaffEvent("staff.timesheets.time_tracking.rounding_reapplied", {
+      tenantId,
+      organizationId,
+      progressJobId: progressJob.id,
+      candidateCount
+    }, { persistent: true }).catch((err) => {
+      logger.error("staff.timesheets emit time_tracking.rounding_reapplied failed", { err });
+    });
+    return session.respond(202, responseSchema.parse({ ok: true, progressJobId: progressJob.id, candidateCount }));
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    logger.error("staff.timesheets.settings.reapply-rounding failed", { err });
+    const { translate } = await resolveTranslations();
+    return NextResponse.json(
+      { error: translate("staff.errors.internal", "Internal server error") },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: "Staff",
+  summary: "Reapply the rounding rule to existing entries",
+  methods: {
+    POST: {
+      summary: "Queue a retroactive rounding job",
+      description: "Enqueues a `ProgressJob` that recomputes `rounded_minutes` on existing time entries under the tenant\u2019s current rounding rule. Entries locked into a closed report are excluded \u2014 a billed amount is never restated. Returns `202` with `progressJobId`, or `200` with a null job id when there is nothing to restate.",
+      responses: [
+        { status: 200, description: "Nothing to restate", schema: responseSchema },
+        { status: 202, description: "Job queued", schema: responseSchema },
+        { status: 400, description: "Missing scope", schema: z.object({ error: z.string() }) },
+        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 403, description: "Missing staff.timesheets.settings.manage" },
+        { status: 500, description: "Queueing failure", schema: z.object({ error: z.string() }) }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/settings/reapply-rounding/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/staff/api/timesheets/settings/reapply-rounding/route.ts"],
+  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/settings/reapply-rounding` \u2014 screen 16 note 3 (T7.3).\n *\n * The mockup draws retroactive rounding as a switch. It is implemented as an\n * **action**, because the two are not the same promise: a switch that rewrites\n * `rounded_minutes` across a tenant's history when the settings form is saved\n * changes invoiced amounts as a side effect of an unrelated save. This endpoint\n * makes it something a person does, once, on purpose, with a progress bar and a\n * final count.\n *\n * It enqueues; it does not do the work. Restating a tenant's entries is exactly the\n * long-running job the progress module exists for, so the response is a `202` with\n * a `progressJobId` that the top bar picks up on its own.\n *\n * Locked entries are never touched \u2014 the candidate query excludes them and the\n * command excludes them again, independently.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ProgressService } from '../../../../../progress/lib/progressService'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../guards'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n  STAFF_TIME_REAPPLY_ROUNDING_QUEUE,\n  countReapplyRoundingCandidates,\n  getStaffQueue,\n  type ReapplyRoundingScope,\n} from '../../../../lib/time-tracking/reapplyRounding'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/settings/reapply-rounding' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.settings.manage'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.settings\nconst RESOURCE_ID = 'time_tracking'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst responseSchema = z.object({\n  ok: z.boolean(),\n  progressJobId: z.string().uuid().nullable(),\n  /** Entries eligible for restatement \u2014 locked ones are not among them. */\n  candidateCount: z.number().int(),\n})\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n    if (!tenantId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const actorId = typeof auth.sub === 'string' && auth.sub.trim().length > 0 ? auth.sub : 'system'\n    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const access = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!access.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = access.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: {\n        container,\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n        tenantGlobal: true,\n      },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: RESOURCE_ID,\n        operation: 'update',\n        mutationPayload: { action: 'reapply-rounding' },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const scope: ReapplyRoundingScope = {\n      tenantId,\n      // `filterIds === null` means the caller may act across every organization of\n      // the tenant, which is what a tenant-global rule is about; anything narrower\n      // restates only what the caller can already see.