@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/api/timesheets/time-entries/route.js

@@ -2,11 +2,19 @@ import { z } from "zod";
 import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { resolveCrudRecordId, parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
-import { StaffTimeEntry } from "../../../data/entities.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { sanitizeSearchTerm } from "../../helpers.js";
+import { StaffTimeEntry, StaffTimeEntryTag, StaffTimeProject } from "../../../data/entities.js";
 import { staffTimeEntryCreateSchema, staffTimeEntryUpdateSchema } from "../../../data/validators.js";
 import { buildTimeEntryListFilters, isParseableDateFilter } from "../../../lib/timesheets/timeEntryListFilters.js";
-import { staffTimeEntryCommandIds } from "../../../lib/crud.js";
+import { staffTimeEntryCommandIds, staffTimeEntryCrudEvents } from "../../../lib/crud.js";
+import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.js";
+import { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from "../../../lib/time-tracking/access.js";
+import { readTimeTrackingSettings } from "../../../lib/time-tracking/settings.js";
+import { decorateTimeEntryRows } from "../../../lib/timesheets/timeEntryDecoration.js";
 import { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from "../../openapi.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/time-entries" });
 const F = {
   id: "id",
   tenant_id: "tenant_id",
@@ -14,18 +22,26 @@ const F = {
   staff_member_id: "staff_member_id",
   date: "date",
   duration_minutes: "duration_minutes",
+  rounded_minutes: "rounded_minutes",
   started_at: "started_at",
   ended_at: "ended_at",
   notes: "notes",
   time_project_id: "time_project_id",
+  task_id: "task_id",
   customer_id: "customer_id",
   deal_id: "deal_id",
   order_id: "order_id",
+  is_billable: "is_billable",
+  rate_override_amount: "rate_override_amount",
+  rate_currency_code: "rate_currency_code",
+  locked_report_id: "locked_report_id",
+  locked_at: "locked_at",
   source: "source",
   created_at: "created_at",
   updated_at: "updated_at",
   deleted_at: "deleted_at"
 };
+const RATES_FEATURE = "staff.timesheets.rates.view";
 const routeMetadata = {
   GET: { requireAuth: true, requireFeatures: ["staff.timesheets.view"] },
   POST: { requireAuth: true, requireFeatures: ["staff.timesheets.manage_own"] },
@@ -42,11 +58,190 @@ const listSchema = z.object({
   from: dateFilterSchema,
   to: dateFilterSchema,
   projectId: z.string().uuid().optional(),
+  /**
+   * One task id, or a comma-separated list of them. The list form is what the
+   * task drawer needs: a parent and its subtasks are one question ("what has
+   * been logged against this task?"), so answering it must not cost one request
+   * per child.
+   */
+  taskId: z.string().optional(),
   ids: z.string().optional(),
   running: z.string().optional(),
+  /** `true` / `false` — omitted means "either". */
+  billable: z.string().optional(),
+  /** `true` = frozen into a closed report, `false` = still editable. */
+  locked: z.string().optional(),
+  /** Free text over the entry note. */
+  q: z.string().optional(),
+  /** Customer id — narrows to that customer's projects. */
+  customerId: z.string().uuid().optional(),
+  /** One tag id, or a comma-separated list; an entry matching any of them. */
+  tagIds: z.string().optional(),
   sortField: z.string().optional(),
   sortDir: z.enum(["asc", "desc"]).optional()
 }).passthrough();
+function parseBooleanFlagOrNull(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  if (normalized.length === 0) return null;
+  if (["1", "true", "yes", "on"].includes(normalized)) return true;
+  if (["0", "false", "no", "off"].includes(normalized)) return false;
+  return null;
+}
+const IMPOSSIBLE_ID = "00000000-0000-0000-0000-000000000000";
+const DENIED_ACCESS = { canManageAll: false, projectIds: [], staffMemberId: null };
+const UUID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function splitTaskIdList(value) {
+  if (typeof value !== "string" || value.trim().length === 0) return null;
+  return value.split(",").map((entry) => entry.trim()).filter((entry) => UUID_PATTERN.test(entry));
+}
+const accessByRequest = /* @__PURE__ */ new WeakMap();
+async function resolveAssignmentGraceDays(container, tenantId) {
+  try {
+    const configService = container.resolve("moduleConfigService");
+    const settings = await readTimeTrackingSettings(configService, { tenantId });
+    return settings.access.assignmentGraceDays;
+  } catch {
+    return null;
+  }
+}
+async function loadProjectAccess(container, userId, tenantId, organizationId) {
+  if (!tenantId || !organizationId) return { ...DENIED_ACCESS };
+  const scope = { tenantId, organizationId };
+  try {
+    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope);
+    const em = container.resolve("em");
+    return await resolveProjectAccess({
+      em: em.fork(),
+      userId,
+      tenantId,
+      organizationId,
+      canManageAll: access.allowed,
+      userFeatures: access.grantedFeatures,
+      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId)
+    });
+  } catch (err) {
+    logger.error("staff.timesheets.time-entries access resolution failed", { err });
+    return { ...DENIED_ACCESS };
+  }
+}
+function resolveCtxScope(ctx) {
+  return {
+    tenantId: ctx.auth?.tenantId ?? null,
+    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
+  };
+}
+async function resolveListProjectAccess(ctx) {
+  const { tenantId, organizationId } = resolveCtxScope(ctx);
+  const load = () => loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId);
+  const request = ctx.request;
+  if (!request) return load();
+  const cached = accessByRequest.get(request);
+  if (cached) return cached;
+  const pending = load();
+  accessByRequest.set(request, pending);
+  return pending;
+}
+async function buildScopedTimeEntryListFilters(query, ctx) {
+  const filters = buildTimeEntryListFilters(query);
+  const taskIds = splitTaskIdList(query.taskId);
+  if (taskIds !== null) {
+    filters[F.task_id] = { $in: taskIds.length > 0 ? taskIds : [IMPOSSIBLE_ID] };
+  }
+  const billable = parseBooleanFlagOrNull(query.billable);
+  if (billable !== null) filters[F.is_billable] = { $eq: billable };
+  const locked = parseBooleanFlagOrNull(query.locked);
+  if (locked !== null) {
+    filters[F.locked_report_id] = locked ? { $ne: null } : { $eq: null };
+  }
+  const term = sanitizeSearchTerm(query.q);
+  if (term) filters[F.notes] = { $ilike: `%${escapeLikePattern(term)}%` };
+  if (typeof query.customerId === "string" && query.customerId.trim().length > 0) {
+    const em = ctx.container.resolve("em");
