@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/api/timesheets/tasks/[id]/status/route.js

@@ -0,0 +1,210 @@
+import { NextResponse } from "next/server";
+import { resolveFeatureAccess } from "../../../../../lib/time-tracking/featureAccess.js";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { StaffTimeTask } from "../../../../../data/entities.js";
+import { staffTimeTaskStatusChangeSchema } from "../../../../../data/validators.js";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { STAFF_TIME_TRACKING_RESOURCE_KINDS } from "../../../../guards.js";
+import { runTimesheetInterceptors } from "../../../_shared/withTimesheetInterceptors.js";
+import {
+  staffTimeTaskCommandIds
+} from "../../../../../commands/timesheets-tasks.js";
+import { assertProjectAccess } from "../../../../../lib/time-tracking/access.js";
+import { resolveListProjectAccess } from "../../route.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/tasks/status" });
+const MANAGE_FEATURE = "staff.timesheets.tasks.manage";
+const metadata = {
+  PATCH: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] }
+};
+function extractTaskIdFromUrl(request) {
+  if (!request?.url) return null;
+  try {
+    const url = new URL(request.url);
+    const match = url.pathname.match(/\/tasks\/([^/]+)\/status/);
+    return match?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+async function resolveTaskId(req, context) {
+  const params = context?.params ? await context.params : null;
+  const fromParams = params?.id;
+  if (typeof fromParams === "string" && fromParams.length > 0) return fromParams;
+  return extractTaskIdFromUrl(req);
+}
+async function PATCH(req, context) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    const { translate } = await resolveTranslations();
+    if (!auth) {
+      throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+    }
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    if (!tenantId || !organizationId) {
+      throw new CrudHttpError(400, {
+        error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
+      });
+    }
+    const taskId = await resolveTaskId(req, context);
+    if (!taskId || !z.string().uuid().safeParse(taskId).success) {
+      throw new CrudHttpError(400, {
+        error: translate("staff.time_tracking.tasks.errors.idRequired", "Task id is required.")
+      });
+    }
+    const actorId = auth.sub ?? "";
+    const manageTasks = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId });
+    if (!manageTasks.allowed) {
+      throw forbidden(translate("staff.errors.forbidden", "Forbidden"));
+    }
+    const grantedFeatures = manageTasks.grantedFeatures;
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "PATCH",
+      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },
+      body: await readJsonSafe(req, {})
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
+    const parsed = staffTimeTaskStatusChangeSchema.parse(session.body);
+    const routeCtx = {
+      container,
+      auth,
+      organizationScope: scope,
+      selectedOrganizationId: organizationId,
+      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+      request: req
+    };
+    const em = container.resolve("em").fork();
+    const task = await em.findOne(StaffTimeTask, { id: taskId, tenantId, organizationId, deletedAt: null });
+    const access = task ? await resolveListProjectAccess(routeCtx) : null;
+    if (!task || !access || !assertProjectAccess(access, task.timeProjectId)) {
+      throw new CrudHttpError(404, {
+        error: translate("staff.time_tracking.tasks.errors.notFound", "Task not found or not accessible.")
+      });
+    }
+    const guardResult = await runRouteMutationGuards({
+      container,
+      req,
+      auth: {
+        userId: actorId,
+        tenantId,
+        organizationId,
+        userFeatures: grantedFeatures
+      },
+      input: {
+        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,
+        resourceId: taskId,
+        operation: "update",
+        mutationPayload: parsed
+      }
+    });
+    if (!guardResult.ok) return guardResult.response;
+    const effective = guardResult.modifiedPayload ? staffTimeTaskStatusChangeSchema.parse({ ...parsed, ...guardResult.modifiedPayload }) : parsed;
+    const commandBus = container.resolve("commandBus");
+    const { result, logEntry } = await commandBus.execute(staffTimeTaskCommandIds.statusChange, {
+      input: { ...effective, id: taskId },
+      ctx: routeCtx
+    });
+    await guardResult.runAfterSuccess();
+    const response = await session.respond(200, {
+      id: result?.taskId ?? taskId,
+      timeProjectId: result?.timeProjectId ?? task.timeProjectId,
+      previousTaskStatusId: result?.previousTaskStatusId ?? null,
+      taskStatusId: result?.taskStatusId ?? effective.taskStatusId,
+      position: result?.position ?? null,
+      closedAt: result?.closedAt ?? null,
+      updatedAt: result?.updatedAt ?? null
+    });
+    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
+      response.headers.set(
+        "x-om-operation",
+        serializeOperationMetadata({
+          id: logEntry.id,
+          undoToken: logEntry.undoToken,
+          commandId: logEntry.commandId,
+          actionLabel: logEntry.actionLabel ?? null,
+          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,
+          resourceId: logEntry.resourceId ?? taskId,
+          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : void 0
+        })
+      );
+    }
+    return response;
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    const { translate } = await resolveTranslations();
+    if (err instanceof z.ZodError) {
+      return NextResponse.json(
+        { error: translate("staff.errors.invalid_request", "Invalid request"), details: err.issues },
+        { status: 400 }
+      );
+    }
+    logger.error("staff.timesheets.tasks.status PATCH failed", { err });
+    return NextResponse.json(
+      { error: translate("staff.errors.internal", "Internal server error") },
+      { status: 500 }
+    );
+  }
+}
+const statusChangeResponseSchema = z.object({
+  id: z.string().uuid(),
+  timeProjectId: z.string().uuid(),
+  previousTaskStatusId: z.string().uuid().nullable(),
+  taskStatusId: z.string().uuid(),
+  position: z.number().int().nullable(),
+  closedAt: z.string().nullable(),
+  updatedAt: z.string().nullable()
+});
+const conflictSchema = z.object({
+  code: z.literal("optimistic_lock_conflict"),
+  error: z.string(),
+  currentUpdatedAt: z.string(),
+  expectedUpdatedAt: z.string()
+});
+const openApi = {
+  tag: "Staff",
+  summary: "Move a task to another board column",
+  methods: {
+    PATCH: {
+      summary: "Move a task to another board column",
