@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/staff/commands/timesheets-entries.js

@@ -1,11 +1,26 @@
+import { z } from "zod";
 import { registerCommand } from "@open-mercato/shared/lib/commands";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { buildChanges, emitCrudSideEffects, emitCrudUndoSideEffects } from "@open-mercato/shared/lib/commands/helpers";
 import { makeCreateRedo } from "@open-mercato/shared/lib/commands/redo";
-import { StaffTimeEntry, StaffTimeEntrySegment, StaffTimeProject } from "../data/entities.js";
+import {
+  StaffTimeEntry,
+  StaffTimeEntrySegment,
+  StaffTimeProject,
+  StaffTimeTask
+} from "../data/entities.js";
 import { emitStaffEvent } from "../events.js";
+import { deriveInterval, formatClock, parseClock } from "../lib/time-tracking/interval.js";
+import { roundMinutes } from "../lib/time-tracking/rounding.js";
+import { resolveBillability } from "../lib/time-tracking/billability.js";
+import {
+  DEFAULT_TIME_TRACKING_SETTINGS,
+  readTimeTrackingSettings
+} from "../lib/time-tracking/settings.js";
+import { resolveProjectAccess } from "../lib/time-tracking/access.js";
+import { staffTimeTagCommandIds, TAG_TARGET_LOCKED_CODE } from "./timesheets-tags.js";
 const timeEntryCrudIndexer = {
   entityType: "staff:staff_time_entry"
 };
@@ -57,14 +72,15 @@ async function resolveCallerStaffMemberId(em, ctx) {
   );
   return member?.id ?? null;
 }
-async function assertTimeProjectInScope(em, projectId, tenantId, organizationId) {
-  if (!projectId) return;
-  const exists = await em.findOne(
-    StaffTimeProject,
-    { id: projectId, tenantId, organizationId, deletedAt: null },
-    { fields: ["id"] }
-  );
-  if (!exists) {
+async function requireTimeProjectInScope(em, projectId, tenantId, organizationId) {
+  if (!projectId) return null;
+  const project = await em.findOne(StaffTimeProject, {
+    id: projectId,
+    tenantId,
+    organizationId,
+    deletedAt: null
+  });
+  if (!project) {
     const { translate } = await resolveTranslations();
     throw new CrudHttpError(422, {
       error: translate("staff.timesheets.errors.projectNotFound", "Time project not found or not accessible."),
@@ -73,6 +89,238 @@ async function assertTimeProjectInScope(em, projectId, tenantId, organizationId)
       }
     });
   }
+  return project;
+}
+async function requireTaskInScope(em, taskId, tenantId, organizationId) {
+  if (!taskId) return null;
+  const task = await em.findOne(StaffTimeTask, {
+    id: taskId,
+    tenantId,
+    organizationId,
+    deletedAt: null
+  });
+  if (!task) {
+    const { translate } = await resolveTranslations();
+    const message = translate("staff.timesheets.errors.taskNotFound", "Task not found or not accessible.");
+    throw new CrudHttpError(422, { error: message, fieldErrors: { taskId: message } });
+  }
+  return task;
+}
+async function assertTaskBelongsToProject(task, projectId) {
+  if (timeEntryTaskMatchesProject(task, projectId)) return;
+  const { translate } = await resolveTranslations();
+  const message = translate("staff.timesheets.errors.taskNotFound", "Task not found or not accessible.");
+  throw new CrudHttpError(422, { error: message, fieldErrors: { taskId: message } });
+}
+function timeEntryTaskMatchesProject(task, projectId) {
+  if (!task || !projectId) return true;
+  return task.timeProjectId === projectId;
+}
+function resolveTimeEntryProjectId(requestedProjectId, task) {
+  return requestedProjectId ?? task?.timeProjectId ?? null;
+}
+function resolveTimeEntryBillable(params) {
+  return resolveBillability({
+    ...params.scope ?? {},
+    requested: params.requested,
+    project: params.project ?? null,
+    settings: params.settings
+  });
+}
+async function readEntrySettingsFrom(container, tenantId) {
+  try {
+    const configService = container.resolve("moduleConfigService");
+    if (!configService?.getRecord) return DEFAULT_TIME_TRACKING_SETTINGS;
+    return await readTimeTrackingSettings(configService, { tenantId });
+  } catch {
