@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/api/timesheets/tags/task-assignments/route.js

@@ -0,0 +1,233 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { emitStaffEvent } from "../../../../events.js";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { runTimesheetInterceptors } from "../../_shared/withTimesheetInterceptors.js";
+import {
+  staffTimeTaskTagAssignmentSchema
+} from "../../../../data/validators.js";
+import { staffTimeTagCommandIds } from "../../../../commands/timesheets-tags.js";
+import {
+  STAFF_TIME_TRACKING_RESOURCE_KINDS,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards
+} from "../../../guards.js";
+import { loadTagProjectAccess, requireAccessibleTask } from "../access.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/tags/task-assignments" });
+const RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.taskTag;
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["staff.timesheets.tasks.manage"] },
+  DELETE: { requireAuth: true, requireFeatures: ["staff.timesheets.tasks.manage"] }
+};
+const assignResponseSchema = z.object({
+  taskId: z.string().uuid(),
+  tagIds: z.array(z.string().uuid()),
+  assignedTagIds: z.array(z.string().uuid()),
+  alreadyAssignedTagIds: z.array(z.string().uuid())
+});
+const unassignResponseSchema = z.object({
+  taskId: z.string().uuid(),
+  tagIds: z.array(z.string().uuid()),
+  removedTagIds: z.array(z.string().uuid()),
+  notAssignedTagIds: z.array(z.string().uuid())
+});
+async function buildContext(req) {
+  const container = await createRequestContainer();
+  const auth = await getAuthFromRequest(req);
+  const { translate } = await resolveTranslations();
+  if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+  const ctx = {
+    container,
+    auth,
+    organizationScope: scope,
+    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+    request: req
+  };
+  return { ctx, translate };
+}
+function requireAssignmentScope(ctx, translate) {
+  const tenantId = ctx.auth?.tenantId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+  const userId = ctx.auth?.sub ?? null;
+  if (!tenantId || !organizationId || !userId) {
+    throw new CrudHttpError(400, {
+      error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
+    });
+  }
+  return { tenantId, organizationId, userId };
+}
+async function handle(req, commandId, operation) {
+  const { ctx, translate } = await buildContext(req);
+  const scope = requireAssignmentScope(ctx, translate);
+  const interceptors = await runTimesheetInterceptors({
+    request: req,
+    method: operation === "create" ? "POST" : "DELETE",
+    scope: {
+      container: ctx.container,
+      userId: scope.userId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId
+    },
+    body: await readJsonSafe(req, {})
+  });
+  if (!interceptors.ok) return interceptors.response;
+  const { session } = interceptors;
+  const input = parseScopedCommandInput(staffTimeTaskTagAssignmentSchema, session.body, ctx, translate);
+  const access = await loadTagProjectAccess(ctx.container, scope);
+  const em = ctx.container.resolve("em").fork();
+  await requireAccessibleTask(em, input.taskId, scope, access, translate);
+  const guardResult = await runStaffMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: RESOURCE_KIND,
+      resourceId: input.taskId,
+      operation,
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input
+    }
+  );
+  if (!guardResult.ok) {
+    return NextResponse.json(guardResult.errorBody ?? { error: "Operation blocked by guard" }, {
+      status: guardResult.errorStatus ?? 422
+    });
+  }
+  const commandBus = ctx.container.resolve("commandBus");
+  const { result, logEntry } = await commandBus.execute(commandId, { input, ctx });
+  if (guardResult.afterSuccessCallbacks.length) {
+    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: RESOURCE_KIND,
+      resourceId: input.taskId,
+      operation,
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
+  }
+  void emitStaffEvent("staff.timesheets.time_task.updated", {
+    id: input.taskId,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId
+  }, { persistent: true }).catch((err) => {
+    logger.error("staff.timesheets emit time_task.updated failed", { err });
+  });
+  const assignment = result;
+  const unassignment = result;
+  const payload = operation === "create" ? {
+    taskId: input.taskId,
+    tagIds: assignment?.tagIds ?? [],
+    assignedTagIds: assignment?.assignedTagIds ?? [],
+    alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? []
+  } : {