+      description: "Moves a task to the requested status column and slot. `position` is optional \u2014 omitting it appends the task to the end of the target column, which is what the drawer subtask tick does. The target status must belong to the task project (422 otherwise). Landing on a done column stamps `closedAt`, leaving one clears it. Send the record version in `x-om-ext-optimistic-lock-expected-updated-at`: a stale version answers 409 so an optimistic board can roll the card back to its origin column. Emits `staff.timesheets.time_task.status_changed`, which is bridged to connected boards.",
+      requestBody: {
+        contentType: "application/json",
+        schema: staffTimeTaskStatusChangeSchema
+      },
+      responses: [{ status: 200, description: "Task moved", schema: statusChangeResponseSchema }],
+      errors: [
+        { status: 400, description: "Invalid task id or body" },
+        { status: 401, description: "Unauthorized" },
+        { status: 403, description: "Missing staff.timesheets.tasks.manage" },
+        { status: 404, description: "Task not found, or not on a project the caller can see" },
+        { status: 409, description: "The task changed since the version the caller sent", schema: conflictSchema },
+        { status: 422, description: "The target column does not belong to this project" }
+      ]
+    }
+  }
+};
+export {
+  PATCH,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/tasks/[id]/status/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/staff/api/timesheets/tasks/%5Bid%5D/status/route.ts"],
+  "sourcesContent": ["/**\n * The Kanban drag of screen 6 (US-C2), and the drawer's subtask tick, which is the\n * same move without a meaningful position.\n *\n * The board writes optimistically \u2014 the card lands in the new column before the\n * request completes \u2014 so this endpoint's contract is what makes the rollback in the\n * mockup's note 2 correct:\n *\n *  1. **The `updated_at` version travels with the drag.** Two people moving the same\n *     card is the one genuinely likely conflict on this board, so a stale\n *     `x-om-ext-optimistic-lock-expected-updated-at` answers 409 and the client puts\n *     the card back where it came from instead of overwriting the other move.\n *  2. **Project access is intersected before anything else is revealed.** The access\n *     decision reuses the tasks list route's memoised resolver, and a caller who is\n *     not a member gets the same 404 a missing task gets \u2014 the body never confirms\n *     the task exists.\n *  3. **The target column must belong to the task's own project.** A foreign column\n *     is refused by the command (422) rather than quietly accepted, because a task\n *     lives in exactly one project (\u00A72) and its board is that project's.\n *\n * The write itself is the `staff.timesheets.tasks.status_change` command, which owns\n * the `closed_at` stamping and emits `staff.timesheets.time_task.status_changed`.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeTask } from '../../../../../data/entities'\nimport { staffTimeTaskStatusChangeSchema } from '../../../../../data/validators'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskCommandIds,\n  type StaffTimeTaskStatusChangeCommandInput,\n  type StaffTimeTaskStatusChangeResult,\n} from '../../../../../commands/timesheets-tasks'\nimport { assertProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { resolveListProjectAccess } from '../../route'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/status' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\ntype RouteContext = {\n  params?: Promise<Record<string, string | string[]>> | Record<string, string | string[]>\n}\n\nfunction extractTaskIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/tasks\\/([^/]+)\\/status/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveTaskId(req: Request, context?: RouteContext): Promise<string | null> {\n  const params = context?.params ? await context.params : null\n  const fromParams = params?.id\n  if (typeof fromParams === 'string' && fromParams.length > 0) return fromParams\n  return extractTaskIdFromUrl(req)\n}\n\nexport async function PATCH(req: Request, context?: RouteContext): Promise<Response> {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const taskId = await resolveTaskId(req, context)\n    if (!taskId || !z.string().uuid().safeParse(taskId).success) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.time_tracking.tasks.errors.idRequired', 'Task id is required.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority, answering both\n    // questions this route asks: may the caller manage tasks, and what grant list\n    // do the interceptors and the mutation-guard registry gate on. The decision is\n    // checked unconditionally and fails closed; the list is plumbing and is empty \u2014\n    // never absent \u2014 when RBAC could not produce it.\n    const manageTasks = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!manageTasks.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageTasks.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'PATCH',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffTimeTaskStatusChangeSchema.parse(session.body)\n\n    const routeCtx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    // Membership is resolved against the task's project, so the lookup has to happen\n    // here. Both \"no such task\" and \"not your project\" answer with the same body.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const task = await em.findOne(StaffTimeTask, { id: taskId, tenantId, organizationId, deletedAt: null })\n    const access = task ? await resolveListProjectAccess(routeCtx) : null\n    if (!task || !access || !assertProjectAccess(access, task.timeProjectId)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.tasks.errors.notFound', 'Task not found or not accessible.