+    return DEFAULT_TIME_TRACKING_SETTINGS;
+  }
+}
+async function readEntrySettings(ctx, tenantId) {
+  return readEntrySettingsFrom(ctx.container, tenantId);
+}
+async function resolveTimeEntrySettings(container, tenantId) {
+  return readEntrySettingsFrom(container, tenantId);
+}
+async function resolveRoundedMinutes(container, tenantId, durationMinutes, organizationId) {
+  return roundedMinutesFor(durationMinutes, await readEntrySettingsFrom(container, tenantId), {
+    tenantId,
+    organizationId: organizationId ?? void 0
+  });
+}
+async function resolveGrantedFeatures(ctx, tenantId, organizationId) {
+  const userId = ctx.auth?.sub;
+  if (!userId) return [];
+  try {
+    const rbac = ctx.container.resolve("rbacService");
+    if (!rbac?.getGrantedFeatures) return [];
+    return await rbac.getGrantedFeatures(userId, { tenantId, organizationId }) ?? [];
+  } catch {
+    return [];
+  }
+}
+async function resolveEntryProjectAccess(em, ctx, tenantId, organizationId, settings) {
+  return resolveProjectAccess({
+    em: em.fork(),
+    userId: ctx.auth?.sub ?? null,
+    tenantId,
+    organizationId,
+    userFeatures: await resolveGrantedFeatures(ctx, tenantId, organizationId),
+    assignmentGraceDays: settings.access.assignmentGraceDays
+  });
+}
+async function assertEntryProjectAccess(params) {
+  if (params.hasManageAll || params.access.canManageAll) return;
+  const { translate } = await resolveTranslations();
+  if (params.projectId) {
+    if (params.access.projectIds.includes(params.projectId)) return;
+    throw new CrudHttpError(403, {
+      error: translate("staff.timesheets.errors.notAssigned", "You are not assigned to this project.")
+    });
+  }
+  if (params.access.staffMemberId && params.access.staffMemberId === params.entryStaffMemberId) return;
+  throw new CrudHttpError(403, {
+    error: translate("staff.timesheets.errors.notOwner", "You can only manage your own time entries.")
+  });
+}
+function resolveTimeEntryNotesInput(parsed) {
+  if (parsed.description !== void 0) return parsed.description ?? null;
+  if (parsed.notes !== void 0) return parsed.notes ?? null;
+  return void 0;
+}
+function toStoredTimeEntryRateOverride(amount) {
+  return amount === null || amount === void 0 ? null : String(amount);
+}
+function roundedMinutesFor(durationMinutes, settings, scope) {
+  return roundMinutes(durationMinutes, settings.rounding, scope);
+}
+function clockOfTimestamp(value) {
+  return formatClock(value.getUTCHours() * 60 + value.getUTCMinutes());
+}
+function timestampOnDayOf(reference, clock, dayOffset) {
+  const minutesOfDay = parseClock(clock) ?? 0;
+  return new Date(
+    Date.UTC(
+      reference.getUTCFullYear(),
+      reference.getUTCMonth(),
+      reference.getUTCDate() + dayOffset,
+      Math.floor(minutesOfDay / 60),
+      minutesOfDay % 60,
+      0,
+      0
+    )
+  );
+}
+function alignEndToStart(startedAt, endedAt, endClock, crossesMidnight) {
+  if (endedAt.getTime() >= startedAt.getTime()) return endedAt;
+  return timestampOnDayOf(startedAt, endClock, crossesMidnight ? 1 : 0);
+}
+function reconcileTimeEntryInterval(params) {
+  const startProvided = params.startedAt !== void 0;
+  const endProvided = params.endedAt !== void 0;
+  const durationProvided = params.durationMinutes !== void 0;
+  if (!startProvided && !endProvided && !durationProvided) return params.stored;
+  const startedAt = startProvided ? params.startedAt ?? null : params.stored.startedAt;
+  const endedAt = endProvided ? params.endedAt ?? null : params.stored.endedAt;
+  const durationMinutes = durationProvided ? params.durationMinutes : params.stored.durationMinutes;
+  if (!startedAt || !endedAt) return { startedAt, endedAt, durationMinutes };
+  const startClock = clockOfTimestamp(startedAt);
+  const endClock = clockOfTimestamp(endedAt);
+  const durationAnchored = durationProvided && !(startProvided && endProvided);
+  if (durationAnchored && !endProvided) {
+    const derived2 = deriveInterval({ start: startClock, durationMinutes });
+    return {
+      startedAt,
+      endedAt: timestampOnDayOf(startedAt, derived2.end ?? endClock, derived2.crossesMidnight ? 1 : 0),
+      durationMinutes
+    };
+  }
+  if (durationAnchored && !startProvided) {
+    const derived2 = deriveInterval({ end: endClock, durationMinutes });
+    return {
+      startedAt: timestampOnDayOf(endedAt, derived2.start ?? startClock, derived2.crossesMidnight ? -1 : 0),
+      endedAt,
+      durationMinutes
+    };
+  }
+  const derived = deriveInterval({ start: startClock, end: endClock, durationMinutes });
+  return {
+    startedAt,
+    endedAt: alignEndToStart(startedAt, endedAt, endClock, derived.crossesMidnight),
+    durationMinutes: derived.durationMinutes ?? durationMinutes
+  };
+}
+const MS_PER_DAY = 864e5;
+function toDateOrNull(value) {
+  if (value === null || value === void 0) return null;
+  const date = value instanceof Date ? value : new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+function utcDayIndex(value) {
+  return Math.round(
+    Date.UTC(value.getUTCFullYear(), value.getUTCMonth(), value.getUTCDate()) / MS_PER_DAY
+  );
+}
+function rebaseTimeEntryIntervalToDate(params) {
+  const fromDate = toDateOrNull(params.fromDate);
+  const toDate = toDateOrNull(params.toDate);
+  if (!fromDate || !toDate) return params.stored;
+  const { startedAt, endedAt } = params.stored;
+  if (!startedAt && !endedAt) return params.stored;
+  if (startedAt && !endedAt) return params.stored;
+  const shiftMs = (utcDayIndex(toDate) - utcDayIndex(fromDate)) * MS_PER_DAY;
+  if (shiftMs === 0) return params.stored;
+  return {
+    startedAt: startedAt ? new Date(startedAt.getTime() + shiftMs) : null,
+    endedAt: endedAt ? new Date(endedAt.getTime() + shiftMs) : null,
+    durationMinutes: params.stored.durationMinutes
+  };
+}
+const TIME_ENTRY_LOCKED_CODE = TAG_TARGET_LOCKED_CODE;
+function buildTimeEntryLockedError(lockedEntries, translate) {
+  const lockedEntryIds = lockedEntries.map((entry) => entry.id);
+  const lockedReportIds = Array.from(
+    new Set(
+      lockedEntries.map((entry) => entry.lockedReportId).filter((reportId) => typeof reportId === "string" && reportId.length > 0)
+    )
+  );
+  return new CrudHttpError(409, {
+    code: TIME_ENTRY_LOCKED_CODE,
+    error: lockedEntryIds.length > 1 ? translate(
+      "staff.time_tracking.entries.errors.entriesLocked",
+      "Some of these time entries are locked in a closed report and cannot be changed. Unlock the report first."
+    ) : translate(
+      "staff.time_tracking.entries.errors.entryLocked",
+      "This time entry is locked in a closed report and cannot be changed. Unlock the report first."
+    ),
+    lockedReportId: lockedReportIds[0] ?? null,
+    lockedEntryIds,
+    lockedReportIds
+  });
+}
+function assertTimeEntryUnlocked(entry, translate) {
+  if (!entry.lockedReportId) return;
+  throw buildTimeEntryLockedError([{ id: entry.id, lockedReportId: entry.lockedReportId }], translate);
+}
+async function syncEntryTags(ctx, params) {
+  const bus = ctx.container.resolve("commandBus");
+  const desired = Array.from(new Set(params.tagIds));
+  const scoped = {
+    tenantId: params.tenantId,
+    organizationId: params.organizationId,
+    timeEntryId: params.timeEntryId
+  };
+  const assigned = await bus.execute(staffTimeTagCommandIds.assignEntry, {
+    input: { ...scoped, tagIds: desired },
+    ctx
+  });
+  const current = assigned?.result?.tagIds ?? desired;
+  const stale = current.filter((tagId) => !desired.includes(tagId));
+  if (stale.length === 0) return;
+  await bus.execute(staffTimeTagCommandIds.unassignEntry, {
+    input: { ...scoped, tagIds: stale },
+    ctx
+  });
 }
 async function loadTimeEntrySnapshot(em, id, scope) {
   const entry = await findOneWithDecryption(
@@ -90,13 +338,18 @@ async function loadTimeEntrySnapshot(em, id, scope) {
     staffMemberId: entry.staffMemberId,
     date: entry.date instanceof Date ? entry.date.toISOString().split("T")[0] : String(entry.date),
     durationMinutes: entry.durationMinutes,
+    roundedMinutes: entry.roundedMinutes ?? null,
     startedAt: entry.startedAt ? entry.startedAt.toISOString() : null,
     endedAt: entry.endedAt ? entry.endedAt.toISOString() : null,
     notes: entry.notes ?? null,
     timeProjectId: entry.timeProjectId ?? null,
+    taskId: entry.taskId ?? null,
     customerId: entry.customerId ?? null,
     dealId: entry.dealId ?? null,
     orderId: entry.orderId ?? null,
+    isBillable: entry.isBillable,
+    rateOverrideAmount: entry.rateOverrideAmount ?? null,
+    rateCurrencyCode: entry.rateCurrencyCode ?? null,
     source: entry.source,
     deletedAt: entry.deletedAt ? entry.deletedAt.toISOString() : null
   };
@@ -109,13 +362,18 @@ function timeEntrySeedFromSnapshot(snapshot) {
     staffMemberId: snapshot.staffMemberId,
     date: snapshot.date,
     durationMinutes: snapshot.durationMinutes,
+    roundedMinutes: snapshot.roundedMinutes ?? null,
     startedAt: snapshot.startedAt ? new Date(snapshot.startedAt) : null,
     endedAt: snapshot.endedAt ? new Date(snapshot.endedAt) : null,
     notes: snapshot.notes ?? null,
     timeProjectId: snapshot.timeProjectId ?? null,
+    taskId: snapshot.taskId ?? null,
     customerId: snapshot.customerId ?? null,
     dealId: snapshot.dealId ?? null,
     orderId: snapshot.orderId ?? null,
+    isBillable: snapshot.isBillable ?? true,
+    rateOverrideAmount: snapshot.rateOverrideAmount ?? null,
+    rateCurrencyCode: snapshot.rateCurrencyCode ?? null,
     source: snapshot.source ?? "manual",
     createdAt: /* @__PURE__ */ new Date(),
     updatedAt: /* @__PURE__ */ new Date(),
@@ -141,7 +399,17 @@ const createTimeEntryCommand = {
       }
       effectiveStaffMemberId = callerStaffMemberId;
     }
-    await assertTimeProjectInScope(em, parsed.timeProjectId ?? null, parsed.tenantId, parsed.organizationId);
+    const task = await requireTaskInScope(em, parsed.taskId ?? null, parsed.tenantId, parsed.organizationId);
+    const requestedProjectId = resolveTimeEntryProjectId(parsed.timeProjectId, task);
+    const project = await requireTimeProjectInScope(em, requestedProjectId, parsed.tenantId, parsed.organizationId);
+    await assertTaskBelongsToProject(task, project?.id ?? null);
+    const settings = await readEntrySettings(ctx, parsed.tenantId);
+    await assertEntryProjectAccess({
+      access: await resolveEntryProjectAccess(em, ctx, parsed.tenantId, parsed.organizationId, settings),
+      hasManageAll: await callerHasManageAll(ctx),
+      projectId: project?.id ?? null,
+      entryStaffMemberId: effectiveStaffMemberId
+    });
     const now = /* @__PURE__ */ new Date();
     const entry = em.create(StaffTimeEntry, {
       tenantId: parsed.tenantId,
@@ -149,13 +417,28 @@ const createTimeEntryCommand = {
       staffMemberId: effectiveStaffMemberId,
       date: parsed.date,
       durationMinutes: parsed.durationMinutes,
+      roundedMinutes: roundedMinutesFor(parsed.durationMinutes, settings, {
+        tenantId: parsed.tenantId,
+        organizationId: parsed.organizationId
+      }),
       startedAt: parsed.startedAt ?? null,
       endedAt: parsed.endedAt ?? null,
-      notes: parsed.notes ?? null,
-      timeProjectId: parsed.timeProjectId ?? null,
+      notes: resolveTimeEntryNotesInput(parsed) ?? null,
+      timeProjectId: project?.id ?? null,
+      taskId: task?.id ?? null,
       customerId: parsed.customerId ?? null,
       dealId: parsed.dealId ?? null,
       orderId: parsed.orderId ?? null,
+      isBillable: resolveTimeEntryBillable({
+        requested: parsed.isBillable,
+        project,
+        settings,
+        scope: { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
+      }),
+      rateOverrideAmount: toStoredTimeEntryRateOverride(parsed.rateOverrideAmount),
+      // Snapshotted rather than joined at read time so a later project currency
+      // change cannot re-denominate money that has already been reported (D-3).
+      rateCurrencyCode: project?.currencyCode ?? null,
       source: parsed.source ?? "manual",
       createdAt: now,
       updatedAt: now,
@@ -163,6 +446,14 @@ const createTimeEntryCommand = {
     });
     em.persist(entry);
     await em.flush();
+    if (parsed.tagIds !== void 0) {
+      await syncEntryTags(ctx, {
+        timeEntryId: entry.id,
+        tenantId: parsed.tenantId,
+        organizationId: parsed.organizationId,
+        tagIds: parsed.tagIds
+      });
+    }
     await emitCrudSideEffects({
       dataEngine: ctx.container.resolve("dataEngine"),
       action: "created",
@@ -245,7 +536,11 @@ const startTimerCommand = {
       }
       effectiveStaffMemberId = callerStaffMemberId;
     }
-    await assertTimeProjectInScope(em, parsed.timeProjectId ?? null, parsed.tenantId, parsed.organizationId);
+    const task = await requireTaskInScope(em, parsed.taskId ?? null, parsed.tenantId, parsed.organizationId);
+    const requestedProjectId = resolveTimeEntryProjectId(parsed.timeProjectId, task);
+    const project = await requireTimeProjectInScope(em, requestedProjectId, parsed.tenantId, parsed.organizationId);
+    await assertTaskBelongsToProject(task, project?.id ?? null);
+    const settings = await readEntrySettings(ctx, parsed.tenantId);
     const scopeCtx = { tenantId: parsed.tenantId, organizationId: parsed.organizationId };
     const { entry, startedAt } = await em.transactional(async (trx) => {
       const otherRunningEntry = await findOneWithDecryption(
@@ -278,10 +573,15 @@ const startTimerCommand = {
         staffMemberId: effectiveStaffMemberId,
         date: parsed.date,
         durationMinutes: 0,
+        roundedMinutes: roundedMinutesFor(0, settings, {
+          tenantId: parsed.tenantId,
+          organizationId: parsed.organizationId
+        }),
         startedAt: startedAt2,
         endedAt: null,
         notes: parsed.notes ?? null,
-        timeProjectId: parsed.timeProjectId ?? null,
+        timeProjectId: project?.id ?? null,
+        taskId: task?.id ?? null,
         customerId: null,
         dealId: null,
         orderId: null,
@@ -389,7 +689,9 @@ const updateTimeEntryCommand = {
     if (!entry) throw new CrudHttpError(404, { error: "Time entry not found." });
     ensureTenantScope(ctx, entry.tenantId);
     ensureOrganizationScope(ctx, entry.organizationId);
-    if (!await callerHasManageAll(ctx)) {
+    assertTimeEntryUnlocked(entry, (await resolveTranslations()).translate);
+    const hasManageAll = await callerHasManageAll(ctx);
+    if (!hasManageAll) {
       const callerStaffMemberId = await resolveCallerStaffMemberId(em, ctx);
       if (!callerStaffMemberId || entry.staffMemberId !== callerStaffMemberId) {
         const { translate } = await resolveTranslations();
@@ -398,18 +700,76 @@ const updateTimeEntryCommand = {
         });
       }
     }
-    if (parsed.timeProjectId !== void 0 && parsed.timeProjectId !== null) {
-      await assertTimeProjectInScope(em, parsed.timeProjectId, entry.tenantId, entry.organizationId);
+    const task = parsed.taskId !== void 0 ? await requireTaskInScope(em, parsed.taskId, entry.tenantId, entry.organizationId) : null;
+    const nextProjectId = parsed.timeProjectId !== void 0 ? parsed.timeProjectId ?? null : task?.timeProjectId ?? entry.timeProjectId ?? null;
+    const projectChanged = nextProjectId !== (entry.timeProjectId ?? null);
+    const project = projectChanged ? await requireTimeProjectInScope(em, nextProjectId, entry.tenantId, entry.organizationId) : null;
+    await assertTaskBelongsToProject(task, nextProjectId);
+    const settings = await readEntrySettings(ctx, entry.tenantId);
+    const access = await resolveEntryProjectAccess(em, ctx, entry.tenantId, entry.organizationId, settings);
+    await assertEntryProjectAccess({
+      access,
+      hasManageAll,
+      projectId: entry.timeProjectId ?? null,
+      entryStaffMemberId: entry.staffMemberId
+    });
+    if (projectChanged) {
+      await assertEntryProjectAccess({
+        access,
+        hasManageAll,
+        projectId: nextProjectId,
+        entryStaffMemberId: entry.staffMemberId
+      });
     }
+    const notes = resolveTimeEntryNotesInput(parsed);
+    const stored = rebaseTimeEntryIntervalToDate({
+      stored: {
+        startedAt: entry.startedAt ?? null,
+        endedAt: entry.endedAt ?? null,
+        durationMinutes: entry.durationMinutes
+      },
+      fromDate: entry.date,
+      toDate: parsed.date
+    });
+    const interval = reconcileTimeEntryInterval({
+      stored,
+      startedAt: parsed.startedAt,
+      endedAt: parsed.endedAt,
+      durationMinutes: parsed.durationMinutes
+    });
     if (parsed.date !== void 0) entry.date = parsed.date;
-    if (parsed.durationMinutes !== void 0) entry.durationMinutes = parsed.durationMinutes;
-    if (parsed.timeProjectId !== void 0) entry.timeProjectId = parsed.timeProjectId ?? null;
+    if (interval.startedAt !== (entry.startedAt ?? null)) entry.startedAt = interval.startedAt;
+    if (interval.endedAt !== (entry.endedAt ?? null)) entry.endedAt = interval.endedAt;
+    if (parsed.durationMinutes !== void 0 || interval.durationMinutes !== entry.durationMinutes) {
+      entry.durationMinutes = interval.durationMinutes;
+      entry.roundedMinutes = roundedMinutesFor(interval.durationMinutes, settings, {
+        tenantId: entry.tenantId,
+        organizationId: entry.organizationId
+      });
+    }
+    if (projectChanged) {
+      entry.timeProjectId = nextProjectId;
+      entry.rateCurrencyCode = project?.currencyCode ?? null;
+    }
+    if (parsed.taskId !== void 0) entry.taskId = task?.id ?? null;
     if (parsed.customerId !== void 0) entry.customerId = parsed.customerId ?? null;
     if (parsed.dealId !== void 0) entry.dealId = parsed.dealId ?? null;
     if (parsed.orderId !== void 0) entry.orderId = parsed.orderId ?? null;
-    if (parsed.notes !== void 0) entry.notes = parsed.notes ?? null;
+    if (parsed.isBillable !== void 0) entry.isBillable = parsed.isBillable;
+    if (parsed.rateOverrideAmount !== void 0) {
+      entry.rateOverrideAmount = toStoredTimeEntryRateOverride(parsed.rateOverrideAmount);
+    }
+    if (notes !== void 0) entry.notes = notes;
     entry.updatedAt = /* @__PURE__ */ new Date();
     await em.flush();
+    if (parsed.tagIds !== void 0) {
+      await syncEntryTags(ctx, {
+        timeEntryId: entry.id,
+        tenantId: entry.tenantId,
+        organizationId: entry.organizationId,
+        tagIds: parsed.tagIds
+      });
+    }
     await emitCrudSideEffects({
       dataEngine: ctx.container.resolve("dataEngine"),
       action: "updated",
@@ -429,10 +789,19 @@ const updateTimeEntryCommand = {
     const changes = buildChanges(before, after, [
       "date",
       "durationMinutes",
+      "roundedMinutes",
+      // A time correction is exactly the edit somebody will later have to justify
+      // on an invoice, so the clocks are named in the trail beside the minutes.
+      "startedAt",
+      "endedAt",
       "timeProjectId",
+      "taskId",
       "customerId",
       "dealId",
       "orderId",
+      "isBillable",
+      "rateOverrideAmount",
+      "rateCurrencyCode",
       "notes",
       "deletedAt"
     ]);
@@ -463,10 +832,17 @@ const updateTimeEntryCommand = {
     if (!entry) return;
     entry.date = before.date;
     entry.durationMinutes = before.durationMinutes;
+    entry.roundedMinutes = before.roundedMinutes ?? null;
+    entry.startedAt = before.startedAt ? new Date(before.startedAt) : null;
+    entry.endedAt = before.endedAt ? new Date(before.endedAt) : null;
     entry.timeProjectId = before.timeProjectId ?? null;
+    entry.taskId = before.taskId ?? null;
     entry.customerId = before.customerId ?? null;
     entry.dealId = before.dealId ?? null;
     entry.orderId = before.orderId ?? null;
+    entry.isBillable = before.isBillable ?? true;
+    entry.rateOverrideAmount = before.rateOverrideAmount ?? null;
+    entry.rateCurrencyCode = before.rateCurrencyCode ?? null;
     entry.notes = before.notes ?? null;
     entry.deletedAt = before.deletedAt ? new Date(before.deletedAt) : null;
     entry.updatedAt = /* @__PURE__ */ new Date();
@@ -506,7 +882,9 @@ const deleteTimeEntryCommand = {
     if (!entry) throw new CrudHttpError(404, { error: "Time entry not found." });
     ensureTenantScope(ctx, entry.tenantId);
     ensureOrganizationScope(ctx, entry.organizationId);
-    if (!await callerHasManageAll(ctx)) {
+    assertTimeEntryUnlocked(entry, (await resolveTranslations()).translate);
+    const hasManageAll = await callerHasManageAll(ctx);
+    if (!hasManageAll) {
       const callerStaffMemberId = await resolveCallerStaffMemberId(em, ctx);
       if (!callerStaffMemberId || entry.staffMemberId !== callerStaffMemberId) {
         const { translate } = await resolveTranslations();
@@ -515,6 +893,13 @@ const deleteTimeEntryCommand = {
         });
       }
     }
+    const settings = await readEntrySettings(ctx, entry.tenantId);
+    await assertEntryProjectAccess({
+      access: await resolveEntryProjectAccess(em, ctx, entry.tenantId, entry.organizationId, settings),
+      hasManageAll,
+      projectId: entry.timeProjectId ?? null,
+      entryStaffMemberId: entry.staffMemberId
+    });
     entry.deletedAt = /* @__PURE__ */ new Date();
     entry.updatedAt = /* @__PURE__ */ new Date();
     await em.flush();
@@ -560,13 +945,18 @@ const deleteTimeEntryCommand = {
         staffMemberId: before.staffMemberId,
         date: before.date,