+    taskId: input.taskId,
+    tagIds: unassignment?.tagIds ?? [],
+    removedTagIds: unassignment?.removedTagIds ?? [],
+    notAssignedTagIds: unassignment?.notAssignedTagIds ?? []
+  };
+  const response = await session.respond(200, payload);
+  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
+    response.headers.set(
+      "x-om-operation",
+      serializeOperationMetadata({
+        id: logEntry.id,
+        undoToken: logEntry.undoToken,
+        commandId: logEntry.commandId,
+        actionLabel: logEntry.actionLabel ?? null,
+        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,
+        resourceId: logEntry.resourceId ?? input.taskId,
+        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : void 0
+      })
+    );
+  }
+  return response;
+}
+async function errorResponse(err, message) {
+  if (isCrudHttpError(err)) {
+    return NextResponse.json(err.body, { status: err.status });
+  }
+  const { translate } = await resolveTranslations();
+  if (err instanceof z.ZodError) {
+    return NextResponse.json(
+      { error: translate("staff.errors.invalid_request", "Invalid request"), details: err.issues },
+      { status: 400 }
+    );
+  }
+  logger.error(message, { err });
+  return NextResponse.json({ error: translate("staff.errors.internal", "Internal server error") }, { status: 500 });
+}
+async function POST(req) {
+  try {
+    return await handle(req, staffTimeTagCommandIds.assignTask, "create");
+  } catch (err) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    return errorResponse(err, "staff.timesheets.tags.task-assignments.POST failed");
+  }
+}
+async function DELETE(req) {
+  try {
+    return await handle(req, staffTimeTagCommandIds.unassignTask, "delete");
+  } catch (err) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    return errorResponse(err, "staff.timesheets.tags.task-assignments.DELETE failed");
+  }
+}
+const openApi = {
+  tag: "Staff",
+  summary: "Task tag assignments",
+  methods: {
+    POST: {
+      summary: "Assign tags to a task",
+      description: "Adds tags to a task. Idempotent \u2014 a tag the task already carries comes back in alreadyAssignedTagIds instead of failing. Refused with 404 when the task is outside the caller's project access.",
+      requestBody: { contentType: "application/json", schema: staffTimeTaskTagAssignmentSchema },
+      responses: [{ status: 200, description: "Tags assigned", schema: assignResponseSchema }],
+      errors: [
+        { status: 400, description: "Invalid payload or missing organization scope" },
+        { status: 401, description: "Unauthorized" },
+        { status: 403, description: "Missing staff.timesheets.tasks.manage" },
+        { status: 404, description: "Task not found or not accessible" },
+        { status: 422, description: "Unknown tag ids" }
+      ]
+    },
+    DELETE: {
+      summary: "Unassign tags from a task",
+      description: "Removes tags from a task. Idempotent \u2014 a tag the task does not carry comes back in notAssignedTagIds instead of failing.",
+      requestBody: { contentType: "application/json", schema: staffTimeTaskTagAssignmentSchema },
+      responses: [{ status: 200, description: "Tags unassigned", schema: unassignResponseSchema }],
+      errors: [
+        { status: 400, description: "Invalid payload or missing organization scope" },
+        { status: 401, description: "Unauthorized" },
+        { status: 403, description: "Missing staff.timesheets.tasks.manage" },
+        { status: 404, description: "Task not found or not accessible" }
+      ]
+    }
+  }
+};
+export {
+  DELETE,
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/tags/task-assignments/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/staff/api/timesheets/tags/task-assignments/route.ts"],
+  "sourcesContent": ["/**\n * Task tag assignment (T3.4) \u2014 the \"Dodaj tag\" chip in the task drawer of screen\n * 7 and the badges on the board cards of screen 6.\n *\n * `POST` adds the tags, `DELETE` removes them; both are idempotent, so the drawer\n * can re-send its chip list without special-casing what was already there.\n *\n * Every call resolves the caller's project access before it touches the task \u2014\n * see `../access.ts` for why that lookup and the 404 are shaped the way they are.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskTagAssignmentSchema,\n  type StaffTimeTaskTagAssignmentInput,\n} from '../../../../data/validators'\nimport { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { loadTagProjectAccess, requireAccessibleTask, type TagAssignmentScope } from '../access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags/task-assignments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.taskTag\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nconst assignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  assignedTagIds: z.array(z.string().uuid()),\n  alreadyAssignedTagIds: z.array(z.string().uuid()),\n})\n\nconst unassignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  removedTagIds: z.array(z.string().uuid()),\n  notAssignedTagIds: z.array(z.string().uuid()),\n})\n\ntype AssignmentResult = {\n  targetId: string\n  assignedTagIds: string[]\n  alreadyAssignedTagIds: string[]\n  tagIds: string[]\n}\n\ntype UnassignmentResult = {\n  targetId: string\n  removedTagIds: string[]\n  notAssignedTagIds: string[]\n  tagIds: string[]\n}\n\nasync function buildContext(\n  req: Request,\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction requireAssignmentScope(\n  ctx: CommandRuntimeContext,\n  translate: (key: string, fallback?: string) => string,\n): TagAssignmentScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const userId = ctx.auth?.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return { tenantId, organizationId, userId }\n}\n\nasync function handle(\n  req: Request,\n  commandId: string,\n  operation: 'create' | 'delete',\n): Promise<Response> {\n  const { ctx, translate } = await buildContext(req)\n  const scope = requireAssignmentScope(ctx, translate)\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: operation === 'create' ? 'POST' : 'DELETE',\n    scope: {\n      container: ctx.container,\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    body: await readJsonSafe<Record<string, unknown>>(req, {}),\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const input = parseScopedCommandInput(staffTimeTaskTagAssignmentSchema, session.body, ctx, translate)\n\n  const access = await loadTagProjectAccess(ctx.container, scope)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, input.taskId, scope, access, translate)\n\n  const guardResult = await runStaffMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n      status: guardResult.errorStatus ?? 422,\n    })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { result, logEntry } = await commandBus.execute<\n    StaffTimeTaskTagAssignmentInput,\n    AssignmentResult | UnassignmentResult\n  >(commandId, { input, ctx })\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  // A tag write is a change to the task itself, so it travels as the task's own\n  // `updated` event rather than an assignment-shaped one no subscriber knows about.\n  void emitStaffEvent('staff.timesheets.time_task.updated', {\n    id: input.taskId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_task.updated failed', { err })\n  })\n\n  const assignment = result as AssignmentResult | undefined\n  const unassignment = result as UnassignmentResult | undefined\n  const payload =\n    operation === 'create'\n      ? {\n          taskId: input.taskId,\n          tagIds: assignment?.tagIds ?? [],\n          assignedTagIds: assignment?.assignedTagIds ?? [],\n          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],\n        }\n      : {\n          taskId: input.taskId,\n          tagIds: unassignment?.tagIds ?? [],\n          removedTagIds: unassignment?.removedTagIds ?? [],\n          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],\n        }\n\n  const response = await session.respond(200, payload)\n  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n    response.headers.set(\n      'x-om-operation',\n      serializeOperationMetadata({\n        id: logEntry.id,\n        undoToken: logEntry.undoToken,\n        commandId: logEntry.commandId,\n        actionLabel: logEntry.actionLabel ?? null,\n        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n        resourceId: logEntry.resourceId ?? input.taskId,\n        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n      }),\n    )\n  }\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.assignTask, 'create')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.unassignTask, 'delete')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task tag assignments',\n  methods: {\n    POST: {\n      summary: 'Assign tags to a task',\n      description:\n        'Adds tags to a task. Idempotent \u2014 a tag the task already carries comes back in alreadyAssignedTagIds instead of failing. Refused with 404 when the task is outside the caller\\'s project access.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n        { status: 422, description: 'Unknown tag ids' },\n      ],\n    },\n    DELETE: {\n      summary: 'Unassign tags from a task',\n      description:\n        'Removes tags from a task. Idempotent \u2014 a tag the task does not carry comes back in notAssignedTagIds instead of failing.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,6BAAsD;AAErF,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC9C,CAAC;AAgBD,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,uBACP,KACA,WACoB;AACpB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,SAAS,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO;AAC5C;AAEA,eAAe,OACb,KACA,WACA,WACmB;AACnB,QAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,QAAM,QAAQ,uBAAuB,KAAK,SAAS;AAEnD,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ,cAAc,WAAW,SAAS;AAAA,IAC1C,OAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,EAC3D,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,QAAQ,wBAAwB,kCAAkC,QAAQ,MAAM,KAAK,SAAS;AAEpG,QAAM,SAAS,MAAM,qBAAqB,IAAI,WAAW,KAAK;AAC9D,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,sBAAsB,IAAI,MAAM,QAAQ,OAAO,QAAQ,SAAS;AAEtE,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,MACzF,QAAQ,YAAY,eAAe;AAAA,IACrC,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,WAAW,EAAE,OAAO,IAAI,CAAC;AAE3B,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAIA,OAAK,eAAe,sCAAsC;AAAA,IACxD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,EACxE,CAAC;AAED,QAAM,aAAa;AACnB,QAAM,eAAe;AACrB,QAAM,UACJ,cAAc,WACV;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,YAAY,UAAU,CAAC;AAAA,IAC/B,gBAAgB,YAAY,kBAAkB,CAAC;AAAA,IAC/C,uBAAuB,YAAY,yBAAyB,CAAC;AAAA,EAC/D,IACA;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,cAAc,UAAU,CAAC;AAAA,IACjC,eAAe,cAAc,iBAAiB,CAAC;AAAA,IAC/C,mBAAmB,cAAc,qBAAqB,CAAC;AAAA,EACzD;AAEN,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,OAAO;AACnD,MAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,2BAA2B;AAAA,QACzB,IAAI,SAAS;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS,eAAe;AAAA,QACrC,cAAc,SAAS,gBAAgB;AAAA,QACvC,YAAY,SAAS,cAAc,MAAM;AAAA,QACzC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,YAAY,QAAQ;AAAA,EACtE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,oDAAoD;AAAA,EAChF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,cAAc,QAAQ;AAAA,EACxE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,sDAAsD;AAAA,EAClF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,qBAAqB,CAAC;AAAA,MACvF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/task-statuses/route.js

@@ -0,0 +1,188 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { staffTimeTaskStatusCrudEvents } from "../../../lib/crud.js";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { resolveCrudRecordId, parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
+import { StaffTimeTaskStatus } from "../../../data/entities.js";
+import { staffTimeTaskStatusCreateSchema, staffTimeTaskStatusUpdateSchema } from "../../../data/validators.js";
+import { staffTimeTaskStatusCommandIds } from "../../../commands/timesheets-task-statuses.js";
+import { resolveListProjectAccess } from "../tasks/route.js";
+import { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from "../../openapi.js";
+const F = {
+  id: "id",
+  tenant_id: "tenant_id",
+  organization_id: "organization_id",
+  time_project_id: "time_project_id",
+  name: "name",
+  slug: "slug",
+  color: "color",
+  position: "position",
+  is_default: "is_default",
+  is_done: "is_done",
+  created_at: "created_at",
+  updated_at: "updated_at"
+};
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ["staff.timesheets.tasks.view"] },
+  POST: { requireAuth: true, requireFeatures: ["staff.timesheets.projects.manage"] },
+  PUT: { requireAuth: true, requireFeatures: ["staff.timesheets.projects.manage"] },
+  DELETE: { requireAuth: true, requireFeatures: ["staff.timesheets.projects.manage"] }
+};
+const metadata = routeMetadata;
+const rawBodySchema = z.object({}).passthrough();
+const listSchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(50),
+  ids: z.string().optional(),
+  timeProjectId: z.string().uuid().optional(),
+  sortField: z.string().optional(),
+  sortDir: z.enum(["asc", "desc"]).optional()
+}).passthrough();
+const IMPOSSIBLE_ID = "00000000-0000-0000-0000-000000000000";
+function splitIdList(value) {
+  if (typeof value !== "string" || value.trim().length === 0) return null;
+  const ids = value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  return ids.length > 0 ? ids : [];
+}
+async function buildTaskStatusListFilters(query, ctx) {
+  const filters = {};
+  const narrowIds = splitIdList(query.ids);
+  const requestedProjectId = typeof query.timeProjectId === "string" && query.timeProjectId.trim().length > 0 ? query.timeProjectId.trim() : null;
+  const access = await resolveListProjectAccess(ctx);
+  if (!access.canManageAll) {
+    const projectIds = requestedProjectId ? access.projectIds.filter((id) => id === requestedProjectId) : [...access.projectIds];
+    if (projectIds.length === 0) {
+      filters[F.time_project_id] = { $in: [IMPOSSIBLE_ID] };
+      return filters;
+    }
+    filters[F.time_project_id] = { $in: projectIds };
+  } else if (requestedProjectId) {
+    filters[F.time_project_id] = requestedProjectId;
+  }
+  if (narrowIds !== null) {
+    filters[F.id] = { $in: narrowIds.length > 0 ? narrowIds : [IMPOSSIBLE_ID] };
+  }
+  return filters;
+}
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: StaffTimeTaskStatus,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId",
+    softDeleteField: "deletedAt"
+  },
+  events: staffTimeTaskStatusCrudEvents,
+  indexer: { entityType: "staff:staff_time_task_status" },
+  list: {
+    schema: listSchema,
+    entityId: "staff:staff_time_task_status",
+    fields: [
+      F.id,
+      F.organization_id,
+      F.tenant_id,
+      F.time_project_id,
+      F.name,
+      F.slug,
+      F.color,
+      F.position,
+      F.is_default,
+      F.is_done,
+      F.created_at,
+      F.updated_at
+    ],
+    // The board renders left to right in `position` order, so that is the default
+    // sort rather than the usual created-at.
+    defaultSort: { field: F.position, dir: "asc" },
+    sortFieldMap: {
+      position: F.position,
+      name: F.name,
+      slug: F.slug,
+      createdAt: F.created_at,
+      updatedAt: F.updated_at
+    },
+    buildFilters: buildTaskStatusListFilters
+  },
+  actions: {
+    create: {
+      commandId: staffTimeTaskStatusCommandIds.create,
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return parseScopedCommandInput(staffTimeTaskStatusCreateSchema, raw ?? {}, ctx, translate);
+      },
+      response: ({ result }) => ({ id: result?.taskStatusId ?? null }),
+      status: 201
+    },
+    update: {
+      commandId: staffTimeTaskStatusCommandIds.update,
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return parseScopedCommandInput(staffTimeTaskStatusUpdateSchema, raw ?? {}, ctx, translate);
+      },
+      response: () => ({ ok: true })
+    },
+    delete: {
+      commandId: staffTimeTaskStatusCommandIds.delete,
+      schema: rawBodySchema,
+      mapInput: async ({ parsed, ctx }) => {
+        const { translate } = await resolveTranslations();
+        const id = resolveCrudRecordId(parsed, ctx, translate);
+        return { id };
+      },
+      response: () => ({ ok: true })
+    }
+  }
+});
+const GET = crud.GET;
+const POST = crud.POST;
+const PUT = crud.PUT;
+const DELETE = crud.DELETE;
+const taskStatusListItemSchema = z.object({
+  id: z.string().uuid().nullable().optional(),
+  organization_id: z.string().uuid().nullable().optional(),
+  tenant_id: z.string().uuid().nullable().optional(),
+  time_project_id: z.string().uuid().nullable().optional(),
+  name: z.string().nullable().optional(),
+  slug: z.string().nullable().optional(),
+  color: z.string().nullable().optional(),
+  position: z.number().int().nullable().optional(),
+  is_default: z.boolean().nullable().optional(),
+  is_done: z.boolean().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional()
+});
+const openApi = createStaffCrudOpenApi({
+  resourceName: "TimeTaskStatus",
+  pluralName: "Time Task Statuses",
+  description: "Returns the Kanban columns of the projects the caller can see. A caller without `staff.timesheets.projects.manage` is narrowed to the projects they are an active member of, so `timeProjectId` can only ever select a board they already have access to.",
+  querySchema: listSchema,
+  listResponseSchema: createPagedListResponseSchema(taskStatusListItemSchema),
+  create: {
+    schema: staffTimeTaskStatusCreateSchema,
+    description: "Creates a Kanban column on a time project."
+  },
+  update: {
+    schema: staffTimeTaskStatusUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description: "Updates a Kanban column. Supplying `position` re-orders the board; the last default column cannot be unset and the last done column cannot be cleared."
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description: "Soft-deletes a Kanban column. Refused with 409 when it is the project's last column or still holds tasks."
+  }
+});
+export {
+  DELETE,
+  GET,
+  POST,
+  PUT,
+  buildTaskStatusListFilters,
+  metadata,
+  openApi,
+  taskStatusListItemSchema
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/task-statuses/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/task-statuses/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeTaskStatusCrudEvents } from '../../../lib/crud'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { StaffTimeTaskStatus } from '../../../data/entities'\nimport { staffTimeTaskStatusCreateSchema, staffTimeTaskStatusUpdateSchema } from '../../../data/validators'\nimport { staffTimeTaskStatusCommandIds } from '../../../commands/timesheets-task-statuses'\nimport { resolveListProjectAccess } from '../tasks/route'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  time_project_id: 'time_project_id',\n  name: 'name',\n  slug: 'slug',\n  color: 'color',\n  position: 'position',\n  is_default: 'is_default',\n  is_done: 'is_done',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n} as const\n\n/**\n * Columns are project configuration (D-1), not task content: anyone who can see the\n * board needs to read them, but only a Team Leader who can manage the project may\n * add, rename, recolour, reorder or remove one. Hence the asymmetric gating \u2014\n * `tasks.view` to read, `projects.manage` to write.\n *\n * `tasks.view` is granted to every employee, so it decides *what kind* of access this\n * is, never *whose* board is being read. The list is therefore intersected with\n * `resolveProjectAccess` exactly as the tasks routes are \u2014 a column carries its\n * project's naming, workflow and done/default policy, which is the same thing a task\n * title leaks about a client the caller has no route to.\n */\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    ids: z.string().optional(),\n    timeProjectId: z.string().uuid().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype TaskStatusListQuery = z.infer<typeof listSchema>\n\n/** Non-UUID sentinel used as the \"match nothing\" filter, mirroring the tasks route. */\nconst IMPOSSIBLE_ID = '00000000-0000-0000-0000-000000000000'\n\nfunction splitIdList(value: unknown): string[] | null {\n  if (typeof value !== 'string' || value.trim().length === 0) return null\n  const ids = value\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0)\n  return ids.length > 0 ? ids : []\n}\n\n/**\n * Every column query narrows to the projects the caller may actually see. The access\n * decision is the tasks route's memoised resolver, so a board that loads its columns\n * and its cards in one request pays for it once and both answers agree. Exported so\n * the intersection is testable without standing up the CRUD factory.\n */\nexport async function buildTaskStatusListFilters(\n  query: TaskStatusListQuery,\n  ctx: CrudCtx,\n): Promise<Record<string, unknown>> {\n  const filters: Record<string, unknown> = {}\n\n  const narrowIds = splitIdList(query.ids)\n  const requestedProjectId =\n    typeof query.timeProjectId === 'string' && query.timeProjectId.trim().length > 0\n      ? query.timeProjectId.trim()\n      : null\n\n  const access = await resolveListProjectAccess(ctx)\n  if (!access.canManageAll) {\n    const projectIds = requestedProjectId\n      ? access.projectIds.filter((id) => id === requestedProjectId)\n      : [...access.projectIds]\n    if (projectIds.length === 0) {\n      // A non-member gets no row at all \u2014 not a redacted one \u2014 so a foreign board's\n      // column names and workflow never leave the server.\n      filters[F.time_project_id] = { $in: [IMPOSSIBLE_ID] }\n      return filters\n    }\n    filters[F.time_project_id] = { $in: projectIds }\n  } else if (requestedProjectId) {\n    filters[F.time_project_id] = requestedProjectId\n  }\n\n  if (narrowIds !== null) {\n    filters[F.id] = { $in: narrowIds.length > 0 ? narrowIds : [IMPOSSIBLE_ID] }\n  }\n\n  return filters\n}\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeTaskStatus,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeTaskStatusCrudEvents,\n  indexer: { entityType: 'staff:staff_time_task_status' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_task_status',\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.time_project_id,\n      F.name,\n      F.slug,\n      F.color,\n      F.position,\n      F.is_default,\n      F.is_done,\n      F.created_at,\n      F.updated_at,\n    ],\n    // The board renders left to right in `position` order, so that is the default\n    // sort rather than the usual created-at.\n    defaultSort: { field: F.position, dir: 'asc' },\n    sortFieldMap: {\n      position: F.position,\n      name: F.name,\n      slug: F.slug,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n    },\n    buildFilters: buildTaskStatusListFilters,\n  },\n  actions: {\n    create: {\n      commandId: staffTimeTaskStatusCommandIds.create,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeTaskStatusCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.taskStatusId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: staffTimeTaskStatusCommandIds.update,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeTaskStatusUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: staffTimeTaskStatusCommandIds.delete,\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nexport const taskStatusListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  name: z.string().nullable().optional(),\n  slug: z.string().nullable().optional(),\n  color: z.string().nullable().optional(),\n  position: z.number().int().nullable().optional(),\n  is_default: z.boolean().nullable().optional(),\n  is_done: z.boolean().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeTaskStatus',\n  pluralName: 'Time Task Statuses',\n  description:\n    'Returns the Kanban columns of the projects the caller can see. A caller without `staff.timesheets.projects.manage` is narrowed to the projects they are an active member of, so `timeProjectId` can only ever select a board they already have access to.',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(taskStatusListItemSchema),\n  create: {\n    schema: staffTimeTaskStatusCreateSchema,\n    description: 'Creates a Kanban column on a time project.',\n  },\n  update: {\n    schema: staffTimeTaskStatusUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Updates a Kanban column. Supplying `position` re-orders the board; the last default column cannot be unset and the last done column cannot be cleared.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Soft-deletes a Kanban column. Refused with 409 when it is the project\\'s last column or still holds tasks.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAmC;AAC5C,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,2BAA2B;AACpC,SAAS,iCAAiC,uCAAuC;AACjF,SAAS,qCAAqC;AAC9C,SAAS,gCAAgC;AACzC,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO;AAAA,EACP,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,YAAY;AACd;AAcA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EACjF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EAChF,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AACrF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAKf,MAAM,gBAAgB;AAEtB,SAAS,YAAY,OAAiC;AACpD,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO;AACnE,QAAM,MAAM,MACT,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,SAAO,IAAI,SAAS,IAAI,MAAM,CAAC;AACjC;AAQA,eAAsB,2BACpB,OACA,KACkC;AAClC,QAAM,UAAmC,CAAC;AAE1C,QAAM,YAAY,YAAY,MAAM,GAAG;AACvC,QAAM,qBACJ,OAAO,MAAM,kBAAkB,YAAY,MAAM,cAAc,KAAK,EAAE,SAAS,IAC3E,MAAM,cAAc,KAAK,IACzB;AAEN,QAAM,SAAS,MAAM,yBAAyB,GAAG;AACjD,MAAI,CAAC,OAAO,cAAc;AACxB,UAAM,aAAa,qBACf,OAAO,WAAW,OAAO,CAAC,OAAO,OAAO,kBAAkB,IAC1D,CAAC,GAAG,OAAO,UAAU;AACzB,QAAI,WAAW,WAAW,GAAG;AAG3B,cAAQ,EAAE,eAAe,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACpD,aAAO;AAAA,IACT;AACA,YAAQ,EAAE,eAAe,IAAI,EAAE,KAAK,WAAW;AAAA,EACjD,WAAW,oBAAoB;AAC7B,YAAQ,EAAE,eAAe,IAAI;AAAA,EAC/B;AAEA,MAAI,cAAc,MAAM;AACtB,YAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,UAAU,SAAS,IAAI,YAAY,CAAC,aAAa,EAAE;AAAA,EAC5E;AAEA,SAAO;AACT;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,EAAE,YAAY,+BAA+B;AAAA,EACtD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA,aAAa,EAAE,OAAO,EAAE,UAAU,KAAK,MAAM;AAAA,IAC7C,cAAc;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW,8BAA8B;AAAA,MACzC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,iCAAiC,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MAC3F;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,gBAAgB,KAAK;AAAA,MAC9D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,8BAA8B;AAAA,MACzC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,iCAAiC,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MAC3F;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,8BAA8B;AAAA,MACzC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAEpB,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aACE;AAAA,EACF,aAAa;AAAA,EACb,oBAAoB,8BAA8B,wBAAwB;AAAA,EAC1E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AACF,CAAC;",
+  "names": []
+}