\n      organizationIds: organizationScope?.filterIds ?? (organizationId ? [organizationId] : null),\n      userId: actorId,\n    }\n\n    const em = container.resolve('em') as EntityManager\n    const candidateCount = await countReapplyRoundingCandidates(em.fork(), scope)\n    if (candidateCount === 0) {\n      // Nothing to restate: no job, no progress bar, no queue traffic. The caller\n      // gets an honest zero rather than a job that completes instantly.\n      await guardResult.runAfterSuccess()\n      return session.respond(200, responseSchema.parse({ ok: true, progressJobId: null, candidateCount: 0 }))\n    }\n\n    const progressService = container.resolve('progressService') as ProgressService\n    const progressJob = await progressService.createJob(\n      {\n        jobType: STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n        name: translate('staff.time_tracking.settings.retro.jobName', 'Reapply rounding to existing entries'),\n        description: translate(\n          'staff.time_tracking.settings.retro.jobDescription',\n          'Recomputing rounded time on existing entries. Locked entries are not changed.',\n        ),\n        totalCount: candidateCount,\n        cancellable: true,\n        meta: { source: 'staff.timesheets.settings.reapply-rounding' },\n      },\n      { tenantId, organizationId, userId: actorId },\n    )\n\n    const queue = getStaffQueue(STAFF_TIME_REAPPLY_ROUNDING_QUEUE)\n    await queue.enqueue({ progressJobId: progressJob.id, scope })\n\n    await guardResult.runAfterSuccess()\n\n    void emitStaffEvent('staff.timesheets.time_tracking.rounding_reapplied', {\n      tenantId,\n      organizationId,\n      progressJobId: progressJob.id,\n      candidateCount,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_tracking.rounding_reapplied failed', { err })\n    })\n\n    return session.respond(202, responseSchema.parse({ ok: true, progressJobId: progressJob.id, candidateCount }))\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.settings.reapply-rounding failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reapply the rounding rule to existing entries',\n  methods: {\n    POST: {\n      summary: 'Queue a retroactive rounding job',\n      description:\n        'Enqueues a `ProgressJob` that recomputes `rounded_minutes` on existing time entries under the tenant\u2019s current rounding rule. Entries locked into a closed report are excluded \u2014 a billed amount is never restated. Returns `202` with `progressJobId`, or `200` with a null job id when there is nothing to restate.',\n      responses: [\n        { status: 200, description: 'Nothing to restate', schema: responseSchema },\n        { status: 202, description: 'Job queued', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Missing staff.timesheets.settings.manage' },\n        { status: 500, description: 'Queueing failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAkBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAG/B,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,2CAA2C,CAAC;AAEpG,MAAM,iBAAiB;AACvB,MAAM,gBAAgB,mCAAmC;AACzD,MAAM,cAAc;AAEb,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ;AAAA,EACd,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE1C,gBAAgB,EAAE,OAAO,EAAE,IAAI;AACjC,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,UAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,IAAI,KAAK,MAAM;AACxF,UAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AAKtE,UAAM,SAAS,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AAC5G,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,OAAO;AAE/B,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB,EAAE,QAAQ,mBAAmB;AAAA,MAChD;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,QAA8B;AAAA,MAClC;AAAA;AAAA;AAAA;AAAA,MAIA,iBAAiB,mBAAmB,cAAc,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACtF,QAAQ;AAAA,IACV;AAEA,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,iBAAiB,MAAM,+BAA+B,GAAG,KAAK,GAAG,KAAK;AAC5E,QAAI,mBAAmB,GAAG;AAGxB,YAAM,YAAY,gBAAgB;AAClC,aAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,MAAM,gBAAgB,EAAE,CAAC,CAAC;AAAA,IACxG;AAEA,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,cAAc,MAAM,gBAAgB;AAAA,MACxC;AAAA,QACE,SAAS;AAAA,QACT,MAAM,UAAU,8CAA8C,sCAAsC;AAAA,QACpG,aAAa;AAAA,UACX;AAAA,UACA;AAAA,QACF;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,MAAM,EAAE,QAAQ,6CAA6C;AAAA,MAC/D;AAAA,MACA,EAAE,UAAU,gBAAgB,QAAQ,QAAQ;AAAA,IAC9C;AAEA,UAAM,QAAQ,cAAc,iCAAiC;AAC7D,UAAM,MAAM,QAAQ,EAAE,eAAe,YAAY,IAAI,MAAM,CAAC;AAE5D,UAAM,YAAY,gBAAgB;AAElC,SAAK,eAAe,qDAAqD;AAAA,MACvE;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,iEAAiE,EAAE,IAAI,CAAC;AAAA,IACvF,CAAC;AAED,WAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,YAAY,IAAI,eAAe,CAAC,CAAC;AAAA,EAC/G,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AACzE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,eAAe;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,eAAe;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}