         durationMinutes: before.durationMinutes,
+        roundedMinutes: before.roundedMinutes ?? null,
         startedAt: before.startedAt ? new Date(before.startedAt) : null,
         endedAt: before.endedAt ? new Date(before.endedAt) : null,
         notes: before.notes ?? null,
         timeProjectId: before.timeProjectId ?? null,
+        taskId: before.taskId ?? null,
         customerId: before.customerId ?? null,
         dealId: before.dealId ?? null,
         orderId: before.orderId ?? null,
+        isBillable: before.isBillable ?? true,
+        rateOverrideAmount: before.rateOverrideAmount ?? null,
+        rateCurrencyCode: before.rateCurrencyCode ?? null,
         source: before.source ?? "manual",
         deletedAt: null,
         createdAt: /* @__PURE__ */ new Date(),
@@ -577,13 +967,18 @@ const deleteTimeEntryCommand = {
       entry.staffMemberId = before.staffMemberId;
       entry.date = before.date;
       entry.durationMinutes = before.durationMinutes;
+      entry.roundedMinutes = before.roundedMinutes ?? null;
       entry.startedAt = before.startedAt ? new Date(before.startedAt) : null;
       entry.endedAt = before.endedAt ? new Date(before.endedAt) : null;
       entry.notes = before.notes ?? null;
       entry.timeProjectId = before.timeProjectId ?? null;
+      entry.taskId = before.taskId ?? null;
       entry.customerId = before.customerId ?? null;
       entry.dealId = before.dealId ?? null;
       entry.orderId = before.orderId ?? null;
+      entry.isBillable = before.isBillable ?? true;
+      entry.rateOverrideAmount = before.rateOverrideAmount ?? null;
+      entry.rateCurrencyCode = before.rateCurrencyCode ?? null;
       entry.source = before.source ?? "manual";
       entry.deletedAt = null;
       entry.updatedAt = /* @__PURE__ */ new Date();
@@ -599,8 +994,161 @@ const deleteTimeEntryCommand = {
     });
   }
 };
+const staffTimeEntryDuplicateSchema = z.object({
+  id: z.string().uuid(),
+  // The copy usually lands on another day (US-D6 "log the same thing again"), so
+  // the caller may move it; omitted, it keeps the source's day.
+  date: z.coerce.date().optional(),
+  // US-D6 ends "…I adjust the duration and the date", so both adjustments travel
+  // with the copy request rather than costing a second round trip that would
+  // leave the unadjusted duration visible in between. Omitted, the copy keeps the
+  // source's minutes. The rounded twin is always recomputed by the create command
+  // from the tenant rule, so an overridden duration can never carry the source's
+  // stale `rounded_minutes` into a new entry (D-7).
+  durationMinutes: z.number().int().min(0).max(1440).optional(),
+  // Tags are NOT read off the source here: this file writes tags only through the
+  // tag commands and never touches `staff_time_entry_tags`, so the caller — which
+  // already has the source's `tags[]` from the list response — passes them on.
+  tagIds: z.array(z.string().uuid()).max(50).optional()
+});
+const duplicateTimeEntryCommand = {
+  id: "staff.timesheets.time_entries.duplicate",
+  async execute(rawInput, ctx) {
+    const parsed = staffTimeEntryDuplicateSchema.parse(rawInput);
+    const em = ctx.container.resolve("em").fork();
+    const scope = commandActorScope(ctx);
+    const source = await findOneWithDecryption(
+      em,
+      StaffTimeEntry,
+      applyScopeToWhere({ id: parsed.id, deletedAt: null }, scope),
+      void 0,
+      scopeForDecryption(scope)
+    );
+    if (!source) throw new CrudHttpError(404, { error: "Time entry not found." });
+    ensureTenantScope(ctx, source.tenantId);
+    ensureOrganizationScope(ctx, source.organizationId);
+    assertTimeEntryUnlocked(source, (await resolveTranslations()).translate);
+    const bus = ctx.container.resolve("commandBus");
+    const created = await bus.execute(createTimeEntryCommand.id, {
+      input: {
+        tenantId: source.tenantId,
+        organizationId: source.organizationId,
+        staffMemberId: source.staffMemberId,
+        date: parsed.date ?? source.date,
+        durationMinutes: parsed.durationMinutes ?? source.durationMinutes,
+        timeProjectId: source.timeProjectId ?? null,
+        taskId: source.taskId ?? null,
+        customerId: source.customerId ?? null,
+        dealId: source.dealId ?? null,
+        orderId: source.orderId ?? null,
+        isBillable: source.isBillable,
+        rateOverrideAmount: source.rateOverrideAmount === null || source.rateOverrideAmount === void 0 ? null : Number(source.rateOverrideAmount),
+        description: source.notes ?? null,
+        // A copy is typed, not timed: carrying `started_at`/`ended_at` over would
+        // manufacture an overlap with the entry it was copied from (US-D7).