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n        resourceId: taskId,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? staffTimeTaskStatusChangeSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      StaffTimeTaskStatusChangeCommandInput,\n      StaffTimeTaskStatusChangeResult\n    >(staffTimeTaskCommandIds.statusChange, {\n      input: { ...effective, id: taskId },\n      ctx: routeCtx,\n    })\n\n    await guardResult.runAfterSuccess()\n\n    const response = await session.respond(200, {\n      id: result?.taskId ?? taskId,\n      timeProjectId: result?.timeProjectId ?? task.timeProjectId,\n      previousTaskStatusId: result?.previousTaskStatusId ?? null,\n      taskStatusId: result?.taskStatusId ?? effective.taskStatusId,\n      position: result?.position ?? null,\n      closedAt: result?.closedAt ?? null,\n      updatedAt: result?.updatedAt ?? null,\n    })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTask,\n          resourceId: logEntry.resourceId ?? taskId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.tasks.status PATCH failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst statusChangeResponseSchema = z.object({\n  id: z.string().uuid(),\n  timeProjectId: z.string().uuid(),\n  previousTaskStatusId: z.string().uuid().nullable(),\n  taskStatusId: z.string().uuid(),\n  position: z.number().int().nullable(),\n  closedAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst conflictSchema = z.object({\n  code: z.literal('optimistic_lock_conflict'),\n  error: z.string(),\n  currentUpdatedAt: z.string(),\n  expectedUpdatedAt: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Move a task to another board column',\n  methods: {\n    PATCH: {\n      summary: 'Move a task to another board column',\n      description:\n        'Moves a task to the requested status column and slot. `position` is optional \u2014 omitting it appends the task to the end of the target column, which is what the drawer subtask tick does. The target status must belong to the task project (422 otherwise). Landing on a done column stamps `closedAt`, leaving one clears it. Send the record version in `x-om-ext-optimistic-lock-expected-updated-at`: a stale version answers 409 so an optimistic board can roll the card back to its origin column. Emits `staff.timesheets.time_task.status_changed`, which is bridged to connected boards.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeTaskStatusChangeSchema,\n      },\n      responses: [{ status: 200, description: 'Task moved', schema: statusChangeResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid task id or body' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found, or not on a project the caller can see' },\n        { status: 409, description: 'The task changed since the version the caller sent', schema: conflictSchema },\n        { status: 422, description: 'The target column does not belong to this project' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,qBAAqB;AAC9B,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,2BAA2B;AACpC,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,8BAA8B,CAAC;AAEvF,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAChE;AAMA,SAAS,qBAAqB,SAAkC;AAC9D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,0BAA0B;AAC3D,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,cAAc,KAAc,SAAgD;AACzF,QAAM,SAAS,SAAS,SAAS,MAAM,QAAQ,SAAS;AACxD,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,YAAY,WAAW,SAAS,EAAG,QAAO;AACpE,SAAO,qBAAqB,GAAG;AACjC;AAEA,eAAsB,MAAM,KAAc,SAA2C;AACnF,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,cAAc,KAAK,OAAO;AAC/C,QAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,MAAM,EAAE,SAAS;AAC3D,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,sBAAsB;AAAA,MACxF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAM5B,UAAM,cAAc,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AACjH,QAAI,CAAC,YAAY,SAAS;AACxB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,YAAY;AAEpC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,gCAAgC,MAAM,QAAQ,IAAI;AAEjE,UAAM,WAAkC;AAAA,MACtC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAIA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,OAAO,MAAM,GAAG,QAAQ,eAAe,EAAE,IAAI,QAAQ,UAAU,gBAAgB,WAAW,KAAK,CAAC;AACtG,UAAM,SAAS,OAAO,MAAM,yBAAyB,QAAQ,IAAI;AACjE,QAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,QAAQ,KAAK,aAAa,GAAG;AACxE,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6CAA6C,mCAAmC;AAAA,MACnG,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,gCAAgC,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IACnF;AAEJ,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,wBAAwB,cAAc;AAAA,MACtC,OAAO,EAAE,GAAG,WAAW,IAAI,OAAO;AAAA,MAClC,KAAK;AAAA,IACP,CAAC;AAED,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,UAAU;AAAA,MACtB,eAAe,QAAQ,iBAAiB,KAAK;AAAA,MAC7C,sBAAsB,QAAQ,wBAAwB;AAAA,MACtD,cAAc,QAAQ,gBAAgB,UAAU;AAAA,MAChD,UAAU,QAAQ,YAAY;AAAA,MAC9B,UAAU,QAAQ,YAAY;AAAA,MAC9B,WAAW,QAAQ,aAAa;AAAA,IAClC,CAAC;AACD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAClE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACjD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,QAAQ,0BAA0B;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAC9B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,2BAA2B,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,sDAAsD,QAAQ,eAAe;AAAA,QACzG,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/tasks/route.js

@@ -0,0 +1,333 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { staffTimeTaskCrudEvents } from "../../../lib/crud.js";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { resolveCrudRecordId, parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
+import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { StaffTimeTask, StaffTimeTaskTag } from "../../../data/entities.js";
+import { staffTimeTaskCreateSchema, staffTimeTaskUpdateSchema } from "../../../data/validators.js";
+import { staffTimeTaskCommandIds } from "../../../commands/timesheets-tasks.js";
+import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.js";
+import { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from "../../../lib/time-tracking/access.js";
+import { readTimeTrackingSettings } from "../../../lib/time-tracking/settings.js";
+import { sanitizeSearchTerm, parseBooleanFlag } from "../../helpers.js";
+import { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from "../../openapi.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/tasks" });
+const F = {
+  id: "id",
+  tenant_id: "tenant_id",
+  organization_id: "organization_id",
+  time_project_id: "time_project_id",
+  parent_task_id: "parent_task_id",
+  task_status_id: "task_status_id",
+  sequence_number: "sequence_number",
+  reference: "reference",
+  title: "title",
+  description: "description",
+  assignee_staff_member_id: "assignee_staff_member_id",
+  position: "position",
+  created_by_user_id: "created_by_user_id",
+  closed_at: "closed_at",
+  created_at: "created_at",
+  updated_at: "updated_at"
+};
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ["staff.timesheets.tasks.view"] },
+  POST: { requireAuth: true, requireFeatures: ["staff.timesheets.tasks.manage"] },
+  PUT: { requireAuth: true, requireFeatures: ["staff.timesheets.tasks.manage"] },
+  DELETE: { requireAuth: true, requireFeatures: ["staff.timesheets.tasks.manage"] }
+};
+const metadata = routeMetadata;
+const rawBodySchema = z.object({}).passthrough();
+const listSchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(50),
