@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/api/timesheets/time-entries/[id]/duplicate/route.js

@@ -0,0 +1,228 @@
+import { NextResponse } from "next/server";
+import { resolveFeatureAccess } from "../../../../../lib/time-tracking/featureAccess.js";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { emitStaffEvent } from "../../../../../events.js";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { StaffTimeEntry } from "../../../../../data/entities.js";
+import { staffTimeEntryCommandIds } from "../../../../../commands/timesheets-entries.js";
+import { resolveProjectAccess } from "../../../../../lib/time-tracking/access.js";
+import { readTimeTrackingSettings } from "../../../../../lib/time-tracking/settings.js";
+import { STAFF_TIME_TRACKING_RESOURCE_KINDS } from "../../../../guards.js";
+import { runTimesheetInterceptors } from "../../../_shared/withTimesheetInterceptors.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/time-entries/duplicate" });
+const MANAGE_OWN_FEATURE = "staff.timesheets.manage_own";
+const RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry;
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: [MANAGE_OWN_FEATURE] }
+};
+const duplicateRequestSchema = z.object({
+  date: z.coerce.date().optional(),
+  durationMinutes: z.number().int().min(0).max(1440).optional(),
+  tagIds: z.array(z.string().uuid()).max(50).optional()
+});
+const duplicateResponseSchema = z.object({
+  id: z.string().uuid(),
+  sourceId: z.string().uuid()
+});
+const lockedConflictSchema = z.object({
+  code: z.literal("time_entry_locked"),
+  error: z.string(),
+  lockedReportId: z.string().uuid().nullable(),
+  lockedEntryIds: z.array(z.string().uuid()),
+  lockedReportIds: z.array(z.string().uuid())
+});
+function extractEntryIdFromUrl(request) {
+  if (!request?.url) return null;
+  try {
+    const url = new URL(request.url);
+    const match = url.pathname.match(/\/time-entries\/([^/]+)\/duplicate/);
+    return match?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+async function resolveAssignmentGraceDays(container, tenantId) {
+  try {
+    const configService = container.resolve("moduleConfigService");
+    const settings = await readTimeTrackingSettings(configService, { tenantId });
+    return settings.access.assignmentGraceDays;
+  } catch {
+    return null;
+  }
+}
+async function loadProjectAccess(container, userId, tenantId, organizationId, grantedFeatures) {
+  const em = container.resolve("em");
+  return resolveProjectAccess({
+    em: em.fork(),
+    userId,
+    tenantId,
+    organizationId,
+    userFeatures: grantedFeatures,
+    assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId)
+  });
+}
+function isTimeEntryVisible(entry, access) {
+  if (access.canManageAll) return true;
+  const projectId = entry.timeProjectId ?? null;
+  if (projectId) return access.projectIds.includes(projectId);
+  return access.staffMemberId !== null && access.staffMemberId === entry.staffMemberId;
+}
+async function POST(req) {
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    const { translate } = await resolveTranslations();
+    if (!auth) {
+      throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
+    }
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    if (!tenantId || !organizationId) {
+      throw new CrudHttpError(400, {
+        error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")
+      });
+    }
+    const timeEntryId = extractEntryIdFromUrl(req);
+    if (!timeEntryId) {
+      throw new CrudHttpError(400, {
+        error: translate("staff.timesheets.errors.missingEntryId", "Missing entry ID.")
+      });
+    }
+    const actorId = auth.sub ?? "";
+    const manageOwn = await resolveFeatureAccess(container, actorId, [MANAGE_OWN_FEATURE], { tenantId, organizationId });
+    if (!manageOwn.allowed) {
+      throw forbidden(translate("staff.errors.forbidden", "Forbidden"));
+    }
+    const grantedFeatures = manageOwn.grantedFeatures;
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "POST",
+      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },
+      body: await readJsonSafe(req, {})
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
+    const parsed = duplicateRequestSchema.parse(session.body);
+    const em = container.resolve("em").fork();
+    const source = await findOneWithDecryption(
+      em,
+      StaffTimeEntry,
+      { id: timeEntryId, tenantId, organizationId, deletedAt: null },
+      {},
+      { tenantId, organizationId }
+    );
+    const access = await loadProjectAccess(container, actorId || null, tenantId, organizationId, grantedFeatures);
+    if (!source || !isTimeEntryVisible(source, access)) {
+      throw new CrudHttpError(404, {
+        error: translate("staff.timesheets.errors.entryNotFound", "Time entry not found, deleted, or not owned by you.")