+        source: "manual",
+        ...parsed.tagIds !== void 0 ? { tagIds: parsed.tagIds } : {}
+      },
+      ctx
+    });
+    const timeEntryId = created?.result?.timeEntryId;
+    if (!timeEntryId) throw new CrudHttpError(400, { error: "Failed to duplicate time entry." });
+    return { timeEntryId };
+  }
+};
+const staffTimeEntryReapplyRoundingSchema = z.object({
+  tenantId: z.string().uuid(),
+  organizationId: z.string().uuid(),
+  entryIds: z.array(z.string().uuid()).min(1).max(500)
+});
+const reapplyRoundingCommand = {
+  id: "staff.timesheets.time_entries.reapply_rounding",
+  async execute(input, ctx) {
+    const parsed = staffTimeEntryReapplyRoundingSchema.parse(input ?? {});
+    if (ctx.systemActor !== true && ctx.auth?.isSuperAdmin !== true) {
+      const { translate } = await resolveTranslations();
+      throw new CrudHttpError(403, { error: translate("staff.errors.forbidden", "Forbidden") });
+    }
+    const scope = commandInputScope(ctx, parsed.tenantId, parsed.organizationId);
+    const em = ctx.container.resolve("em").fork();
+    const settings = await readEntrySettings(ctx, parsed.tenantId);
+    const entries = await em.find(
+      StaffTimeEntry,
+      applyScopeToWhere(
+        {
+          id: { $in: parsed.entryIds },
+          deletedAt: null,
+          // Non-negotiable: a frozen entry has already been billed at the value it
+          // carries, so it is excluded at the query, not at an `if`.
+          lockedReportId: null
+        },
+        scope
+      )
+    );
+    const changed = [];
+    let unchangedCount = 0;
+    for (const entry of entries) {
+      const next = roundedMinutesFor(entry.durationMinutes, settings, {
+        tenantId: entry.tenantId,
+        organizationId: entry.organizationId
+      });
+      if (entry.roundedMinutes === next) {
+        unchangedCount += 1;
+        continue;
+      }
+      entry.roundedMinutes = next;
+      entry.updatedAt = /* @__PURE__ */ new Date();
+      changed.push(entry);
+    }
+    if (changed.length > 0) await em.flush();
+    const dataEngine = ctx.container.resolve("dataEngine");
+    for (const entry of changed) {
+      await emitCrudSideEffects({
+        dataEngine,
+        action: "updated",
+        entity: entry,
+        identifiers: { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },
+        events: staffTimeEntryCrudEvents,
+        indexer: timeEntryCrudIndexer
+      });
+    }
+    return {
+      updatedCount: changed.length,
+      unchangedCount,
+      skippedCount: Math.max(0, parsed.entryIds.length - entries.length)
+    };
+  }
+};
 registerCommand(createTimeEntryCommand);
 registerCommand(startTimerCommand);
 registerCommand(updateTimeEntryCommand);
 registerCommand(deleteTimeEntryCommand);
+registerCommand(duplicateTimeEntryCommand);
+registerCommand(reapplyRoundingCommand);
+const staffTimeEntryCommandIds = {
+  create: createTimeEntryCommand.id,
+  startTimer: startTimerCommand.id,
+  update: updateTimeEntryCommand.id,
+  delete: deleteTimeEntryCommand.id,
+  duplicate: duplicateTimeEntryCommand.id,
+  reapplyRounding: reapplyRoundingCommand.id
+};
+export {
+  TIME_ENTRY_LOCKED_CODE,
+  assertTimeEntryUnlocked,
+  buildTimeEntryLockedError,
+  rebaseTimeEntryIntervalToDate,
+  reconcileTimeEntryInterval,
+  resolveRoundedMinutes,
+  resolveTimeEntryBillable,
+  resolveTimeEntryNotesInput,
+  resolveTimeEntryProjectId,
+  resolveTimeEntrySettings,
+  roundedMinutesFor,
+  staffTimeEntryCommandIds,
+  staffTimeEntryDuplicateSchema,
+  staffTimeEntryReapplyRoundingSchema,
+  timeEntryTaskMatchesProject,
+  toStoredTimeEntryRateOverride
+};
 //# sourceMappingURL=timesheets-entries.js.map