+  q: z.string().optional(),
+  /** Prefix match on the denormalised `<CODE>-<n>` reference. */
+  reference: z.string().optional(),
+  id: z.string().optional(),
+  ids: z.string().optional(),
+  timeProjectId: z.string().uuid().optional(),
+  taskStatusId: z.string().uuid().optional(),
+  assigneeStaffMemberId: z.string().uuid().optional(),
+  parentTaskId: z.string().uuid().optional(),
+  tagIds: z.string().optional(),
+  topLevelOnly: z.string().optional(),
+  sortField: z.string().optional(),
+  sortDir: z.enum(["asc", "desc"]).optional()
+}).passthrough();
+const IMPOSSIBLE_ID = "00000000-0000-0000-0000-000000000000";
+const DENIED_ACCESS = { canManageAll: false, projectIds: [], staffMemberId: null };
+const accessByRequest = /* @__PURE__ */ new WeakMap();
+async function resolveAssignmentGraceDays(container, tenantId) {
+  try {
+    const configService = container.resolve("moduleConfigService");
+    const settings = await readTimeTrackingSettings(configService, { tenantId });
+    return settings.access.assignmentGraceDays;
+  } catch {
+    return null;
+  }
+}
+async function loadProjectAccess(container, userId, tenantId, organizationId) {
+  if (!tenantId || !organizationId) return { ...DENIED_ACCESS };
+  const scope = { tenantId, organizationId };
+  try {
+    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope);
+    const em = container.resolve("em");
+    return await resolveProjectAccess({
+      em: em.fork(),
+      userId,
+      tenantId,
+      organizationId,
+      canManageAll: access.allowed,
+      userFeatures: access.grantedFeatures,
+      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId)
+    });
+  } catch (err) {
+    logger.error("staff.timesheets.tasks access resolution failed", { err });
+    return { ...DENIED_ACCESS };
+  }
+}
+async function resolveListProjectAccess(ctx) {
+  const tenantId = ctx.auth?.tenantId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+  const load = () => loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId);
+  const request = ctx.request;
+  if (!request) return load();
+  const cached = accessByRequest.get(request);
+  if (cached) return cached;
+  const pending = load();
+  accessByRequest.set(request, pending);
+  return pending;
+}
+function splitIdList(value) {
+  if (typeof value !== "string" || value.trim().length === 0) return null;
+  const ids = value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  return ids.length > 0 ? ids : [];
+}
+async function resolveTaskIdsForTags(ctx, tagIds) {
+  const tenantId = ctx.auth?.tenantId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+  if (!tenantId || !organizationId) return [];
+  try {
+    const em = ctx.container.resolve("em").fork();
+    const rows = await em.find(
+      StaffTimeTaskTag,
+      { tagId: { $in: tagIds }, tenantId, organizationId },
+      { fields: ["taskId", "tagId"] }
+    );
+    const seen = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      const taskId = row.taskId;
+      if (!taskId) continue;
+      const bucket = seen.get(taskId) ?? /* @__PURE__ */ new Set();
+      bucket.add(row.tagId);
+      seen.set(taskId, bucket);
+    }
+    const required = new Set(tagIds).size;
+    return [...seen.entries()].filter(([, tags]) => tags.size >= required).map(([taskId]) => taskId);
+  } catch (err) {
+    logger.error("staff.timesheets.tasks tag filter resolution failed", { err });
+    return [];
+  }
+}
+async function buildTaskListFilters(query, ctx) {
+  const filters = {};
+  let narrowIds = null;
+  for (const raw of [query.ids, query.id]) {
+    const parsed = splitIdList(raw);
+    if (parsed === null) continue;
+    narrowIds = narrowIds ? narrowIds.filter((id) => parsed.includes(id)) : parsed;
+  }
+  const requestedTagIds = splitIdList(query.tagIds);
+  if (requestedTagIds !== null) {
+    const tagged = requestedTagIds.length === 0 ? [] : await resolveTaskIdsForTags(ctx, requestedTagIds);
+    narrowIds = narrowIds ? narrowIds.filter((id) => tagged.includes(id)) : tagged;
+  }
+  const access = await resolveListProjectAccess(ctx);
+  let projectIds = null;
+  if (!access.canManageAll) {
+    projectIds = [...access.projectIds];
+    if (typeof query.timeProjectId === "string" && query.timeProjectId.trim().length > 0) {
+      const requested = query.timeProjectId.trim();
+      projectIds = projectIds.filter((id) => id === requested);
+    }
+    if (projectIds.length === 0) {
+      filters[F.time_project_id] = { $in: [IMPOSSIBLE_ID] };
+      return filters;
+    }
+    filters[F.time_project_id] = { $in: projectIds };
+  } else if (typeof query.timeProjectId === "string" && query.timeProjectId.trim().length > 0) {
+    filters[F.time_project_id] = query.timeProjectId.trim();
+  }
+  if (narrowIds !== null) {
+    if (narrowIds.length === 0) {
+      filters[F.id] = { $in: [IMPOSSIBLE_ID] };
+      return filters;
+    }
+    filters[F.id] = { $in: narrowIds };
+  }
+  if (typeof query.taskStatusId === "string" && query.taskStatusId.trim().length > 0) {
+    filters[F.task_status_id] = query.taskStatusId.trim();
+  }
+  if (typeof query.assigneeStaffMemberId === "string" && query.assigneeStaffMemberId.trim().length > 0) {
+    filters[F.assignee_staff_member_id] = query.assigneeStaffMemberId.trim();
+  }
+  if (typeof query.parentTaskId === "string" && query.parentTaskId.trim().length > 0) {
+    filters[F.parent_task_id] = query.parentTaskId.trim();
+  } else if (parseBooleanFlag(query.topLevelOnly)) {
+    filters[F.parent_task_id] = { $eq: null };
+  }
+  const term = sanitizeSearchTerm(query.q);
+  if (term) {
+    filters[F.title] = { $ilike: `%${escapeLikePattern(term)}%` };
+  }
+  const referenceTerm = sanitizeSearchTerm(query.reference);
+  if (referenceTerm) {
+    filters[F.reference] = { $ilike: `${escapeLikePattern(referenceTerm)}%` };
+  }
+  return filters;
+}
+const taskListFields = [
+  F.id,
+  F.organization_id,
+  F.tenant_id,
+  F.time_project_id,
+  F.parent_task_id,
+  F.task_status_id,
+  F.sequence_number,
+  F.reference,
+  F.title,
+  F.description,
+  F.assignee_staff_member_id,
+  F.position,
+  F.created_by_user_id,
+  F.closed_at,
+  F.created_at,
+  F.updated_at
+];
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: StaffTimeTask,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId",
+    softDeleteField: "deletedAt"
+  },
+  events: staffTimeTaskCrudEvents,
+  indexer: { entityType: "staff:staff_time_task" },
+  list: {
+    schema: listSchema,
+    entityId: "staff:staff_time_task",
+    fields: [...taskListFields],
+    // Cards stack in `position` order inside their column, so that is the board's
+    // natural sort rather than created-at.
+    defaultSort: { field: F.position, dir: "asc" },
+    tiebreakSortField: F.created_at,
+    sortFieldMap: {
+      position: F.position,
+      title: F.title,
+      reference: F.reference,
+      sequenceNumber: F.sequence_number,
+      createdAt: F.created_at,
+      updatedAt: F.updated_at,
+      closedAt: F.closed_at
+    },
+    buildFilters: buildTaskListFilters
+  },
+  enrichers: { entityId: "staff:staff_time_task" },
+  actions: {
+    create: {
+      commandId: staffTimeTaskCommandIds.create,
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return parseScopedCommandInput(staffTimeTaskCreateSchema, raw ?? {}, ctx, translate);
+      },
+      response: ({ result }) => ({ id: result?.taskId ?? null }),
+      status: 201
+    },
+    update: {
+      commandId: staffTimeTaskCommandIds.update,
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations();
+        return parseScopedCommandInput(staffTimeTaskUpdateSchema, raw ?? {}, ctx, translate);
+      },
+      response: () => ({ ok: true })
+    },
+    delete: {
+      commandId: staffTimeTaskCommandIds.delete,
+      schema: rawBodySchema,
+      mapInput: async ({ parsed, ctx }) => {
+        const { translate } = await resolveTranslations();
+        const id = resolveCrudRecordId(parsed, ctx, translate);
+        return { id };
+      },
+      response: () => ({ ok: true })
+    }
+  }
+});
+const GET = crud.GET;
+const POST = crud.POST;
+const PUT = crud.PUT;
+const DELETE = crud.DELETE;
+const taskListItemSchema = z.object({
+  id: z.string().uuid().nullable().optional(),
+  organization_id: z.string().uuid().nullable().optional(),
+  tenant_id: z.string().uuid().nullable().optional(),
+  time_project_id: z.string().uuid().nullable().optional(),
+  parent_task_id: z.string().uuid().nullable().optional(),
+  task_status_id: z.string().uuid().nullable().optional(),
+  sequence_number: z.number().int().nullable().optional(),
+  reference: z.string().nullable().optional(),
+  title: z.string().nullable().optional(),
+  description: z.string().nullable().optional(),
+  assignee_staff_member_id: z.string().uuid().nullable().optional(),
+  position: z.number().int().nullable().optional(),
+  created_by_user_id: z.string().uuid().nullable().optional(),
+  closed_at: z.string().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional(),
+  /** This task's own entries, in raw minutes. */
+  ownMinutes: z.number().int().optional(),
+  /** The inclusive rollup: own entries plus every live child's (D-2). */
+  loggedMinutes: z.number().int().optional(),
+  /** Live children only — soft-deleted subtasks are not counted. */
+  childCount: z.number().int().optional()
+});
+const openApi = createStaffCrudOpenApi({
+  resourceName: "TimeTask",
+  pluralName: "Time Tasks",
+  querySchema: listSchema,
+  listResponseSchema: createPagedListResponseSchema(taskListItemSchema),
+  create: {
+    schema: staffTimeTaskCreateSchema,
+    description: "Creates a task. Only `title` is required beyond scoping and `timeProjectId`: the task lands on the project default column with the creator assigned unless the request says otherwise. Supplying `parentTaskId` creates a subtask; a parent that is itself a subtask is refused with 400 subtask_depth_exceeded."
+  },
+  update: {
+    schema: staffTimeTaskUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description: "Updates a task. Re-parenting under a subtask, or turning a task that already has subtasks into one, is refused with 400 subtask_depth_exceeded; moving a task to another project is refused with 400 task_project_move_unsupported. Moving into a done column stamps closed_at, moving out clears it."
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description: "Soft-deletes a task. Deleting a parent soft-deletes its subtasks in the same transaction; time entries keep pointing at the deleted task so closed reports still resolve their labels."
+  }
+});
+export {
+  DELETE,
+  GET,
+  POST,
+  PUT,
+  buildTaskListFilters,
+  metadata,
+  openApi,
+  resolveListProjectAccess,
+  taskListFields,
+  taskListItemSchema
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/tasks/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/timesheets/tasks/route.ts"],
+  "sourcesContent": ["/**\n * Tasks \u2014 the board of screen 6, the drawer of screen 7 and the subtask checklist\n * inside it, all served from one collection (D-2: a subtask is a child task).\n *\n * Two things this route is responsible for beyond plain CRUD:\n *\n *  1. **Project access is intersected into every query.** A caller without\n *     `staff.timesheets.projects.manage` only sees tasks belonging to projects they\n *     are an active member of \u2014 including when they ask for one id. A route that\n *     leaves that to the caller leaks another client's task titles, which is exactly\n *     the defect the projects route was fixed for; the resolution is memoised per\n *     request and fails closed, so an access decision that could not be made denies.\n *  2. **`topLevelOnly` is what the board asks for.** Children render inside their\n *     parent's drawer, never as their own card, so the board filters\n *     `parent_task_id IS NULL` rather than post-filtering a page it already paid for.\n *\n * The rollup fields (`ownMinutes`, `loggedMinutes`, `childCount`) are added by the\n * `staff.timesheets-tasks-rollup` response enricher rather than by a query in this\n * file, so the board pays one grouped aggregate per page instead of one per card.\n * `loggedMinutes` is the inclusive rollup (own + children, D-2); `ownMinutes` is this\n * task's entries alone. They are never summed together \u2014 see the enricher's note on\n * risk R10.\n */\n\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeTaskCrudEvents } from '../../../lib/crud'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeTask, StaffTimeTaskTag } from '../../../data/entities'\nimport { staffTimeTaskCreateSchema, staffTimeTaskUpdateSchema } from '../../../data/validators'\nimport { staffTimeTaskCommandIds } from '../../../commands/timesheets-tasks'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess, type ProjectAccess } from '../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { sanitizeSearchTerm, parseBooleanFlag } from '../../helpers'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks' })\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  time_project_id: 'time_project_id',\n  parent_task_id: 'parent_task_id',\n  task_status_id: 'task_status_id',\n  sequence_number: 'sequence_number',\n  reference: 'reference',\n  title: 'title',\n  description: 'description',\n  assignee_staff_member_id: 'assignee_staff_member_id',\n  position: 'position',\n  created_by_user_id: 'created_by_user_id',\n  closed_at: 'closed_at',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    q: z.string().optional(),\n    /** Prefix match on the denormalised `<CODE>-<n>` reference. */\n    reference: z.string().optional(),\n    id: z.string().optional(),\n    ids: z.string().optional(),\n    timeProjectId: z.string().uuid().optional(),\n    taskStatusId: z.string().uuid().optional(),\n    assigneeStaffMemberId: z.string().uuid().optional(),\n    parentTaskId: z.string().uuid().optional(),\n    tagIds: z.string().optional(),\n    topLevelOnly: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype TaskListQuery = z.infer<typeof listSchema>\n\n/**\n * Non-UUID sentinel used as the \"match nothing\" filter, mirroring the projects route\n * so both narrowing paths behave identically.\n */\nconst IMPOSSIBLE_ID = '00000000-0000-0000-0000-000000000000'\n\nconst DENIED_ACCESS: ProjectAccess = { canManageAll: false, projectIds: [], staffMemberId: null }\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\n/** One access decision per request, shared by every filter that needs it. */\nconst accessByRequest = new WeakMap<Request, Promise<ProjectAccess>>()\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<ProjectAccess> {\n  if (!tenantId || !organizationId) return { ...DENIED_ACCESS }\n  const scope = { tenantId, organizationId }\n  try {\n    // One lookup, one authority, and a failure that says so. The previous\n    // `catch \u2192 []` could not tell \"denied\" from \"could not ask\", so an RBAC\n    // hiccup silently demoted a manager to their own memberships.\n    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope)\n    const em = container.resolve('em') as EntityManager\n    return await resolveProjectAccess({\n      em: em.fork(),\n      userId,\n      tenantId,\n      organizationId,\n      canManageAll: access.allowed,\n      userFeatures: access.grantedFeatures,\n      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n    })\n  } catch (err) {\n    logger.error('staff.timesheets.tasks access resolution failed', { err })\n    return { ...DENIED_ACCESS }\n  }\n}\n\nexport async function resolveListProjectAccess(ctx: CrudCtx): Promise<ProjectAccess> {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const load = () => loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId)\n  const request = ctx.request\n  if (!request) return load()\n  const cached = accessByRequest.get(request)\n  if (cached) return cached\n  const pending = load()\n  accessByRequest.set(request, pending)\n  return pending\n}\n\nfunction splitIdList(value: unknown): string[] | null {\n  if (typeof value !== 'string' || value.trim().length === 0) return null\n  const ids = value\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0)\n  return ids.length > 0 ? ids : []\n}\n\n/**\n * Task ids carrying **every** requested tag (W9).\n *\n * AND rather than OR, because that is what the board's chips already mean\n * (`matchesBoardTagFilter` requires every selected tag), and a server filter that\n * disagreed with the chips would change the result set on the same selection.\n *\n * Returning `[]` narrows to nothing, which is the correct answer both when no task\n * carries the combination and when the lookup failed: a filter that cannot be\n * applied must not silently widen the page back to every task.\n */\nasync function resolveTaskIdsForTags(ctx: CrudCtx, tagIds: string[]): Promise<string[]> {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!tenantId || !organizationId) return []\n  try {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const rows = await em.find(\n      StaffTimeTaskTag,\n      { tagId: { $in: tagIds }, tenantId, organizationId },\n      { fields: ['taskId', 'tagId'] },\n    )\n    const seen = new Map<string, Set<string>>()\n    for (const row of rows) {\n      const taskId = row.taskId\n      if (!taskId) continue\n      const bucket = seen.get(taskId) ?? new Set<string>()\n      bucket.add(row.tagId)\n      seen.set(taskId, bucket)\n    }\n    const required = new Set(tagIds).size\n    return [...seen.entries()].filter(([, tags]) => tags.size >= required).map(([taskId]) => taskId)\n  } catch (err) {\n    logger.error('staff.timesheets.tasks tag filter resolution failed', { err })\n    return []\n  }\n}\n\n/**\n * Every task query narrows to the projects the caller may actually see. Exported so\n * the access intersection is testable without standing up the CRUD factory.\n */\nexport async function buildTaskListFilters(\n  query: TaskListQuery,\n  ctx: CrudCtx,\n): Promise<Record<string, unknown>> {\n  const filters: Record<string, unknown> = {}\n\n  let narrowIds: string[] | null = null\n  for (const raw of [query.ids, query.id]) {\n    const parsed = splitIdList(raw)\n    if (parsed === null) continue\n    narrowIds = narrowIds ? narrowIds.filter((id) => parsed.includes(id)) : parsed\n  }\n\n  const requestedTagIds = splitIdList(query.tagIds)\n  if (requestedTagIds !== null) {\n    const tagged = requestedTagIds.length === 0 ? [] : await resolveTaskIdsForTags(ctx, requestedTagIds)\n    narrowIds = narrowIds ? narrowIds.filter((id) => tagged.includes(id)) : tagged\n  }\n\n  const access = await resolveListProjectAccess(ctx)\n  let projectIds: string[] | null = null\n  if (!access.canManageAll) {\n    projectIds = [...access.projectIds]\n    if (typeof query.timeProjectId === 'string' && query.timeProjectId.trim().length > 0) {\n      const requested = query.timeProjectId.trim()\n      projectIds = projectIds.filter((id) => id === requested)\n    }\n    if (projectIds.length === 0) {\n      // A non-member gets no row at all \u2014 not a redacted one \u2014 so a task title and\n      // its project never leave the server.\n      filters[F.time_project_id] = { $in: [IMPOSSIBLE_ID] }\n      return filters\n    }\n    filters[F.time_project_id] = { $in: projectIds }\n  } else if (typeof query.timeProjectId === 'string' && query.timeProjectId.trim().length > 0) {\n    filters[F.time_project_id] = query.timeProjectId.trim()\n  }\n\n  if (narrowIds !== null) {\n    if (narrowIds.length === 0) {\n      filters[F.id] = { $in: [IMPOSSIBLE_ID] }\n      return filters\n    }\n    filters[F.id] = { $in: narrowIds }\n  }\n\n  if (typeof query.taskStatusId === 'string' && query.taskStatusId.trim().length > 0) {\n    filters[F.task_status_id] = query.taskStatusId.trim()\n  }\n  if (typeof query.assigneeStaffMemberId === 'string' && query.assigneeStaffMemberId.trim().length > 0) {\n    filters[F.assignee_staff_member_id] = query.assigneeStaffMemberId.trim()\n  }\n  if (typeof query.parentTaskId === 'string' && query.parentTaskId.trim().length > 0) {\n    // The drawer's checklist: one parent's children, in position order.\n    filters[F.parent_task_id] = query.parentTaskId.trim()\n  } else if (parseBooleanFlag(query.topLevelOnly)) {\n    // The board: cards only, never a child that already renders inside a drawer.\n    filters[F.parent_task_id] = { $eq: null }\n  }\n\n  const term = sanitizeSearchTerm(query.q)\n  if (term) {\n    // A reference is the thing people actually type \u2014 \"AWR-9\" is how a task is\n    // named out loud \u2014 so searching only the title made the one identifier the\n    // UI shows everywhere unusable as a search key.\n    //\n    // The query engine's filter compiler has no OR across fields (`normalizeFilters`\n    // treats a top-level `$or` array as a field name), so the term is routed by\n    // shape instead: anything that looks like a code or a code-and-number goes to\n    // `reference`, everything else to `title`. A reference is `<CODE>-<n>` with no\n    // spaces, which is not a shape task titles take.\n    filters[F.title] = { $ilike: `%${escapeLikePattern(term)}%` }\n  }\n\n  // Searching by reference is a separate parameter rather than a shape-guess on\n  // `q`, because the guess is not decidable: \"Booking\" is a title word and \"AWR\"\n  // is a code, and both are single alphanumeric tokens. The query engine's filter\n  // compiler has no OR across fields \u2014 `normalizeFilters` reads a top-level `$or`\n  // array as a field name \u2014 so a caller that wants both asks for both and merges.\n  const referenceTerm = sanitizeSearchTerm(query.reference)\n  if (referenceTerm) {\n    filters[F.reference] = { $ilike: `${escapeLikePattern(referenceTerm)}%` }\n  }\n\n  return filters\n}\n\nexport const taskListFields = [\n  F.id,\n  F.organization_id,\n  F.tenant_id,\n  F.time_project_id,\n  F.parent_task_id,\n  F.task_status_id,\n  F.sequence_number,\n  F.reference,\n  F.title,\n  F.description,\n  F.assignee_staff_member_id,\n  F.position,\n  F.created_by_user_id,\n  F.closed_at,\n  F.created_at,\n  F.updated_at,\n] as const\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeTask,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeTaskCrudEvents,\n  indexer: { entityType: 'staff:staff_time_task' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_task',\n    fields: [...taskListFields],\n    // Cards stack in `position` order inside their column, so that is the board's\n    // natural sort rather than created-at.\n    defaultSort: { field: F.position, dir: 'asc' },\n    tiebreakSortField: F.created_at,\n    sortFieldMap: {\n      position: F.position,\n      title: F.title,\n      reference: F.reference,\n      sequenceNumber: F.sequence_number,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      closedAt: F.closed_at,\n    },\n    buildFilters: buildTaskListFilters,\n  },\n  enrichers: { entityId: 'staff:staff_time_task' },\n  actions: {\n    create: {\n      commandId: staffTimeTaskCommandIds.create,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeTaskCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.taskId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: staffTimeTaskCommandIds.update,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeTaskUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: staffTimeTaskCommandIds.delete,\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nexport const taskListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  parent_task_id: z.string().uuid().nullable().optional(),\n  task_status_id: z.string().uuid().nullable().optional(),\n  sequence_number: z.number().int().nullable().optional(),\n  reference: z.string().nullable().optional(),\n  title: z.string().nullable().optional(),\n  description: z.string().nullable().optional(),\n  assignee_staff_member_id: z.string().uuid().nullable().optional(),\n  position: z.number().int().nullable().optional(),\n  created_by_user_id: z.string().uuid().nullable().optional(),\n  closed_at: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  /** This task's own entries, in raw minutes. */\n  ownMinutes: z.number().int().optional(),\n  /** The inclusive rollup: own entries plus every live child's (D-2). */\n  loggedMinutes: z.number().int().optional(),\n  /** Live children only \u2014 soft-deleted subtasks are not counted. */\n  childCount: z.number().int().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeTask',\n  pluralName: 'Time Tasks',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(taskListItemSchema),\n  create: {\n    schema: staffTimeTaskCreateSchema,\n    description:\n      'Creates a task. Only `title` is required beyond scoping and `timeProjectId`: the task lands on the project default column with the creator assigned unless the request says otherwise. Supplying `parentTaskId` creates a subtask; a parent that is itself a subtask is refused with 400 subtask_depth_exceeded.',\n  },\n  update: {\n    schema: staffTimeTaskUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Updates a task. Re-parenting under a subtask, or turning a task that already has subtasks into one, is refused with 400 subtask_depth_exceeded; moving a task to another project is refused with 400 task_project_move_unsupported. Moving into a done column stamps closed_at, moving out clears it.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Soft-deletes a task. Deleting a parent soft-deletes its subtasks in the same transaction; time entries keep pointing at the deleted task so closed reports still resolve their labels.',\n  },\n})\n"],
+  "mappings": "AAwBA,SAAS,SAAS;AAElB,SAAS,qBAAmC;AAC5C,SAAS,+BAA+B;AACxC,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,SAAS,eAAe,wBAAwB;AAChD,SAAS,2BAA2B,iCAAiC;AACrE,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,4BAAgD;AAClF,SAAS,gCAAgC;AACzC,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uBAAuB,CAAC;AAEhF,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,OAAO;AAAA,EACP,aAAa;AAAA,EACb,0BAA0B;AAAA,EAC1B,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC7E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,EACxB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAClD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAQf,MAAM,gBAAgB;AAEtB,MAAM,gBAA+B,EAAE,cAAc,OAAO,YAAY,CAAC,GAAG,eAAe,KAAK;AAYhG,MAAM,kBAAkB,oBAAI,QAAyC;AAErE,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACwB;AACxB,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,EAAE,GAAG,cAAc;AAC5D,QAAM,QAAQ,EAAE,UAAU,eAAe;AACzC,MAAI;AAIF,UAAM,SAAS,MAAM,qBAAqB,WAAW,QAAQ,CAAC,uBAAuB,GAAG,KAAK;AAC7F,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,qBAAqB;AAAA,MAChC,IAAI,GAAG,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,IAC3E,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AACvE,WAAO,EAAE,GAAG,cAAc;AAAA,EAC5B;AACF;AAEA,eAAsB,yBAAyB,KAAsC;AACnF,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,OAAO,MAAM,kBAAkB,IAAI,WAAW,IAAI,MAAM,OAAO,MAAM,UAAU,cAAc;AACnG,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAM,SAAS,gBAAgB,IAAI,OAAO;AAC1C,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,KAAK;AACrB,kBAAgB,IAAI,SAAS,OAAO;AACpC,SAAO;AACT;AAEA,SAAS,YAAY,OAAiC;AACpD,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO;AACnE,QAAM,MAAM,MACT,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,SAAO,IAAI,SAAS,IAAI,MAAM,CAAC;AACjC;AAaA,eAAe,sBAAsB,KAAc,QAAqC;AACtF,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,CAAC;AAC1C,MAAI;AACF,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,OAAO,MAAM,GAAG;AAAA,MACpB;AAAA,MACA,EAAE,OAAO,EAAE,KAAK,OAAO,GAAG,UAAU,eAAe;AAAA,MACnD,EAAE,QAAQ,CAAC,UAAU,OAAO,EAAE;AAAA,IAChC;AACA,UAAM,OAAO,oBAAI,IAAyB;AAC1C,eAAW,OAAO,MAAM;AACtB,YAAM,SAAS,IAAI;AACnB,UAAI,CAAC,OAAQ;AACb,YAAM,SAAS,KAAK,IAAI,MAAM,KAAK,oBAAI,IAAY;AACnD,aAAO,IAAI,IAAI,KAAK;AACpB,WAAK,IAAI,QAAQ,MAAM;AAAA,IACzB;AACA,UAAM,WAAW,IAAI,IAAI,MAAM,EAAE;AACjC,WAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,KAAK,QAAQ,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,MAAM,MAAM;AAAA,EACjG,SAAS,KAAK;AACZ,WAAO,MAAM,uDAAuD,EAAE,IAAI,CAAC;AAC3E,WAAO,CAAC;AAAA,EACV;AACF;AAMA,eAAsB,qBACpB,OACA,KACkC;AAClC,QAAM,UAAmC,CAAC;AAE1C,MAAI,YAA6B;AACjC,aAAW,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,GAAG;AACvC,UAAM,SAAS,YAAY,GAAG;AAC9B,QAAI,WAAW,KAAM;AACrB,gBAAY,YAAY,UAAU,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,IAAI;AAAA,EAC1E;AAEA,QAAM,kBAAkB,YAAY,MAAM,MAAM;AAChD,MAAI,oBAAoB,MAAM;AAC5B,UAAM,SAAS,gBAAgB,WAAW,IAAI,CAAC,IAAI,MAAM,sBAAsB,KAAK,eAAe;AACnG,gBAAY,YAAY,UAAU,OAAO,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,IAAI;AAAA,EAC1E;AAEA,QAAM,SAAS,MAAM,yBAAyB,GAAG;AACjD,MAAI,aAA8B;AAClC,MAAI,CAAC,OAAO,cAAc;AACxB,iBAAa,CAAC,GAAG,OAAO,UAAU;AAClC,QAAI,OAAO,MAAM,kBAAkB,YAAY,MAAM,cAAc,KAAK,EAAE,SAAS,GAAG;AACpF,YAAM,YAAY,MAAM,cAAc,KAAK;AAC3C,mBAAa,WAAW,OAAO,CAAC,OAAO,OAAO,SAAS;AAAA,IACzD;AACA,QAAI,WAAW,WAAW,GAAG;AAG3B,cAAQ,EAAE,eAAe,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACpD,aAAO;AAAA,IACT;AACA,YAAQ,EAAE,eAAe,IAAI,EAAE,KAAK,WAAW;AAAA,EACjD,WAAW,OAAO,MAAM,kBAAkB,YAAY,MAAM,cAAc,KAAK,EAAE,SAAS,GAAG;AAC3F,YAAQ,EAAE,eAAe,IAAI,MAAM,cAAc,KAAK;AAAA,EACxD;AAEA,MAAI,cAAc,MAAM;AACtB,QAAI,UAAU,WAAW,GAAG;AAC1B,cAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACvC,aAAO;AAAA,IACT;AACA,YAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,UAAU;AAAA,EACnC;AAEA,MAAI,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,KAAK,EAAE,SAAS,GAAG;AAClF,YAAQ,EAAE,cAAc,IAAI,MAAM,aAAa,KAAK;AAAA,EACtD;AACA,MAAI,OAAO,MAAM,0BAA0B,YAAY,MAAM,sBAAsB,KAAK,EAAE,SAAS,GAAG;AACpG,YAAQ,EAAE,wBAAwB,IAAI,MAAM,sBAAsB,KAAK;AAAA,EACzE;AACA,MAAI,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,KAAK,EAAE,SAAS,GAAG;AAElF,YAAQ,EAAE,cAAc,IAAI,MAAM,aAAa,KAAK;AAAA,EACtD,WAAW,iBAAiB,MAAM,YAAY,GAAG;AAE/C,YAAQ,EAAE,cAAc,IAAI,EAAE,KAAK,KAAK;AAAA,EAC1C;AAEA,QAAM,OAAO,mBAAmB,MAAM,CAAC;AACvC,MAAI,MAAM;AAUR,YAAQ,EAAE,KAAK,IAAI,EAAE,QAAQ,IAAI,kBAAkB,IAAI,CAAC,IAAI;AAAA,EAC9D;AAOA,QAAM,gBAAgB,mBAAmB,MAAM,SAAS;AACxD,MAAI,eAAe;AACjB,YAAQ,EAAE,SAAS,IAAI,EAAE,QAAQ,GAAG,kBAAkB,aAAa,CAAC,IAAI;AAAA,EAC1E;AAEA,SAAO;AACT;AAEO,MAAM,iBAAiB;AAAA,EAC5B,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AACJ;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,EAAE,YAAY,wBAAwB;AAAA,EAC/C,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,CAAC,GAAG,cAAc;AAAA;AAAA;AAAA,IAG1B,aAAa,EAAE,OAAO,EAAE,UAAU,KAAK,MAAM;AAAA,IAC7C,mBAAmB,EAAE;AAAA,IACrB,cAAc;AAAA,MACZ,UAAU,EAAE;AAAA,MACZ,OAAO,EAAE;AAAA,MACT,WAAW,EAAE;AAAA,MACb,gBAAgB,EAAE;AAAA,MAClB,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,UAAU,EAAE;AAAA,IACd;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA,WAAW,EAAE,UAAU,wBAAwB;AAAA,EAC/C,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW,wBAAwB;AAAA,MACnC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,2BAA2B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACrF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,UAAU,KAAK;AAAA,MACxD,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,wBAAwB;AAAA,MACnC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,2BAA2B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACrF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,wBAAwB;AAAA,MACnC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAEpB,MAAM,qBAAqB,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,0BAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEtC,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACxC,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,kBAAkB;AAAA,EACpE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aACE;AAAA,EACJ;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AACF,CAAC;",
+  "names": []
+}