+    const { tenantId, organizationId } = resolveCtxScope(ctx);
+    const projects = await em.fork().find(
+      StaffTimeProject,
+      { customerId: query.customerId.trim(), tenantId, organizationId, deletedAt: null },
+      { fields: ["id"] }
+    );
+    const ids = projects.map((project) => project.id);
+    filters[F.time_project_id] = { $in: ids.length > 0 ? ids : [IMPOSSIBLE_ID] };
+  }
+  const tagIds = splitTaskIdList(query.tagIds);
+  if (tagIds !== null) {
+    const em = ctx.container.resolve("em");
+    const { tenantId, organizationId } = resolveCtxScope(ctx);
+    const assignments = tagIds.length === 0 ? [] : await em.fork().find(
+      StaffTimeEntryTag,
+      { tagId: { $in: tagIds }, tenantId, organizationId },
+      { fields: ["timeEntryId"] }
+    );
+    const entryIds = Array.from(new Set(assignments.map((row) => row.timeEntryId)));
+    filters[F.id] = { $in: entryIds.length > 0 ? entryIds : [IMPOSSIBLE_ID] };
+  }
+  const access = await resolveListProjectAccess(ctx);
+  if (access.canManageAll) return filters;
+  const branches = [];
+  if (access.projectIds.length > 0) {
+    branches.push({ [F.time_project_id]: { $in: access.projectIds } });
+  }
+  if (access.staffMemberId) {
+    branches.push({ [F.time_project_id]: { $eq: null }, [F.staff_member_id]: access.staffMemberId });
+  }
+  if (branches.length === 0) {
+    filters[F.id] = { $in: [IMPOSSIBLE_ID] };
+    return filters;
+  }
+  filters.$or = branches;
+  return filters;
+}
+const timeEntryListFields = [
+  F.id,
+  F.organization_id,
+  F.tenant_id,
+  F.staff_member_id,
+  F.date,
+  F.duration_minutes,
+  F.rounded_minutes,
+  F.started_at,
+  F.ended_at,
+  F.notes,
+  F.time_project_id,
+  F.task_id,
+  F.customer_id,
+  F.deal_id,
+  F.order_id,
+  F.is_billable,
+  F.locked_report_id,
+  F.locked_at,
+  F.source,
+  F.created_at,
+  F.updated_at
+];
+async function callerHasRatesView(ctx) {
+  const userId = ctx.auth?.sub;
+  if (!userId) return false;
+  const { tenantId, organizationId } = resolveCtxScope(ctx);
+  try {
+    const rbac = ctx.container.resolve("rbacService");
+    if (!rbac?.userHasAllFeatures) return false;
+    return await rbac.userHasAllFeatures(userId, [RATES_FEATURE], { tenantId, organizationId });
+  } catch {
+    return false;
+  }
+}
+async function decorateTimeEntryList(payload, ctx) {
+  const items = payload?.items;
+  if (!Array.isArray(items) || items.length === 0) return;
+  const { tenantId, organizationId } = resolveCtxScope(ctx);
+  await decorateTimeEntryRows(items, {
+    em: ctx.container.resolve("em"),
+    tenantId,
+    organizationId,
+    canSeeRates: await callerHasRatesView(ctx),
+    onError: (err) => logger.error("staff.timesheets.time-entries response decoration failed", { err })
+  });
+}
 const crud = makeCrudRoute({
   metadata: routeMetadata,
   orm: {
@@ -56,35 +251,21 @@ const crud = makeCrudRoute({
     tenantField: "tenantId",
     softDeleteField: "deletedAt"
   },
+  events: staffTimeEntryCrudEvents,
+  enrichers: { entityId: "staff:staff_time_entry" },
   indexer: { entityType: "staff:staff_time_entry" },
   list: {
     schema: listSchema,
     entityId: "staff:staff_time_entry",
-    fields: [
-      F.id,
-      F.organization_id,
-      F.tenant_id,
-      F.staff_member_id,
-      F.date,
-      F.duration_minutes,
-      F.started_at,
-      F.ended_at,
-      F.notes,
-      F.time_project_id,
-      F.customer_id,
-      F.deal_id,
-      F.order_id,
-      F.source,
-      F.created_at,
-      F.updated_at
-    ],
+    fields: [...timeEntryListFields],
     sortFieldMap: {
       date: F.date,
       createdAt: F.created_at,
       updatedAt: F.updated_at,
-      durationMinutes: F.duration_minutes
+      durationMinutes: F.duration_minutes,
+      roundedMinutes: F.rounded_minutes
     },
-    buildFilters: async (query) => buildTimeEntryListFilters(query)
+    buildFilters: buildScopedTimeEntryListFilters
   },
   actions: {
     create: {
@@ -122,6 +303,12 @@ const GET = crud.GET;
 const POST = crud.POST;
 const PUT = crud.PUT;
 const DELETE = crud.DELETE;
+const timeEntryTagSchema = z.object({
+  id: z.string().uuid(),
+  slug: z.string(),
+  label: z.string(),
+  color: z.string().nullable()
+});
 const timeEntryListItemSchema = z.object({
   id: z.string().uuid().nullable().optional(),
   organization_id: z.string().uuid().nullable().optional(),
@@ -129,16 +316,36 @@ const timeEntryListItemSchema = z.object({
   staff_member_id: z.string().uuid().nullable().optional(),
   date: z.string().nullable().optional(),
   duration_minutes: z.number().nullable().optional(),
+  rounded_minutes: z.number().nullable().optional(),
   started_at: z.string().nullable().optional(),
   ended_at: z.string().nullable().optional(),
   notes: z.string().nullable().optional(),
   time_project_id: z.string().uuid().nullable().optional(),
+  task_id: z.string().uuid().nullable().optional(),
   customer_id: z.string().uuid().nullable().optional(),
   deal_id: z.string().uuid().nullable().optional(),
   order_id: z.string().uuid().nullable().optional(),
+  is_billable: z.boolean().nullable().optional(),
+  /** Present only for a caller holding `staff.timesheets.rates.view`. */
+  rate_override_amount: z.union([z.string(), z.number()]).nullable().optional(),
+  /** Present only for a caller holding `staff.timesheets.rates.view`. */
+  rate_currency_code: z.string().nullable().optional(),
+  locked_report_id: z.string().uuid().nullable().optional(),
+  locked_at: z.string().nullable().optional(),
   source: z.string().nullable().optional(),
   created_at: z.string().nullable().optional(),
-  updated_at: z.string().nullable().optional()
+  updated_at: z.string().nullable().optional(),
+  /** Alias of `notes`; both keys are returned (see UPGRADE_NOTES.md). */
+  description: z.string().nullable().optional(),
+  /** Raw minutes rounded by the tenant's rule at write time; the only input to cost (D-7). */
+  roundedMinutes: z.number().nullable().optional(),
+  isLocked: z.boolean().optional(),
+  lockedReportId: z.string().uuid().nullable().optional(),
+  tags: z.array(timeEntryTagSchema).optional(),
+  /** Present only for a caller holding `staff.timesheets.rates.view`; `null` when non-billable. */
+  cost: z.number().nullable().optional(),
+  /** Present only for a caller holding `staff.timesheets.rates.view`. */
+  currencyCode: z.string().nullable().optional()
 });
 const openApi = createStaffCrudOpenApi({
   resourceName: "TimeEntry",
@@ -147,12 +354,12 @@ const openApi = createStaffCrudOpenApi({
   listResponseSchema: createPagedListResponseSchema(timeEntryListItemSchema),
   create: {
     schema: staffTimeEntryCreateSchema,
-    description: "Creates a time entry for a staff member."
+    description: "Creates a time entry for a staff member. The note is accepted under either `notes` or `description` (`description` wins when both are sent). `roundedMinutes` is derived from the tenant rounding rule at write time and stored; `isBillable` falls back to the project default then the tenant default; `rateCurrencyCode` snapshots the project currency. `tagIds` is applied through the tag assignment command."
   },
   update: {
     schema: staffTimeEntryUpdateSchema,
     responseSchema: defaultOkResponseSchema,
-    description: "Updates a time entry by id."
+    description: "Updates a time entry by id. `durationMinutes`, `startedAt` and `endedAt` are reconciled so the stored set never contradicts itself: sending both clocks recomputes the duration from them (a duration sent alongside is advisory), sending one clock with a duration derives the other clock, and sending only a duration shifts `endedAt` while `startedAt` anchors. An `endedAt` earlier than its `startedAt` is stored on the next calendar day (a midnight crossing) and `date` still names the day the work started. Any change to the effective duration recomputes the stored rounded minutes from the tenant rounding rule; changing the project re-snapshots the currency. `tagIds` replaces the entry tag set through the tag assignment commands, which refuse an entry locked in a closed report."
   },
   del: {
     schema: z.object({ id: z.string().uuid() }),
@@ -165,7 +372,12 @@ export {
   GET,
   POST,
   PUT,
+  RATES_FEATURE,
+  buildScopedTimeEntryListFilters,
+  decorateTimeEntryList,
   metadata,
-  openApi
+  openApi,
+  resolveListProjectAccess,
+  timeEntryListFields
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/time-entries/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/time-entries/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { StaffTimeEntry } from '../../../data/entities'\nimport { staffTimeEntryCreateSchema, staffTimeEntryUpdateSchema } from '../../../data/validators'\nimport { buildTimeEntryListFilters, isParseableDateFilter } from '../../../lib/timesheets/timeEntryListFilters'\nimport { staffTimeEntryCommandIds } from '../../../lib/crud'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  staff_member_id: 'staff_member_id',\n  date: 'date',\n  duration_minutes: 'duration_minutes',\n  started_at: 'started_at',\n  ended_at: 'ended_at',\n  notes: 'notes',\n  time_project_id: 'time_project_id',\n  customer_id: 'customer_id',\n  deal_id: 'deal_id',\n  order_id: 'order_id',\n  source: 'source',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst dateFilterSchema = z\n  .string()\n  .refine(isParseableDateFilter, { message: 'Invalid date' })\n  .optional()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    staffMemberId: z.string().uuid().optional(),\n    from: dateFilterSchema,\n    to: dateFilterSchema,\n    projectId: z.string().uuid().optional(),\n    ids: z.string().optional(),\n    running: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeEntry,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: 'staff:staff_time_entry' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_entry',\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.staff_member_id,\n      F.date,\n      F.duration_minutes,\n      F.started_at,\n      F.ended_at,\n      F.notes,\n      F.time_project_id,\n      F.customer_id,\n      F.deal_id,\n      F.order_id,\n      F.source,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      date: F.date,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      durationMinutes: F.duration_minutes,\n    },\n    buildFilters: async (query) => buildTimeEntryListFilters(query),\n  },\n  actions: {\n    create: {\n      commandId: staffTimeEntryCommandIds.create,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeEntryCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.timeEntryId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: staffTimeEntryCommandIds.update,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeEntryUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: staffTimeEntryCommandIds.delete,\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst timeEntryListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  staff_member_id: z.string().uuid().nullable().optional(),\n  date: z.string().nullable().optional(),\n  duration_minutes: z.number().nullable().optional(),\n  started_at: z.string().nullable().optional(),\n  ended_at: z.string().nullable().optional(),\n  notes: z.string().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  deal_id: z.string().uuid().nullable().optional(),\n  order_id: z.string().uuid().nullable().optional(),\n  source: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeEntry',\n  pluralName: 'TimeEntries',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(timeEntryListItemSchema),\n  create: {\n    schema: staffTimeEntryCreateSchema,\n    description: 'Creates a time entry for a staff member.',\n  },\n  update: {\n    schema: staffTimeEntryUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a time entry by id.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Deletes a time entry by id.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,sBAAsB;AAC/B,SAAS,4BAA4B,kCAAkC;AACvE,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,gCAAgC;AACzC,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC5E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAChF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,mBAAmB,EACtB,OAAO,EACP,OAAO,uBAAuB,EAAE,SAAS,eAAe,CAAC,EACzD,SAAS;AAEZ,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAEf,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,yBAAyB;AAAA,EAChD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,EAAE;AAAA,MACR,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,iBAAiB,EAAE;AAAA,IACrB;AAAA,IACA,cAAc,OAAO,UAAU,0BAA0B,KAAK;AAAA,EAChE;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW,yBAAyB;AAAA,MACpC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,4BAA4B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACtF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,eAAe,KAAK;AAAA,MAC7D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,yBAAyB;AAAA,MACpC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,4BAA4B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACtF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,yBAAyB;AAAA,MACpC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,uBAAuB;AAAA,EACzE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["/**\n * Time entries \u2014 the timesheet grid of screen 10 and the full entry form of\n * screen 8, served from one collection.\n *\n * Three things this route owns beyond plain CRUD:\n *\n *  1. **Project access is intersected into every query.** A caller without\n *     `staff.timesheets.projects.manage` sees entries on the projects they are an\n *     active member of, plus their own project-less entries \u2014 nobody else's. The\n *     resolution is memoised per request and fails closed, mirroring the projects\n *     and tasks routes.\n *  2. **`description` is returned beside `notes`.** The column is `notes`; every\n *     consulting-suite screen calls it `description`. UPGRADE_NOTES.md promises\n *     both keys on read for at least one minor release, so both are emitted here\n *     and both are accepted on write (the command folds them, `description` wins).\n *  3. **Money is added, not hidden.** `cost`, `currencyCode` and the stored rate\n *     override only exist in the payload for a caller holding\n *     `staff.timesheets.rates.view`; everyone else gets a response with no money\n *     keys at all, the same shape the project portfolio enricher uses. The base\n *     projection selects no money column \u2014 see `timeEntryListFields` for why that\n *     is the gate rather than an optimisation.\n *\n * `cost` is computed from `rounded_minutes` \u2014 never from `duration_minutes` \u2014 via\n * `entryAmount`, so a non-billable entry reads `null` rather than `0`: zero is a\n * price, and out-of-scope work does not have one (D-7).\n */\n\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { sanitizeSearchTerm } from '../../helpers'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeEntry, StaffTimeEntryTag, StaffTimeProject } from '../../../data/entities'\nimport { staffTimeEntryCreateSchema, staffTimeEntryUpdateSchema } from '../../../data/validators'\nimport { buildTimeEntryListFilters, isParseableDateFilter } from '../../../lib/timesheets/timeEntryListFilters'\nimport { staffTimeEntryCommandIds, staffTimeEntryCrudEvents } from '../../../lib/crud'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess, type ProjectAccess } from '../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { decorateTimeEntryRows } from '../../../lib/timesheets/timeEntryDecoration'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries' })\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  staff_member_id: 'staff_member_id',\n  date: 'date',\n  duration_minutes: 'duration_minutes',\n  rounded_minutes: 'rounded_minutes',\n  started_at: 'started_at',\n  ended_at: 'ended_at',\n  notes: 'notes',\n  time_project_id: 'time_project_id',\n  task_id: 'task_id',\n  customer_id: 'customer_id',\n  deal_id: 'deal_id',\n  order_id: 'order_id',\n  is_billable: 'is_billable',\n  rate_override_amount: 'rate_override_amount',\n  rate_currency_code: 'rate_currency_code',\n  locked_report_id: 'locked_report_id',\n  locked_at: 'locked_at',\n  source: 'source',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nexport const RATES_FEATURE = 'staff.timesheets.rates.view'\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst dateFilterSchema = z\n  .string()\n  .refine(isParseableDateFilter, { message: 'Invalid date' })\n  .optional()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    staffMemberId: z.string().uuid().optional(),\n    from: dateFilterSchema,\n    to: dateFilterSchema,\n    projectId: z.string().uuid().optional(),\n    /**\n     * One task id, or a comma-separated list of them. The list form is what the\n     * task drawer needs: a parent and its subtasks are one question (\"what has\n     * been logged against this task?\"), so answering it must not cost one request\n     * per child.\n     */\n    taskId: z.string().optional(),\n    ids: z.string().optional(),\n    running: z.string().optional(),\n    /** `true` / `false` \u2014 omitted means \"either\". */\n    billable: z.string().optional(),\n    /** `true` = frozen into a closed report, `false` = still editable. */\n    locked: z.string().optional(),\n    /** Free text over the entry note. */\n    q: z.string().optional(),\n    /** Customer id \u2014 narrows to that customer's projects. */\n    customerId: z.string().uuid().optional(),\n    /** One tag id, or a comma-separated list; an entry matching any of them. */\n    tagIds: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype EntryListQuery = z.infer<typeof listSchema>\n\n/**\n * Three-state flag: `true`, `false`, or \"the caller did not ask\". A missing\n * filter must widen to everything rather than collapse to `false`, which is what\n * a plain boolean parse would do.\n */\nfunction parseBooleanFlagOrNull(value: unknown): boolean | null {\n  if (typeof value !== 'string') return null\n  const normalized = value.trim().toLowerCase()\n  if (normalized.length === 0) return null\n  if (['1', 'true', 'yes', 'on'].includes(normalized)) return true\n  if (['0', 'false', 'no', 'off'].includes(normalized)) return false\n  return null\n}\n\n/** Non-UUID sentinel used as the \"match nothing\" filter, mirroring the tasks route. */\nconst IMPOSSIBLE_ID = '00000000-0000-0000-0000-000000000000'\n\nconst DENIED_ACCESS: ProjectAccess = { canManageAll: false, projectIds: [], staffMemberId: null }\n\nconst UUID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/\n\n/**\n * Splits `?taskId=a,b,c` into ids the database can be asked about.\n *\n * A token that is not a UUID is dropped rather than passed through: the column is\n * `uuid`, so a malformed id would fail the whole query instead of matching\n * nothing. `null` means the caller asked no task question at all; an empty array\n * means they asked one no row can answer.\n */\nfunction splitTaskIdList(value: unknown): string[] | null {\n  if (typeof value !== 'string' || value.trim().length === 0) return null\n  return value\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter((entry) => UUID_PATTERN.test(entry))\n}\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n  userHasAllFeatures?: (\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\n/** One access decision per request, shared by every filter that needs it. */\nconst accessByRequest = new WeakMap<Request, Promise<ProjectAccess>>()\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<ProjectAccess> {\n  if (!tenantId || !organizationId) return { ...DENIED_ACCESS }\n  const scope = { tenantId, organizationId }\n  try {\n    // One lookup, one authority, and a failure that says so. The previous\n    // `catch \u2192 []` could not tell \"denied\" from \"could not ask\", so an RBAC\n    // hiccup silently demoted a manager to their own memberships.\n    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope)\n    const em = container.resolve('em') as EntityManager\n    return await resolveProjectAccess({\n      em: em.fork(),\n      userId,\n      tenantId,\n      organizationId,\n      canManageAll: access.allowed,\n      userFeatures: access.grantedFeatures,\n      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n    })\n  } catch (err) {\n    logger.error('staff.timesheets.time-entries access resolution failed', { err })\n    return { ...DENIED_ACCESS }\n  }\n}\n\nfunction resolveCtxScope(ctx: CrudCtx): { tenantId: string | null; organizationId: string | null } {\n  return {\n    tenantId: ctx.auth?.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n  }\n}\n\nexport async function resolveListProjectAccess(ctx: CrudCtx): Promise<ProjectAccess> {\n  const { tenantId, organizationId } = resolveCtxScope(ctx)\n  const load = () => loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId)\n  const request = ctx.request\n  if (!request) return load()\n  const cached = accessByRequest.get(request)\n  if (cached) return cached\n  const pending = load()\n  accessByRequest.set(request, pending)\n  return pending\n}\n\n/**\n * Every entry query narrows to what the caller may actually see: entries on the\n * projects they belong to, plus their OWN entries that name no project. A\n * project-less entry has no membership to check, so the only person it can belong\n * to is the member who logged it.\n *\n * Exported so the intersection is testable without standing up the CRUD factory.\n */\nexport async function buildScopedTimeEntryListFilters(\n  query: EntryListQuery,\n  ctx: CrudCtx,\n): Promise<Record<string, unknown>> {\n  const filters = buildTimeEntryListFilters(query)\n\n  // The task narrowing is applied before the access branches and never instead of\n  // them: asking for a task the caller may not see must return nothing, not the\n  // task's entries.\n  const taskIds = splitTaskIdList(query.taskId)\n  if (taskIds !== null) {\n    filters[F.task_id] = { $in: taskIds.length > 0 ? taskIds : [IMPOSSIBLE_ID] }\n  }\n\n  // --- Optional narrowing the grid's filter overlay drives ---------------\n\n  const billable = parseBooleanFlagOrNull(query.billable)\n  if (billable !== null) filters[F.is_billable] = { $eq: billable }\n\n  const locked = parseBooleanFlagOrNull(query.locked)\n  if (locked !== null) {\n    // \"Locked\" is the presence of the report that froze the entry, so it is asked\n    // as a nullness question rather than a boolean column that does not exist.\n    filters[F.locked_report_id] = locked ? { $ne: null } : { $eq: null }\n  }\n\n  const term = sanitizeSearchTerm(query.q)\n  if (term) filters[F.notes] = { $ilike: `%${escapeLikePattern(term)}%` }\n\n  // A customer is a property of the project, not of the entry \u2014 `customer_id` on\n  // the entry is a denormalised convenience that older rows may not carry \u2014 so\n  // the question is answered by resolving the customer's projects first.\n  if (typeof query.customerId === 'string' && query.customerId.trim().length > 0) {\n    const em = ctx.container.resolve('em') as EntityManager\n    const { tenantId, organizationId } = resolveCtxScope(ctx)\n    const projects = await em.fork().find(\n      StaffTimeProject,\n      { customerId: query.customerId.trim(), tenantId, organizationId, deletedAt: null },\n      { fields: ['id'] },\n    )\n    const ids = projects.map((project) => project.id)\n    filters[F.time_project_id] = { $in: ids.length > 0 ? ids : [IMPOSSIBLE_ID] }\n  }\n\n  const tagIds = splitTaskIdList(query.tagIds)\n  if (tagIds !== null) {\n    const em = ctx.container.resolve('em') as EntityManager\n    const { tenantId, organizationId } = resolveCtxScope(ctx)\n    const assignments = tagIds.length === 0\n      ? []\n      : await em.fork().find(\n          StaffTimeEntryTag,\n          { tagId: { $in: tagIds }, tenantId, organizationId },\n          { fields: ['timeEntryId'] },\n        )\n    const entryIds = Array.from(new Set(assignments.map((row) => row.timeEntryId)))\n    filters[F.id] = { $in: entryIds.length > 0 ? entryIds : [IMPOSSIBLE_ID] }\n  }\n\n  const access = await resolveListProjectAccess(ctx)\n  if (access.canManageAll) return filters\n\n  const branches: Record<string, unknown>[] = []\n  if (access.projectIds.length > 0) {\n    branches.push({ [F.time_project_id]: { $in: access.projectIds } })\n  }\n  if (access.staffMemberId) {\n    branches.push({ [F.time_project_id]: { $eq: null }, [F.staff_member_id]: access.staffMemberId })\n  }\n  if (branches.length === 0) {\n    // A caller with no membership and no staff record gets no row at all \u2014 not a\n    // redacted one \u2014 so an entry's note and its project never leave the server.\n    filters[F.id] = { $in: [IMPOSSIBLE_ID] }\n    return filters\n  }\n  filters.$or = branches\n  return filters\n}\n\n/**\n * The base projection, and the reason `rate_override_amount` / `rate_currency_code`\n * are NOT in it.\n *\n * The money gate is `staff.timesheets.rates.view`, and it is applied by the\n * `staff.timesheets-time-entries` response enricher, which is declared\n * `critical: false`. A non-critical enricher that throws or exceeds its timeout\n * leaves the items exactly as the route produced them (`enricher-runner.ts`), so\n * anything the projection selects survives an enricher failure. Selecting the two\n * money columns here and removing them there would therefore fail OPEN under DB\n * contention. They are read back inside the enricher instead, for entitled callers\n * only \u2014 see `lib/timesheets/timeEntryDecoration.ts`.\n */\nexport const timeEntryListFields = [\n  F.id,\n  F.organization_id,\n  F.tenant_id,\n  F.staff_member_id,\n  F.date,\n  F.duration_minutes,\n  F.rounded_minutes,\n  F.started_at,\n  F.ended_at,\n  F.notes,\n  F.time_project_id,\n  F.task_id,\n  F.customer_id,\n  F.deal_id,\n  F.order_id,\n  F.is_billable,\n  F.locked_report_id,\n  F.locked_at,\n  F.source,\n  F.created_at,\n  F.updated_at,\n] as const\n\nexport type { TimeEntryTagSummary } from '../../../lib/timesheets/timeEntryDecoration'\n\nasync function callerHasRatesView(ctx: CrudCtx): Promise<boolean> {\n  const userId = ctx.auth?.sub\n  if (!userId) return false\n  const { tenantId, organizationId } = resolveCtxScope(ctx)\n  try {\n    const rbac = ctx.container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.userHasAllFeatures) return false\n    return await rbac.userHasAllFeatures(userId, [RATES_FEATURE], { tenantId, organizationId })\n  } catch {\n    // Fail closed: an unreadable grant set never opens the money fields.\n    return false\n  }\n}\n\n/**\n * @deprecated The decoration is now the declared `staff.timesheets-time-entries`\n * response enricher (`data/enrichers.ts`), so third-party enrichers for\n * `staff:staff_time_entry` compose with it instead of running blind behind a\n * route-private hook. Kept as a thin, in-place wrapper because it is an exported\n * symbol of this route module; new callers should register an enricher.\n */\nexport async function decorateTimeEntryList(payload: unknown, ctx: CrudCtx): Promise<void> {\n  const items = (payload as { items?: unknown })?.items\n  if (!Array.isArray(items) || items.length === 0) return\n  const { tenantId, organizationId } = resolveCtxScope(ctx)\n  await decorateTimeEntryRows(items as Record<string, unknown>[], {\n    em: ctx.container.resolve('em') as EntityManager,\n    tenantId,\n    organizationId,\n    canSeeRates: await callerHasRatesView(ctx),\n    onError: (err) => logger.error('staff.timesheets.time-entries response decoration failed', { err }),\n  })\n}\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeEntry,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeEntryCrudEvents,\n  enrichers: { entityId: 'staff:staff_time_entry' },\n  indexer: { entityType: 'staff:staff_time_entry' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_entry',\n    fields: [...timeEntryListFields],\n    sortFieldMap: {\n      date: F.date,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      durationMinutes: F.duration_minutes,\n      roundedMinutes: F.rounded_minutes,\n    },\n    buildFilters: buildScopedTimeEntryListFilters,\n  },\n  actions: {\n    create: {\n      commandId: staffTimeEntryCommandIds.create,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeEntryCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.timeEntryId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: staffTimeEntryCommandIds.update,\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeEntryUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: staffTimeEntryCommandIds.delete,\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst timeEntryTagSchema = z.object({\n  id: z.string().uuid(),\n  slug: z.string(),\n  label: z.string(),\n  color: z.string().nullable(),\n})\n\nconst timeEntryListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  staff_member_id: z.string().uuid().nullable().optional(),\n  date: z.string().nullable().optional(),\n  duration_minutes: z.number().nullable().optional(),\n  rounded_minutes: z.number().nullable().optional(),\n  started_at: z.string().nullable().optional(),\n  ended_at: z.string().nullable().optional(),\n  notes: z.string().nullable().optional(),\n  time_project_id: z.string().uuid().nullable().optional(),\n  task_id: z.string().uuid().nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  deal_id: z.string().uuid().nullable().optional(),\n  order_id: z.string().uuid().nullable().optional(),\n  is_billable: z.boolean().nullable().optional(),\n  /** Present only for a caller holding `staff.timesheets.rates.view`. */\n  rate_override_amount: z.union([z.string(), z.number()]).nullable().optional(),\n  /** Present only for a caller holding `staff.timesheets.rates.view`. */\n  rate_currency_code: z.string().nullable().optional(),\n  locked_report_id: z.string().uuid().nullable().optional(),\n  locked_at: z.string().nullable().optional(),\n  source: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  /** Alias of `notes`; both keys are returned (see UPGRADE_NOTES.md). */\n  description: z.string().nullable().optional(),\n  /** Raw minutes rounded by the tenant's rule at write time; the only input to cost (D-7). */\n  roundedMinutes: z.number().nullable().optional(),\n  isLocked: z.boolean().optional(),\n  lockedReportId: z.string().uuid().nullable().optional(),\n  tags: z.array(timeEntryTagSchema).optional(),\n  /** Present only for a caller holding `staff.timesheets.rates.view`; `null` when non-billable. */\n  cost: z.number().nullable().optional(),\n  /** Present only for a caller holding `staff.timesheets.rates.view`. */\n  currencyCode: z.string().nullable().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeEntry',\n  pluralName: 'TimeEntries',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(timeEntryListItemSchema),\n  create: {\n    schema: staffTimeEntryCreateSchema,\n    description:\n      'Creates a time entry for a staff member. The note is accepted under either `notes` or `description` (`description` wins when both are sent). `roundedMinutes` is derived from the tenant rounding rule at write time and stored; `isBillable` falls back to the project default then the tenant default; `rateCurrencyCode` snapshots the project currency. `tagIds` is applied through the tag assignment command.',\n  },\n  update: {\n    schema: staffTimeEntryUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description:\n      'Updates a time entry by id. `durationMinutes`, `startedAt` and `endedAt` are reconciled so the stored set never contradicts itself: sending both clocks recomputes the duration from them (a duration sent alongside is advisory), sending one clock with a duration derives the other clock, and sending only a duration shifts `endedAt` while `startedAt` anchors. An `endedAt` earlier than its `startedAt` is stored on the next calendar day (a midnight crossing) and `date` still names the day the work started. Any change to the effective duration recomputes the stored rounded minutes from the tenant rounding rule; changing the project re-snapshots the currency. `tagIds` replaces the entry tag set through the tag assignment commands, which refuse an entry locked in a closed report.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Deletes a time entry by id.',\n  },\n})\n"],
+  "mappings": "AA2BA,SAAS,SAAS;AAElB,SAAS,qBAAmC;AAC5C,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AAEnC,SAAS,gBAAgB,mBAAmB,wBAAwB;AACpE,SAAS,4BAA4B,kCAAkC;AACvE,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,0BAA0B,gCAAgC;AACnE,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,4BAAgD;AAClF,SAAS,gCAAgC;AACzC,SAAS,6BAA6B;AACtC,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,8BAA8B,CAAC;AAEvF,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,aAAa;AAAA,EACb,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEO,MAAM,gBAAgB;AAE7B,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC5E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAChF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,mBAAmB,EACtB,OAAO,EACP,OAAO,uBAAuB,EAAE,SAAS,eAAe,CAAC,EACzD,SAAS;AAEZ,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE7B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE5B,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEvB,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEvC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AASf,SAAS,uBAAuB,OAAgC;AAC9D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,WAAW,WAAW,EAAG,QAAO;AACpC,MAAI,CAAC,KAAK,QAAQ,OAAO,IAAI,EAAE,SAAS,UAAU,EAAG,QAAO;AAC5D,MAAI,CAAC,KAAK,SAAS,MAAM,KAAK,EAAE,SAAS,UAAU,EAAG,QAAO;AAC7D,SAAO;AACT;AAGA,MAAM,gBAAgB;AAEtB,MAAM,gBAA+B,EAAE,cAAc,OAAO,YAAY,CAAC,GAAG,eAAe,KAAK;AAEhG,MAAM,eAAe;AAUrB,SAAS,gBAAgB,OAAiC;AACxD,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO;AACnE,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,aAAa,KAAK,KAAK,CAAC;AAC/C;AAiBA,MAAM,kBAAkB,oBAAI,QAAyC;AAErE,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACwB;AACxB,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,EAAE,GAAG,cAAc;AAC5D,QAAM,QAAQ,EAAE,UAAU,eAAe;AACzC,MAAI;AAIF,UAAM,SAAS,MAAM,qBAAqB,WAAW,QAAQ,CAAC,uBAAuB,GAAG,KAAK;AAC7F,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,qBAAqB;AAAA,MAChC,IAAI,GAAG,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,IAC3E,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,0DAA0D,EAAE,IAAI,CAAC;AAC9E,WAAO,EAAE,GAAG,cAAc;AAAA,EAC5B;AACF;AAEA,SAAS,gBAAgB,KAA0E;AACjG,SAAO;AAAA,IACL,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,EACnE;AACF;AAEA,eAAsB,yBAAyB,KAAsC;AACnF,QAAM,EAAE,UAAU,eAAe,IAAI,gBAAgB,GAAG;AACxD,QAAM,OAAO,MAAM,kBAAkB,IAAI,WAAW,IAAI,MAAM,OAAO,MAAM,UAAU,cAAc;AACnG,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAM,SAAS,gBAAgB,IAAI,OAAO;AAC1C,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,KAAK;AACrB,kBAAgB,IAAI,SAAS,OAAO;AACpC,SAAO;AACT;AAUA,eAAsB,gCACpB,OACA,KACkC;AAClC,QAAM,UAAU,0BAA0B,KAAK;AAK/C,QAAM,UAAU,gBAAgB,MAAM,MAAM;AAC5C,MAAI,YAAY,MAAM;AACpB,YAAQ,EAAE,OAAO,IAAI,EAAE,KAAK,QAAQ,SAAS,IAAI,UAAU,CAAC,aAAa,EAAE;AAAA,EAC7E;AAIA,QAAM,WAAW,uBAAuB,MAAM,QAAQ;AACtD,MAAI,aAAa,KAAM,SAAQ,EAAE,WAAW,IAAI,EAAE,KAAK,SAAS;AAEhE,QAAM,SAAS,uBAAuB,MAAM,MAAM;AAClD,MAAI,WAAW,MAAM;AAGnB,YAAQ,EAAE,gBAAgB,IAAI,SAAS,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,KAAK;AAAA,EACrE;AAEA,QAAM,OAAO,mBAAmB,MAAM,CAAC;AACvC,MAAI,KAAM,SAAQ,EAAE,KAAK,IAAI,EAAE,QAAQ,IAAI,kBAAkB,IAAI,CAAC,IAAI;AAKtE,MAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,KAAK,EAAE,SAAS,GAAG;AAC9E,UAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,UAAM,EAAE,UAAU,eAAe,IAAI,gBAAgB,GAAG;AACxD,UAAM,WAAW,MAAM,GAAG,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA,EAAE,YAAY,MAAM,WAAW,KAAK,GAAG,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACjF,EAAE,QAAQ,CAAC,IAAI,EAAE;AAAA,IACnB;AACA,UAAM,MAAM,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAChD,YAAQ,EAAE,eAAe,IAAI,EAAE,KAAK,IAAI,SAAS,IAAI,MAAM,CAAC,aAAa,EAAE;AAAA,EAC7E;AAEA,QAAM,SAAS,gBAAgB,MAAM,MAAM;AAC3C,MAAI,WAAW,MAAM;AACnB,UAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,UAAM,EAAE,UAAU,eAAe,IAAI,gBAAgB,GAAG;AACxD,UAAM,cAAc,OAAO,WAAW,IAClC,CAAC,IACD,MAAM,GAAG,KAAK,EAAE;AAAA,MACd;AAAA,MACA,EAAE,OAAO,EAAE,KAAK,OAAO,GAAG,UAAU,eAAe;AAAA,MACnD,EAAE,QAAQ,CAAC,aAAa,EAAE;AAAA,IAC5B;AACJ,UAAM,WAAW,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC;AAC9E,YAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,SAAS,SAAS,IAAI,WAAW,CAAC,aAAa,EAAE;AAAA,EAC1E;AAEA,QAAM,SAAS,MAAM,yBAAyB,GAAG;AACjD,MAAI,OAAO,aAAc,QAAO;AAEhC,QAAM,WAAsC,CAAC;AAC7C,MAAI,OAAO,WAAW,SAAS,GAAG;AAChC,aAAS,KAAK,EAAE,CAAC,EAAE,eAAe,GAAG,EAAE,KAAK,OAAO,WAAW,EAAE,CAAC;AAAA,EACnE;AACA,MAAI,OAAO,eAAe;AACxB,aAAS,KAAK,EAAE,CAAC,EAAE,eAAe,GAAG,EAAE,KAAK,KAAK,GAAG,CAAC,EAAE,eAAe,GAAG,OAAO,cAAc,CAAC;AAAA,EACjG;AACA,MAAI,SAAS,WAAW,GAAG;AAGzB,YAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE;AACvC,WAAO;AAAA,EACT;AACA,UAAQ,MAAM;AACd,SAAO;AACT;AAeO,MAAM,sBAAsB;AAAA,EACjC,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AACJ;AAIA,eAAe,mBAAmB,KAAgC;AAChE,QAAM,SAAS,IAAI,MAAM;AACzB,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,UAAU,eAAe,IAAI,gBAAgB,GAAG;AACxD,MAAI;AACF,UAAM,OAAO,IAAI,UAAU,QAAQ,aAAa;AAChD,QAAI,CAAC,MAAM,mBAAoB,QAAO;AACtC,WAAO,MAAM,KAAK,mBAAmB,QAAQ,CAAC,aAAa,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,EAC5F,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,sBAAsB,SAAkB,KAA6B;AACzF,QAAM,QAAS,SAAiC;AAChD,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG;AACjD,QAAM,EAAE,UAAU,eAAe,IAAI,gBAAgB,GAAG;AACxD,QAAM,sBAAsB,OAAoC;AAAA,IAC9D,IAAI,IAAI,UAAU,QAAQ,IAAI;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,aAAa,MAAM,mBAAmB,GAAG;AAAA,IACzC,SAAS,CAAC,QAAQ,OAAO,MAAM,4DAA4D,EAAE,IAAI,CAAC;AAAA,EACpG,CAAC;AACH;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,WAAW,EAAE,UAAU,yBAAyB;AAAA,EAChD,SAAS,EAAE,YAAY,yBAAyB;AAAA,EAChD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,CAAC,GAAG,mBAAmB;AAAA,IAC/B,cAAc;AAAA,MACZ,MAAM,EAAE;AAAA,MACR,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,iBAAiB,EAAE;AAAA,MACnB,gBAAgB,EAAE;AAAA,IACpB;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW,yBAAyB;AAAA,MACpC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,4BAA4B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACtF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,eAAe,KAAK;AAAA,MAC7D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,yBAAyB;AAAA,MACpC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,4BAA4B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACtF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW,yBAAyB;AAAA,MACpC,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAED,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE7C,sBAAsB,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE5E,oBAAoB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACxD,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE3C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAE5C,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,MAAM,EAAE,MAAM,kBAAkB,EAAE,SAAS;AAAA;AAAA,EAE3C,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC/C,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,uBAAuB;AAAA,EACzE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aACE;AAAA,EACJ;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/start-timer/route.js

@@ -9,7 +9,10 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
 import { staffTimeEntryStartTimerSchema } from "../../../../data/validators.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { STAFF_TIME_TRACKING_RESOURCE_KINDS } from "../../../guards.js";
+import { runTimesheetInterceptors } from "../../_shared/withTimesheetInterceptors.js";
 const logger = createLogger("staff");
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["staff.timesheets.manage_own"] }
@@ -28,19 +31,31 @@ async function buildContext(req) {
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };
-  return { ctx, translate };
+  return {
+    ctx,
+    translate,
+    tenantId: scope?.tenantId ?? auth.tenantId ?? null,
+    organizationId: scope?.selectedId ?? auth.orgId ?? null
+  };
 }
 async function POST(req) {
   try {
-    const { ctx, translate } = await buildContext(req);
-    const body = await req.json().catch(() => ({}));
-    const input = parseScopedCommandInput(staffTimeEntryStartTimerSchema, body, ctx, translate);
+    const { ctx, translate, tenantId, organizationId } = await buildContext(req);
+    const interceptors = await runTimesheetInterceptors({
+      request: req,
+      method: "POST",
+      scope: { container: ctx.container, userId: ctx.auth?.sub, tenantId, organizationId },
+      body: await readJsonSafe(req, {})
+    });
+    if (!interceptors.ok) return interceptors.response;
+    const { session } = interceptors;
+    const input = parseScopedCommandInput(staffTimeEntryStartTimerSchema, session.body, ctx, translate);
     const commandBus = ctx.container.resolve("commandBus");
     const { result, logEntry } = await commandBus.execute(
       "staff.timesheets.time_entries.start_timer",
       { input, ctx }
     );
-    const response = NextResponse.json({ ok: true, id: result?.timeEntryId ?? null }, { status: 201 });
+    const response = await session.respond(201, { ok: true, id: result?.timeEntryId ?? null });
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(
         "x-om-operation",
@@ -49,7 +64,7 @@ async function POST(req) {
           undoToken: logEntry.undoToken,
           commandId: logEntry.commandId,
           actionLabel: logEntry.actionLabel ?? null,
-          resourceKind: logEntry.resourceKind ?? "staff.timesheets.time_entry",
+          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,
           resourceId: logEntry.resourceId ?? result?.timeEntryId ?? null,
           executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : void 0
         })
@@ -78,7 +93,7 @@ const openApi = {
   methods: {
     POST: {
       summary: "Start a timesheet timer",
-      description: "Atomically creates a timer-sourced time entry and starts it (sets startedAt and creates the initial work segment) in a single transaction, so a partial failure cannot leave an orphaned, unstarted entry.",
+      description: "Atomically creates a timer-sourced time entry and starts it (sets startedAt and creates the initial work segment) in a single transaction, so a partial failure cannot leave an orphaned, unstarted entry. An optional `taskId` is validated and stored by the same write, so starting a timer from a board card or the task drawer takes one request instead of a start followed by a link that can fail; when only `taskId` is sent, the project follows from the task.",
       requestBody: {
         contentType: "application/json",
         schema: staffTimeEntryStartTimerSchema
@@ -99,7 +114,7 @@ const openApi = {
         },
         {
           status: 422,
-          description: "Referenced time project not found or out of scope",
+          description: "Referenced time project or task not found, out of scope, or the task belongs to another project",
           schema: z.object({ error: z.string() })
         }
       ]

package/dist/modules/staff/api/timesheets/time-entries/start-timer/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/time-entries/start-timer/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffTimeEntryStartTimerSchema, type StaffTimeEntryStartTimerInput } from '../../../../data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffTimeEntryStartTimerSchema, body, ctx, translate)\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffTimeEntryStartTimerInput, { timeEntryId: string }>(\n      'staff.timesheets.time_entries.start_timer',\n      { input, ctx },\n    )\n    const response = NextResponse.json({ ok: true, id: result?.timeEntryId ?? null }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.timesheets.time_entry',\n          resourceId: logEntry.resourceId ?? result?.timeEntryId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.start-timer failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStart', 'Failed to start timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Start a timesheet timer',\n  methods: {\n    POST: {\n      summary: 'Start a timesheet timer',\n      description:\n        'Atomically creates a timer-sourced time entry and starts it (sets startedAt and creates the initial work segment) in a single transaction, so a partial failure cannot leave an orphaned, unstarted entry.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntryStartTimerSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Timer started',\n          schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }),\n        },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        {\n          status: 409,\n          description: 'Another timer is already running for this staff member',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 422,\n          description: 'Referenced time project not found or out of scope',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,sCAA0E;AACnF,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,gCAAgC,MAAM,KAAK,SAAS;AAC1F,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,eAAe,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACjG,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,eAAe;AAAA,UAC1D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,oDAAoD,EAAE,IAAI,CAAC;AACxE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE;AAAA,MACnF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAAA,QAC5E;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffTimeEntryStartTimerSchema, type StaffTimeEntryStartTimerInput } from '../../../../data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../guards'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{\n  ctx: CommandRuntimeContext\n  translate: (key: string, fallback?: string) => string\n  tenantId: string | null\n  organizationId: string | null\n}> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return {\n    ctx,\n    translate,\n    tenantId: scope?.tenantId ?? auth.tenantId ?? null,\n    organizationId: scope?.selectedId ?? auth.orgId ?? null,\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate, tenantId, organizationId } = await buildContext(req)\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container: ctx.container, userId: ctx.auth?.sub, tenantId, organizationId },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const input = parseScopedCommandInput(staffTimeEntryStartTimerSchema, session.body, ctx, translate)\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffTimeEntryStartTimerInput, { timeEntryId: string }>(\n      'staff.timesheets.time_entries.start_timer',\n      { input, ctx },\n    )\n    const response = await session.respond(201, { ok: true, id: result?.timeEntryId ?? null })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,\n          resourceId: logEntry.resourceId ?? result?.timeEntryId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.start-timer failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStart', 'Failed to start timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Start a timesheet timer',\n  methods: {\n    POST: {\n      summary: 'Start a timesheet timer',\n      description:\n        'Atomically creates a timer-sourced time entry and starts it (sets startedAt and creates the initial work segment) in a single transaction, so a partial failure cannot leave an orphaned, unstarted entry. An optional `taskId` is validated and stored by the same write, so starting a timer from a board card or the task drawer takes one request instead of a start followed by a link that can fail; when only `taskId` is sent, the project follows from the task.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntryStartTimerSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Timer started',\n          schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }),\n        },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        {\n          status: 409,\n          description: 'Another timer is already running for this staff member',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 422,\n          description:\n            'Referenced time project or task not found, out of scope, or the task belongs to another project',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,sCAA0E;AACnF,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KAMC;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,UAAU,OAAO,YAAY,KAAK,YAAY;AAAA,IAC9C,gBAAgB,OAAO,cAAc,KAAK,SAAS;AAAA,EACrD;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,WAAW,UAAU,eAAe,IAAI,MAAM,aAAa,GAAG;AAC3E,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,IAAI,WAAW,QAAQ,IAAI,MAAM,KAAK,UAAU,eAAe;AAAA,MACnF,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,QAAQ,wBAAwB,gCAAgC,QAAQ,MAAM,KAAK,SAAS;AAClG,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AACA,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,eAAe,KAAK,CAAC;AACzF,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc,QAAQ,eAAe;AAAA,UAC1D,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,oDAAoD,EAAE,IAAI,CAAC;AACxE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE;AAAA,MACnF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAAA,QAC5E;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }