@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/api/timesheets/time-projects/route.js

@@ -1,13 +1,26 @@
+import { NextResponse } from "next/server";
 import { z } from "zod";
 import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { staffTimeProjectCrudEvents } from "../../../lib/crud.js";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { resolveCrudRecordId, parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { isIdsParamProvided, parseIdsParam } from "@open-mercato/shared/lib/crud/ids";
+import { createLogger } from "@open-mercato/shared/lib/logger";
 import { StaffTimeProject, StaffTimeProjectMember, StaffTeamMember } from "../../../data/entities.js";
 import { staffTimeProjectCreateSchema, staffTimeProjectUpdateSchema } from "../../../data/validators.js";
+import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.js";
+import { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from "../../../lib/time-tracking/access.js";
+import { readTimeTrackingSettings } from "../../../lib/time-tracking/settings.js";
+import { buildSqlInClause } from "../../../lib/time-tracking/sqlInClause.js";
 import { sanitizeSearchTerm, parseBooleanFlag } from "../../helpers.js";
 import { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from "../../openapi.js";
+import { E } from "../../../../../generated/entities.ids.generated.js";
+const logger = createLogger("staff").child({ component: "api/timesheets/time-projects" });
 const F = {
   id: "id",
   tenant_id: "tenant_id",
@@ -19,9 +32,16 @@ const F = {
   color: "color",
   status: "status",
   customer_id: "customer_id",
+  customer_snapshot: "customer_snapshot",
   owner_user_id: "owner_user_id",
   cost_center: "cost_center",
   start_date: "start_date",
+  hourly_rate: "hourly_rate",
+  currency_code: "currency_code",
+  billable_by_default: "billable_by_default",
+  budget_kind: "budget_kind",
+  budget_value: "budget_value",
+  budget_warn_at_percent: "budget_warn_at_percent",
   created_at: "created_at",
   updated_at: "updated_at",
   deleted_at: "deleted_at"
@@ -47,6 +67,78 @@ const listSchema = z.object({
   sortField: z.string().optional(),
   sortDir: z.enum(["asc", "desc"]).optional()
 }).passthrough();
+const NO_PROJECT_ACCESS_REASON = "no_project_access";
+const IMPOSSIBLE_PROJECT_ID = "00000000-0000-0000-0000-000000000000";
+const DENIED_ACCESS = { canManageAll: false, projectIds: [], staffMemberId: null };
+const accessByRequest = /* @__PURE__ */ new WeakMap();
+async function resolveGrantedFeatures(container, userId, scope) {
+  try {
+    const rbac = container.resolve("rbacService");
+    if (!rbac?.getGrantedFeatures) return [];
+    return await rbac.getGrantedFeatures(userId, scope) ?? [];
+  } catch {
+    return [];
+  }
+}
+async function resolveUnrestricted(container, userId, scope) {
+  try {
+    const rbac = container.resolve("rbacService");
+    if (!rbac?.userHasAllFeatures) return false;
+    return await rbac.userHasAllFeatures(userId, [MANAGE_PROJECTS_FEATURE], scope) === true;
+  } catch {
+    return false;
+  }
+}
+async function resolveAssignmentGraceDays(container, tenantId) {
+  try {
+    const configService = container.resolve("moduleConfigService");
+    const settings = await readTimeTrackingSettings(configService, { tenantId });
+    return settings.access.assignmentGraceDays;
+  } catch {
+    return null;
+  }
+}
+async function loadProjectAccess(container, userId, tenantId, organizationId) {
+  if (!tenantId || !organizationId) return { ...DENIED_ACCESS };
+  const scope = { tenantId, organizationId };
+  try {
+    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope);
+    const em = container.resolve("em");
+    return await resolveProjectAccess({
+      em: em.fork(),
+      userId,
+      tenantId,
+      organizationId,
+      canManageAll: access.allowed,
+      userFeatures: access.grantedFeatures,
+      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId)
+    });
+  } catch (err) {
+    logger.error("staff.timesheets.time-projects access resolution failed", { err });
+    return { ...DENIED_ACCESS };
+  }
+}
+function resolveRequestProjectAccess(request, load) {
+  if (!request) return load();
+  const cached = accessByRequest.get(request);
+  if (cached) return cached;
+  const pending = load();
+  accessByRequest.set(request, pending);
+  return pending;
+}
+function resolveCtxScope(ctx) {
+  return {
+    tenantId: ctx.auth?.tenantId ?? null,
+    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
+  };
+}
+async function resolveListProjectAccess(ctx) {
+  const { tenantId, organizationId } = resolveCtxScope(ctx);
+  return resolveRequestProjectAccess(
+    ctx.request,
+    () => loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId)
+  );
+}
 async function resolveCallerAssignedProjectIds(em, userId, tenantId, organizationId) {
   const scopeCtx = { tenantId, organizationId };
   const staffMember = await findOneWithDecryption(
@@ -66,6 +158,63 @@ async function resolveCallerAssignedProjectIds(em, userId, tenantId, organizatio
   });
   return Array.from(new Set(memberships.map((m) => m.timeProjectId)));
 }
+function toCount(value) {
+  const parsed = typeof value === "number" ? value : Number(value ?? 0);
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+async function decorateProjectCurrencyLock(items, em, scope) {
+  const ids = Array.from(
+    new Set(items.map((item) => item.id).filter((value) => typeof value === "string" && value.length > 0))
+  );
+  if (ids.length === 0) return;
+  const projectIn = buildSqlInClause("time_project_id", ids);
+  const rows = await em.getConnection().execute(
+    `
+      SELECT time_project_id,
+             COUNT(*)::bigint AS entry_count,
+             COUNT(locked_report_id)::bigint AS locked_entry_count
+      FROM staff_time_entries
+      WHERE tenant_id = ?
+        AND organization_id = ?
+        AND deleted_at IS NULL
+        AND ${projectIn.sql}
+      GROUP BY time_project_id
+    `,
+    [scope.tenantId, scope.organizationId, ...projectIn.params]
+  );
+  const counts = new Map(rows.map((row) => [row.time_project_id, row]));
+  for (const item of items) {
+    const row = typeof item.id === "string" ? counts.get(item.id) : void 0;
+    const entryCount = toCount(row?.entry_count);
+    item.entryCount = entryCount;
+    item.lockedEntryCount = toCount(row?.locked_entry_count);
+    item.currencyLocked = entryCount > 0;
+  }
+}
+const timeProjectListFields = [
+  F.id,
+  F.organization_id,
+  F.tenant_id,
+  F.name,
+  F.code,
+  F.description,
+  F.project_type,
+  F.color,
+  F.status,
+  F.customer_id,
+  F.customer_snapshot,
+  F.owner_user_id,
+  F.cost_center,
+  F.start_date,
+  F.hourly_rate,
+  F.currency_code,
+  F.billable_by_default,
+  F.budget_kind,
+  F.budget_value,
+  F.budget_warn_at_percent,
+  F.created_at,
+  F.updated_at
+];
 const crud = makeCrudRoute({
   metadata: routeMetadata,
   orm: {
@@ -75,28 +224,14 @@ const crud = makeCrudRoute({
     tenantField: "tenantId",
     softDeleteField: "deletedAt"
   },
+  events: staffTimeProjectCrudEvents,
   indexer: { entityType: "staff:staff_time_project" },
   enrichers: { entityId: "staff:staff_time_project" },
   list: {
     schema: listSchema,
     entityId: "staff:staff_time_project",
-    fields: [
-      F.id,
-      F.organization_id,
-      F.tenant_id,
-      F.name,
-      F.code,
-      F.description,
-      F.project_type,
-      F.color,
-      F.status,
-      F.customer_id,
-      F.owner_user_id,
-      F.cost_center,
-      F.start_date,
-      F.created_at,
-      F.updated_at
-    ],
+    fields: [...timeProjectListFields],
+    decorateCustomFields: { entityIds: [E.staff.staff_time_project] },
     sortFieldMap: {
       name: F.name,
       code: F.code,
@@ -123,7 +258,15 @@ const crud = makeCrudRoute({
         );
         narrowIds = narrowIds ? narrowIds.filter((id) => assigned.includes(id)) : assigned;
         if (narrowIds.length === 0) {
-          filters[F.id] = { $in: ["00000000-0000-0000-0000-000000000000"] };
+          filters[F.id] = { $in: [IMPOSSIBLE_PROJECT_ID] };
+          return filters;
+        }
+      }
+      const access = await resolveListProjectAccess(ctx);
+      if (!access.canManageAll) {
+        narrowIds = narrowIds ? narrowIds.filter((id) => access.projectIds.includes(id)) : [...access.projectIds];
+        if (narrowIds.length === 0) {
+          filters[F.id] = { $in: [IMPOSSIBLE_PROJECT_ID] };
           return filters;
         }
       }
@@ -146,6 +289,17 @@ const crud = makeCrudRoute({
       return filters;
     }
   },
+  hooks: {
+    afterList: async (res, ctx) => {
+      const items = Array.isArray(res?.items) ? res.items : [];
+      if (items.length === 0) return;
+      const tenantId = ctx.auth?.tenantId ?? null;
+      const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+      if (!tenantId || !organizationId) return;
+      const em = ctx.container.resolve("em");
+      await decorateProjectCurrencyLock(items, em.fork(), { tenantId, organizationId });
+    }
+  },
   actions: {
     create: {
       commandId: "staff.timesheets.time_projects.create",
@@ -178,7 +332,54 @@ const crud = makeCrudRoute({
     }
   }
 });
-const GET = crud.GET;
+async function buildAccessDenialResponse() {
+  const { translate } = await resolveTranslations();
+  return NextResponse.json(
+    {
+      // Same string a genuinely missing record gets: the body must not tell the
+      // caller which of the two it is beyond the membership discriminator.
+      error: translate("staff.timesheets.projects.errors.notFound", "Project not found."),
+      reason: NO_PROJECT_ACCESS_REASON
+    },
+    { status: 404 }
+  );
+}
+async function resolveProjectAccessDenial(req) {
+  const url = new URL(req.url);
+  const rawIds = url.searchParams.get("ids") ?? url.searchParams.get("id");
+  if (!isIdsParamProvided(rawIds)) return null;
+  const requestedIds = parseIdsParam(rawIds);
+  if (requestedIds.length === 0) return null;
+  try {
+    const container = await createRequestContainer();
+    const auth = await getAuthFromRequest(req);
+    if (!auth) return null;
+    const orgScope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+    const tenantId = orgScope?.tenantId ?? auth.tenantId ?? null;
+    const organizationId = orgScope?.selectedId ?? auth.orgId ?? null;
+    if (!tenantId || !organizationId) return null;
+    const access = await resolveRequestProjectAccess(
+      req,
+      () => loadProjectAccess(
+        container,
+        typeof auth.sub === "string" ? auth.sub : null,
+        tenantId,
+        organizationId
+      )
+    );
+    if (access.canManageAll) return null;
+    if (requestedIds.some((id) => access.projectIds.includes(id))) return null;
+    return await buildAccessDenialResponse();
+  } catch (err) {
+    logger.error("staff.timesheets.time-projects denial probe failed", { err });
+    return await buildAccessDenialResponse();
+  }
+}
+async function GET(req) {
+  const denial = await resolveProjectAccessDenial(req);
+  if (denial) return denial;
+  return crud.GET(req);
+}
 const POST = crud.POST;
 const PUT = crud.PUT;
 const DELETE = crud.DELETE;
@@ -193,13 +394,29 @@ const timeProjectListItemSchema = z.object({
   color: z.string().nullable().optional(),
   status: z.string().nullable().optional(),
   customer_id: z.string().uuid().nullable().optional(),
+  customer_snapshot: z.record(z.string(), z.unknown()).nullable().optional(),
   owner_user_id: z.string().uuid().nullable().optional(),
   cost_center: z.string().nullable().optional(),
   start_date: z.string().nullable().optional(),
+  // numeric(14,4) reaches the client as a decimal string; a number stays accepted
+  // for callers that read the column through a numeric-casting driver.
+  hourly_rate: z.union([z.string(), z.number()]).nullable().optional(),
+  currency_code: z.string().nullable().optional(),
+  billable_by_default: z.boolean().nullable().optional(),
+  budget_kind: z.string().nullable().optional(),
+  budget_value: z.union([z.string(), z.number()]).nullable().optional(),
+  budget_warn_at_percent: z.number().int().nullable().optional(),
   created_at: z.string().nullable().optional(),
-  updated_at: z.string().nullable().optional()
+  updated_at: z.string().nullable().optional(),
+  entryCount: z.number().int().optional(),
+  lockedEntryCount: z.number().int().optional(),
+  currencyLocked: z.boolean().optional()
 });
-const openApi = createStaffCrudOpenApi({
+const projectAccessDeniedResponseSchema = z.object({
+  error: z.string(),
+  reason: z.literal(NO_PROJECT_ACCESS_REASON)
+});
+const baseOpenApi = createStaffCrudOpenApi({
   resourceName: "TimeProject",
   pluralName: "Time Projects",
   querySchema: listSchema,
@@ -219,12 +436,37 @@ const openApi = createStaffCrudOpenApi({
     description: "Soft-deletes a time project by id."
   }
 });
+const openApi = {
+  ...baseOpenApi,
+  methods: {
+    ...baseOpenApi.methods,
+    ...baseOpenApi.methods?.GET ? {
+      GET: {
+        ...baseOpenApi.methods.GET,
+        description: `${baseOpenApi.methods.GET.description ?? ""} Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),
+        responses: [
+          ...baseOpenApi.methods.GET.responses ?? [],
+          {
+            status: 404,
+            description: "The caller is not a member of the requested project (or it does not exist)",
+            schema: projectAccessDeniedResponseSchema
+          }
+        ]
+      }
+    } : {}
+  }
+};
 export {
   DELETE,
   GET,
+  NO_PROJECT_ACCESS_REASON,
   POST,
   PUT,
+  decorateProjectCurrencyLock,
   metadata,
-  openApi
+  openApi,
+  projectAccessDeniedResponseSchema,
+  timeProjectListFields,
+  timeProjectListItemSchema
 };
 //# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/time-projects/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/time-projects/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { StaffTimeProject, StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { staffTimeProjectCreateSchema, staffTimeProjectUpdateSchema } from '../../../data/validators'\nimport { sanitizeSearchTerm, parseBooleanFlag } from '../../helpers'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  name: 'name',\n  code: 'code',\n  description: 'description',\n  project_type: 'project_type',\n  color: 'color',\n  status: 'status',\n  customer_id: 'customer_id',\n  owner_user_id: 'owner_user_id',\n  cost_center: 'cost_center',\n  start_date: 'start_date',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    q: z.string().optional(),\n    ids: z.string().optional(),\n    projectType: z.string().optional(),\n    status: z.string().optional(),\n    customerId: z.string().uuid().optional(),\n    mine: z.string().optional(),\n    include: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\nasync function resolveCallerAssignedProjectIds(\n  em: EntityManager,\n  userId: string,\n  tenantId: string,\n  organizationId: string,\n): Promise<string[]> {\n  const scopeCtx = { tenantId, organizationId }\n  const staffMember = await findOneWithDecryption(\n    em.fork(),\n    StaffTeamMember,\n    { userId, tenantId, organizationId, deletedAt: null },\n    {},\n    scopeCtx,\n  )\n  if (!staffMember) return []\n  const memberships = await em.fork().find(StaffTimeProjectMember, {\n    staffMemberId: staffMember.id,\n    tenantId,\n    organizationId,\n    status: 'active',\n    deletedAt: null,\n  })\n  return Array.from(new Set(memberships.map((m) => m.timeProjectId)))\n}\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeProject,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: 'staff:staff_time_project' },\n  enrichers: { entityId: 'staff:staff_time_project' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_project',\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.name,\n      F.code,\n      F.description,\n      F.project_type,\n      F.color,\n      F.status,\n      F.customer_id,\n      F.owner_user_id,\n      F.cost_center,\n      F.start_date,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      name: F.name,\n      code: F.code,\n      status: F.status,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      startDate: F.start_date,\n    },\n    buildFilters: async (query, ctx) => {\n      const filters: Record<string, unknown> = {}\n      let narrowIds: string[] | null = null\n      if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n        narrowIds = query.ids\n          .split(',')\n          .map((value) => value.trim())\n          .filter((value) => value.length > 0)\n      }\n      if (parseBooleanFlag(query.mine) && ctx.auth) {\n        const em = ctx.container.resolve('em') as EntityManager\n        const tenantId = ctx.auth.tenantId ?? ''\n        const organizationId = ctx.selectedOrganizationId ?? ctx.auth.orgId ?? ''\n        const assigned = await resolveCallerAssignedProjectIds(\n          em,\n          ctx.auth.sub,\n          tenantId,\n          organizationId,\n        )\n        narrowIds = narrowIds\n          ? narrowIds.filter((id) => assigned.includes(id))\n          : assigned\n        if (narrowIds.length === 0) {\n          filters[F.id] = { $in: ['00000000-0000-0000-0000-000000000000'] }\n          return filters\n        }\n      }\n      if (narrowIds && narrowIds.length > 0) {\n        filters[F.id] = { $in: narrowIds }\n      }\n      const term = sanitizeSearchTerm(query.q)\n      if (term) {\n        filters[F.name] = { $ilike: `%${escapeLikePattern(term)}%` }\n      }\n      if (typeof query.projectType === 'string' && query.projectType.trim().length > 0) {\n        filters[F.project_type] = query.projectType.trim()\n      }\n      if (typeof query.status === 'string' && query.status.trim().length > 0) {\n        filters[F.status] = query.status.trim()\n      }\n      if (typeof query.customerId === 'string' && query.customerId.trim().length > 0) {\n        filters[F.customer_id] = query.customerId.trim()\n      }\n      return filters\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.timesheets.time_projects.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeProjectCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.timeProjectId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'staff.timesheets.time_projects.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeProjectUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'staff.timesheets.time_projects.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst timeProjectListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  name: z.string().nullable().optional(),\n  code: z.string().nullable().optional(),\n  description: z.string().nullable().optional(),\n  project_type: z.string().nullable().optional(),\n  color: z.string().nullable().optional(),\n  status: z.string().nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  owner_user_id: z.string().uuid().nullable().optional(),\n  cost_center: z.string().nullable().optional(),\n  start_date: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'TimeProject',\n  pluralName: 'Time Projects',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(timeProjectListItemSchema),\n  create: {\n    schema: staffTimeProjectCreateSchema,\n    description: 'Creates a time project.',\n  },\n  update: {\n    schema: staffTimeProjectUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a time project by id.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes a time project by id.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,kBAAkB,wBAAwB,uBAAuB;AAC1E,SAAS,8BAA8B,oCAAoC;AAC3E,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,MAAM;AAAA,EACN,aAAa;AAAA,EACb,cAAc;AAAA,EACd,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,eAAe;AAAA,EACf,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAAA,EAC9E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EACjF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EAChF,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AACrF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA,EACvB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAEf,eAAe,gCACb,IACA,QACA,UACA,gBACmB;AACnB,QAAM,WAAW,EAAE,UAAU,eAAe;AAC5C,QAAM,cAAc,MAAM;AAAA,IACxB,GAAG,KAAK;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,UAAU,gBAAgB,WAAW,KAAK;AAAA,IACpD,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa,QAAO,CAAC;AAC1B,QAAM,cAAc,MAAM,GAAG,KAAK,EAAE,KAAK,wBAAwB;AAAA,IAC/D,eAAe,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC;AACD,SAAO,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACpE;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,2BAA2B;AAAA,EAClD,WAAW,EAAE,UAAU,2BAA2B;AAAA,EAClD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,MACV,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,UAAmC,CAAC;AAC1C,UAAI,YAA6B;AACjC,UAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,oBAAY,MAAM,IACf,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,MACvC;AACA,UAAI,iBAAiB,MAAM,IAAI,KAAK,IAAI,MAAM;AAC5C,cAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,cAAM,WAAW,IAAI,KAAK,YAAY;AACtC,cAAM,iBAAiB,IAAI,0BAA0B,IAAI,KAAK,SAAS;AACvE,cAAM,WAAW,MAAM;AAAA,UACrB;AAAA,UACA,IAAI,KAAK;AAAA,UACT;AAAA,UACA;AAAA,QACF;AACA,oBAAY,YACR,UAAU,OAAO,CAAC,OAAO,SAAS,SAAS,EAAE,CAAC,IAC9C;AACJ,YAAI,UAAU,WAAW,GAAG;AAC1B,kBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,sCAAsC,EAAE;AAChE,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,aAAa,UAAU,SAAS,GAAG;AACrC,gBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,UAAU;AAAA,MACnC;AACA,YAAM,OAAO,mBAAmB,MAAM,CAAC;AACvC,UAAI,MAAM;AACR,gBAAQ,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,kBAAkB,IAAI,CAAC,IAAI;AAAA,MAC7D;AACA,UAAI,OAAO,MAAM,gBAAgB,YAAY,MAAM,YAAY,KAAK,EAAE,SAAS,GAAG;AAChF,gBAAQ,EAAE,YAAY,IAAI,MAAM,YAAY,KAAK;AAAA,MACnD;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,KAAK,EAAE,SAAS,GAAG;AACtE,gBAAQ,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,KAAK,EAAE,SAAS,GAAG;AAC9E,gBAAQ,EAAE,WAAW,IAAI,MAAM,WAAW,KAAK;AAAA,MACjD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,8BAA8B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACxF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,iBAAiB,KAAK;AAAA,MAC/D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,8BAA8B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACxF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC7C,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { staffTimeProjectCrudEvents } from '../../../lib/crud'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isIdsParamProvided, parseIdsParam } from '@open-mercato/shared/lib/crud/ids'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeProject, StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { staffTimeProjectCreateSchema, staffTimeProjectUpdateSchema } from '../../../data/validators'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess, type ProjectAccess } from '../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { buildSqlInClause } from '../../../lib/time-tracking/sqlInClause'\nimport { sanitizeSearchTerm, parseBooleanFlag } from '../../helpers'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'\nimport { E } from '#generated/entities.ids.generated'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-projects' })\n\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  name: 'name',\n  code: 'code',\n  description: 'description',\n  project_type: 'project_type',\n  color: 'color',\n  status: 'status',\n  customer_id: 'customer_id',\n  customer_snapshot: 'customer_snapshot',\n  owner_user_id: 'owner_user_id',\n  cost_center: 'cost_center',\n  start_date: 'start_date',\n  hourly_rate: 'hourly_rate',\n  currency_code: 'currency_code',\n  billable_by_default: 'billable_by_default',\n  budget_kind: 'budget_kind',\n  budget_value: 'budget_value',\n  budget_warn_at_percent: 'budget_warn_at_percent',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.view'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    q: z.string().optional(),\n    ids: z.string().optional(),\n    projectType: z.string().optional(),\n    status: z.string().optional(),\n    customerId: z.string().uuid().optional(),\n    mine: z.string().optional(),\n    include: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\n/**\n * Discriminator returned with the 404 a project-scoped read answers when the\n * caller may not see the record. It is the whole body besides a generic error\n * string: naming the project or the customer here would confirm the resource to\n * someone who has no right to it (screen 17 note 1).\n *\n * Denied and genuinely-missing are deliberately indistinguishable for a caller\n * without `staff.timesheets.projects.manage` \u2014 both answer this same 404 \u2014 so the\n * endpoint cannot be used to enumerate which project ids exist. The discriminator\n * only tells the client \"you are not a member\", which is what screen 17 needs to\n * render the request-access affordance; a manager still gets a plain 200-empty\n * for an id that really does not exist.\n */\nexport const NO_PROJECT_ACCESS_REASON = 'no_project_access'\n\n/**\n * Non-UUID sentinel used as the \"match nothing\" id filter. Kept in the shape the\n * `mine=true` branch has always used so both narrowing paths behave identically.\n */\nconst IMPOSSIBLE_PROJECT_ID = '00000000-0000-0000-0000-000000000000'\n\nconst DENIED_ACCESS: ProjectAccess = { canManageAll: false, projectIds: [], staffMemberId: null }\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[]>\n  userHasAllFeatures?: (\n    userId: string,\n    required: string[],\n    options: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\n/**\n * Both entry points into a single request \u2014 the denial probe on `GET` and the\n * list narrowing in `buildFilters` \u2014 must agree on what the caller may see, and\n * neither should pay for the other's lookups. The resolved access is therefore\n * memoised per `Request`; the factory hands `buildFilters` the same object the\n * route received.\n */\nconst accessByRequest = new WeakMap<Request, Promise<ProjectAccess>>()\n\nasync function resolveGrantedFeatures(\n  container: ContainerLike,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<string[]> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getGrantedFeatures) return []\n    return (await rbac.getGrantedFeatures(userId, scope)) ?? []\n  } catch {\n    // Fail closed: an unreadable grant set is no grant set, so the caller falls\n    // back to their project memberships instead of being treated as a manager.\n    return []\n  }\n}\n\nasync function resolveUnrestricted(\n  container: ContainerLike,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<boolean> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.userHasAllFeatures) return false\n    return (await rbac.userHasAllFeatures(userId, [MANAGE_PROJECTS_FEATURE], scope)) === true\n  } catch {\n    // Fail closed, exactly as the grant lookup does.\n    return false\n  }\n}\n\nasync function resolveAssignmentGraceDays(\n  container: ContainerLike,\n  tenantId: string,\n): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<ProjectAccess> {\n  if (!tenantId || !organizationId) return { ...DENIED_ACCESS }\n  const scope = { tenantId, organizationId }\n  try {\n    // One lookup, one authority, and a failure that says so. The two-call version\n    // this replaces rescued `canManageAll` but still fed a possibly-empty array\n    // into `userFeatures`, which the guards downstream read.\n    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope)\n    const em = container.resolve('em') as EntityManager\n    return await resolveProjectAccess({\n      em: em.fork(),\n      userId,\n      tenantId,\n      organizationId,\n      canManageAll: access.allowed,\n      userFeatures: access.grantedFeatures,\n      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n    })\n  } catch (err) {\n    logger.error('staff.timesheets.time-projects access resolution failed', { err })\n    return { ...DENIED_ACCESS }\n  }\n}\n\nfunction resolveRequestProjectAccess(\n  request: Request | undefined,\n  load: () => Promise<ProjectAccess>,\n): Promise<ProjectAccess> {\n  if (!request) return load()\n  const cached = accessByRequest.get(request)\n  if (cached) return cached\n  const pending = load()\n  accessByRequest.set(request, pending)\n  return pending\n}\n\nfunction resolveCtxScope(ctx: CrudCtx): { tenantId: string | null; organizationId: string | null } {\n  return {\n    tenantId: ctx.auth?.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n  }\n}\n\nasync function resolveListProjectAccess(ctx: CrudCtx): Promise<ProjectAccess> {\n  const { tenantId, organizationId } = resolveCtxScope(ctx)\n  return resolveRequestProjectAccess(ctx.request, () =>\n    loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId),\n  )\n}\n\nasync function resolveCallerAssignedProjectIds(\n  em: EntityManager,\n  userId: string,\n  tenantId: string,\n  organizationId: string,\n): Promise<string[]> {\n  const scopeCtx = { tenantId, organizationId }\n  const staffMember = await findOneWithDecryption(\n    em.fork(),\n    StaffTeamMember,\n    { userId, tenantId, organizationId, deletedAt: null },\n    {},\n    scopeCtx,\n  )\n  if (!staffMember) return []\n  const memberships = await em.fork().find(StaffTimeProjectMember, {\n    staffMemberId: staffMember.id,\n    tenantId,\n    organizationId,\n    status: 'active',\n    deletedAt: null,\n  })\n  return Array.from(new Set(memberships.map((m) => m.timeProjectId)))\n}\n\ntype ProjectEntryCountRow = {\n  time_project_id: string\n  entry_count: string | number\n  locked_entry_count: string | number\n}\n\ntype ProjectListItem = {\n  id?: unknown\n  entryCount?: number\n  lockedEntryCount?: number\n  currencyLocked?: boolean\n}\n\nfunction toCount(value: string | number | null | undefined): number {\n  const parsed = typeof value === 'number' ? value : Number(value ?? 0)\n  return Number.isFinite(parsed) ? parsed : 0\n}\n\n/**\n * D-3 read-side signal: currency is read-only once hours have been logged, so the\n * project list/detail response carries the reason alongside the value.\n * `currencyLocked` tells the form to render the field read-only behind the explicit\n * change action, `entryCount` names why, and `lockedEntryCount` says whether even\n * that action will be refused (entries frozen in a closed report).\n *\n * One grouped aggregate for the whole page \u2014 never a per-row count.\n */\nexport async function decorateProjectCurrencyLock(\n  items: ProjectListItem[],\n  em: EntityManager,\n  scope: { tenantId: string; organizationId: string },\n): Promise<void> {\n  const ids = Array.from(\n    new Set(items.map((item) => item.id).filter((value): value is string => typeof value === 'string' && value.length > 0)),\n  )\n  if (ids.length === 0) return\n\n  const projectIn = buildSqlInClause('time_project_id', ids)\n  const rows = (await em.getConnection().execute(\n    `\n      SELECT time_project_id,\n             COUNT(*)::bigint AS entry_count,\n             COUNT(locked_report_id)::bigint AS locked_entry_count\n      FROM staff_time_entries\n      WHERE tenant_id = ?\n        AND organization_id = ?\n        AND deleted_at IS NULL\n        AND ${projectIn.sql}\n      GROUP BY time_project_id\n    `,\n    [scope.tenantId, scope.organizationId, ...projectIn.params],\n  )) as ProjectEntryCountRow[]\n\n  const counts = new Map(rows.map((row) => [row.time_project_id, row]))\n  for (const item of items) {\n    const row = typeof item.id === 'string' ? counts.get(item.id) : undefined\n    const entryCount = toCount(row?.entry_count)\n    item.entryCount = entryCount\n    item.lockedEntryCount = toCount(row?.locked_entry_count)\n    item.currencyLocked = entryCount > 0\n  }\n}\n\n/**\n * The list projection doubles as the detail projection (the edit page re-reads this\n * route with `?id=`), so every column the project form round-trips has to be here.\n */\nexport const timeProjectListFields = [\n  F.id,\n  F.organization_id,\n  F.tenant_id,\n  F.name,\n  F.code,\n  F.description,\n  F.project_type,\n  F.color,\n  F.status,\n  F.customer_id,\n  F.customer_snapshot,\n  F.owner_user_id,\n  F.cost_center,\n  F.start_date,\n  F.hourly_rate,\n  F.currency_code,\n  F.billable_by_default,\n  F.budget_kind,\n  F.budget_value,\n  F.budget_warn_at_percent,\n  F.created_at,\n  F.updated_at,\n] as const\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffTimeProject,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  events: staffTimeProjectCrudEvents,\n  indexer: { entityType: 'staff:staff_time_project' },\n  enrichers: { entityId: 'staff:staff_time_project' },\n  list: {\n    schema: listSchema,\n    entityId: 'staff:staff_time_project',\n    fields: [...timeProjectListFields],\n    decorateCustomFields: { entityIds: [E.staff.staff_time_project] },\n    sortFieldMap: {\n      name: F.name,\n      code: F.code,\n      status: F.status,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n      startDate: F.start_date,\n    },\n    buildFilters: async (query, ctx) => {\n      const filters: Record<string, unknown> = {}\n      let narrowIds: string[] | null = null\n      if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n        narrowIds = query.ids\n          .split(',')\n          .map((value) => value.trim())\n          .filter((value) => value.length > 0)\n      }\n      if (parseBooleanFlag(query.mine) && ctx.auth) {\n        const em = ctx.container.resolve('em') as EntityManager\n        const tenantId = ctx.auth.tenantId ?? ''\n        const organizationId = ctx.selectedOrganizationId ?? ctx.auth.orgId ?? ''\n        const assigned = await resolveCallerAssignedProjectIds(\n          em,\n          ctx.auth.sub,\n          tenantId,\n          organizationId,\n        )\n        narrowIds = narrowIds\n          ? narrowIds.filter((id) => assigned.includes(id))\n          : assigned\n        if (narrowIds.length === 0) {\n          filters[F.id] = { $in: [IMPOSSIBLE_PROJECT_ID] }\n          return filters\n        }\n      }\n      // Every project-scoped read filters through the one resolver: a caller\n      // without `staff.timesheets.projects.manage` only ever sees the projects\n      // they are an active member of. A non-member gets no row at all \u2014 not a\n      // redacted one \u2014 so the customer and project name never leave the server.\n      const access = await resolveListProjectAccess(ctx)\n      if (!access.canManageAll) {\n        narrowIds = narrowIds\n          ? narrowIds.filter((id) => access.projectIds.includes(id))\n          : [...access.projectIds]\n        if (narrowIds.length === 0) {\n          filters[F.id] = { $in: [IMPOSSIBLE_PROJECT_ID] }\n          return filters\n        }\n      }\n      if (narrowIds && narrowIds.length > 0) {\n        filters[F.id] = { $in: narrowIds }\n      }\n      const term = sanitizeSearchTerm(query.q)\n      if (term) {\n        filters[F.name] = { $ilike: `%${escapeLikePattern(term)}%` }\n      }\n      if (typeof query.projectType === 'string' && query.projectType.trim().length > 0) {\n        filters[F.project_type] = query.projectType.trim()\n      }\n      if (typeof query.status === 'string' && query.status.trim().length > 0) {\n        filters[F.status] = query.status.trim()\n      }\n      if (typeof query.customerId === 'string' && query.customerId.trim().length > 0) {\n        filters[F.customer_id] = query.customerId.trim()\n      }\n      return filters\n    },\n  },\n  hooks: {\n    afterList: async (res, ctx) => {\n      const items = Array.isArray((res as { items?: unknown })?.items)\n        ? ((res as { items: ProjectListItem[] }).items)\n        : []\n      if (items.length === 0) return\n      const tenantId = ctx.auth?.tenantId ?? null\n      const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n      if (!tenantId || !organizationId) return\n      const em = ctx.container.resolve('em') as EntityManager\n      await decorateProjectCurrencyLock(items, em.fork(), { tenantId, organizationId })\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.timesheets.time_projects.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeProjectCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.timeProjectId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'staff.timesheets.time_projects.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(staffTimeProjectUpdateSchema, raw ?? {}, ctx, translate)\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'staff.timesheets.time_projects.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nasync function buildAccessDenialResponse(): Promise<Response> {\n  const { translate } = await resolveTranslations()\n  return NextResponse.json(\n    {\n      // Same string a genuinely missing record gets: the body must not tell the\n      // caller which of the two it is beyond the membership discriminator.\n      error: translate('staff.timesheets.projects.errors.notFound', 'Project not found.'),\n      reason: NO_PROJECT_ACCESS_REASON,\n    },\n    { status: 404 },\n  )\n}\n\n/**\n * The list route doubles as the detail read (`?ids=<id>`, and defensively `?id=`),\n * so a caller asking for one specific project needs an answer the UI can turn\n * into screen 17 rather than an indistinguishable empty page. Returning 404 for\n * denied *and* unknown ids alike keeps the endpoint useless for enumeration; the\n * `reason` discriminator carries only \"you are not a member of this project\",\n * never the project or customer it is refusing to describe.\n */\nasync function resolveProjectAccessDenial(req: Request): Promise<Response | null> {\n  const url = new URL(req.url)\n  const rawIds = url.searchParams.get('ids') ?? url.searchParams.get('id')\n  if (!isIdsParamProvided(rawIds)) return null\n  const requestedIds = parseIdsParam(rawIds)\n  // Malformed ids match nothing on their own; the factory answers an empty list.\n  if (requestedIds.length === 0) return null\n\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    // Unauthenticated and unscoped requests are the factory's to reject.\n    if (!auth) return null\n    const orgScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = orgScope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = orgScope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) return null\n\n    const access = await resolveRequestProjectAccess(req, () =>\n      loadProjectAccess(\n        container,\n        typeof auth.sub === 'string' ? auth.sub : null,\n        tenantId,\n        organizationId,\n      ),\n    )\n    if (access.canManageAll) return null\n    if (requestedIds.some((id) => access.projectIds.includes(id))) return null\n    return await buildAccessDenialResponse()\n  } catch (err) {\n    // Fail closed: an access decision that could not be made is a denial.\n    logger.error('staff.timesheets.time-projects denial probe failed', { err })\n    return await buildAccessDenialResponse()\n  }\n}\n\nexport async function GET(req: Request): Promise<Response> {\n  const denial = await resolveProjectAccessDenial(req)\n  if (denial) return denial\n  return crud.GET(req)\n}\n\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nexport const timeProjectListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  name: z.string().nullable().optional(),\n  code: z.string().nullable().optional(),\n  description: z.string().nullable().optional(),\n  project_type: z.string().nullable().optional(),\n  color: z.string().nullable().optional(),\n  status: z.string().nullable().optional(),\n  customer_id: z.string().uuid().nullable().optional(),\n  customer_snapshot: z.record(z.string(), z.unknown()).nullable().optional(),\n  owner_user_id: z.string().uuid().nullable().optional(),\n  cost_center: z.string().nullable().optional(),\n  start_date: z.string().nullable().optional(),\n  // numeric(14,4) reaches the client as a decimal string; a number stays accepted\n  // for callers that read the column through a numeric-casting driver.\n  hourly_rate: z.union([z.string(), z.number()]).nullable().optional(),\n  currency_code: z.string().nullable().optional(),\n  billable_by_default: z.boolean().nullable().optional(),\n  budget_kind: z.string().nullable().optional(),\n  budget_value: z.union([z.string(), z.number()]).nullable().optional(),\n  budget_warn_at_percent: z.number().int().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  entryCount: z.number().int().optional(),\n  lockedEntryCount: z.number().int().optional(),\n  currencyLocked: z.boolean().optional(),\n})\n\nexport const projectAccessDeniedResponseSchema = z.object({\n  error: z.string(),\n  reason: z.literal(NO_PROJECT_ACCESS_REASON),\n})\n\nconst baseOpenApi = createStaffCrudOpenApi({\n  resourceName: 'TimeProject',\n  pluralName: 'Time Projects',\n  querySchema: listSchema,\n  listResponseSchema: createPagedListResponseSchema(timeProjectListItemSchema),\n  create: {\n    schema: staffTimeProjectCreateSchema,\n    description: 'Creates a time project.',\n  },\n  update: {\n    schema: staffTimeProjectUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a time project by id.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes a time project by id.',\n  },\n})\n\nexport const openApi = {\n  ...baseOpenApi,\n  methods: {\n    ...baseOpenApi.methods,\n    ...(baseOpenApi.methods?.GET\n      ? {\n          GET: {\n            ...baseOpenApi.methods.GET,\n            description: `${baseOpenApi.methods.GET.description ?? ''} Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),\n            responses: [\n              ...(baseOpenApi.methods.GET.responses ?? []),\n              {\n                status: 404,\n                description: 'The caller is not a member of the requested project (or it does not exist)',\n                schema: projectAccessDeniedResponseSchema,\n              },\n            ],\n          },\n        }\n      : {}),\n  },\n} satisfies typeof baseOpenApi\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,qBAAmC;AAC5C,SAAS,kCAAkC;AAC3C,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,oBAAoB,qBAAqB;AAClD,SAAS,oBAAoB;AAE7B,SAAS,kBAAkB,wBAAwB,uBAAuB;AAC1E,SAAS,8BAA8B,oCAAoC;AAC3E,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,4BAAgD;AAClF,SAAS,gCAAgC;AACzC,SAAS,wBAAwB;AACjC,SAAS,oBAAoB,wBAAwB;AACrD,SAAS,wBAAwB,+BAA+B,+BAA+B;AAC/F,SAAS,SAAS;AAElB,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAExF,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,MAAM;AAAA,EACN,MAAM;AAAA,EACN,aAAa;AAAA,EACb,cAAc;AAAA,EACd,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,cAAc;AAAA,EACd,wBAAwB;AAAA,EACxB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAAA,EAC9E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EACjF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AAAA,EAChF,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AACrF;AAEO,MAAM,WAAW;AAExB,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA,EACvB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAeR,MAAM,2BAA2B;AAMxC,MAAM,wBAAwB;AAE9B,MAAM,gBAA+B,EAAE,cAAc,OAAO,YAAY,CAAC,GAAG,eAAe,KAAK;AAuBhG,MAAM,kBAAkB,oBAAI,QAAyC;AAErE,eAAe,uBACb,WACA,QACA,OACmB;AACnB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,mBAAoB,QAAO,CAAC;AACvC,WAAQ,MAAM,KAAK,mBAAmB,QAAQ,KAAK,KAAM,CAAC;AAAA,EAC5D,QAAQ;AAGN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,oBACb,WACA,QACA,OACkB;AAClB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,mBAAoB,QAAO;AACtC,WAAQ,MAAM,KAAK,mBAAmB,QAAQ,CAAC,uBAAuB,GAAG,KAAK,MAAO;AAAA,EACvF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,2BACb,WACA,UACwB;AACxB,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACwB;AACxB,MAAI,CAAC,YAAY,CAAC,eAAgB,QAAO,EAAE,GAAG,cAAc;AAC5D,QAAM,QAAQ,EAAE,UAAU,eAAe;AACzC,MAAI;AAIF,UAAM,SAAS,MAAM,qBAAqB,WAAW,QAAQ,CAAC,uBAAuB,GAAG,KAAK;AAC7F,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,WAAO,MAAM,qBAAqB;AAAA,MAChC,IAAI,GAAG,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO;AAAA,MACrB,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,IAC3E,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAC/E,WAAO,EAAE,GAAG,cAAc;AAAA,EAC5B;AACF;AAEA,SAAS,4BACP,SACA,MACwB;AACxB,MAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAM,SAAS,gBAAgB,IAAI,OAAO;AAC1C,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,KAAK;AACrB,kBAAgB,IAAI,SAAS,OAAO;AACpC,SAAO;AACT;AAEA,SAAS,gBAAgB,KAA0E;AACjG,SAAO;AAAA,IACL,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,EACnE;AACF;AAEA,eAAe,yBAAyB,KAAsC;AAC5E,QAAM,EAAE,UAAU,eAAe,IAAI,gBAAgB,GAAG;AACxD,SAAO;AAAA,IAA4B,IAAI;AAAA,IAAS,MAC9C,kBAAkB,IAAI,WAAW,IAAI,MAAM,OAAO,MAAM,UAAU,cAAc;AAAA,EAClF;AACF;AAEA,eAAe,gCACb,IACA,QACA,UACA,gBACmB;AACnB,QAAM,WAAW,EAAE,UAAU,eAAe;AAC5C,QAAM,cAAc,MAAM;AAAA,IACxB,GAAG,KAAK;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,UAAU,gBAAgB,WAAW,KAAK;AAAA,IACpD,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa,QAAO,CAAC;AAC1B,QAAM,cAAc,MAAM,GAAG,KAAK,EAAE,KAAK,wBAAwB;AAAA,IAC/D,eAAe,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC;AACD,SAAO,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACpE;AAeA,SAAS,QAAQ,OAAmD;AAClE,QAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,OAAO,SAAS,CAAC;AACpE,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAWA,eAAsB,4BACpB,OACA,IACA,OACe;AACf,QAAM,MAAM,MAAM;AAAA,IAChB,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,CAAC;AAAA,EACxH;AACA,MAAI,IAAI,WAAW,EAAG;AAEtB,QAAM,YAAY,iBAAiB,mBAAmB,GAAG;AACzD,QAAM,OAAQ,MAAM,GAAG,cAAc,EAAE;AAAA,IACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAQU,UAAU,GAAG;AAAA;AAAA;AAAA,IAGvB,CAAC,MAAM,UAAU,MAAM,gBAAgB,GAAG,UAAU,MAAM;AAAA,EAC5D;AAEA,QAAM,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,iBAAiB,GAAG,CAAC,CAAC;AACpE,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,OAAO,KAAK,OAAO,WAAW,OAAO,IAAI,KAAK,EAAE,IAAI;AAChE,UAAM,aAAa,QAAQ,KAAK,WAAW;AAC3C,SAAK,aAAa;AAClB,SAAK,mBAAmB,QAAQ,KAAK,kBAAkB;AACvD,SAAK,iBAAiB,aAAa;AAAA,EACrC;AACF;AAMO,MAAM,wBAAwB;AAAA,EACnC,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AAAA,EACF,EAAE;AACJ;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,EAAE,YAAY,2BAA2B;AAAA,EAClD,WAAW,EAAE,UAAU,2BAA2B;AAAA,EAClD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,CAAC,GAAG,qBAAqB;AAAA,IACjC,sBAAsB,EAAE,WAAW,CAAC,EAAE,MAAM,kBAAkB,EAAE;AAAA,IAChE,cAAc;AAAA,MACZ,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,MACV,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,UAAmC,CAAC;AAC1C,UAAI,YAA6B;AACjC,UAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,oBAAY,MAAM,IACf,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,MACvC;AACA,UAAI,iBAAiB,MAAM,IAAI,KAAK,IAAI,MAAM;AAC5C,cAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,cAAM,WAAW,IAAI,KAAK,YAAY;AACtC,cAAM,iBAAiB,IAAI,0BAA0B,IAAI,KAAK,SAAS;AACvE,cAAM,WAAW,MAAM;AAAA,UACrB;AAAA,UACA,IAAI,KAAK;AAAA,UACT;AAAA,UACA;AAAA,QACF;AACA,oBAAY,YACR,UAAU,OAAO,CAAC,OAAO,SAAS,SAAS,EAAE,CAAC,IAC9C;AACJ,YAAI,UAAU,WAAW,GAAG;AAC1B,kBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,qBAAqB,EAAE;AAC/C,iBAAO;AAAA,QACT;AAAA,MACF;AAKA,YAAM,SAAS,MAAM,yBAAyB,GAAG;AACjD,UAAI,CAAC,OAAO,cAAc;AACxB,oBAAY,YACR,UAAU,OAAO,CAAC,OAAO,OAAO,WAAW,SAAS,EAAE,CAAC,IACvD,CAAC,GAAG,OAAO,UAAU;AACzB,YAAI,UAAU,WAAW,GAAG;AAC1B,kBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,qBAAqB,EAAE;AAC/C,iBAAO;AAAA,QACT;AAAA,MACF;AACA,UAAI,aAAa,UAAU,SAAS,GAAG;AACrC,gBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,UAAU;AAAA,MACnC;AACA,YAAM,OAAO,mBAAmB,MAAM,CAAC;AACvC,UAAI,MAAM;AACR,gBAAQ,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,kBAAkB,IAAI,CAAC,IAAI;AAAA,MAC7D;AACA,UAAI,OAAO,MAAM,gBAAgB,YAAY,MAAM,YAAY,KAAK,EAAE,SAAS,GAAG;AAChF,gBAAQ,EAAE,YAAY,IAAI,MAAM,YAAY,KAAK;AAAA,MACnD;AACA,UAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,KAAK,EAAE,SAAS,GAAG;AACtE,gBAAQ,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,KAAK,EAAE,SAAS,GAAG;AAC9E,gBAAQ,EAAE,WAAW,IAAI,MAAM,WAAW,KAAK;AAAA,MACjD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,WAAW,OAAO,KAAK,QAAQ;AAC7B,YAAM,QAAQ,MAAM,QAAS,KAA6B,KAAK,IACzD,IAAqC,QACvC,CAAC;AACL,UAAI,MAAM,WAAW,EAAG;AACxB,YAAM,WAAW,IAAI,MAAM,YAAY;AACvC,YAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,UAAI,CAAC,YAAY,CAAC,eAAgB;AAClC,YAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,YAAM,4BAA4B,OAAO,GAAG,KAAK,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAClF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,8BAA8B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACxF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,iBAAiB,KAAK;AAAA,MAC/D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,8BAA8B,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACxF;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,eAAe,4BAA+C;AAC5D,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,SAAO,aAAa;AAAA,IAClB;AAAA;AAAA;AAAA,MAGE,OAAO,UAAU,6CAA6C,oBAAoB;AAAA,MAClF,QAAQ;AAAA,IACV;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAUA,eAAe,2BAA2B,KAAwC;AAChF,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,IAAI,aAAa,IAAI,KAAK,KAAK,IAAI,aAAa,IAAI,IAAI;AACvE,MAAI,CAAC,mBAAmB,MAAM,EAAG,QAAO;AACxC,QAAM,eAAe,cAAc,MAAM;AAEzC,MAAI,aAAa,WAAW,EAAG,QAAO;AAEtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AAEzC,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAC3F,UAAM,WAAW,UAAU,YAAY,KAAK,YAAY;AACxD,UAAM,iBAAiB,UAAU,cAAc,KAAK,SAAS;AAC7D,QAAI,CAAC,YAAY,CAAC,eAAgB,QAAO;AAEzC,UAAM,SAAS,MAAM;AAAA,MAA4B;AAAA,MAAK,MACpD;AAAA,QACE;AAAA,QACA,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,QAC1C;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAc,QAAO;AAChC,QAAI,aAAa,KAAK,CAAC,OAAO,OAAO,WAAW,SAAS,EAAE,CAAC,EAAG,QAAO;AACtE,WAAO,MAAM,0BAA0B;AAAA,EACzC,SAAS,KAAK;AAEZ,WAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAC1E,WAAO,MAAM,0BAA0B;AAAA,EACzC;AACF;AAEA,eAAsB,IAAI,KAAiC;AACzD,QAAM,SAAS,MAAM,2BAA2B,GAAG;AACnD,MAAI,OAAQ,QAAO;AACnB,SAAO,KAAK,IAAI,GAAG;AACrB;AAEO,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAEpB,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACzE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA,EAG3C,aAAa,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,qBAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,QAAQ,wBAAwB;AAC5C,CAAC;AAED,MAAM,cAAc,uBAAuB;AAAA,EACzC,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;AAEM,MAAM,UAAU;AAAA,EACrB,GAAG;AAAA,EACH,SAAS;AAAA,IACP,GAAG,YAAY;AAAA,IACf,GAAI,YAAY,SAAS,MACrB;AAAA,MACE,KAAK;AAAA,QACH,GAAG,YAAY,QAAQ;AAAA,QACvB,aAAa,GAAG,YAAY,QAAQ,IAAI,eAAe,EAAE,wOAAwO,wBAAwB,iJAAiJ,KAAK;AAAA,QAC/c,WAAW;AAAA,UACT,GAAI,YAAY,QAAQ,IAAI,aAAa,CAAC;AAAA,UAC1C;AAAA,YACE,QAAQ;AAAA,YACR,aAAa;AAAA,YACb,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF,IACA,CAAC;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/staff/backend/staff/time-tracking/board/page.js

@@ -0,0 +1,110 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { useQuery } from "@tanstack/react-query";
+import { Page, PageBody, PageHeader } from "@open-mercato/ui/backend/Page";
+import { Button } from "@open-mercato/ui/primitives/button";
+import { EmptyState } from "@open-mercato/ui/primitives/empty-state";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue
+} from "@open-mercato/ui/primitives/select";
+import { ErrorMessage, LoadingMessage } from "@open-mercato/ui/backend/detail";
+import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+import { useOrganizationScopeVersion } from "@open-mercato/shared/lib/frontend/useOrganizationScope";
+import { TaskBoardScreen } from "../../../../lib/time-tracking-ui/TaskBoardScreen.js";
+import { readItems, readString } from "../../../../lib/time-tracking-ui/kanbanBoardData.js";
+function TimeTrackingBoardPage() {
+  const t = useT();
+  const router = useRouter();
+  const searchParams = useSearchParams();
+  const scopeVersion = useOrganizationScopeVersion();
+  const requestedProjectId = searchParams?.get("projectId") ?? null;
+  const projectsQuery = useQuery({
+    queryKey: ["staff", "time-tracking", "board", "projects", `scope:${scopeVersion}`],
+    staleTime: 6e4,
+    queryFn: async () => {
+      const call = await apiCall(
+        "/api/staff/timesheets/time-projects?page=1&pageSize=100&sortField=name&sortDir=asc"
+      );
+      if (!call.ok) throw new Error(`[internal] staff.time_tracking board projects request failed (${call.status})`);
+      return readItems(call.result).map((row) => {
+        const id = readString(row, "id");
+        if (!id) return null;
+        return { id, name: readString(row, "name") ?? id };
+      }).filter((project) => project !== null);
+    }
+  });
+  const projects = projectsQuery.data ?? [];
+  const activeProject = projects.find((project) => project.id === requestedProjectId) ?? projects[0] ?? null;
+  const handleProjectChange = React.useCallback(
+    (projectId) => {
+      const params = new URLSearchParams(searchParams?.toString() ?? "");
+      params.set("projectId", projectId);
+      params.delete("task");
+      router.replace(`?${params.toString()}`, { scroll: false });
+    },
+    [router, searchParams]
+  );
+  const projectPicker = projects.length > 0 && activeProject ? /* @__PURE__ */ jsxs(Select, { value: activeProject.id, onValueChange: handleProjectChange, children: [
+    /* @__PURE__ */ jsx(
+      SelectTrigger,
+      {
+        className: "w-64",
+        "aria-label": t("staff.time_tracking.board.projectPicker", "Project"),
+        children: /* @__PURE__ */ jsx(SelectValue, {})
+      }
+    ),
+    /* @__PURE__ */ jsx(SelectContent, { children: projects.map((project) => /* @__PURE__ */ jsx(SelectItem, { value: project.id, children: project.name }, project.id)) })
+  ] }) : null;
+  if (projectsQuery.isLoading) {
+    return /* @__PURE__ */ jsxs(Page, { children: [
+      /* @__PURE__ */ jsx(PageHeader, { title: t("staff.time_tracking.nav.tasks", "Tasks") }),
+      /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(LoadingMessage, { label: t("staff.time_tracking.board.loading", "Loading the board\u2026") }) })
+    ] });
+  }
+  if (projectsQuery.isError) {
+    return /* @__PURE__ */ jsxs(Page, { children: [
+      /* @__PURE__ */ jsx(PageHeader, { title: t("staff.time_tracking.nav.tasks", "Tasks") }),
+      /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(
+        ErrorMessage,
+        {
+          label: t("staff.time_tracking.board.projectsLoadError", "Could not load your projects."),
+          action: /* @__PURE__ */ jsx(Button, { type: "button", variant: "outline", size: "sm", onClick: () => void projectsQuery.refetch(), children: t("staff.time_tracking.board.reload", "Try again") })
+        }
+      ) })
+    ] });
+  }
+  if (!activeProject) {
+    return /* @__PURE__ */ jsxs(Page, { children: [
+      /* @__PURE__ */ jsx(PageHeader, { title: t("staff.time_tracking.nav.tasks", "Tasks") }),
+      /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(
+        EmptyState,
+        {
+          title: t("staff.time_tracking.board.noProject.title", "No project to show"),
+          description: t(
+            "staff.time_tracking.board.noProject.description",
+            "The board needs a project. Ask a Team Leader for access to one."
+          )
+        }
+      ) })
+    ] });
+  }
+  return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(
+    TaskBoardScreen,
+    {
+      timeProjectId: activeProject.id,
+      projectName: activeProject.name,
+      headerActions: projectPicker
+    }
+  ) });
+}
+export {
+  TimeTrackingBoardPage as default
+};
+//# sourceMappingURL=page.js.map

package/dist/modules/staff/backend/staff/time-tracking/board/page.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/staff/backend/staff/time-tracking/board/page.tsx"],
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { useRouter, useSearchParams } from 'next/navigation'\nimport { useQuery } from '@tanstack/react-query'\nimport { Page, PageBody, PageHeader } from '@open-mercato/ui/backend/Page'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { EmptyState } from '@open-mercato/ui/primitives/empty-state'\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from '@open-mercato/ui/primitives/select'\nimport { ErrorMessage, LoadingMessage } from '@open-mercato/ui/backend/detail'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { TaskBoardScreen } from '../../../../lib/time-tracking-ui/TaskBoardScreen'\nimport { readItems, readString } from '../../../../lib/time-tracking-ui/kanbanBoardData'\n\ntype BoardProject = {\n  id: string\n  name: string\n}\n\n/**\n * The module-level Tasks board (screen 6).\n *\n * Columns are per project (D-1), so the board always needs one. This route carries the\n * project in `?projectId=` and falls back to the first project the caller can see; the\n * per-project route renders the same screen with the id already resolved.\n */\nexport default function TimeTrackingBoardPage() {\n  const t = useT()\n  const router = useRouter()\n  const searchParams = useSearchParams()\n  const scopeVersion = useOrganizationScopeVersion()\n  const requestedProjectId = searchParams?.get('projectId') ?? null\n\n  const projectsQuery = useQuery<BoardProject[]>({\n    queryKey: ['staff', 'time-tracking', 'board', 'projects', `scope:${scopeVersion}`],\n    staleTime: 60_000,\n    queryFn: async () => {\n      const call = await apiCall<Record<string, unknown>>(\n        '/api/staff/timesheets/time-projects?page=1&pageSize=100&sortField=name&sortDir=asc',\n      )\n      // A failed call must not look like an empty project list: the empty state below\n      // tells the caller to ask a Team Leader for access, which is the wrong advice for\n      // a network error or a 500.\n      if (!call.ok) throw new Error(`[internal] staff.time_tracking board projects request failed (${call.status})`)\n      return readItems(call.result)\n        .map((row) => {\n          const id = readString(row, 'id')\n          if (!id) return null\n          return { id, name: readString(row, 'name') ?? id }\n        })\n        .filter((project): project is BoardProject => project !== null)\n    },\n  })\n\n  const projects = projectsQuery.data ?? []\n  const activeProject =\n    projects.find((project) => project.id === requestedProjectId) ?? projects[0] ?? null\n\n  const handleProjectChange = React.useCallback(\n    (projectId: string) => {\n      const params = new URLSearchParams(searchParams?.toString() ?? '')\n      params.set('projectId', projectId)\n      params.delete('task')\n      router.replace(`?${params.toString()}`, { scroll: false })\n    },\n    [router, searchParams],\n  )\n\n  const projectPicker =\n    projects.length > 0 && activeProject ? (\n      <Select value={activeProject.id} onValueChange={handleProjectChange}>\n        <SelectTrigger\n          className=\"w-64\"\n          aria-label={t('staff.time_tracking.board.projectPicker', 'Project')}\n        >\n          <SelectValue />\n        </SelectTrigger>\n        <SelectContent>\n          {projects.map((project) => (\n            <SelectItem key={project.id} value={project.id}>\n              {project.name}\n            </SelectItem>\n          ))}\n        </SelectContent>\n      </Select>\n    ) : null\n\n  if (projectsQuery.isLoading) {\n    return (\n      <Page>\n        <PageHeader title={t('staff.time_tracking.nav.tasks', 'Tasks')} />\n        <PageBody>\n          <LoadingMessage label={t('staff.time_tracking.board.loading', 'Loading the board\u2026')} />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (projectsQuery.isError) {\n    return (\n      <Page>\n        <PageHeader title={t('staff.time_tracking.nav.tasks', 'Tasks')} />\n        <PageBody>\n          <ErrorMessage\n            label={t('staff.time_tracking.board.projectsLoadError', 'Could not load your projects.')}\n            action={\n              <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={() => void projectsQuery.refetch()}>\n                {t('staff.time_tracking.board.reload', 'Try again')}\n              </Button>\n            }\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (!activeProject) {\n    return (\n      <Page>\n        <PageHeader title={t('staff.time_tracking.nav.tasks', 'Tasks')} />\n        <PageBody>\n          <EmptyState\n            title={t('staff.time_tracking.board.noProject.title', 'No project to show')}\n            description={t(\n              'staff.time_tracking.board.noProject.description',\n              'The board needs a project. Ask a Team Leader for access to one.',\n            )}\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <TaskBoardScreen\n        timeProjectId={activeProject.id}\n        projectName={activeProject.name}\n        headerActions={projectPicker}\n      />\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA8EM,SAKI,KALJ;AA5EN,YAAY,WAAW;AACvB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,gBAAgB;AACzB,SAAS,MAAM,UAAU,kBAAkB;AAC3C,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAc,sBAAsB;AAC7C,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,SAAS,mCAAmC;AAC5C,SAAS,uBAAuB;AAChC,SAAS,WAAW,kBAAkB;AAcvB,SAAR,wBAAyC;AAC9C,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,gBAAgB;AACrC,QAAM,eAAe,4BAA4B;AACjD,QAAM,qBAAqB,cAAc,IAAI,WAAW,KAAK;AAE7D,QAAM,gBAAgB,SAAyB;AAAA,IAC7C,UAAU,CAAC,SAAS,iBAAiB,SAAS,YAAY,SAAS,YAAY,EAAE;AAAA,IACjF,WAAW;AAAA,IACX,SAAS,YAAY;AACnB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,MACF;AAIA,UAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,iEAAiE,KAAK,MAAM,GAAG;AAC7G,aAAO,UAAU,KAAK,MAAM,EACzB,IAAI,CAAC,QAAQ;AACZ,cAAM,KAAK,WAAW,KAAK,IAAI;AAC/B,YAAI,CAAC,GAAI,QAAO;AAChB,eAAO,EAAE,IAAI,MAAM,WAAW,KAAK,MAAM,KAAK,GAAG;AAAA,MACnD,CAAC,EACA,OAAO,CAAC,YAAqC,YAAY,IAAI;AAAA,IAClE;AAAA,EACF,CAAC;AAED,QAAM,WAAW,cAAc,QAAQ,CAAC;AACxC,QAAM,gBACJ,SAAS,KAAK,CAAC,YAAY,QAAQ,OAAO,kBAAkB,KAAK,SAAS,CAAC,KAAK;AAElF,QAAM,sBAAsB,MAAM;AAAA,IAChC,CAAC,cAAsB;AACrB,YAAM,SAAS,IAAI,gBAAgB,cAAc,SAAS,KAAK,EAAE;AACjE,aAAO,IAAI,aAAa,SAAS;AACjC,aAAO,OAAO,MAAM;AACpB,aAAO,QAAQ,IAAI,OAAO,SAAS,CAAC,IAAI,EAAE,QAAQ,MAAM,CAAC;AAAA,IAC3D;AAAA,IACA,CAAC,QAAQ,YAAY;AAAA,EACvB;AAEA,QAAM,gBACJ,SAAS,SAAS,KAAK,gBACrB,qBAAC,UAAO,OAAO,cAAc,IAAI,eAAe,qBAC9C;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QACV,cAAY,EAAE,2CAA2C,SAAS;AAAA,QAElE,8BAAC,eAAY;AAAA;AAAA,IACf;AAAA,IACA,oBAAC,iBACE,mBAAS,IAAI,CAAC,YACb,oBAAC,cAA4B,OAAO,QAAQ,IACzC,kBAAQ,QADM,QAAQ,EAEzB,CACD,GACH;AAAA,KACF,IACE;AAEN,MAAI,cAAc,WAAW;AAC3B,WACE,qBAAC,QACC;AAAA,0BAAC,cAAW,OAAO,EAAE,iCAAiC,OAAO,GAAG;AAAA,MAChE,oBAAC,YACC,8BAAC,kBAAe,OAAO,EAAE,qCAAqC,yBAAoB,GAAG,GACvF;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,cAAc,SAAS;AACzB,WACE,qBAAC,QACC;AAAA,0BAAC,cAAW,OAAO,EAAE,iCAAiC,OAAO,GAAG;AAAA,MAChE,oBAAC,YACC;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,+CAA+C,+BAA+B;AAAA,UACvF,QACE,oBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,MAAM,KAAK,cAAc,QAAQ,GACzF,YAAE,oCAAoC,WAAW,GACpD;AAAA;AAAA,MAEJ,GACF;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,CAAC,eAAe;AAClB,WACE,qBAAC,QACC;AAAA,0BAAC,cAAW,OAAO,EAAE,iCAAiC,OAAO,GAAG;AAAA,MAChE,oBAAC,YACC;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,6CAA6C,oBAAoB;AAAA,UAC1E,aAAa;AAAA,YACX;AAAA,YACA;AAAA,UACF;AAAA;AAAA,MACF,GACF;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC;AAAA,IAAC;AAAA;AAAA,MACC,eAAe,cAAc;AAAA,MAC7B,aAAa,cAAc;AAAA,MAC3B,eAAe;AAAA;AAAA,EACjB,GACF;AAEJ;",
+  "names": []
+}

package/dist/modules/staff/backend/staff/time-tracking/board/page.meta.js

@@ -0,0 +1,18 @@
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["staff.timesheets.tasks.view"],
+  pageTitle: "Tasks",
+  pageTitleKey: "staff.time_tracking.nav.tasks",
+  pageGroup: "Time tracking",
+  pageGroupKey: "staff.time_tracking.nav.group",
+  pageOrder: 30,
+  icon: "layers",
+  breadcrumb: [
+    { label: "Time tracking", labelKey: "staff.time_tracking.nav.group", href: "/backend/staff/time-tracking" },
+    { label: "Tasks", labelKey: "staff.time_tracking.nav.tasks" }
+  ]
+};
+export {
+  metadata
+};
+//# sourceMappingURL=page.meta.js.map