+      });
+    }
+    const guardResult = await runRouteMutationGuards({
+      container,
+      req,
+      auth: {
+        userId: actorId,
+        tenantId,
+        organizationId,
+        userFeatures: grantedFeatures
+      },
+      input: {
+        resourceKind: RESOURCE_KIND,
+        resourceId: timeEntryId,
+        operation: "create",
+        mutationPayload: parsed
+      }
+    });
+    if (!guardResult.ok) return guardResult.response;
+    const effective = guardResult.modifiedPayload ? duplicateRequestSchema.parse({ ...parsed, ...guardResult.modifiedPayload }) : parsed;
+    const ctx = {
+      container,
+      auth,
+      organizationScope: scope,
+      selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+      request: req
+    };
+    const commandBus = container.resolve("commandBus");
+    const { result } = await commandBus.execute(
+      staffTimeEntryCommandIds.duplicate,
+      { input: { ...effective, id: timeEntryId }, ctx }
+    );
+    await guardResult.runAfterSuccess();
+    if (result?.timeEntryId) {
+      void emitStaffEvent("staff.timesheets.time_entry.copied", {
+        id: result.timeEntryId,
+        sourceId: timeEntryId,
+        tenantId,
+        organizationId
+      }, { persistent: true }).catch((err) => {
+        logger.error("staff.timesheets emit time_entry.copied failed", { err });
+      });
+    }
+    return session.respond(201, { id: result?.timeEntryId ?? null, sourceId: timeEntryId });
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    const { translate } = await resolveTranslations();
+    if (err instanceof z.ZodError) {
+      return NextResponse.json(
+        { error: translate("staff.errors.invalid_request", "Invalid request"), details: err.issues },
+        { status: 400 }
+      );
+    }
+    logger.error("staff.timesheets.time-entries.duplicate failed", { err });
+    return NextResponse.json(
+      { error: translate("staff.errors.internal", "Internal server error") },
+      { status: 500 }
+    );
+  }
+}
+const openApi = {
+  tag: "Staff",
+  summary: "Duplicate a time entry",
+  methods: {
+    POST: {
+      summary: "Duplicate a time entry",
+      description: "US-D6. Copies an existing time entry, carrying its task, project, description, billable flag and rate override across. `date` and `durationMinutes` override the copy without a second request; `tagIds` sets the copy tag set (the caller passes the source tags it already holds from the list response). The copy is written through the create command, so ownership, project access, the billable and currency defaults, and the tenant rounding rule apply to it exactly as they do to a hand-made entry. A source locked into a closed report is refused with 409 `time_entry_locked`; a source the caller cannot see answers 404.",
+      requestBody: {
+        contentType: "application/json",
+        schema: duplicateRequestSchema
+      },
+      responses: [
+        { status: 201, description: "Copy created", schema: duplicateResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Invalid body or missing scope" },
+        { status: 401, description: "Unauthorized" },
+        { status: 403, description: "Missing staff.timesheets.manage_own" },
+        { status: 404, description: "Time entry not found, deleted, or outside the caller project access" },
+        {
+          status: 409,
+          description: "The source entry is locked into a closed report; nothing was copied",
+          schema: lockedConflictSchema
+        }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/time-entries/[id]/duplicate/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/duplicate/route.ts"],
+  "sourcesContent": ["/**\n * US-D6 \u2014 \"repeat yesterday\", for one entry.\n *\n * The row action on screen 10 and the per-row copy button on screen 1 both land\n * here. The route is deliberately thin: T4.2 already put the whole copy in the\n * `staff.timesheets.time_entries.duplicate` command, which resolves the SOURCE,\n * runs it past the lock gate and then delegates the write to the create command\n * so the copy inherits ownership enforcement, project access, the billable and\n * currency defaults, rounding (D-7), tag syncing and the audit entry unchanged.\n * Nothing here re-implements any of that.\n *\n * Two things the route owns that the command cannot:\n *\n *  1. **Existence is decided by the caller's project access, not by the row.** The\n *     source is looked up through the same intersection the list route applies \u2014\n *     entries on projects the caller belongs to, plus their own project-less\n *     entries \u2014 and anything outside it answers `404`, never `403`. A `403` on a\n *     project the caller cannot see would confirm the entry exists and name the\n *     project it belongs to.\n *  2. **`date` and `durationMinutes` overrides.** US-D6 ends with \"I adjust the\n *     duration and the date\", so both travel with the copy request instead of\n *     costing a follow-up PUT that would briefly show the wrong duration.\n *\n * `tagIds` is passed in by the caller rather than read off the junction: the\n * command writes tags only through the tag commands and never touches\n * `staff_time_entry_tags`, and the client already holds the source's `tags[]`\n * from the list response.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeEntry } from '../../../../../data/entities'\nimport { staffTimeEntryCommandIds } from '../../../../../commands/timesheets-entries'\nimport { resolveProjectAccess, type ProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../../../lib/time-tracking/settings'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/duplicate' })\n\nconst MANAGE_OWN_FEATURE = 'staff.timesheets.manage_own'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_OWN_FEATURE] },\n}\n\nconst duplicateRequestSchema = z.object({\n  date: z.coerce.date().optional(),\n  durationMinutes: z.number().int().min(0).max(1440).optional(),\n  tagIds: z.array(z.string().uuid()).max(50).optional(),\n})\n\nconst duplicateResponseSchema = z.object({\n  id: z.string().uuid(),\n  sourceId: z.string().uuid(),\n})\n\nconst lockedConflictSchema = z.object({\n  code: z.literal('time_entry_locked'),\n  error: z.string(),\n  lockedReportId: z.string().uuid().nullable(),\n  lockedEntryIds: z.array(z.string().uuid()),\n  lockedReportIds: z.array(z.string().uuid()),\n})\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/duplicate/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string,\n  organizationId: string,\n  grantedFeatures: readonly string[],\n): Promise<ProjectAccess> {\n  const em = container.resolve('em') as EntityManager\n  return resolveProjectAccess({\n    em: em.fork(),\n    userId,\n    tenantId,\n    organizationId,\n    userFeatures: grantedFeatures,\n    assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n  })\n}\n\n/**\n * The per-row form of the list route's `$or` intersection: an entry on a project\n * is visible to the members of that project, and a project-less entry is visible\n * only to the member who logged it.\n */\nfunction isTimeEntryVisible(\n  entry: { staffMemberId: string; timeProjectId?: string | null },\n  access: ProjectAccess,\n): boolean {\n  if (access.canManageAll) return true\n  const projectId = entry.timeProjectId ?? null\n  if (projectId) return access.projectIds.includes(projectId)\n  return access.staffMemberId !== null && access.staffMemberId === entry.staffMemberId\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const timeEntryId = extractEntryIdFromUrl(req)\n    if (!timeEntryId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const manageOwn = await resolveFeatureAccess(container, actorId, [MANAGE_OWN_FEATURE], { tenantId, organizationId })\n    if (!manageOwn.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageOwn.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = duplicateRequestSchema.parse(session.body)\n\n    // The source is resolved here, before the command, purely so an entry the\n    // caller cannot see answers 404 instead of the command's 403 \u2014 which would\n    // confirm the entry exists and name the project that hides it.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const source = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: timeEntryId, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n    const access = await loadProjectAccess(container, actorId || null, tenantId, organizationId, grantedFeatures)\n    if (!source || !isTimeEntryVisible(source, access)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found, deleted, or not owned by you.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: timeEntryId,\n        operation: 'create',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? duplicateRequestSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<unknown, { timeEntryId: string }>(\n      staffTimeEntryCommandIds.duplicate,\n      { input: { ...effective, id: timeEntryId }, ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    if (result?.timeEntryId) {\n      void emitStaffEvent('staff.timesheets.time_entry.copied', {\n        id: result.timeEntryId,\n        sourceId: timeEntryId,\n        tenantId,\n        organizationId,\n      }, { persistent: true }).catch((err) => {\n        logger.error('staff.timesheets emit time_entry.copied failed', { err })\n      })\n    }\n\n    return session.respond(201, { id: result?.timeEntryId ?? null, sourceId: timeEntryId })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.time-entries.duplicate failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Duplicate a time entry',\n  methods: {\n    POST: {\n      summary: 'Duplicate a time entry',\n      description:\n        'US-D6. Copies an existing time entry, carrying its task, project, description, billable flag and rate override across. `date` and `durationMinutes` override the copy without a second request; `tagIds` sets the copy tag set (the caller passes the source tags it already holds from the list response). The copy is written through the create command, so ownership, project access, the billable and currency defaults, and the tenant rounding rule apply to it exactly as they do to a hand-made entry. A source locked into a closed report is refused with 409 `time_entry_locked`; a source the caller cannot see answers 404.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: duplicateRequestSchema,\n      },\n      responses: [\n        { status: 201, description: 'Copy created', schema: duplicateResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid body or missing scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.manage_own' },\n        { status: 404, description: 'Time entry not found, deleted, or outside the caller project access' },\n        {\n          status: 409,\n          description: 'The source entry is locked into a closed report; nothing was copied',\n          schema: lockedConflictSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AA6BA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,0CAA0C;AAGnD,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,4BAAgD;AACzD,SAAS,gCAAgC;AACzC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,wCAAwC,CAAC;AAEjG,MAAM,qBAAqB;AAC3B,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EAC/B,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC5D,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AACtD,CAAC;AAED,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,mBAAmB;AAAA,EACnC,OAAO,EAAE,OAAO;AAAA,EAChB,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC5C,CAAC;AAID,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,oCAAoC;AACrE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACA,iBACwB;AACxB,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO,qBAAqB;AAAA,IAC1B,IAAI,GAAG,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,EAC3E,CAAC;AACH;AAOA,SAAS,mBACP,OACA,QACS;AACT,MAAI,OAAO,aAAc,QAAO;AAChC,QAAM,YAAY,MAAM,iBAAiB;AACzC,MAAI,UAAW,QAAO,OAAO,WAAW,SAAS,SAAS;AAC1D,SAAO,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,MAAM;AACzE;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,sBAAsB,GAAG;AAC7C,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,0CAA0C,mBAAmB;AAAA,MAChF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAI5B,UAAM,YAAY,MAAM,qBAAqB,WAAW,SAAS,CAAC,kBAAkB,GAAG,EAAE,UAAU,eAAe,CAAC;AACnH,QAAI,CAAC,UAAU,SAAS;AACtB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,UAAU;AAElC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,uBAAuB,MAAM,QAAQ,IAAI;AAKxD,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,aAAa,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC7D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,SAAS,MAAM,kBAAkB,WAAW,WAAW,MAAM,UAAU,gBAAgB,eAAe;AAC5G,QAAI,CAAC,UAAU,CAAC,mBAAmB,QAAQ,MAAM,GAAG;AAClD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,qDAAqD;AAAA,MACjH,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,uBAAuB,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAC1E;AAEJ,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,MAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC,yBAAyB;AAAA,MACzB,EAAE,OAAO,EAAE,GAAG,WAAW,IAAI,YAAY,GAAG,IAAI;AAAA,IAClD;AAEA,UAAM,YAAY,gBAAgB;AAElC,QAAI,QAAQ,aAAa;AACvB,WAAK,eAAe,sCAAsC;AAAA,QACxD,IAAI,OAAO;AAAA,QACX,UAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,eAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,MACxE,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,QAAQ,eAAe,MAAM,UAAU,YAAY,CAAC;AAAA,EACxF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,wBAAwB;AAAA,MAC9E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,sEAAsE;AAAA,QAClG;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/[segmentId]/route.js

@@ -10,11 +10,15 @@ import { LockMode } from "@mikro-orm/core";
 import { StaffTimeEntry, StaffTimeEntrySegment } from "../../../../../../data/entities.js";
 import { staffTimeEntrySegmentUpdateSchema } from "../../../../../../data/validators.js";
 import { getStaffMemberByUserId } from "../../../../../../lib/staffMemberResolver.js";
+import { emitStaffEvent } from "../../../../../../events.js";
+import { runTimesheetInterceptors } from "../../../../_shared/withTimesheetInterceptors.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
 import {
-  resolveUserFeatures,
+  STAFF_TIME_TRACKING_RESOURCE_KINDS,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards
 } from "../../../../../guards.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/time-entries/segments" });
 const routeMetadata = {
   PATCH: { requireAuth: true, requireFeatures: ["staff.timesheets.manage_own"] }
 };
@@ -43,10 +47,6 @@ async function PATCH(req) {
   if (!rawBody) {
     return NextResponse.json({ error: "Invalid payload" }, { status: 400 });
   }
-  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...rawBody, id: ids.segmentId });
-  if (!parsed.success) {
-    return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 400 });
-  }
   const container = await createRequestContainer();
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
   const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
@@ -54,6 +54,18 @@ async function PATCH(req) {
   if (!tenantId || !organizationId) {
     return NextResponse.json({ error: "Missing tenant or organization scope." }, { status: 400 });
   }
+  const interceptors = await runTimesheetInterceptors({
+    request: req,
+    method: "PATCH",
+    scope: { container, userId: auth.sub, tenantId, organizationId },
+    body: rawBody
+  });
+  if (!interceptors.ok) return interceptors.response;
+  const { session } = interceptors;
+  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...session.body, id: ids.segmentId });
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 400 });
+  }
   const em = container.resolve("em").fork();
   const scopeCtx = { tenantId, organizationId };
   const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx);
@@ -80,14 +92,13 @@ async function PATCH(req) {
       tenantId,
       organizationId,
       userId: auth.sub ?? "",
-      resourceKind: "staff.timesheets.time_entry_segment",
+      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,
       resourceId: segment.id,
       operation: "update",
       requestMethod: req.method,
       requestHeaders: req.headers,
       mutationPayload: parsed.data
-    },
-    resolveUserFeatures(auth)
+    }
   );
   if (!guardResult.ok) {
     return NextResponse.json(
@@ -141,14 +152,22 @@ async function PATCH(req) {
       tenantId,
       organizationId,
       userId: auth.sub ?? "",
-      resourceKind: "staff.timesheets.time_entry_segment",
+      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,
       resourceId: updatedSegment.id,
       operation: "update",
       requestMethod: req.method,
       requestHeaders: req.headers
     });
   }
-  return NextResponse.json({
+  void emitStaffEvent("staff.timesheets.time_entry_segment.updated", {
+    id: updatedSegment.id,
+    timeEntryId: updatedSegment.timeEntryId,
+    tenantId,
+    organizationId
+  }, { persistent: true }).catch((err) => {
+    logger.error("staff.timesheets emit time_entry_segment.updated failed", { err });
+  });
+  return session.respond(200, {
     ok: true,
     item: {
       id: updatedSegment.id,

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/[segmentId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/segments/%5BsegmentId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../../data/entities'\nimport { staffTimeEntrySegmentUpdateSchema } from '../../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../../lib/staffMemberResolver'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../../guards'\n\nconst routeMetadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nfunction extractIdsFromUrl(request?: Request): { entryId: string; segmentId: string } | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments\\/([^/]+)/)\n    if (!match?.[1] || !match?.[2]) return null\n    return { entryId: match[1], segmentId: match[2] }\n  } catch {\n    return null\n  }\n}\n\nexport async function PATCH(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const ids = extractIdsFromUrl(req)\n  if (!ids) {\n    return NextResponse.json({ error: 'Segment id is required' }, { status: 400 })\n  }\n\n  const rawBody = await readJsonSafe<Record<string, unknown>>(req, null)\n  if (!rawBody) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...rawBody, id: ids.segmentId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    return NextResponse.json({ error: 'Missing tenant or organization scope.' }, { status: 400 })\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const scopeCtx = { tenantId, organizationId }\n\n  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx)\n  if (!entry) {\n    return NextResponse.json({ error: 'Time entry not found' }, { status: 404 })\n  }\n\n  const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n  if (!staffMember || entry.staffMemberId !== staffMember.id) {\n    return NextResponse.json({ error: 'You can only manage your own time entries.' }, { status: 403 })\n  }\n\n  const segment = await findOneWithDecryption(em, StaffTimeEntrySegment, {\n    id: ids.segmentId,\n    timeEntryId: ids.entryId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  }, {}, scopeCtx)\n\n  if (!segment) {\n    return NextResponse.json({ error: 'Segment not found' }, { status: 404 })\n  }\n\n  const guardResult = await runStaffMutationGuards(\n    container,\n    {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'staff.timesheets.time_entry_segment',\n      resourceId: segment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  // Apply the segment edit inside a single transaction with a PESSIMISTIC_WRITE\n  // lock on the parent time entry row, re-loading the segment under the lock so\n  // concurrent segment edits / timer-stop recomputes on the same entry serialize\n  // instead of racing on a shared in-memory snapshot (issue #2416).\n  let updatedSegment: StaffTimeEntrySegment\n  try {\n    updatedSegment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: ids.entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: 'Time entry not found' })\n      }\n\n      const lockedSegment = await findOneWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { id: ids.segmentId, timeEntryId: ids.entryId, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n      if (!lockedSegment) {\n        throw new CrudHttpError(404, { error: 'Segment not found' })\n      }\n\n      if (parsed.data.startedAt !== undefined) {\n        lockedSegment.startedAt = parsed.data.startedAt\n      }\n      if (parsed.data.endedAt !== undefined) {\n        lockedSegment.endedAt = parsed.data.endedAt ?? null\n      }\n      if (parsed.data.segmentType !== undefined) {\n        lockedSegment.segmentType = parsed.data.segmentType\n      }\n\n      await trx.flush()\n      return lockedSegment\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: 'staff.timesheets.time_entry_segment',\n      resourceId: updatedSegment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: updatedSegment.id,\n      timeEntryId: updatedSegment.timeEntryId,\n      startedAt: updatedSegment.startedAt,\n      endedAt: updatedSegment.endedAt,\n      segmentType: updatedSegment.segmentType,\n      createdAt: updatedSegment.createdAt,\n      updatedAt: updatedSegment.updatedAt,\n    },\n  })\n}\n\nconst errorSchema = z.object({ error: z.string() })\nconst segmentResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    timeEntryId: z.string(),\n    startedAt: z.string(),\n    endedAt: z.string().nullable(),\n    segmentType: z.enum(['work', 'break']),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry segment management',\n  methods: {\n    PATCH: {\n      summary: 'Update a time entry segment',\n      description: 'Updates fields on an existing time entry segment (startedAt, endedAt, segmentType).',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentUpdateSchema.omit({ id: true }),\n      },\n      responses: [\n        { status: 200, description: 'Segment updated successfully', schema: segmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing segment id', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Segment not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,eAAe,uBAAuB;AAE/C,SAAS,gBAAgB;AACzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,gBAAgB;AAAA,EACpB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEO,MAAM,WAAW;AAExB,SAAS,kBAAkB,SAAkE;AAC3F,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,4CAA4C;AAC7E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAG,QAAO;AACvC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,kBAAkB,GAAG;AACjC,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,UAAU,MAAM,aAAsC,KAAK,IAAI;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,kCAAkC,UAAU,EAAE,GAAG,SAAS,IAAI,IAAI,UAAU,CAAC;AAC5F,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,QAAM,QAAQ,MAAM,sBAAsB,IAAI,gBAAgB,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK,GAAG,CAAC,GAAG,QAAQ;AAC1I,MAAI,CAAC,OAAO;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,MAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,QAAM,UAAU,MAAM,sBAAsB,IAAI,uBAAuB;AAAA,IACrE,IAAI,IAAI;AAAA,IACR,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,QAAQ;AAEf,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QAC7D,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAEA,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,WAAW,aAAa,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzF,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC7D;AAEA,UAAI,OAAO,KAAK,cAAc,QAAW;AACvC,sBAAc,YAAY,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,KAAK,YAAY,QAAW;AACrC,sBAAc,UAAU,OAAO,KAAK,WAAW;AAAA,MACjD;AACA,UAAI,OAAO,KAAK,gBAAgB,QAAW;AACzC,sBAAc,cAAc,OAAO,KAAK;AAAA,MAC1C;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,eAAe;AAAA,MAC3B,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,eAAe;AAAA,MACnB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,SAAS,eAAe;AAAA,MACxB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,WAAW,eAAe;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClD,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,IACrC,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,EACtB,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,kCAAkC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,sBAAsB;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,QACzF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../../data/entities'\nimport { staffTimeEntrySegmentUpdateSchema } from '../../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../../lib/staffMemberResolver'\nimport { emitStaffEvent } from '../../../../../../events'\nimport { runTimesheetInterceptors } from '../../../../_shared/withTimesheetInterceptors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../../guards'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/segments' })\n\nconst routeMetadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nfunction extractIdsFromUrl(request?: Request): { entryId: string; segmentId: string } | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments\\/([^/]+)/)\n    if (!match?.[1] || !match?.[2]) return null\n    return { entryId: match[1], segmentId: match[2] }\n  } catch {\n    return null\n  }\n}\n\nexport async function PATCH(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const ids = extractIdsFromUrl(req)\n  if (!ids) {\n    return NextResponse.json({ error: 'Segment id is required' }, { status: 400 })\n  }\n\n  const rawBody = await readJsonSafe<Record<string, unknown>>(req, null)\n  if (!rawBody) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    return NextResponse.json({ error: 'Missing tenant or organization scope.' }, { status: 400 })\n  }\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: 'PATCH',\n    scope: { container, userId: auth.sub, tenantId, organizationId },\n    body: rawBody,\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...session.body, id: ids.segmentId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const scopeCtx = { tenantId, organizationId }\n\n  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx)\n  if (!entry) {\n    return NextResponse.json({ error: 'Time entry not found' }, { status: 404 })\n  }\n\n  const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n  if (!staffMember || entry.staffMemberId !== staffMember.id) {\n    return NextResponse.json({ error: 'You can only manage your own time entries.' }, { status: 403 })\n  }\n\n  const segment = await findOneWithDecryption(em, StaffTimeEntrySegment, {\n    id: ids.segmentId,\n    timeEntryId: ids.entryId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  }, {}, scopeCtx)\n\n  if (!segment) {\n    return NextResponse.json({ error: 'Segment not found' }, { status: 404 })\n  }\n\n  const guardResult = await runStaffMutationGuards(\n    container,\n    {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: segment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  // Apply the segment edit inside a single transaction with a PESSIMISTIC_WRITE\n  // lock on the parent time entry row, re-loading the segment under the lock so\n  // concurrent segment edits / timer-stop recomputes on the same entry serialize\n  // instead of racing on a shared in-memory snapshot (issue #2416).\n  let updatedSegment: StaffTimeEntrySegment\n  try {\n    updatedSegment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: ids.entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: 'Time entry not found' })\n      }\n\n      const lockedSegment = await findOneWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { id: ids.segmentId, timeEntryId: ids.entryId, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n      if (!lockedSegment) {\n        throw new CrudHttpError(404, { error: 'Segment not found' })\n      }\n\n      if (parsed.data.startedAt !== undefined) {\n        lockedSegment.startedAt = parsed.data.startedAt\n      }\n      if (parsed.data.endedAt !== undefined) {\n        lockedSegment.endedAt = parsed.data.endedAt ?? null\n      }\n      if (parsed.data.segmentType !== undefined) {\n        lockedSegment.segmentType = parsed.data.segmentType\n      }\n\n      await trx.flush()\n      return lockedSegment\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: updatedSegment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  void emitStaffEvent('staff.timesheets.time_entry_segment.updated', {\n    id: updatedSegment.id,\n    timeEntryId: updatedSegment.timeEntryId,\n    tenantId,\n    organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_entry_segment.updated failed', { err })\n  })\n\n  return session.respond(200, {\n    ok: true,\n    item: {\n      id: updatedSegment.id,\n      timeEntryId: updatedSegment.timeEntryId,\n      startedAt: updatedSegment.startedAt,\n      endedAt: updatedSegment.endedAt,\n      segmentType: updatedSegment.segmentType,\n      createdAt: updatedSegment.createdAt,\n      updatedAt: updatedSegment.updatedAt,\n    },\n  })\n}\n\nconst errorSchema = z.object({ error: z.string() })\nconst segmentResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    timeEntryId: z.string(),\n    startedAt: z.string(),\n    endedAt: z.string().nullable(),\n    segmentType: z.enum(['work', 'break']),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry segment management',\n  methods: {\n    PATCH: {\n      summary: 'Update a time entry segment',\n      description: 'Updates fields on an existing time entry segment (startedAt, endedAt, segmentType).',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentUpdateSchema.omit({ id: true }),\n      },\n      responses: [\n        { status: 200, description: 'Segment updated successfully', schema: segmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing segment id', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Segment not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,eAAe,uBAAuB;AAE/C,SAAS,gBAAgB;AACzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB;AAAA,EACpB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEO,MAAM,WAAW;AAExB,SAAS,kBAAkB,SAAkE;AAC3F,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,4CAA4C;AAC7E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAG,QAAO;AACvC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,kBAAkB,GAAG;AACjC,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,UAAU,MAAM,aAAsC,KAAK,IAAI;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,SAAS,kCAAkC,UAAU,EAAE,GAAG,QAAQ,MAAM,IAAI,IAAI,UAAU,CAAC;AACjG,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,QAAM,QAAQ,MAAM,sBAAsB,IAAI,gBAAgB,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK,GAAG,CAAC,GAAG,QAAQ;AAC1I,MAAI,CAAC,OAAO;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,MAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,QAAM,UAAU,MAAM,sBAAsB,IAAI,uBAAuB;AAAA,IACrE,IAAI,IAAI;AAAA,IACR,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,QAAQ;AAEf,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QAC7D,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAEA,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,WAAW,aAAa,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzF,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC7D;AAEA,UAAI,OAAO,KAAK,cAAc,QAAW;AACvC,sBAAc,YAAY,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,KAAK,YAAY,QAAW;AACrC,sBAAc,UAAU,OAAO,KAAK,WAAW;AAAA,MACjD;AACA,UAAI,OAAO,KAAK,gBAAgB,QAAW;AACzC,sBAAc,cAAc,OAAO,KAAK;AAAA,MAC1C;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,eAAe;AAAA,MAC3B,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,OAAK,eAAe,+CAA+C;AAAA,IACjE,IAAI,eAAe;AAAA,IACnB,aAAa,eAAe;AAAA,IAC5B;AAAA,IACA;AAAA,EACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAAA,EACjF,CAAC;AAED,SAAO,QAAQ,QAAQ,KAAK;AAAA,IAC1B,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,eAAe;AAAA,MACnB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,SAAS,eAAe;AAAA,MACxB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,WAAW,eAAe;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClD,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,IACrC,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,EACtB,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,kCAAkC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,sBAAsB;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,QACzF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/route.js

@@ -13,11 +13,13 @@ import { StaffTimeEntry, StaffTimeEntrySegment } from "../../../../../data/entit
 import { staffTimeEntrySegmentCreateSchema } from "../../../../../data/validators.js";
 import { getStaffMemberByUserId } from "../../../../../lib/staffMemberResolver.js";
 import {
-  resolveUserFeatures,
+  STAFF_TIME_TRACKING_RESOURCE_KINDS,
   runStaffMutationGuardAfterSuccess,
   runStaffMutationGuards
 } from "../../../../guards.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { emitStaffEvent } from "../../../../../events.js";
+import { runTimesheetInterceptors } from "../../../_shared/withTimesheetInterceptors.js";
 const logger = createLogger("staff");
 function extractEntryIdFromUrl(request) {
   if (!request?.url) return null;
@@ -64,10 +66,17 @@ async function POST(req) {
     if (!staffMember || entry.staffMemberId !== staffMember.id) {
       throw new CrudHttpError(403, { error: translate("staff.timesheets.errors.notOwner", "You can only manage your own time entries.") });
     }
-    const body = await readJsonSafe(req, {});
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "POST",
+      scope: { container, userId: auth.sub, tenantId, organizationId },
+      body: await readJsonSafe(req, {})
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
     const input = parseScopedCommandInput(
       staffTimeEntrySegmentCreateSchema,
-      { ...body, timeEntryId: entryId },
+      { ...session.body, timeEntryId: entryId },
       {
         container,
         auth,
@@ -84,14 +93,13 @@ async function POST(req) {
         tenantId,
         organizationId,
         userId: auth.sub ?? "",
-        resourceKind: "staff.timesheets.time_entry_segment",
+        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,
         resourceId: entry.id,
         operation: "create",
         requestMethod: req.method,
         requestHeaders: req.headers,
         mutationPayload: input
-      },
-      resolveUserFeatures(auth)
+      }
     );
     if (!guardResult.ok) {
       return NextResponse.json(
@@ -127,24 +135,29 @@ async function POST(req) {
         tenantId,
         organizationId,
         userId: auth.sub ?? "",
-        resourceKind: "staff.timesheets.time_entry_segment",
+        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,
         resourceId: segment.id,
         operation: "create",
         requestMethod: req.method,
         requestHeaders: req.headers
       });
     }
-    return NextResponse.json(
-      {
-        id: segment.id,
-        timeEntryId: segment.timeEntryId,
-        startedAt: segment.startedAt,
-        endedAt: segment.endedAt ?? null,
-        segmentType: segment.segmentType,
-        createdAt: segment.createdAt
-      },
-      { status: 201 }
-    );
+    void emitStaffEvent("staff.timesheets.time_entry_segment.created", {
+      id: segment.id,
+      timeEntryId: segment.timeEntryId,
+      tenantId,
+      organizationId
+    }, { persistent: true }).catch((err) => {
+      logger.error("staff.timesheets emit time_entry_segment.created failed", { err });
+    });
+    return session.respond(201, {
+      id: segment.id,
+      timeEntryId: segment.timeEntryId,
+      startedAt: segment.startedAt,
+      endedAt: segment.endedAt ?? null,
+      segmentType: segment.segmentType,
+      createdAt: segment.createdAt
+    });
   } catch (err) {
     if (err instanceof CrudHttpError) {
       return NextResponse.json(err.body, { status: err.status });

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/segments/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { staffTimeEntrySegmentCreateSchema } from '../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  resolveUserFeatures,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    const body = await readJsonSafe(req, {})\n    const input = parseScopedCommandInput(\n      staffTimeEntrySegmentCreateSchema,\n      { ...body, timeEntryId: entryId },\n      {\n        container,\n        auth,\n        organizationScope: scope,\n        selectedOrganizationId: organizationId,\n        organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n        request: req,\n      },\n      translate,\n    )\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry_segment',\n        resourceId: entry.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input as unknown as Record<string, unknown>,\n      },\n      resolveUserFeatures(auth),\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Create the segment inside a single transaction with a PESSIMISTIC_WRITE\n    // lock on the parent time entry row, so segment writes serialize against\n    // concurrent timer-stop / segment mutations that recompute the entry from a\n    // shared snapshot (issue #2416).\n    const segment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n\n      const segmentData = {\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        timeEntryId: input.timeEntryId,\n        startedAt: input.startedAt,\n        endedAt: input.endedAt ?? null,\n        segmentType: input.segmentType,\n      }\n      const created = trx.create(StaffTimeEntrySegment, segmentData as never)\n\n      await trx.flush()\n      return created\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: 'staff.timesheets.time_entry_segment',\n        resourceId: segment.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json(\n      {\n        id: segment.id,\n        timeEntryId: segment.timeEntryId,\n        startedAt: segment.startedAt,\n        endedAt: segment.endedAt ?? null,\n        segmentType: segment.segmentType,\n        createdAt: segment.createdAt,\n      },\n      { status: 201 },\n    )\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.segments.create failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.segmentCreate', 'Failed to create time entry segment.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Add a segment to a time entry',\n  methods: {\n    POST: {\n      summary: 'Add a segment to a time entry',\n      description: 'Creates a new work or break segment for the specified time entry.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentCreateSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Segment created',\n          schema: z.object({\n            id: z.string().uuid(),\n            timeEntryId: z.string().uuid(),\n            startedAt: z.string(),\n            endedAt: z.string().nullable(),\n            segmentType: z.enum(['work', 'break']),\n            createdAt: z.string(),\n          }),\n        },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,mCAAmC;AACpE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAEA,UAAM,OAAO,MAAM,aAAa,KAAK,CAAC,CAAC;AACvC,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,GAAG,MAAM,aAAa,QAAQ;AAAA,MAChC;AAAA,QACE;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,QAClE,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,MACA,oBAAoB,IAAI;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,UAAU,MAAM,GAAG,cAAc,OAAO,QAAQ;AACpD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAEA,YAAM,cAAc;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM,WAAW;AAAA,QAC1B,aAAa,MAAM;AAAA,MACrB;AACA,YAAM,UAAU,IAAI,OAAO,uBAAuB,WAAoB;AAEtE,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc;AAAA,QACd,YAAY,QAAQ;AAAA,QACpB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,WAAW,QAAQ;AAAA,QACnB,SAAS,QAAQ,WAAW;AAAA,QAC5B,aAAa,QAAQ;AAAA,QACrB,WAAW,QAAQ;AAAA,MACrB;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wDAAwD,EAAE,IAAI,CAAC;AAC5E,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yCAAyC,sCAAsC,EAAE;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,YACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,YAC7B,WAAW,EAAE,OAAO;AAAA,YACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,YACrC,WAAW,EAAE,OAAO;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { staffTimeEntrySegmentCreateSchema } from '../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const input = parseScopedCommandInput(\n      staffTimeEntrySegmentCreateSchema,\n      { ...session.body, timeEntryId: entryId },\n      {\n        container,\n        auth,\n        organizationScope: scope,\n        selectedOrganizationId: organizationId,\n        organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n        request: req,\n      },\n      translate,\n    )\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n        resourceId: entry.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input as unknown as Record<string, unknown>,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Create the segment inside a single transaction with a PESSIMISTIC_WRITE\n    // lock on the parent time entry row, so segment writes serialize against\n    // concurrent timer-stop / segment mutations that recompute the entry from a\n    // shared snapshot (issue #2416).\n    const segment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n\n      const segmentData = {\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        timeEntryId: input.timeEntryId,\n        startedAt: input.startedAt,\n        endedAt: input.endedAt ?? null,\n        segmentType: input.segmentType,\n      }\n      const created = trx.create(StaffTimeEntrySegment, segmentData as never)\n\n      await trx.flush()\n      return created\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n        resourceId: segment.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    void emitStaffEvent('staff.timesheets.time_entry_segment.created', {\n      id: segment.id,\n      timeEntryId: segment.timeEntryId,\n      tenantId,\n      organizationId,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_entry_segment.created failed', { err })\n    })\n\n    return session.respond(201, {\n      id: segment.id,\n      timeEntryId: segment.timeEntryId,\n      startedAt: segment.startedAt,\n      endedAt: segment.endedAt ?? null,\n      segmentType: segment.segmentType,\n      createdAt: segment.createdAt,\n    })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.segments.create failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.segmentCreate', 'Failed to create time entry segment.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Add a segment to a time entry',\n  methods: {\n    POST: {\n      summary: 'Add a segment to a time entry',\n      description: 'Creates a new work or break segment for the specified time entry.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentCreateSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Segment created',\n          schema: z.object({\n            id: z.string().uuid(),\n            timeEntryId: z.string().uuid(),\n            startedAt: z.string(),\n            endedAt: z.string().nullable(),\n            segmentType: z.enum(['work', 'break']),\n            createdAt: z.string(),\n          }),\n        },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,mCAAmC;AACpE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,GAAG,QAAQ,MAAM,aAAa,QAAQ;AAAA,MACxC;AAAA,QACE;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,QAClE,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,UAAU,MAAM,GAAG,cAAc,OAAO,QAAQ;AACpD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAEA,YAAM,cAAc;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM,WAAW;AAAA,QAC1B,aAAa,MAAM;AAAA,MACrB;AACA,YAAM,UAAU,IAAI,OAAO,uBAAuB,WAAoB;AAEtE,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,QAAQ;AAAA,QACpB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,SAAK,eAAe,+CAA+C;AAAA,MACjE,IAAI,QAAQ;AAAA,MACZ,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,IAAI,QAAQ;AAAA,MACZ,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,SAAS,QAAQ,WAAW;AAAA,MAC5B,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wDAAwD,EAAE,IAAI,CAAC;AAC5E,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yCAAyC,sCAAsC,EAAE;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,YACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,YAC7B,WAAW,EAAE,OAAO;AAAA,YACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,YACrC,WAAW,EAAE,OAAO;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }