@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/staff/api/timesheets/my-projects/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findWithDecryption, findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -24,7 +25,7 @@ async function GET(req) {
     if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, { error: translate("staff.errors.missingScope", "Missing tenant or organization scope.") });
     }

package/dist/modules/staff/api/timesheets/my-projects/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/my-projects/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n}\n\n/**\n * GET /api/staff/timesheets/my-projects\n *\n * Spec N+1 Mitigation \u2014 Query 1:\n * Returns staff_time_project_members for the authenticated staff member.\n * Used by \"My Timesheets\" grid to resolve assigned project IDs.\n */\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.') })\n    }\n\n    const assignments = await findWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      { staffMemberId: staffMember.id, tenantId, organizationId, deletedAt: null, status: 'active' },\n      {},\n      scopeCtx,\n    )\n\n    const items = assignments.map((assignment) => ({\n      id: assignment.id,\n      time_project_id: assignment.timeProjectId,\n      staff_member_id: assignment.staffMemberId,\n      role: assignment.role ?? null,\n      status: assignment.status ?? null,\n      assigned_start_date: assignment.assignedStartDate ?? null,\n      assigned_end_date: assignment.assignedEndDate ?? null,\n      show_in_grid: assignment.showInGrid ?? false,\n    }))\n\n    return session.respond(200, { items, total: items.length })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.myProjects', 'Failed to load your projects.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My assigned time projects',\n  methods: {\n    GET: {\n      summary: 'List assigned time project memberships for the current user',\n      description: 'Returns staff_time_project_members where the authenticated user is an active member. Used by the My Timesheets grid to resolve assigned project IDs (spec N+1 mitigation query 1).',\n      responses: [\n        {\n          status: 200,\n          description: 'Assigned project memberships',\n          schema: z.object({\n            items: z.array(z.object({\n              id: z.string().uuid(),\n              time_project_id: z.string().uuid(),\n              staff_member_id: z.string().uuid(),\n              role: z.string().nullable(),\n              status: z.string().nullable(),\n              assigned_start_date: z.string().nullable(),\n              assigned_end_date: z.string().nullable(),\n              show_in_grid: z.boolean(),\n            })),\n            total: z.number(),\n          }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB,6BAA6B;AAG1D,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AASA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,yCAAyC,EAAE,CAAC;AAAA,IACvI;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,WAAW,MAAM,QAAQ,SAAS;AAAA,MAC7F,CAAC;AAAA,MACD;AAAA,IACF;AAEA,UAAM,QAAQ,YAAY,IAAI,CAAC,gBAAgB;AAAA,MAC7C,IAAI,WAAW;AAAA,MACf,iBAAiB,WAAW;AAAA,MAC5B,iBAAiB,WAAW;AAAA,MAC5B,MAAM,WAAW,QAAQ;AAAA,MACzB,QAAQ,WAAW,UAAU;AAAA,MAC7B,qBAAqB,WAAW,qBAAqB;AAAA,MACrD,mBAAmB,WAAW,mBAAmB;AAAA,MACjD,cAAc,WAAW,cAAc;AAAA,IACzC,EAAE;AAEF,WAAO,QAAQ,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,OAAO,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;AAC3D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE;AAAA,MAC1F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,cACtB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,cACpB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,cAC1B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,cAC5B,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,cACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,cACvC,cAAc,EAAE,QAAQ;AAAA,YAC1B,CAAC,CAAC;AAAA,YACF,OAAO,EAAE,OAAO;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeProjectMember, StaffTeamMember } from '../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.view'] },\n}\n\n/**\n * GET /api/staff/timesheets/my-projects\n *\n * Spec N+1 Mitigation \u2014 Query 1:\n * Returns staff_time_project_members for the authenticated staff member.\n * Used by \"My Timesheets\" grid to resolve assigned project IDs.\n */\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const staffMember = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!staffMember) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.noStaffMember', 'No staff member linked to your account.') })\n    }\n\n    const assignments = await findWithDecryption(\n      em,\n      StaffTimeProjectMember,\n      { staffMemberId: staffMember.id, tenantId, organizationId, deletedAt: null, status: 'active' },\n      {},\n      scopeCtx,\n    )\n\n    const items = assignments.map((assignment) => ({\n      id: assignment.id,\n      time_project_id: assignment.timeProjectId,\n      staff_member_id: assignment.staffMemberId,\n      role: assignment.role ?? null,\n      status: assignment.status ?? null,\n      assigned_start_date: assignment.assignedStartDate ?? null,\n      assigned_end_date: assignment.assignedEndDate ?? null,\n      show_in_grid: assignment.showInGrid ?? false,\n    }))\n\n    return session.respond(200, { items, total: items.length })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-projects failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.myProjects', 'Failed to load your projects.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My assigned time projects',\n  methods: {\n    GET: {\n      summary: 'List assigned time project memberships for the current user',\n      description: 'Returns staff_time_project_members where the authenticated user is an active member. Used by the My Timesheets grid to resolve assigned project IDs (spec N+1 mitigation query 1).',\n      responses: [\n        {\n          status: 200,\n          description: 'Assigned project memberships',\n          schema: z.object({\n            items: z.array(z.object({\n              id: z.string().uuid(),\n              time_project_id: z.string().uuid(),\n              staff_member_id: z.string().uuid(),\n              role: z.string().nullable(),\n              status: z.string().nullable(),\n              assigned_start_date: z.string().nullable(),\n              assigned_end_date: z.string().nullable(),\n              show_in_grid: z.boolean(),\n            })),\n            total: z.number(),\n          }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No staff member linked', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB,6BAA6B;AAG1D,SAAS,wBAAwB,uBAAuB;AACxD,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AASA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,yCAAyC,EAAE,CAAC;AAAA,IACvI;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,WAAW,MAAM,QAAQ,SAAS;AAAA,MAC7F,CAAC;AAAA,MACD;AAAA,IACF;AAEA,UAAM,QAAQ,YAAY,IAAI,CAAC,gBAAgB;AAAA,MAC7C,IAAI,WAAW;AAAA,MACf,iBAAiB,WAAW;AAAA,MAC5B,iBAAiB,WAAW;AAAA,MAC5B,MAAM,WAAW,QAAQ;AAAA,MACzB,QAAQ,WAAW,UAAU;AAAA,MAC7B,qBAAqB,WAAW,qBAAqB;AAAA,MACrD,mBAAmB,WAAW,mBAAmB;AAAA,MACjD,cAAc,WAAW,cAAc;AAAA,IACzC,EAAE;AAEF,WAAO,QAAQ,QAAQ,KAAK,EAAE,OAAO,OAAO,MAAM,OAAO,CAAC;AAAA,EAC5D,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;AAC3D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE;AAAA,MAC1F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,cACtB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,cACpB,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,cACjC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,cAC1B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,cAC5B,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,cACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,cACvC,cAAc,EAAE,QAAQ;AAAA,YAC1B,CAAC,CAAC;AAAA,YACF,OAAO,EAAE,OAAO;AAAA,UAClB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/my-work/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -104,7 +105,7 @@ async function GET(req) {
     if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")

package/dist/modules/staff/api/timesheets/my-work/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/my-work/route.ts"],
-  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/my-work` \u2014 the aggregate behind screen 1 (T5.6).\n *\n * The dashboard a Team Member lands on asks four questions at once (today, this\n * week, this month, how much of it is non-billable), then wants today's entries,\n * the projects they are on with their budget burn, and the tasks they last\n * touched. Answering that with the existing list routes would be six round trips\n * and three client-side aggregations of paginated data; this route answers it in\n * one, with the sums done by the database.\n *\n * Scoping and access:\n *\n *  * Everything is scoped to the CALLER's staff member. There is no\n *    `staffMemberId` parameter \u2014 this endpoint is \"mine\" by construction, so it\n *    can never become a way to read a colleague's day.\n *  * Projects come from the caller's own active memberships, which is the same\n *    set `resolveProjectAccess` would return for a non-manager. A manager sees\n *    their own memberships here too: My work is a personal surface, and the\n *    portfolio view is screen 3.\n *  * **Money is gated on `staff.timesheets.rates.view` and absent, not blanked**,\n *    for anyone else: no `hourlyRate`, no `currencyCode`, and no `amount` budget\n *    burn (which is a money statement). An `hours` budget is not money and stays.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport {\n  StaffTeamMember,\n  StaffTimeEntry,\n  StaffTimeProject,\n  StaffTimeProjectMember,\n  StaffTimeTask,\n} from '../../../data/entities'\nimport { computeProjectFinancials } from '../../../lib/timesheets-projects/computeProjectFinancials'\nimport { computeBudgetBurn } from '../../../lib/timesheets-projects/budgetBurn'\nimport {\n  addUtcDays,\n  getFirstDayOfMonthUtc,\n  getFirstDayOfNextMonthUtc,\n  getMondayUtc,\n  toDateOnlyString,\n} from '../../../lib/timesheets-projects/dateBuckets'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { buildMyWorkKpis, pickRecentTaskIds, toMinutes } from './myWorkAggregate'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/my-work' })\n\nconst VIEW_FEATURE = 'staff.timesheets.view'\nconst RATES_FEATURE = 'staff.timesheets.rates.view'\nconst RECENT_TASK_LIMIT = 5\nconst MAX_PROJECTS = 50\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\ntype RbacServiceLike = {\n  userHasAllFeatures?: (\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\nconst entrySchema = z.object({\n  id: z.string().uuid(),\n  date: z.string(),\n  taskId: z.string().uuid().nullable(),\n  taskTitle: z.string().nullable(),\n  timeProjectId: z.string().uuid().nullable(),\n  projectName: z.string().nullable(),\n  description: z.string().nullable(),\n  startedAt: z.string().nullable(),\n  endedAt: z.string().nullable(),\n  durationMinutes: z.number().int(),\n  isBillable: z.boolean(),\n  isLocked: z.boolean(),\n})\n\nconst projectSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  code: z.string().nullable(),\n  color: z.string().nullable(),\n  customerName: z.string().nullable(),\n  myMinutes: z.number().int(),\n  totalMinutes: z.number().int(),\n  hourlyRate: z.number().nullable().optional(),\n  currencyCode: z.string().nullable().optional(),\n  budget: z\n    .object({\n      kind: z.enum(['hours', 'amount']),\n      budgetValue: z.number(),\n      usedValue: z.number(),\n      percent: z.number(),\n      barPercent: z.number(),\n      tone: z.string(),\n    })\n    .nullable(),\n})\n\nconst responseSchema = z.object({\n  staffMember: z.object({ id: z.string().uuid(), displayName: z.string() }).nullable(),\n  today: z.string(),\n  kpis: z.object({\n    todayMinutes: z.number().int(),\n    weekMinutes: z.number().int(),\n    monthMinutes: z.number().int(),\n    monthNonBillableMinutes: z.number().int(),\n    dailyTargetMinutes: z.number().int().nullable(),\n    weekTargetMinutes: z.number().int().nullable(),\n    monthTargetMinutes: z.number().int().nullable(),\n    weekWorkingDays: z.number().int(),\n    monthWorkingDays: z.number().int(),\n    nonBillableSharePercent: z.number().nullable(),\n  }),\n  entries: z.array(entrySchema),\n  projects: z.array(projectSchema),\n  recentTasks: z.array(\n    z.object({\n      id: z.string().uuid(),\n      title: z.string(),\n      timeProjectId: z.string().uuid(),\n      projectName: z.string().nullable(),\n    }),\n  ),\n})\n\ntype TotalsRow = {\n  today_minutes: string | number | null\n  week_minutes: string | number | null\n  month_minutes: string | number | null\n  month_nonbillable_minutes: string | number | null\n}\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const now = new Date()\n    const todayDate = toDateOnlyString(now)\n    const weekStart = getMondayUtc(now)\n    const weekEnd = addUtcDays(weekStart, 6)\n    const monthStart = getFirstDayOfMonthUtc(now)\n    const nextMonthStart = getFirstDayOfNextMonthUtc(now)\n    const monthEnd = addUtcDays(nextMonthStart, -1)\n\n    let dailyHours: number | null = null\n    try {\n      const configService = container.resolve('moduleConfigService') as ModuleConfigService\n      dailyHours = (await readTimeTrackingSettings(configService, { tenantId })).targets.dailyHours\n    } catch {\n      // A settings read failure must not empty the dashboard; the targets simply\n      // go missing, which the UI already renders as \"no target\".\n      dailyHours = null\n    }\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    const emptyKpis = buildMyWorkKpis(\n      { todayMinutes: 0, weekMinutes: 0, monthMinutes: 0, monthNonBillableMinutes: 0 },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    if (!staffMember) {\n      // No staff profile yet: the shape is the same, so screen 1 renders its\n      // \"set up your profile\" branch instead of failing.\n      return session.respond(200, {\n        staffMember: null,\n        today: todayDate,\n        kpis: emptyKpis,\n        entries: [],\n        projects: [],\n        recentTasks: [],\n      })\n    }\n\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const canSeeMoney =\n      (await rbac?.userHasAllFeatures?.(auth.sub, [RATES_FEATURE], { tenantId, organizationId })) ?? false\n\n    const totalsRows = (await em.getConnection().execute(\n      `\n        SELECT\n          COALESCE(SUM(CASE WHEN date = ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS today_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS week_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS month_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date AND is_billable = false THEN duration_minutes ELSE 0 END), 0)::bigint AS month_nonbillable_minutes\n        FROM staff_time_entries\n        WHERE tenant_id = ?\n          AND organization_id = ?\n          AND staff_member_id = ?\n          AND deleted_at IS NULL\n      `,\n      [\n        todayDate,\n        toDateOnlyString(weekStart),\n        toDateOnlyString(weekEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        tenantId,\n        organizationId,\n        staffMember.id,\n      ],\n    )) as TotalsRow[]\n\n    const totals = totalsRows[0]\n    const kpis = buildMyWorkKpis(\n      {\n        todayMinutes: toMinutes(totals?.today_minutes),\n        weekMinutes: toMinutes(totals?.week_minutes),\n        monthMinutes: toMinutes(totals?.month_minutes),\n        monthNonBillableMinutes: toMinutes(totals?.month_nonbillable_minutes),\n      },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    const memberships = await em.fork().find(StaffTimeProjectMember, {\n      staffMemberId: staffMember.id,\n      tenantId,\n      organizationId,\n      status: 'active',\n      deletedAt: null,\n    })\n    const projectIds = Array.from(new Set(memberships.map((membership) => membership.timeProjectId))).slice(\n      0,\n      MAX_PROJECTS,\n    )\n\n    const projects =\n      projectIds.length > 0\n        ? await findWithDecryption(\n            em.fork(),\n            StaffTimeProject,\n            { id: { $in: projectIds }, tenantId, organizationId, deletedAt: null },\n            {},\n            { tenantId, organizationId },\n          )\n        : []\n\n    const hourlyRateByProjectId = new Map<string, number | null>(\n      projects.map((project) => [\n        project.id,\n        project.hourlyRate === null || project.hourlyRate === undefined ? null : Number(project.hourlyRate),\n      ]),\n    )\n    const [mine, everyone] = await Promise.all([\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n        staffMemberId: staffMember.id,\n      }),\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n      }),\n    ])\n\n    const todaysEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      { staffMemberId: staffMember.id, tenantId, organizationId, date: new Date(`${todayDate}T00:00:00.000Z`), deletedAt: null },\n      { orderBy: { startedAt: 'asc', createdAt: 'asc' } },\n      { tenantId, organizationId },\n    )\n\n    const recentEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      {\n        staffMemberId: staffMember.id,\n        tenantId,\n        organizationId,\n        deletedAt: null,\n        taskId: { $ne: null },\n      },\n      { orderBy: { date: 'desc' }, limit: 50 },\n      { tenantId, organizationId },\n    )\n    const recentTaskIds = pickRecentTaskIds(\n      recentEntries.map((entry) => ({\n        id: entry.id,\n        taskId: entry.taskId ?? null,\n        date: toDateOnlyString(new Date(entry.date)),\n      })),\n      RECENT_TASK_LIMIT,\n    )\n    const referencedTaskIds = Array.from(\n      new Set([\n        ...recentTaskIds,\n        ...todaysEntries.map((entry) => entry.taskId).filter((id): id is string => typeof id === 'string'),\n      ]),\n    )\n    const tasks =\n      referencedTaskIds.length > 0\n        ? await em.fork().find(StaffTimeTask, {\n            id: { $in: referencedTaskIds },\n            tenantId,\n            organizationId,\n            deletedAt: null,\n          })\n        : []\n    const taskById = new Map(tasks.map((task) => [task.id, task]))\n    const projectNameById = new Map(projects.map((project) => [project.id, project.name]))\n\n    const payload = {\n      staffMember: { id: staffMember.id, displayName: staffMember.displayName },\n      today: todayDate,\n      kpis,\n      entries: todaysEntries.map((entry) => ({\n        id: entry.id,\n        date: toDateOnlyString(new Date(entry.date)),\n        taskId: entry.taskId ?? null,\n        taskTitle: entry.taskId ? taskById.get(entry.taskId)?.title ?? null : null,\n        timeProjectId: entry.timeProjectId ?? null,\n        projectName: entry.timeProjectId ? projectNameById.get(entry.timeProjectId) ?? null : null,\n        description: entry.notes ?? null,\n        startedAt: entry.startedAt ? entry.startedAt.toISOString() : null,\n        endedAt: entry.endedAt ? entry.endedAt.toISOString() : null,\n        durationMinutes: entry.durationMinutes,\n        isBillable: entry.isBillable !== false,\n        isLocked: Boolean(entry.lockedReportId),\n      })),\n      projects: projects.map((project) => {\n        const myFinancials = mine.get(project.id)\n        const allFinancials = everyone.get(project.id)\n        const snapshot = project.customerSnapshot ?? null\n        const customerName =\n          snapshot && typeof snapshot === 'object' && typeof (snapshot as { name?: unknown }).name === 'string'\n            ? ((snapshot as { name?: string }).name as string)\n            : null\n        // An `amount` budget is a money statement, so it only exists for a caller\n        // who may see money; an `hours` budget is not, and stays for everybody.\n        const burn =\n          project.budgetKind === 'amount' && !canSeeMoney\n            ? null\n            : computeBudgetBurn({\n                kind: project.budgetKind,\n                budgetValue:\n                  project.budgetValue === null || project.budgetValue === undefined\n                    ? null\n                    : Number(project.budgetValue),\n                warnAtPercent: project.budgetWarnAtPercent,\n                totalMinutes: allFinancials?.totalMinutes ?? 0,\n                cost: allFinancials?.cost ?? null,\n              })\n        return {\n          id: project.id,\n          name: project.name,\n          code: project.code ?? null,\n          color: project.color ?? null,\n          customerName,\n          myMinutes: myFinancials?.totalMinutes ?? 0,\n          totalMinutes: allFinancials?.totalMinutes ?? 0,\n          ...(canSeeMoney\n            ? {\n                hourlyRate: hourlyRateByProjectId.get(project.id) ?? null,\n                currencyCode: project.currencyCode ?? null,\n              }\n            : {}),\n          budget: burn\n            ? {\n                kind: burn.kind,\n                budgetValue: burn.budgetValue,\n                usedValue: burn.usedValue,\n                percent: burn.percent,\n                barPercent: burn.barPercent,\n                tone: burn.tone,\n              }\n            : null,\n        }\n      }),\n      recentTasks: recentTaskIds\n        .map((taskId) => {\n          const task = taskById.get(taskId)\n          if (!task) return null\n          return {\n            id: task.id,\n            title: task.title,\n            timeProjectId: task.timeProjectId,\n            projectName: projectNameById.get(task.timeProjectId) ?? null,\n          }\n        })\n        .filter((task): task is NonNullable<typeof task> => task !== null),\n    }\n\n    return session.respond(200, payload)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-work failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.time_tracking.myWork.errors.load', 'Failed to load your work summary.') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My work dashboard aggregate',\n  methods: {\n    GET: {\n      summary: 'Today, this week and this month for the calling staff member',\n      description:\n        'One aggregate for the time tracking landing page: day/week/month/non-billable totals with working-day targets, today\u2019s entries, the caller\u2019s projects with budget burn, and the tasks they last logged against. Always scoped to the caller \u2014 there is no way to ask about another person. Rate and amount-budget fields are present only for holders of `staff.timesheets.rates.view`.',\n      responses: [\n        { status: 200, description: 'My work summary', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAI7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,iBAAiB,mBAAmB,iBAAiB;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAElF,MAAM,eAAe;AACrB,MAAM,gBAAgB;AACtB,MAAM,oBAAoB;AAC1B,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAUA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,EAChC,YAAY,EAAE,QAAQ;AAAA,EACtB,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,QAAQ,EACL,OAAO;AAAA,IACN,MAAM,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,IAChC,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO;AAAA,IAClB,YAAY,EAAE,OAAO;AAAA,IACrB,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA,EACnF,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,IACb,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,IAC5B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAAA,IACxC,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC7C,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,IACjC,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,SAAS,EAAE,MAAM,WAAW;AAAA,EAC5B,UAAU,EAAE,MAAM,aAAa;AAAA,EAC/B,aAAa,EAAE;AAAA,IACb,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,OAAO,EAAE,OAAO;AAAA,MAChB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,MAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,CAAC;AAAA,EACH;AACF,CAAC;AASD,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YAAY,iBAAiB,GAAG;AACtC,UAAM,YAAY,aAAa,GAAG;AAClC,UAAM,UAAU,WAAW,WAAW,CAAC;AACvC,UAAM,aAAa,sBAAsB,GAAG;AAC5C,UAAM,iBAAiB,0BAA0B,GAAG;AACpD,UAAM,WAAW,WAAW,gBAAgB,EAAE;AAE9C,QAAI,aAA4B;AAChC,QAAI;AACF,YAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,oBAAc,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC,GAAG,QAAQ;AAAA,IACrF,QAAQ;AAGN,mBAAa;AAAA,IACf;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,YAAY;AAAA,MAChB,EAAE,cAAc,GAAG,aAAa,GAAG,cAAc,GAAG,yBAAyB,EAAE;AAAA,MAC/E;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,aAAa;AAGhB,aAAO,QAAQ,QAAQ,KAAK;AAAA,QAC1B,aAAa;AAAA,QACb,OAAO;AAAA,QACP,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,QACV,UAAU,CAAC;AAAA,QACX,aAAa,CAAC;AAAA,MAChB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,cACH,MAAM,MAAM,qBAAqB,KAAK,KAAK,CAAC,aAAa,GAAG,EAAE,UAAU,eAAe,CAAC,KAAM;AAEjG,UAAM,aAAc,MAAM,GAAG,cAAc,EAAE;AAAA,MAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYA;AAAA,QACE;AAAA,QACA,iBAAiB,SAAS;AAAA,QAC1B,iBAAiB,OAAO;AAAA,QACxB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,SAAS,WAAW,CAAC;AAC3B,UAAM,OAAO;AAAA,MACX;AAAA,QACE,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,aAAa,UAAU,QAAQ,YAAY;AAAA,QAC3C,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,yBAAyB,UAAU,QAAQ,yBAAyB;AAAA,MACtE;AAAA,MACA;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,GAAG,KAAK,EAAE,KAAK,wBAAwB;AAAA,MAC/D,eAAe,YAAY;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,WAAW;AAAA,IACb,CAAC;AACD,UAAM,aAAa,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,aAAa,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WACJ,WAAW,SAAS,IAChB,MAAM;AAAA,MACJ,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACrE,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B,IACA,CAAC;AAEP,UAAM,wBAAwB,IAAI;AAAA,MAChC,SAAS,IAAI,CAAC,YAAY;AAAA,QACxB,QAAQ;AAAA,QACR,QAAQ,eAAe,QAAQ,QAAQ,eAAe,SAAY,OAAO,OAAO,QAAQ,UAAU;AAAA,MACpG,CAAC;AAAA,IACH;AACA,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MACzC,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,QACA,eAAe,YAAY;AAAA,MAC7B,CAAC;AAAA,MACD,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,MAAM,oBAAI,KAAK,GAAG,SAAS,gBAAgB,GAAG,WAAW,KAAK;AAAA,MACzH,EAAE,SAAS,EAAE,WAAW,OAAO,WAAW,MAAM,EAAE;AAAA,MAClD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA;AAAA,QACE,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,QAAQ,EAAE,KAAK,KAAK;AAAA,MACtB;AAAA,MACA,EAAE,SAAS,EAAE,MAAM,OAAO,GAAG,OAAO,GAAG;AAAA,MACvC,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,gBAAgB;AAAA,MACpB,cAAc,IAAI,CAAC,WAAW;AAAA,QAC5B,IAAI,MAAM;AAAA,QACV,QAAQ,MAAM,UAAU;AAAA,QACxB,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,MAC7C,EAAE;AAAA,MACF;AAAA,IACF;AACA,UAAM,oBAAoB,MAAM;AAAA,MAC9B,oBAAI,IAAI;AAAA,QACN,GAAG;AAAA,QACH,GAAG,cAAc,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,MACnG,CAAC;AAAA,IACH;AACA,UAAM,QACJ,kBAAkB,SAAS,IACvB,MAAM,GAAG,KAAK,EAAE,KAAK,eAAe;AAAA,MAClC,IAAI,EAAE,KAAK,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC,IACD,CAAC;AACP,UAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC7D,UAAM,kBAAkB,IAAI,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,UAAM,UAAU;AAAA,MACd,aAAa,EAAE,IAAI,YAAY,IAAI,aAAa,YAAY,YAAY;AAAA,MACxE,OAAO;AAAA,MACP;AAAA,MACA,SAAS,cAAc,IAAI,CAAC,WAAW;AAAA,QACrC,IAAI,MAAM;AAAA,QACV,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,QAC3C,QAAQ,MAAM,UAAU;AAAA,QACxB,WAAW,MAAM,SAAS,SAAS,IAAI,MAAM,MAAM,GAAG,SAAS,OAAO;AAAA,QACtE,eAAe,MAAM,iBAAiB;AAAA,QACtC,aAAa,MAAM,gBAAgB,gBAAgB,IAAI,MAAM,aAAa,KAAK,OAAO;AAAA,QACtF,aAAa,MAAM,SAAS;AAAA,QAC5B,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,QAC7D,SAAS,MAAM,UAAU,MAAM,QAAQ,YAAY,IAAI;AAAA,QACvD,iBAAiB,MAAM;AAAA,QACvB,YAAY,MAAM,eAAe;AAAA,QACjC,UAAU,QAAQ,MAAM,cAAc;AAAA,MACxC,EAAE;AAAA,MACF,UAAU,SAAS,IAAI,CAAC,YAAY;AAClC,cAAM,eAAe,KAAK,IAAI,QAAQ,EAAE;AACxC,cAAM,gBAAgB,SAAS,IAAI,QAAQ,EAAE;AAC7C,cAAM,WAAW,QAAQ,oBAAoB;AAC7C,cAAM,eACJ,YAAY,OAAO,aAAa,YAAY,OAAQ,SAAgC,SAAS,WACvF,SAA+B,OACjC;AAGN,cAAM,OACJ,QAAQ,eAAe,YAAY,CAAC,cAChC,OACA,kBAAkB;AAAA,UAChB,MAAM,QAAQ;AAAA,UACd,aACE,QAAQ,gBAAgB,QAAQ,QAAQ,gBAAgB,SACpD,OACA,OAAO,QAAQ,WAAW;AAAA,UAChC,eAAe,QAAQ;AAAA,UACvB,cAAc,eAAe,gBAAgB;AAAA,UAC7C,MAAM,eAAe,QAAQ;AAAA,QAC/B,CAAC;AACP,eAAO;AAAA,UACL,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,MAAM,QAAQ,QAAQ;AAAA,UACtB,OAAO,QAAQ,SAAS;AAAA,UACxB;AAAA,UACA,WAAW,cAAc,gBAAgB;AAAA,UACzC,cAAc,eAAe,gBAAgB;AAAA,UAC7C,GAAI,cACA;AAAA,YACE,YAAY,sBAAsB,IAAI,QAAQ,EAAE,KAAK;AAAA,YACrD,cAAc,QAAQ,gBAAgB;AAAA,UACxC,IACA,CAAC;AAAA,UACL,QAAQ,OACJ;AAAA,YACE,MAAM,KAAK;AAAA,YACX,aAAa,KAAK;AAAA,YAClB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,YAAY,KAAK;AAAA,YACjB,MAAM,KAAK;AAAA,UACb,IACA;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,aAAa,cACV,IAAI,CAAC,WAAW;AACf,cAAM,OAAO,SAAS,IAAI,MAAM;AAChC,YAAI,CAAC,KAAM,QAAO;AAClB,eAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,KAAK;AAAA,UACZ,eAAe,KAAK;AAAA,UACpB,aAAa,gBAAgB,IAAI,KAAK,aAAa,KAAK;AAAA,QAC1D;AAAA,MACF,CAAC,EACA,OAAO,CAAC,SAA2C,SAAS,IAAI;AAAA,IACrE;AAEA,WAAO,QAAQ,QAAQ,KAAK,OAAO;AAAA,EACrC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,mCAAmC,EAAE,IAAI,CAAC;AACvD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,0CAA0C,mCAAmC,EAAE;AAAA,MAClG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,eAAe;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/my-work` \u2014 the aggregate behind screen 1 (T5.6).\n *\n * The dashboard a Team Member lands on asks four questions at once (today, this\n * week, this month, how much of it is non-billable), then wants today's entries,\n * the projects they are on with their budget burn, and the tasks they last\n * touched. Answering that with the existing list routes would be six round trips\n * and three client-side aggregations of paginated data; this route answers it in\n * one, with the sums done by the database.\n *\n * Scoping and access:\n *\n *  * Everything is scoped to the CALLER's staff member. There is no\n *    `staffMemberId` parameter \u2014 this endpoint is \"mine\" by construction, so it\n *    can never become a way to read a colleague's day.\n *  * Projects come from the caller's own active memberships, which is the same\n *    set `resolveProjectAccess` would return for a non-manager. A manager sees\n *    their own memberships here too: My work is a personal surface, and the\n *    portfolio view is screen 3.\n *  * **Money is gated on `staff.timesheets.rates.view` and absent, not blanked**,\n *    for anyone else: no `hourlyRate`, no `currencyCode`, and no `amount` budget\n *    burn (which is a money statement). An `hours` budget is not money and stays.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport {\n  StaffTeamMember,\n  StaffTimeEntry,\n  StaffTimeProject,\n  StaffTimeProjectMember,\n  StaffTimeTask,\n} from '../../../data/entities'\nimport { computeProjectFinancials } from '../../../lib/timesheets-projects/computeProjectFinancials'\nimport { computeBudgetBurn } from '../../../lib/timesheets-projects/budgetBurn'\nimport {\n  addUtcDays,\n  getFirstDayOfMonthUtc,\n  getFirstDayOfNextMonthUtc,\n  getMondayUtc,\n  toDateOnlyString,\n} from '../../../lib/timesheets-projects/dateBuckets'\nimport { readTimeTrackingSettings } from '../../../lib/time-tracking/settings'\nimport { buildMyWorkKpis, pickRecentTaskIds, toMinutes } from './myWorkAggregate'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/my-work' })\n\nconst VIEW_FEATURE = 'staff.timesheets.view'\nconst RATES_FEATURE = 'staff.timesheets.rates.view'\nconst RECENT_TASK_LIMIT = 5\nconst MAX_PROJECTS = 50\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\ntype RbacServiceLike = {\n  userHasAllFeatures?: (\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\nconst entrySchema = z.object({\n  id: z.string().uuid(),\n  date: z.string(),\n  taskId: z.string().uuid().nullable(),\n  taskTitle: z.string().nullable(),\n  timeProjectId: z.string().uuid().nullable(),\n  projectName: z.string().nullable(),\n  description: z.string().nullable(),\n  startedAt: z.string().nullable(),\n  endedAt: z.string().nullable(),\n  durationMinutes: z.number().int(),\n  isBillable: z.boolean(),\n  isLocked: z.boolean(),\n})\n\nconst projectSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  code: z.string().nullable(),\n  color: z.string().nullable(),\n  customerName: z.string().nullable(),\n  myMinutes: z.number().int(),\n  totalMinutes: z.number().int(),\n  hourlyRate: z.number().nullable().optional(),\n  currencyCode: z.string().nullable().optional(),\n  budget: z\n    .object({\n      kind: z.enum(['hours', 'amount']),\n      budgetValue: z.number(),\n      usedValue: z.number(),\n      percent: z.number(),\n      barPercent: z.number(),\n      tone: z.string(),\n    })\n    .nullable(),\n})\n\nconst responseSchema = z.object({\n  staffMember: z.object({ id: z.string().uuid(), displayName: z.string() }).nullable(),\n  today: z.string(),\n  kpis: z.object({\n    todayMinutes: z.number().int(),\n    weekMinutes: z.number().int(),\n    monthMinutes: z.number().int(),\n    monthNonBillableMinutes: z.number().int(),\n    dailyTargetMinutes: z.number().int().nullable(),\n    weekTargetMinutes: z.number().int().nullable(),\n    monthTargetMinutes: z.number().int().nullable(),\n    weekWorkingDays: z.number().int(),\n    monthWorkingDays: z.number().int(),\n    nonBillableSharePercent: z.number().nullable(),\n  }),\n  entries: z.array(entrySchema),\n  projects: z.array(projectSchema),\n  recentTasks: z.array(\n    z.object({\n      id: z.string().uuid(),\n      title: z.string(),\n      timeProjectId: z.string().uuid(),\n      projectName: z.string().nullable(),\n    }),\n  ),\n})\n\ntype TotalsRow = {\n  today_minutes: string | number | null\n  week_minutes: string | number | null\n  month_minutes: string | number | null\n  month_nonbillable_minutes: string | number | null\n}\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const now = new Date()\n    const todayDate = toDateOnlyString(now)\n    const weekStart = getMondayUtc(now)\n    const weekEnd = addUtcDays(weekStart, 6)\n    const monthStart = getFirstDayOfMonthUtc(now)\n    const nextMonthStart = getFirstDayOfNextMonthUtc(now)\n    const monthEnd = addUtcDays(nextMonthStart, -1)\n\n    let dailyHours: number | null = null\n    try {\n      const configService = container.resolve('moduleConfigService') as ModuleConfigService\n      dailyHours = (await readTimeTrackingSettings(configService, { tenantId })).targets.dailyHours\n    } catch {\n      // A settings read failure must not empty the dashboard; the targets simply\n      // go missing, which the UI already renders as \"no target\".\n      dailyHours = null\n    }\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    const emptyKpis = buildMyWorkKpis(\n      { todayMinutes: 0, weekMinutes: 0, monthMinutes: 0, monthNonBillableMinutes: 0 },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    if (!staffMember) {\n      // No staff profile yet: the shape is the same, so screen 1 renders its\n      // \"set up your profile\" branch instead of failing.\n      return session.respond(200, {\n        staffMember: null,\n        today: todayDate,\n        kpis: emptyKpis,\n        entries: [],\n        projects: [],\n        recentTasks: [],\n      })\n    }\n\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const canSeeMoney =\n      (await rbac?.userHasAllFeatures?.(auth.sub, [RATES_FEATURE], { tenantId, organizationId })) ?? false\n\n    const totalsRows = (await em.getConnection().execute(\n      `\n        SELECT\n          COALESCE(SUM(CASE WHEN date = ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS today_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS week_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date THEN duration_minutes ELSE 0 END), 0)::bigint AS month_minutes,\n          COALESCE(SUM(CASE WHEN date >= ?::date AND date <= ?::date AND is_billable = false THEN duration_minutes ELSE 0 END), 0)::bigint AS month_nonbillable_minutes\n        FROM staff_time_entries\n        WHERE tenant_id = ?\n          AND organization_id = ?\n          AND staff_member_id = ?\n          AND deleted_at IS NULL\n      `,\n      [\n        todayDate,\n        toDateOnlyString(weekStart),\n        toDateOnlyString(weekEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        toDateOnlyString(monthStart),\n        toDateOnlyString(monthEnd),\n        tenantId,\n        organizationId,\n        staffMember.id,\n      ],\n    )) as TotalsRow[]\n\n    const totals = totalsRows[0]\n    const kpis = buildMyWorkKpis(\n      {\n        todayMinutes: toMinutes(totals?.today_minutes),\n        weekMinutes: toMinutes(totals?.week_minutes),\n        monthMinutes: toMinutes(totals?.month_minutes),\n        monthNonBillableMinutes: toMinutes(totals?.month_nonbillable_minutes),\n      },\n      {\n        week: { from: toDateOnlyString(weekStart), to: toDateOnlyString(weekEnd) },\n        month: { from: toDateOnlyString(monthStart), to: toDateOnlyString(monthEnd) },\n      },\n      dailyHours,\n    )\n\n    const memberships = await em.fork().find(StaffTimeProjectMember, {\n      staffMemberId: staffMember.id,\n      tenantId,\n      organizationId,\n      status: 'active',\n      deletedAt: null,\n    })\n    const projectIds = Array.from(new Set(memberships.map((membership) => membership.timeProjectId))).slice(\n      0,\n      MAX_PROJECTS,\n    )\n\n    const projects =\n      projectIds.length > 0\n        ? await findWithDecryption(\n            em.fork(),\n            StaffTimeProject,\n            { id: { $in: projectIds }, tenantId, organizationId, deletedAt: null },\n            {},\n            { tenantId, organizationId },\n          )\n        : []\n\n    const hourlyRateByProjectId = new Map<string, number | null>(\n      projects.map((project) => [\n        project.id,\n        project.hourlyRate === null || project.hourlyRate === undefined ? null : Number(project.hourlyRate),\n      ]),\n    )\n    const [mine, everyone] = await Promise.all([\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n        staffMemberId: staffMember.id,\n      }),\n      computeProjectFinancials({\n        em,\n        tenantId,\n        organizationId,\n        projectIds: projects.map((project) => project.id),\n        hourlyRateByProjectId,\n      }),\n    ])\n\n    const todaysEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      { staffMemberId: staffMember.id, tenantId, organizationId, date: new Date(`${todayDate}T00:00:00.000Z`), deletedAt: null },\n      { orderBy: { startedAt: 'asc', createdAt: 'asc' } },\n      { tenantId, organizationId },\n    )\n\n    const recentEntries = await findWithDecryption(\n      em.fork(),\n      StaffTimeEntry,\n      {\n        staffMemberId: staffMember.id,\n        tenantId,\n        organizationId,\n        deletedAt: null,\n        taskId: { $ne: null },\n      },\n      { orderBy: { date: 'desc' }, limit: 50 },\n      { tenantId, organizationId },\n    )\n    const recentTaskIds = pickRecentTaskIds(\n      recentEntries.map((entry) => ({\n        id: entry.id,\n        taskId: entry.taskId ?? null,\n        date: toDateOnlyString(new Date(entry.date)),\n      })),\n      RECENT_TASK_LIMIT,\n    )\n    const referencedTaskIds = Array.from(\n      new Set([\n        ...recentTaskIds,\n        ...todaysEntries.map((entry) => entry.taskId).filter((id): id is string => typeof id === 'string'),\n      ]),\n    )\n    const tasks =\n      referencedTaskIds.length > 0\n        ? await em.fork().find(StaffTimeTask, {\n            id: { $in: referencedTaskIds },\n            tenantId,\n            organizationId,\n            deletedAt: null,\n          })\n        : []\n    const taskById = new Map(tasks.map((task) => [task.id, task]))\n    const projectNameById = new Map(projects.map((project) => [project.id, project.name]))\n\n    const payload = {\n      staffMember: { id: staffMember.id, displayName: staffMember.displayName },\n      today: todayDate,\n      kpis,\n      entries: todaysEntries.map((entry) => ({\n        id: entry.id,\n        date: toDateOnlyString(new Date(entry.date)),\n        taskId: entry.taskId ?? null,\n        taskTitle: entry.taskId ? taskById.get(entry.taskId)?.title ?? null : null,\n        timeProjectId: entry.timeProjectId ?? null,\n        projectName: entry.timeProjectId ? projectNameById.get(entry.timeProjectId) ?? null : null,\n        description: entry.notes ?? null,\n        startedAt: entry.startedAt ? entry.startedAt.toISOString() : null,\n        endedAt: entry.endedAt ? entry.endedAt.toISOString() : null,\n        durationMinutes: entry.durationMinutes,\n        isBillable: entry.isBillable !== false,\n        isLocked: Boolean(entry.lockedReportId),\n      })),\n      projects: projects.map((project) => {\n        const myFinancials = mine.get(project.id)\n        const allFinancials = everyone.get(project.id)\n        const snapshot = project.customerSnapshot ?? null\n        const customerName =\n          snapshot && typeof snapshot === 'object' && typeof (snapshot as { name?: unknown }).name === 'string'\n            ? ((snapshot as { name?: string }).name as string)\n            : null\n        // An `amount` budget is a money statement, so it only exists for a caller\n        // who may see money; an `hours` budget is not, and stays for everybody.\n        const burn =\n          project.budgetKind === 'amount' && !canSeeMoney\n            ? null\n            : computeBudgetBurn({\n                kind: project.budgetKind,\n                budgetValue:\n                  project.budgetValue === null || project.budgetValue === undefined\n                    ? null\n                    : Number(project.budgetValue),\n                warnAtPercent: project.budgetWarnAtPercent,\n                totalMinutes: allFinancials?.totalMinutes ?? 0,\n                cost: allFinancials?.cost ?? null,\n              })\n        return {\n          id: project.id,\n          name: project.name,\n          code: project.code ?? null,\n          color: project.color ?? null,\n          customerName,\n          myMinutes: myFinancials?.totalMinutes ?? 0,\n          totalMinutes: allFinancials?.totalMinutes ?? 0,\n          ...(canSeeMoney\n            ? {\n                hourlyRate: hourlyRateByProjectId.get(project.id) ?? null,\n                currencyCode: project.currencyCode ?? null,\n              }\n            : {}),\n          budget: burn\n            ? {\n                kind: burn.kind,\n                budgetValue: burn.budgetValue,\n                usedValue: burn.usedValue,\n                percent: burn.percent,\n                barPercent: burn.barPercent,\n                tone: burn.tone,\n              }\n            : null,\n        }\n      }),\n      recentTasks: recentTaskIds\n        .map((taskId) => {\n          const task = taskById.get(taskId)\n          if (!task) return null\n          return {\n            id: task.id,\n            title: task.title,\n            timeProjectId: task.timeProjectId,\n            projectName: projectNameById.get(task.timeProjectId) ?? null,\n          }\n        })\n        .filter((task): task is NonNullable<typeof task> => task !== null),\n    }\n\n    return session.respond(200, payload)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.my-work failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.time_tracking.myWork.errors.load', 'Failed to load your work summary.') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'My work dashboard aggregate',\n  methods: {\n    GET: {\n      summary: 'Today, this week and this month for the calling staff member',\n      description:\n        'One aggregate for the time tracking landing page: day/week/month/non-billable totals with working-day targets, today\u2019s entries, the caller\u2019s projects with budget burn, and the tasks they last logged against. Always scoped to the caller \u2014 there is no way to ask about another person. Rate and amount-budget fields are present only for holders of `staff.timesheets.rates.view`.',\n      responses: [\n        { status: 200, description: 'My work summary', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAwBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,oBAAoB;AAI7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,iBAAiB,mBAAmB,iBAAiB;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAElF,MAAM,eAAe;AACrB,MAAM,gBAAgB;AACtB,MAAM,oBAAoB;AAC1B,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAUA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,EAChC,YAAY,EAAE,QAAQ;AAAA,EACtB,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7C,QAAQ,EACL,OAAO;AAAA,IACN,MAAM,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,IAChC,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO;AAAA,IAClB,YAAY,EAAE,OAAO;AAAA,IACrB,MAAM,EAAE,OAAO;AAAA,EACjB,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS;AAAA,EACnF,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,IACb,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,IAC5B,cAAc,EAAE,OAAO,EAAE,IAAI;AAAA,IAC7B,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAAA,IACxC,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC7C,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC9C,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,IACjC,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,CAAC;AAAA,EACD,SAAS,EAAE,MAAM,WAAW;AAAA,EAC5B,UAAU,EAAE,MAAM,aAAa;AAAA,EAC/B,aAAa,EAAE;AAAA,IACb,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,OAAO,EAAE,OAAO;AAAA,MAChB,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,MAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,CAAC;AAAA,EACH;AACF,CAAC;AASD,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YAAY,iBAAiB,GAAG;AACtC,UAAM,YAAY,aAAa,GAAG;AAClC,UAAM,UAAU,WAAW,WAAW,CAAC;AACvC,UAAM,aAAa,sBAAsB,GAAG;AAC5C,UAAM,iBAAiB,0BAA0B,GAAG;AACpD,UAAM,WAAW,WAAW,gBAAgB,EAAE;AAE9C,QAAI,aAA4B;AAChC,QAAI;AACF,YAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,oBAAc,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC,GAAG,QAAQ;AAAA,IACrF,QAAQ;AAGN,mBAAa;AAAA,IACf;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,YAAY;AAAA,MAChB,EAAE,cAAc,GAAG,aAAa,GAAG,cAAc,GAAG,yBAAyB,EAAE;AAAA,MAC/E;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,aAAa;AAGhB,aAAO,QAAQ,QAAQ,KAAK;AAAA,QAC1B,aAAa;AAAA,QACb,OAAO;AAAA,QACP,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,QACV,UAAU,CAAC;AAAA,QACX,aAAa,CAAC;AAAA,MAChB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,cACH,MAAM,MAAM,qBAAqB,KAAK,KAAK,CAAC,aAAa,GAAG,EAAE,UAAU,eAAe,CAAC,KAAM;AAEjG,UAAM,aAAc,MAAM,GAAG,cAAc,EAAE;AAAA,MAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAYA;AAAA,QACE;AAAA,QACA,iBAAiB,SAAS;AAAA,QAC1B,iBAAiB,OAAO;AAAA,QACxB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB,iBAAiB,UAAU;AAAA,QAC3B,iBAAiB,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,SAAS,WAAW,CAAC;AAC3B,UAAM,OAAO;AAAA,MACX;AAAA,QACE,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,aAAa,UAAU,QAAQ,YAAY;AAAA,QAC3C,cAAc,UAAU,QAAQ,aAAa;AAAA,QAC7C,yBAAyB,UAAU,QAAQ,yBAAyB;AAAA,MACtE;AAAA,MACA;AAAA,QACE,MAAM,EAAE,MAAM,iBAAiB,SAAS,GAAG,IAAI,iBAAiB,OAAO,EAAE;AAAA,QACzE,OAAO,EAAE,MAAM,iBAAiB,UAAU,GAAG,IAAI,iBAAiB,QAAQ,EAAE;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,GAAG,KAAK,EAAE,KAAK,wBAAwB;AAAA,MAC/D,eAAe,YAAY;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,WAAW;AAAA,IACb,CAAC;AACD,UAAM,aAAa,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,aAAa,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WACJ,WAAW,SAAS,IAChB,MAAM;AAAA,MACJ,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACrE,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B,IACA,CAAC;AAEP,UAAM,wBAAwB,IAAI;AAAA,MAChC,SAAS,IAAI,CAAC,YAAY;AAAA,QACxB,QAAQ;AAAA,QACR,QAAQ,eAAe,QAAQ,QAAQ,eAAe,SAAY,OAAO,OAAO,QAAQ,UAAU;AAAA,MACpG,CAAC;AAAA,IACH;AACA,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MACzC,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,QACA,eAAe,YAAY;AAAA,MAC7B,CAAC;AAAA,MACD,yBAAyB;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,eAAe,YAAY,IAAI,UAAU,gBAAgB,MAAM,oBAAI,KAAK,GAAG,SAAS,gBAAgB,GAAG,WAAW,KAAK;AAAA,MACzH,EAAE,SAAS,EAAE,WAAW,OAAO,WAAW,MAAM,EAAE;AAAA,MAClD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GAAG,KAAK;AAAA,MACR;AAAA,MACA;AAAA,QACE,eAAe,YAAY;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,QAAQ,EAAE,KAAK,KAAK;AAAA,MACtB;AAAA,MACA,EAAE,SAAS,EAAE,MAAM,OAAO,GAAG,OAAO,GAAG;AAAA,MACvC,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,gBAAgB;AAAA,MACpB,cAAc,IAAI,CAAC,WAAW;AAAA,QAC5B,IAAI,MAAM;AAAA,QACV,QAAQ,MAAM,UAAU;AAAA,QACxB,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,MAC7C,EAAE;AAAA,MACF;AAAA,IACF;AACA,UAAM,oBAAoB,MAAM;AAAA,MAC9B,oBAAI,IAAI;AAAA,QACN,GAAG;AAAA,QACH,GAAG,cAAc,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,MACnG,CAAC;AAAA,IACH;AACA,UAAM,QACJ,kBAAkB,SAAS,IACvB,MAAM,GAAG,KAAK,EAAE,KAAK,eAAe;AAAA,MAClC,IAAI,EAAE,KAAK,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC,IACD,CAAC;AACP,UAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC7D,UAAM,kBAAkB,IAAI,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC;AAErF,UAAM,UAAU;AAAA,MACd,aAAa,EAAE,IAAI,YAAY,IAAI,aAAa,YAAY,YAAY;AAAA,MACxE,OAAO;AAAA,MACP;AAAA,MACA,SAAS,cAAc,IAAI,CAAC,WAAW;AAAA,QACrC,IAAI,MAAM;AAAA,QACV,MAAM,iBAAiB,IAAI,KAAK,MAAM,IAAI,CAAC;AAAA,QAC3C,QAAQ,MAAM,UAAU;AAAA,QACxB,WAAW,MAAM,SAAS,SAAS,IAAI,MAAM,MAAM,GAAG,SAAS,OAAO;AAAA,QACtE,eAAe,MAAM,iBAAiB;AAAA,QACtC,aAAa,MAAM,gBAAgB,gBAAgB,IAAI,MAAM,aAAa,KAAK,OAAO;AAAA,QACtF,aAAa,MAAM,SAAS;AAAA,QAC5B,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,QAC7D,SAAS,MAAM,UAAU,MAAM,QAAQ,YAAY,IAAI;AAAA,QACvD,iBAAiB,MAAM;AAAA,QACvB,YAAY,MAAM,eAAe;AAAA,QACjC,UAAU,QAAQ,MAAM,cAAc;AAAA,MACxC,EAAE;AAAA,MACF,UAAU,SAAS,IAAI,CAAC,YAAY;AAClC,cAAM,eAAe,KAAK,IAAI,QAAQ,EAAE;AACxC,cAAM,gBAAgB,SAAS,IAAI,QAAQ,EAAE;AAC7C,cAAM,WAAW,QAAQ,oBAAoB;AAC7C,cAAM,eACJ,YAAY,OAAO,aAAa,YAAY,OAAQ,SAAgC,SAAS,WACvF,SAA+B,OACjC;AAGN,cAAM,OACJ,QAAQ,eAAe,YAAY,CAAC,cAChC,OACA,kBAAkB;AAAA,UAChB,MAAM,QAAQ;AAAA,UACd,aACE,QAAQ,gBAAgB,QAAQ,QAAQ,gBAAgB,SACpD,OACA,OAAO,QAAQ,WAAW;AAAA,UAChC,eAAe,QAAQ;AAAA,UACvB,cAAc,eAAe,gBAAgB;AAAA,UAC7C,MAAM,eAAe,QAAQ;AAAA,QAC/B,CAAC;AACP,eAAO;AAAA,UACL,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,MAAM,QAAQ,QAAQ;AAAA,UACtB,OAAO,QAAQ,SAAS;AAAA,UACxB;AAAA,UACA,WAAW,cAAc,gBAAgB;AAAA,UACzC,cAAc,eAAe,gBAAgB;AAAA,UAC7C,GAAI,cACA;AAAA,YACE,YAAY,sBAAsB,IAAI,QAAQ,EAAE,KAAK;AAAA,YACrD,cAAc,QAAQ,gBAAgB;AAAA,UACxC,IACA,CAAC;AAAA,UACL,QAAQ,OACJ;AAAA,YACE,MAAM,KAAK;AAAA,YACX,aAAa,KAAK;AAAA,YAClB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,YAAY,KAAK;AAAA,YACjB,MAAM,KAAK;AAAA,UACb,IACA;AAAA,QACN;AAAA,MACF,CAAC;AAAA,MACD,aAAa,cACV,IAAI,CAAC,WAAW;AACf,cAAM,OAAO,SAAS,IAAI,MAAM;AAChC,YAAI,CAAC,KAAM,QAAO;AAClB,eAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,KAAK;AAAA,UACZ,eAAe,KAAK;AAAA,UACpB,aAAa,gBAAgB,IAAI,KAAK,aAAa,KAAK;AAAA,QAC1D;AAAA,MACF,CAAC,EACA,OAAO,CAAC,SAA2C,SAAS,IAAI;AAAA,IACrE;AAEA,WAAO,QAAQ,QAAQ,KAAK,OAAO;AAAA,EACrC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,mCAAmC,EAAE,IAAI,CAAC;AACvD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,0CAA0C,mCAAmC,EAAE;AAAA,MAClG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,eAAe;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/projects/kpis/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -61,7 +62,7 @@ async function GET(req) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")

package/dist/modules/staff/api/timesheets/projects/kpis/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/projects/kpis/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { StaffTeamMember } from '../../../../data/entities'\nimport {\n  computeCollabProjectsKpis,\n  computePmProjectsKpis,\n} from '../../../../lib/timesheets-projects/computeProjectsKpis'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nconst VIEW_FEATURE = 'staff.timesheets.projects.view'\nconst MANAGE_FEATURE = 'staff.timesheets.projects.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nconst deltaSchema = z.object({\n  current: z.number(),\n  previous: z.number(),\n  deltaPct: z.number().nullable(),\n})\n\nconst pmResponseSchema = z.object({\n  role: z.literal('pm'),\n  totals: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n    onHold: z.number().int(),\n    completed: z.number().int(),\n  }),\n  hoursWeek: deltaSchema,\n  hoursMonth: deltaSchema,\n  teamActive: z.object({ count: z.number().int() }),\n  assignedToMe: z.object({ total: z.number().int(), active: z.number().int() }),\n})\n\nconst collabResponseSchema = z.object({\n  role: z.literal('collab'),\n  myProjects: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n  }),\n  myHoursWeek: deltaSchema,\n  myHoursMonth: deltaSchema,\n})\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth) {\n      throw new CrudHttpError(401, {\n        error: translate('staff.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const rbac = container.resolve('rbacService') as RbacService\n    const isPm = await rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    if (isPm) {\n      const result = await computePmProjectsKpis({\n        em,\n        tenantId,\n        organizationId,\n        callerStaffMemberId: staffMember?.id ?? null,\n      })\n      return session.respond(200, result)\n    }\n\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate(\n          'staff.timesheets.errors.noStaffMember',\n          'No staff member linked to your account.',\n        ),\n      })\n    }\n\n    const result = await computeCollabProjectsKpis({\n      em,\n      tenantId,\n      organizationId,\n      staffMemberId: staffMember.id,\n    })\n    return session.respond(200, result)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.projects.kpis failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      {\n        error: translate(\n          'staff.timesheets.errors.projectsKpis',\n          'Failed to load project KPIs.',\n        ),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Timesheet projects KPIs',\n  methods: {\n    GET: {\n      summary: 'Aggregate KPIs for the timesheets Projects page',\n      description:\n        'Returns a role-aware KPI payload. Users with `staff.timesheets.projects.manage` get the PM shape (portfolio totals, monthly team hours, active team member count). Other viewers get the Collaborator shape scoped to their own memberships and hours.',\n      responses: [\n        {\n          status: 200,\n          description: 'PM or Collaborator KPIs',\n          schema: z.union([pmResponseSchema, collabResponseSchema]),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        {\n          status: 403,\n          description: 'Missing viewing feature or no staff member linked',\n          schema: z.object({ error: z.string() }),\n        },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAItC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,MAAM,EAAE,QAAQ,IAAI;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EAChD,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,QAAQ;AAAA,EACxB,YAAY,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,CAAC;AAAA,EACD,aAAa;AAAA,EACb,cAAc;AAChB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,cAAc;AAAA,MAC9D,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,OAAO,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG;AAAA,MACrE;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,MAAM;AACR,YAAMA,UAAS,MAAM,sBAAsB;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,qBAAqB,aAAa,MAAM;AAAA,MAC1C,CAAC;AACD,aAAO,QAAQ,QAAQ,KAAKA,OAAM;AAAA,IACpC;AAEA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,0BAA0B;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,IAC7B,CAAC;AACD,WAAO,QAAQ,QAAQ,KAAK,MAAM;AAAA,EACpC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,CAAC,kBAAkB,oBAAoB,CAAC;AAAA,QAC1D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { StaffTeamMember } from '../../../../data/entities'\nimport {\n  computeCollabProjectsKpis,\n  computePmProjectsKpis,\n} from '../../../../lib/timesheets-projects/computeProjectsKpis'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nconst VIEW_FEATURE = 'staff.timesheets.projects.view'\nconst MANAGE_FEATURE = 'staff.timesheets.projects.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nconst deltaSchema = z.object({\n  current: z.number(),\n  previous: z.number(),\n  deltaPct: z.number().nullable(),\n})\n\nconst pmResponseSchema = z.object({\n  role: z.literal('pm'),\n  totals: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n    onHold: z.number().int(),\n    completed: z.number().int(),\n  }),\n  hoursWeek: deltaSchema,\n  hoursMonth: deltaSchema,\n  teamActive: z.object({ count: z.number().int() }),\n  assignedToMe: z.object({ total: z.number().int(), active: z.number().int() }),\n})\n\nconst collabResponseSchema = z.object({\n  role: z.literal('collab'),\n  myProjects: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n  }),\n  myHoursWeek: deltaSchema,\n  myHoursMonth: deltaSchema,\n})\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth) {\n      throw new CrudHttpError(401, {\n        error: translate('staff.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const rbac = container.resolve('rbacService') as RbacService\n    const isPm = await rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    if (isPm) {\n      const result = await computePmProjectsKpis({\n        em,\n        tenantId,\n        organizationId,\n        callerStaffMemberId: staffMember?.id ?? null,\n      })\n      return session.respond(200, result)\n    }\n\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate(\n          'staff.timesheets.errors.noStaffMember',\n          'No staff member linked to your account.',\n        ),\n      })\n    }\n\n    const result = await computeCollabProjectsKpis({\n      em,\n      tenantId,\n      organizationId,\n      staffMemberId: staffMember.id,\n    })\n    return session.respond(200, result)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.projects.kpis failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      {\n        error: translate(\n          'staff.timesheets.errors.projectsKpis',\n          'Failed to load project KPIs.',\n        ),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Timesheet projects KPIs',\n  methods: {\n    GET: {\n      summary: 'Aggregate KPIs for the timesheets Projects page',\n      description:\n        'Returns a role-aware KPI payload. Users with `staff.timesheets.projects.manage` get the PM shape (portfolio totals, monthly team hours, active team member count). Other viewers get the Collaborator shape scoped to their own memberships and hours.',\n      responses: [\n        {\n          status: 200,\n          description: 'PM or Collaborator KPIs',\n          schema: z.union([pmResponseSchema, collabResponseSchema]),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        {\n          status: 403,\n          description: 'Missing viewing feature or no staff member linked',\n          schema: z.object({ error: z.string() }),\n        },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAItC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,MAAM,EAAE,QAAQ,IAAI;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EAChD,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,QAAQ;AAAA,EACxB,YAAY,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,CAAC;AAAA,EACD,aAAa;AAAA,EACb,cAAc;AAChB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,cAAc;AAAA,MAC9D,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,OAAO,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG;AAAA,MACrE;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,MAAM;AACR,YAAMA,UAAS,MAAM,sBAAsB;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,qBAAqB,aAAa,MAAM;AAAA,MAC1C,CAAC;AACD,aAAO,QAAQ,QAAQ,KAAKA,OAAM;AAAA,IACpC;AAEA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,0BAA0B;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,IAC7B,CAAC;AACD,WAAO,QAAQ,QAAQ,KAAK,MAAM;AAAA,EACpC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,CAAC,kBAAkB,oBAAoB,CAAC;AAAA,QAC1D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["result"]
 }

package/dist/modules/staff/api/timesheets/reports/[id]/close/route.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { resolveFeatureAccess } from "../../../../../lib/time-tracking/featureAccess.js";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { z } from "zod";
 import { forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
@@ -69,7 +70,7 @@ async function POST(req) {
       container,
       auth,
       organizationScope,
-      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,
       organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: req
     };

package/dist/modules/staff/api/timesheets/reports/[id]/close/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/reports/%5Bid%5D/close/route.ts"],
-  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/[id]/close` \u2014 US-G3, screen 14's primary\n * action.\n *\n * Gated on `staff.timesheets.lock`, the feature that already existed for exactly\n * this (\"Lock time periods\"), rather than on a new one. Exporting a PDF does NOT\n * come through here: screen 14 note 5 makes closing the only thing that freezes,\n * so a download can never silently lock a team's timesheet.\n *\n * The whole freeze is one transaction inside the command. This file's job is\n * auth, scope, the mutation guard and turning the command's refusals into the\n * bodies the screen can act on.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeReportCommandIds,\n  type StaffTimeReportCloseResult,\n} from '../../../../../commands/timesheets-reports'\nimport { resolveReportRequestContext } from '../../shared'\nimport {\n  evaluateReportClosePolicies,\n  notifyReportClosed,\n} from '../../../../../lib/timesheets-reports/reportApprovalPolicies'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/close' })\n\nconst LOCK_FEATURE = 'staff.timesheets.lock'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [LOCK_FEATURE] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'close' })\n    const { container, auth, organizationScope, tenantId, organizationId, reportId, translate, grantedFeatures } =\n      context\n\n    // Checked unconditionally. The `grantedFeatures &&` this replaces turned the\n    // check off whenever the grant read failed \u2014 harmless here only because the\n    // route metadata happens to require the same feature, which is exactly the\n    // shape that leaked rates on the report routes where no such backstop existed.\n    if (!(await resolveFeatureAccess(container, auth.sub ?? null, [LOCK_FEATURE], { tenantId, organizationId })).allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n\n    // EP-41 runs strictly AFTER the ACL gate above and can only refuse. A policy\n    // never grants, so nothing here can open a report a caller has no feature for.\n    const approvalContext = {\n      tenantId,\n      organizationId,\n      reportId,\n      actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n      actorFeatures: grantedFeatures,\n      status: 'draft',\n    }\n    const refusal = evaluateReportClosePolicies(approvalContext)\n    if (refusal) {\n      throw forbidden(translate(refusal.messageKey, translate('staff.errors.forbidden', 'Forbidden')))\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: auth.sub ?? '',\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n        resourceId: reportId,\n        operation: 'update',\n        mutationPayload: { id: reportId },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<{ id: string }, StaffTimeReportCloseResult>(\n      staffTimeReportCommandIds.close,\n      { input: { id: reportId }, ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    for (const failure of await notifyReportClosed({ ...approvalContext, status: 'closed' })) {\n      logger.error('staff.timesheets.reports.close approval hook failed', {\n        policyId: failure.policyId,\n        err: failure.error,\n      })\n    }\n\n    const response = await session.respond(200, {\n      id: result?.reportId ?? reportId,\n      status: 'closed',\n      lockedEntryCount: result?.lockedEntryCount ?? 0,\n      totalAmount: result?.totalAmount ?? 0,\n      totalBillableMinutes: result?.totalBillableMinutes ?? 0,\n      totalNonbillableMinutes: result?.totalNonbillableMinutes ?? 0,\n    })\n    if (logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          // Explicitly no undo token: unwinding a billing freeze is the unlock\n          // endpoint, which demands a reason and its own feature. A one-click\n          // undo bar over a closed invoice is exactly what US-G3 forbids.\n          undoToken: '',\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n          resourceId: logEntry.resourceId ?? reportId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.close failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst closeResponseSchema = z.object({\n  id: z.string().uuid(),\n  status: z.literal('closed'),\n  lockedEntryCount: z.number().int(),\n  totalAmount: z.number(),\n  totalBillableMinutes: z.number().int(),\n  totalNonbillableMinutes: z.number().int(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Close and lock a customer report',\n  methods: {\n    POST: {\n      summary: 'Close and lock a customer report',\n      description:\n        'Freezes the report: writes one staff_time_report_entries snapshot per covered entry (raw minutes, rounded minutes, rate, currency, amount, billable), stamps locked_report_id / locked_at on entries that are not already locked by an earlier report, freezes the report totals and appends a `closed` event \u2014 all in one transaction. Exporting never locks; this endpoint is the only thing that does.',\n      responses: [{ status: 200, description: 'Report closed', schema: closeResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing report id or scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.lock, or refused by a registered report approval policy' },\n        { status: 404, description: 'Report not found or not accessible' },\n        { status: 409, description: 'Report is already closed (report_closed)' },\n        { status: 422, description: 'Report covers no entries (report_empty)' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAcA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAClB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAExF,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,QAAQ,CAAC;AAC3E,UAAM,EAAE,WAAW,MAAM,mBAAmB,UAAU,gBAAgB,UAAU,WAAW,gBAAgB,IACzG;AAMF,QAAI,EAAE,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,YAAY,GAAG,EAAE,UAAU,eAAe,CAAC,GAAG,SAAS;AACpH,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AAIA,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MACvD,eAAe;AAAA,MACf,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,4BAA4B,eAAe;AAC3D,QAAI,SAAS;AACX,YAAM,UAAU,UAAU,QAAQ,YAAY,UAAU,0BAA0B,WAAW,CAAC,CAAC;AAAA,IACjG;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,IAChG,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,KAAK,OAAO;AAAA,QACpB;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB,EAAE,IAAI,SAAS;AAAA,MAClC;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,MACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C,0BAA0B;AAAA,MAC1B,EAAE,OAAO,EAAE,IAAI,SAAS,GAAG,IAAI;AAAA,IACjC;AAEA,UAAM,YAAY,gBAAgB;AAElC,eAAW,WAAW,MAAM,mBAAmB,EAAE,GAAG,iBAAiB,QAAQ,SAAS,CAAC,GAAG;AACxF,aAAO,MAAM,uDAAuD;AAAA,QAClE,UAAU,QAAQ;AAAA,QAClB,KAAK,QAAQ;AAAA,MACf,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,YAAY;AAAA,MACxB,QAAQ;AAAA,MACR,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ,eAAe;AAAA,MACpC,sBAAsB,QAAQ,wBAAwB;AAAA,MACtD,yBAAyB,QAAQ,2BAA2B;AAAA,IAC9D,CAAC;AACD,QAAI,UAAU,MAAM,UAAU,WAAW;AACvC,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA;AAAA;AAAA;AAAA,UAIb,WAAW;AAAA,UACX,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,QAAQ,QAAQ;AAAA,EAC1B,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,aAAa,EAAE,OAAO;AAAA,EACtB,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAC1C,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,mFAAmF;AAAA,QAC/G,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,0CAA0C;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/[id]/close` \u2014 US-G3, screen 14's primary\n * action.\n *\n * Gated on `staff.timesheets.lock`, the feature that already existed for exactly\n * this (\"Lock time periods\"), rather than on a new one. Exporting a PDF does NOT\n * come through here: screen 14 note 5 makes closing the only thing that freezes,\n * so a download can never silently lock a team's timesheet.\n *\n * The whole freeze is one transaction inside the command. This file's job is\n * auth, scope, the mutation guard and turning the command's refusals into the\n * bodies the screen can act on.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { z } from 'zod'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeReportCommandIds,\n  type StaffTimeReportCloseResult,\n} from '../../../../../commands/timesheets-reports'\nimport { resolveReportRequestContext } from '../../shared'\nimport {\n  evaluateReportClosePolicies,\n  notifyReportClosed,\n} from '../../../../../lib/timesheets-reports/reportApprovalPolicies'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/close' })\n\nconst LOCK_FEATURE = 'staff.timesheets.lock'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [LOCK_FEATURE] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'close' })\n    const { container, auth, organizationScope, tenantId, organizationId, reportId, translate, grantedFeatures } =\n      context\n\n    // Checked unconditionally. The `grantedFeatures &&` this replaces turned the\n    // check off whenever the grant read failed \u2014 harmless here only because the\n    // route metadata happens to require the same feature, which is exactly the\n    // shape that leaked rates on the report routes where no such backstop existed.\n    if (!(await resolveFeatureAccess(container, auth.sub ?? null, [LOCK_FEATURE], { tenantId, organizationId })).allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n\n    // EP-41 runs strictly AFTER the ACL gate above and can only refuse. A policy\n    // never grants, so nothing here can open a report a caller has no feature for.\n    const approvalContext = {\n      tenantId,\n      organizationId,\n      reportId,\n      actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n      actorFeatures: grantedFeatures,\n      status: 'draft',\n    }\n    const refusal = evaluateReportClosePolicies(approvalContext)\n    if (refusal) {\n      throw forbidden(translate(refusal.messageKey, translate('staff.errors.forbidden', 'Forbidden')))\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: auth.sub ?? '',\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n        resourceId: reportId,\n        operation: 'update',\n        mutationPayload: { id: reportId },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<{ id: string }, StaffTimeReportCloseResult>(\n      staffTimeReportCommandIds.close,\n      { input: { id: reportId }, ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    for (const failure of await notifyReportClosed({ ...approvalContext, status: 'closed' })) {\n      logger.error('staff.timesheets.reports.close approval hook failed', {\n        policyId: failure.policyId,\n        err: failure.error,\n      })\n    }\n\n    const response = await session.respond(200, {\n      id: result?.reportId ?? reportId,\n      status: 'closed',\n      lockedEntryCount: result?.lockedEntryCount ?? 0,\n      totalAmount: result?.totalAmount ?? 0,\n      totalBillableMinutes: result?.totalBillableMinutes ?? 0,\n      totalNonbillableMinutes: result?.totalNonbillableMinutes ?? 0,\n    })\n    if (logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          // Explicitly no undo token: unwinding a billing freeze is the unlock\n          // endpoint, which demands a reason and its own feature. A one-click\n          // undo bar over a closed invoice is exactly what US-G3 forbids.\n          undoToken: '',\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n          resourceId: logEntry.resourceId ?? reportId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.close failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst closeResponseSchema = z.object({\n  id: z.string().uuid(),\n  status: z.literal('closed'),\n  lockedEntryCount: z.number().int(),\n  totalAmount: z.number(),\n  totalBillableMinutes: z.number().int(),\n  totalNonbillableMinutes: z.number().int(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Close and lock a customer report',\n  methods: {\n    POST: {\n      summary: 'Close and lock a customer report',\n      description:\n        'Freezes the report: writes one staff_time_report_entries snapshot per covered entry (raw minutes, rounded minutes, rate, currency, amount, billable), stamps locked_report_id / locked_at on entries that are not already locked by an earlier report, freezes the report totals and appends a `closed` event \u2014 all in one transaction. Exporting never locks; this endpoint is the only thing that does.',\n      responses: [{ status: 200, description: 'Report closed', schema: closeResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing report id or scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.lock, or refused by a registered report approval policy' },\n        { status: 404, description: 'Report not found or not accessible' },\n        { status: 409, description: 'Report is already closed (report_closed)' },\n        { status: 422, description: 'Report covers no entries (report_empty)' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAcA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,yCAAyC;AAClD,SAAS,SAAS;AAClB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAExF,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,QAAQ,CAAC;AAC3E,UAAM,EAAE,WAAW,MAAM,mBAAmB,UAAU,gBAAgB,UAAU,WAAW,gBAAgB,IACzG;AAMF,QAAI,EAAE,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,YAAY,GAAG,EAAE,UAAU,eAAe,CAAC,GAAG,SAAS;AACpH,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AAIA,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MACvD,eAAe;AAAA,MACf,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,4BAA4B,eAAe;AAC3D,QAAI,SAAS;AACX,YAAM,UAAU,UAAU,QAAQ,YAAY,UAAU,0BAA0B,WAAW,CAAC,CAAC;AAAA,IACjG;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,IAChG,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,KAAK,OAAO;AAAA,QACpB;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB,EAAE,IAAI,SAAS;AAAA,MAClC;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,MACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C,0BAA0B;AAAA,MAC1B,EAAE,OAAO,EAAE,IAAI,SAAS,GAAG,IAAI;AAAA,IACjC;AAEA,UAAM,YAAY,gBAAgB;AAElC,eAAW,WAAW,MAAM,mBAAmB,EAAE,GAAG,iBAAiB,QAAQ,SAAS,CAAC,GAAG;AACxF,aAAO,MAAM,uDAAuD;AAAA,QAClE,UAAU,QAAQ;AAAA,QAClB,KAAK,QAAQ;AAAA,MACf,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,YAAY;AAAA,MACxB,QAAQ;AAAA,MACR,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ,eAAe;AAAA,MACpC,sBAAsB,QAAQ,wBAAwB;AAAA,MACtD,yBAAyB,QAAQ,2BAA2B;AAAA,IAC9D,CAAC;AACD,QAAI,UAAU,MAAM,UAAU,WAAW;AACvC,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA;AAAA;AAAA;AAAA,UAIb,WAAW;AAAA,UACX,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,QAAQ,QAAQ;AAAA,EAC1B,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,aAAa,EAAE,OAAO;AAAA,EACtB,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAC1C,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,mFAAmF;AAAA,QAC/G,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,0CAA0C;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/[id]/export/route.js

@@ -7,6 +7,7 @@ import { StaffTimeReport, StaffTimeReportEvent } from "../../../../../data/entit
 import { loadReportProjectIds } from "../../../../../commands/timesheets-reports.js";
 import { buildReportSheet } from "../../../../../lib/timesheets-reports/buildReportSheet.js";
 import { buildReportRows } from "../../../../../lib/timesheets-reports/reportRows.js";
+import { formatReportPeriodDate } from "../../../../../lib/timesheets-reports/reportPeriod.js";
 import {
   normalizeReportExportFormat,
   serializeReportExport,
@@ -132,8 +133,8 @@ async function GET(req) {
       directory: sheet.directory,
       labels
     });
-    const periodFrom = report.periodFrom instanceof Date ? report.periodFrom.toISOString().slice(0, 10) : "";
-    const periodTo = report.periodTo instanceof Date ? report.periodTo.toISOString().slice(0, 10) : "";
+    const periodFrom = formatReportPeriodDate(report.periodFrom) ?? "";
+    const periodTo = formatReportPeriodDate(report.periodTo) ?? "";
     const file = serializeReportExport(format, {
       reference: report.reference,
       title: report.title,

package/dist/modules/staff/api/timesheets/reports/[id]/export/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/reports/%5Bid%5D/export/route.ts"],
-  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/reports/[id]/export?format=pdf|csv|xlsx` \u2014 US-G4.\n *\n * Two rules from screen 14:\n *\n *  - **Note 3.** The export inherits the current grouping, filters, rounding and\n *    currency, because it is produced from the same `buildReportSheet` the page\n *    rendered. PDF mirrors that sheet; CSV and XLSX add the raw accounting\n *    columns (date, person, description, raw vs rounded minutes).\n *  - **Note 5.** Exporting NEVER locks. The only write here is an append-only\n *    `exported` report event, which is what lets the unlock dialog say \"the PDF\n *    was downloaded on the 20th\" before someone restates a billed hour.\n *\n * The event is appended after the file is built, so a failed render leaves no\n * trace of an export that never happened; a failed event write is logged and\n * does not deny the caller their file.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeReport, StaffTimeReportEvent } from '../../../../../data/entities'\nimport { loadReportProjectIds } from '../../../../../commands/timesheets-reports'\nimport { buildReportSheet } from '../../../../../lib/timesheets-reports/buildReportSheet'\nimport { buildReportRows } from '../../../../../lib/timesheets-reports/reportRows'\nimport {\n  normalizeReportExportFormat,\n  serializeReportExport,\n  supportedReportExportFormats,\n  type ReportExportLabels,\n} from '../../../../../lib/timesheets-reports/reportExport'\nimport {\n  hasReportGrouping,\n  reportGroupingIds,\n  type ReportGrouping,\n} from '../../../../../lib/timesheets-reports/reportGroupings'\nimport { z } from 'zod'\nimport { resolveReportRequestContext, reportSheetLabels, type Translate } from '../../shared'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/export' })\n\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.view'] },\n}\n\n/**\n * EP-35 / EP-36: both accepted sets come from their registries, so a contributed\n * format or grouping is accepted here without this file being edited.\n */\nfunction readQuery(params: URLSearchParams): { format: string | null; grouping: ReportGrouping | undefined } {\n  const grouping = params.get('grouping')\n  return {\n    format: params.get('format'),\n    grouping: hasReportGrouping(grouping) ? (grouping as ReportGrouping) : undefined,\n  }\n}\n\n/**\n * Read lazily rather than frozen at module load: a module registering a format\n * after this route file is first imported must still appear in the published\n * schema.\n */\nfunction exportQuerySchema(): z.ZodTypeAny {\n  return z.object({\n    format: z.enum(supportedReportExportFormats() as [string, ...string[]]),\n    grouping: z.enum(reportGroupingIds() as [string, ...string[]]).optional(),\n  })\n}\n\nfunction exportLabels(translate: Translate): ReportExportLabels {\n  return {\n    documentTitle: translate('staff.time_tracking.reports.sheet.overline', 'Time and cost statement'),\n    issuedBy: translate('staff.time_tracking.reports.sheet.issuedBy', 'Issued by'),\n    reference: translate('staff.time_tracking.reports.sheet.reference', 'Reference'),\n    period: translate('staff.time_tracking.reports.sheet.period', 'Period'),\n    line: translate('staff.time_tracking.reports.sheet.lineLabel', 'Line'),\n    time: translate('staff.time_tracking.reports.sheet.time', 'Time'),\n    rate: translate('staff.time_tracking.reports.sheet.rate', 'Rate'),\n    amount: translate('staff.time_tracking.reports.sheet.amount', 'Amount'),\n    total: translate('staff.time_tracking.reports.sheet.total', 'Total to invoice'),\n    totalHint: translate(\n      'staff.time_tracking.reports.sheet.totalHint',\n      '{billable} billable \u00B7 {nonbillable} non-billable \u00B7 {rounding}',\n    ),\n    nonbillable: translate('staff.time_tracking.reports.sheet.nonbillable', 'Non-billable time'),\n    overrideBadge: translate('staff.time_tracking.reports.sheet.overrideBadge', 'agreed rate'),\n    date: translate('staff.time_tracking.reports.export.date', 'Date'),\n    project: translate('staff.time_tracking.reports.export.project', 'Project'),\n    task: translate('staff.time_tracking.reports.export.task', 'Task'),\n    person: translate('staff.time_tracking.reports.export.person', 'Person'),\n    description: translate('staff.time_tracking.reports.export.description', 'Description'),\n    billable: translate('staff.time_tracking.reports.export.billable', 'Billable'),\n    yes: translate('staff.time_tracking.reports.export.yes', 'Yes'),\n    no: translate('staff.time_tracking.reports.export.no', 'No'),\n    rawMinutes: translate('staff.time_tracking.reports.export.rawMinutes', 'Raw minutes'),\n    roundedMinutes: translate('staff.time_tracking.reports.export.roundedMinutes', 'Rounded minutes'),\n  }\n}\n\nfunction roundingLabel(translate: Translate, unitMinutes: number, direction: string): string {\n  if (!unitMinutes) return translate('staff.time_tracking.reports.rounding.off', 'no rounding')\n  const directionLabel =\n    direction === 'nearest'\n      ? translate('staff.time_tracking.reports.rounding.nearest', 'to the nearest')\n      : translate('staff.time_tracking.reports.rounding.up', 'always up')\n  return translate('staff.time_tracking.reports.rounding.rule', 'rounding {minutes} min, {direction}')\n    .replace('{minutes}', String(unitMinutes))\n    .replace('{direction}', directionLabel)\n}\n\nfunction readCustomerName(snapshot: Record<string, unknown> | null | undefined, fallback: string): string {\n  if (!snapshot) return fallback\n  for (const key of ['name', 'displayName', 'display_name', 'legalName', 'legal_name']) {\n    const value = snapshot[key]\n    if (typeof value === 'string' && value.trim().length > 0) return value.trim()\n  }\n  return fallback\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'export' })\n    // `canSeeMoney` comes from the shared context and is never re-derived here:\n    // the previous `grantedFeatures === null || authorize(...)` opened the money\n    // fields whenever the grant read failed, and this route requires only\n    // `reports.view`, so nothing else stood in the way.\n    const { container, auth, tenantId, organizationId, reportId, translate, canSeeMoney, grantedFeatures } =\n      context\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const { format: rawFormat, grouping } = readQuery(session.searchParams)\n    const format = normalizeReportExportFormat(rawFormat)\n    if (!format) {\n      throw new CrudHttpError(400, {\n        error: translate(\n          'staff.time_tracking.reports.errors.unsupportedFormat',\n          'Supported export formats are pdf, csv and xlsx.',\n        ),\n        supportedFormats: supportedReportExportFormats(),\n      })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const report = await em.findOne(StaffTimeReport, {\n      id: reportId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!report) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.reports.errors.notFound', 'Report not found or not accessible.'),\n      })\n    }\n\n    const timeProjectIds = await loadReportProjectIds(em, report.id, { tenantId, organizationId })\n    const labels = reportSheetLabels(translate)\n    const sheet = await buildReportSheet({\n      em,\n      scope: { tenantId, organizationId },\n      report,\n      timeProjectIds,\n      labels,\n      grouping,\n    })\n    const rows = buildReportRows({\n      entries: sheet.entries,\n      projects: sheet.projects,\n      directory: sheet.directory,\n      labels,\n    })\n\n    const periodFrom = report.periodFrom instanceof Date ? report.periodFrom.toISOString().slice(0, 10) : ''\n    const periodTo = report.periodTo instanceof Date ? report.periodTo.toISOString().slice(0, 10) : ''\n\n    const file = serializeReportExport(format, {\n      reference: report.reference,\n      title: report.title,\n      customerName: readCustomerName(report.customerSnapshot, report.title),\n      periodLabel: `${periodFrom} \u2013 ${periodTo}`,\n      issuedByLabel: null,\n      issuedAtLabel: report.closedAt ? report.closedAt.toISOString().slice(0, 10) : null,\n      currencyCode: sheet.currencyCode,\n      showRates: (report.showRates ?? true) && canSeeMoney,\n      groups: sheet.totals.groups,\n      rows: canSeeMoney ? rows : rows.map((row) => ({ ...row, rate: null, amount: null })),\n      totals: {\n        billableMinutes: sheet.totals.billableMinutes,\n        nonbillableMinutes: sheet.totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? sheet.totals.totalAmount : 0,\n      },\n      roundingLabel: roundingLabel(\n        translate,\n        report.roundingUnitMinutes ?? 0,\n        report.roundingDirection ?? 'up',\n      ),\n      labels: exportLabels(translate),\n    })\n\n    // Append-only audit. Never a lock \u2014 screen 14 note 5.\n    try {\n      const eventEm = (container.resolve('em') as EntityManager).fork()\n      eventEm.persist(\n        eventEm.create(StaffTimeReportEvent, {\n          tenantId,\n          organizationId,\n          reportId: report.id,\n          eventType: 'exported',\n          reason: null,\n          actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n          metadata: { format, grouping: sheet.grouping, rowCount: rows.length },\n          createdAt: new Date(),\n        }),\n      )\n      await eventEm.flush()\n    } catch (err) {\n      // The caller already has a correct file; refusing it because the audit row\n      // failed would be the wrong trade.\n      logger.error('staff.timesheets.reports.export audit event failed', { err })\n    }\n\n    void emitStaffEvent('staff.timesheets.time_report.exported', {\n      id: report.id,\n      tenantId,\n      organizationId,\n      reference: report.reference,\n      format,\n      grouping: sheet.grouping,\n      rowCount: rows.length,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_report.exported failed', { err })\n    })\n\n    // The after-pass cannot rewrite an export's bytes, so what it shapes is the\n    // file's descriptor: an interceptor may rename the download or restate its\n    // media type, and a failing one replaces the file with its own error.\n    const intercepted = await session.respondWithDescriptor({\n      reportId: report.id,\n      reference: report.reference,\n      format,\n      grouping: sheet.grouping,\n      rowCount: rows.length,\n      filename: file.filename,\n      contentType: file.contentType,\n    })\n    if (!intercepted.ok) return intercepted.response\n\n    const filename =\n      typeof intercepted.descriptor.filename === 'string' && intercepted.descriptor.filename.trim().length > 0\n        ? intercepted.descriptor.filename.trim()\n        : file.filename\n    const contentType =\n      typeof intercepted.descriptor.contentType === 'string' && intercepted.descriptor.contentType.trim().length > 0\n        ? intercepted.descriptor.contentType.trim()\n        : file.contentType\n\n    return new NextResponse(new Uint8Array(file.body), {\n      status: 200,\n      headers: {\n        'content-type': contentType,\n        'content-disposition': `attachment; filename=\"${filename}\"`,\n        'cache-control': 'no-store',\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.reports.export failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Export a customer report',\n  methods: {\n    GET: {\n      summary: 'Export a customer report',\n      get query() {\n        return exportQuerySchema()\n      },\n      description:\n        'Renders the report as `pdf` (mirrors the on-screen sheet, client-facing), `csv` or `xlsx` (raw accounting columns: date, project, task, person, description, raw and rounded minutes, billable, rate, amount). Honours the report grouping \u2014 overridable per request with `?grouping=` \u2014 plus its filters, rounding and currency. Appends an `exported` report event; exporting never locks entries. Rates and amounts are omitted for a caller without staff.timesheets.rates.view.',\n      responses: [{ status: 200, description: 'The rendered report file' }],\n      errors: [\n        { status: 400, description: 'Unsupported format' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        { status: 404, description: 'Report not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAkBA,SAAS,oBAAoB;AAE7B,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,iBAAiB,4BAA4B;AACtD,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,SAAS;AAClB,SAAS,6BAA6B,yBAAyC;AAC/E;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAGlF,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAMA,SAAS,UAAU,QAA0F;AAC3G,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL,QAAQ,OAAO,IAAI,QAAQ;AAAA,IAC3B,UAAU,kBAAkB,QAAQ,IAAK,WAA8B;AAAA,EACzE;AACF;AAOA,SAAS,oBAAkC;AACzC,SAAO,EAAE,OAAO;AAAA,IACd,QAAQ,EAAE,KAAK,6BAA6B,CAA0B;AAAA,IACtE,UAAU,EAAE,KAAK,kBAAkB,CAA0B,EAAE,SAAS;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,aAAa,WAA0C;AAC9D,SAAO;AAAA,IACL,eAAe,UAAU,8CAA8C,yBAAyB;AAAA,IAChG,UAAU,UAAU,8CAA8C,WAAW;AAAA,IAC7E,WAAW,UAAU,+CAA+C,WAAW;AAAA,IAC/E,QAAQ,UAAU,4CAA4C,QAAQ;AAAA,IACtE,MAAM,UAAU,+CAA+C,MAAM;AAAA,IACrE,MAAM,UAAU,0CAA0C,MAAM;AAAA,IAChE,MAAM,UAAU,0CAA0C,MAAM;AAAA,IAChE,QAAQ,UAAU,4CAA4C,QAAQ;AAAA,IACtE,OAAO,UAAU,2CAA2C,kBAAkB;AAAA,IAC9E,WAAW;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,IACA,aAAa,UAAU,iDAAiD,mBAAmB;AAAA,IAC3F,eAAe,UAAU,mDAAmD,aAAa;AAAA,IACzF,MAAM,UAAU,2CAA2C,MAAM;AAAA,IACjE,SAAS,UAAU,8CAA8C,SAAS;AAAA,IAC1E,MAAM,UAAU,2CAA2C,MAAM;AAAA,IACjE,QAAQ,UAAU,6CAA6C,QAAQ;AAAA,IACvE,aAAa,UAAU,kDAAkD,aAAa;AAAA,IACtF,UAAU,UAAU,+CAA+C,UAAU;AAAA,IAC7E,KAAK,UAAU,0CAA0C,KAAK;AAAA,IAC9D,IAAI,UAAU,yCAAyC,IAAI;AAAA,IAC3D,YAAY,UAAU,iDAAiD,aAAa;AAAA,IACpF,gBAAgB,UAAU,qDAAqD,iBAAiB;AAAA,EAClG;AACF;AAEA,SAAS,cAAc,WAAsB,aAAqB,WAA2B;AAC3F,MAAI,CAAC,YAAa,QAAO,UAAU,4CAA4C,aAAa;AAC5F,QAAM,iBACJ,cAAc,YACV,UAAU,gDAAgD,gBAAgB,IAC1E,UAAU,2CAA2C,WAAW;AACtE,SAAO,UAAU,6CAA6C,qCAAqC,EAChG,QAAQ,aAAa,OAAO,WAAW,CAAC,EACxC,QAAQ,eAAe,cAAc;AAC1C;AAEA,SAAS,iBAAiB,UAAsD,UAA0B;AACxG,MAAI,CAAC,SAAU,QAAO;AACtB,aAAW,OAAO,CAAC,QAAQ,eAAe,gBAAgB,aAAa,YAAY,GAAG;AACpF,UAAM,QAAQ,SAAS,GAAG;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,SAAS,CAAC;AAK5E,UAAM,EAAE,WAAW,MAAM,UAAU,gBAAgB,UAAU,WAAW,aAAa,gBAAgB,IACnG;AAEF,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,EAAE,QAAQ,WAAW,SAAS,IAAI,UAAU,QAAQ,YAAY;AACtE,UAAM,SAAS,4BAA4B,SAAS;AACpD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,QACA,kBAAkB,6BAA6B;AAAA,MACjD,CAAC;AAAA,IACH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,qCAAqC;AAAA,MACvG,CAAC;AAAA,IACH;AAEA,UAAM,iBAAiB,MAAM,qBAAqB,IAAI,OAAO,IAAI,EAAE,UAAU,eAAe,CAAC;AAC7F,UAAM,SAAS,kBAAkB,SAAS;AAC1C,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACnC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,gBAAgB;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAED,UAAM,aAAa,OAAO,sBAAsB,OAAO,OAAO,WAAW,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AACtG,UAAM,WAAW,OAAO,oBAAoB,OAAO,OAAO,SAAS,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAEhG,UAAM,OAAO,sBAAsB,QAAQ;AAAA,MACzC,WAAW,OAAO;AAAA,MAClB,OAAO,OAAO;AAAA,MACd,cAAc,iBAAiB,OAAO,kBAAkB,OAAO,KAAK;AAAA,MACpE,aAAa,GAAG,UAAU,WAAM,QAAQ;AAAA,MACxC,eAAe;AAAA,MACf,eAAe,OAAO,WAAW,OAAO,SAAS,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAAA,MAC9E,cAAc,MAAM;AAAA,MACpB,YAAY,OAAO,aAAa,SAAS;AAAA,MACzC,QAAQ,MAAM,OAAO;AAAA,MACrB,MAAM,cAAc,OAAO,KAAK,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,MAAM,MAAM,QAAQ,KAAK,EAAE;AAAA,MACnF,QAAQ;AAAA,QACN,iBAAiB,MAAM,OAAO;AAAA,QAC9B,oBAAoB,MAAM,OAAO;AAAA,QACjC,aAAa,cAAc,MAAM,OAAO,cAAc;AAAA,MACxD;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,OAAO,uBAAuB;AAAA,QAC9B,OAAO,qBAAqB;AAAA,MAC9B;AAAA,MACA,QAAQ,aAAa,SAAS;AAAA,IAChC,CAAC;AAGD,QAAI;AACF,YAAM,UAAW,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAChE,cAAQ;AAAA,QACN,QAAQ,OAAO,sBAAsB;AAAA,UACnC;AAAA,UACA;AAAA,UACA,UAAU,OAAO;AAAA,UACjB,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,UACvD,UAAU,EAAE,QAAQ,UAAU,MAAM,UAAU,UAAU,KAAK,OAAO;AAAA,UACpE,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM,QAAQ,MAAM;AAAA,IACtB,SAAS,KAAK;AAGZ,aAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAAA,IAC5E;AAEA,SAAK,eAAe,yCAAyC;AAAA,MAC3D,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,IACjB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AAAA,IAC3E,CAAC;AAKD,UAAM,cAAc,MAAM,QAAQ,sBAAsB;AAAA,MACtD,UAAU,OAAO;AAAA,MACjB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,aAAa,KAAK;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,WACJ,OAAO,YAAY,WAAW,aAAa,YAAY,YAAY,WAAW,SAAS,KAAK,EAAE,SAAS,IACnG,YAAY,WAAW,SAAS,KAAK,IACrC,KAAK;AACX,UAAM,cACJ,OAAO,YAAY,WAAW,gBAAgB,YAAY,YAAY,WAAW,YAAY,KAAK,EAAE,SAAS,IACzG,YAAY,WAAW,YAAY,KAAK,IACxC,KAAK;AAEX,WAAO,IAAI,aAAa,IAAI,WAAW,KAAK,IAAI,GAAG;AAAA,MACjD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,uBAAuB,yBAAyB,QAAQ;AAAA,QACxD,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,IAAI,QAAQ;AACV,eAAO,kBAAkB;AAAA,MAC3B;AAAA,MACA,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,CAAC;AAAA,MACpE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB;AAAA,QACjD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/reports/[id]/export?format=pdf|csv|xlsx` \u2014 US-G4.\n *\n * Two rules from screen 14:\n *\n *  - **Note 3.** The export inherits the current grouping, filters, rounding and\n *    currency, because it is produced from the same `buildReportSheet` the page\n *    rendered. PDF mirrors that sheet; CSV and XLSX add the raw accounting\n *    columns (date, person, description, raw vs rounded minutes).\n *  - **Note 5.** Exporting NEVER locks. The only write here is an append-only\n *    `exported` report event, which is what lets the unlock dialog say \"the PDF\n *    was downloaded on the 20th\" before someone restates a billed hour.\n *\n * The event is appended after the file is built, so a failed render leaves no\n * trace of an export that never happened; a failed event write is logged and\n * does not deny the caller their file.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeReport, StaffTimeReportEvent } from '../../../../../data/entities'\nimport { loadReportProjectIds } from '../../../../../commands/timesheets-reports'\nimport { buildReportSheet } from '../../../../../lib/timesheets-reports/buildReportSheet'\nimport { buildReportRows } from '../../../../../lib/timesheets-reports/reportRows'\nimport { formatReportPeriodDate } from '../../../../../lib/timesheets-reports/reportPeriod'\nimport {\n  normalizeReportExportFormat,\n  serializeReportExport,\n  supportedReportExportFormats,\n  type ReportExportLabels,\n} from '../../../../../lib/timesheets-reports/reportExport'\nimport {\n  hasReportGrouping,\n  reportGroupingIds,\n  type ReportGrouping,\n} from '../../../../../lib/timesheets-reports/reportGroupings'\nimport { z } from 'zod'\nimport { resolveReportRequestContext, reportSheetLabels, type Translate } from '../../shared'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/export' })\n\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.view'] },\n}\n\n/**\n * EP-35 / EP-36: both accepted sets come from their registries, so a contributed\n * format or grouping is accepted here without this file being edited.\n */\nfunction readQuery(params: URLSearchParams): { format: string | null; grouping: ReportGrouping | undefined } {\n  const grouping = params.get('grouping')\n  return {\n    format: params.get('format'),\n    grouping: hasReportGrouping(grouping) ? (grouping as ReportGrouping) : undefined,\n  }\n}\n\n/**\n * Read lazily rather than frozen at module load: a module registering a format\n * after this route file is first imported must still appear in the published\n * schema.\n */\nfunction exportQuerySchema(): z.ZodTypeAny {\n  return z.object({\n    format: z.enum(supportedReportExportFormats() as [string, ...string[]]),\n    grouping: z.enum(reportGroupingIds() as [string, ...string[]]).optional(),\n  })\n}\n\nfunction exportLabels(translate: Translate): ReportExportLabels {\n  return {\n    documentTitle: translate('staff.time_tracking.reports.sheet.overline', 'Time and cost statement'),\n    issuedBy: translate('staff.time_tracking.reports.sheet.issuedBy', 'Issued by'),\n    reference: translate('staff.time_tracking.reports.sheet.reference', 'Reference'),\n    period: translate('staff.time_tracking.reports.sheet.period', 'Period'),\n    line: translate('staff.time_tracking.reports.sheet.lineLabel', 'Line'),\n    time: translate('staff.time_tracking.reports.sheet.time', 'Time'),\n    rate: translate('staff.time_tracking.reports.sheet.rate', 'Rate'),\n    amount: translate('staff.time_tracking.reports.sheet.amount', 'Amount'),\n    total: translate('staff.time_tracking.reports.sheet.total', 'Total to invoice'),\n    totalHint: translate(\n      'staff.time_tracking.reports.sheet.totalHint',\n      '{billable} billable \u00B7 {nonbillable} non-billable \u00B7 {rounding}',\n    ),\n    nonbillable: translate('staff.time_tracking.reports.sheet.nonbillable', 'Non-billable time'),\n    overrideBadge: translate('staff.time_tracking.reports.sheet.overrideBadge', 'agreed rate'),\n    date: translate('staff.time_tracking.reports.export.date', 'Date'),\n    project: translate('staff.time_tracking.reports.export.project', 'Project'),\n    task: translate('staff.time_tracking.reports.export.task', 'Task'),\n    person: translate('staff.time_tracking.reports.export.person', 'Person'),\n    description: translate('staff.time_tracking.reports.export.description', 'Description'),\n    billable: translate('staff.time_tracking.reports.export.billable', 'Billable'),\n    yes: translate('staff.time_tracking.reports.export.yes', 'Yes'),\n    no: translate('staff.time_tracking.reports.export.no', 'No'),\n    rawMinutes: translate('staff.time_tracking.reports.export.rawMinutes', 'Raw minutes'),\n    roundedMinutes: translate('staff.time_tracking.reports.export.roundedMinutes', 'Rounded minutes'),\n  }\n}\n\nfunction roundingLabel(translate: Translate, unitMinutes: number, direction: string): string {\n  if (!unitMinutes) return translate('staff.time_tracking.reports.rounding.off', 'no rounding')\n  const directionLabel =\n    direction === 'nearest'\n      ? translate('staff.time_tracking.reports.rounding.nearest', 'to the nearest')\n      : translate('staff.time_tracking.reports.rounding.up', 'always up')\n  return translate('staff.time_tracking.reports.rounding.rule', 'rounding {minutes} min, {direction}')\n    .replace('{minutes}', String(unitMinutes))\n    .replace('{direction}', directionLabel)\n}\n\nfunction readCustomerName(snapshot: Record<string, unknown> | null | undefined, fallback: string): string {\n  if (!snapshot) return fallback\n  for (const key of ['name', 'displayName', 'display_name', 'legalName', 'legal_name']) {\n    const value = snapshot[key]\n    if (typeof value === 'string' && value.trim().length > 0) return value.trim()\n  }\n  return fallback\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'export' })\n    // `canSeeMoney` comes from the shared context and is never re-derived here:\n    // the previous `grantedFeatures === null || authorize(...)` opened the money\n    // fields whenever the grant read failed, and this route requires only\n    // `reports.view`, so nothing else stood in the way.\n    const { container, auth, tenantId, organizationId, reportId, translate, canSeeMoney, grantedFeatures } =\n      context\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const { format: rawFormat, grouping } = readQuery(session.searchParams)\n    const format = normalizeReportExportFormat(rawFormat)\n    if (!format) {\n      throw new CrudHttpError(400, {\n        error: translate(\n          'staff.time_tracking.reports.errors.unsupportedFormat',\n          'Supported export formats are pdf, csv and xlsx.',\n        ),\n        supportedFormats: supportedReportExportFormats(),\n      })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const report = await em.findOne(StaffTimeReport, {\n      id: reportId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!report) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.reports.errors.notFound', 'Report not found or not accessible.'),\n      })\n    }\n\n    const timeProjectIds = await loadReportProjectIds(em, report.id, { tenantId, organizationId })\n    const labels = reportSheetLabels(translate)\n    const sheet = await buildReportSheet({\n      em,\n      scope: { tenantId, organizationId },\n      report,\n      timeProjectIds,\n      labels,\n      grouping,\n    })\n    const rows = buildReportRows({\n      entries: sheet.entries,\n      projects: sheet.projects,\n      directory: sheet.directory,\n      labels,\n    })\n\n    const periodFrom = formatReportPeriodDate(report.periodFrom) ?? ''\n    const periodTo = formatReportPeriodDate(report.periodTo) ?? ''\n\n    const file = serializeReportExport(format, {\n      reference: report.reference,\n      title: report.title,\n      customerName: readCustomerName(report.customerSnapshot, report.title),\n      periodLabel: `${periodFrom} \u2013 ${periodTo}`,\n      issuedByLabel: null,\n      issuedAtLabel: report.closedAt ? report.closedAt.toISOString().slice(0, 10) : null,\n      currencyCode: sheet.currencyCode,\n      showRates: (report.showRates ?? true) && canSeeMoney,\n      groups: sheet.totals.groups,\n      rows: canSeeMoney ? rows : rows.map((row) => ({ ...row, rate: null, amount: null })),\n      totals: {\n        billableMinutes: sheet.totals.billableMinutes,\n        nonbillableMinutes: sheet.totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? sheet.totals.totalAmount : 0,\n      },\n      roundingLabel: roundingLabel(\n        translate,\n        report.roundingUnitMinutes ?? 0,\n        report.roundingDirection ?? 'up',\n      ),\n      labels: exportLabels(translate),\n    })\n\n    // Append-only audit. Never a lock \u2014 screen 14 note 5.\n    try {\n      const eventEm = (container.resolve('em') as EntityManager).fork()\n      eventEm.persist(\n        eventEm.create(StaffTimeReportEvent, {\n          tenantId,\n          organizationId,\n          reportId: report.id,\n          eventType: 'exported',\n          reason: null,\n          actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n          metadata: { format, grouping: sheet.grouping, rowCount: rows.length },\n          createdAt: new Date(),\n        }),\n      )\n      await eventEm.flush()\n    } catch (err) {\n      // The caller already has a correct file; refusing it because the audit row\n      // failed would be the wrong trade.\n      logger.error('staff.timesheets.reports.export audit event failed', { err })\n    }\n\n    void emitStaffEvent('staff.timesheets.time_report.exported', {\n      id: report.id,\n      tenantId,\n      organizationId,\n      reference: report.reference,\n      format,\n      grouping: sheet.grouping,\n      rowCount: rows.length,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_report.exported failed', { err })\n    })\n\n    // The after-pass cannot rewrite an export's bytes, so what it shapes is the\n    // file's descriptor: an interceptor may rename the download or restate its\n    // media type, and a failing one replaces the file with its own error.\n    const intercepted = await session.respondWithDescriptor({\n      reportId: report.id,\n      reference: report.reference,\n      format,\n      grouping: sheet.grouping,\n      rowCount: rows.length,\n      filename: file.filename,\n      contentType: file.contentType,\n    })\n    if (!intercepted.ok) return intercepted.response\n\n    const filename =\n      typeof intercepted.descriptor.filename === 'string' && intercepted.descriptor.filename.trim().length > 0\n        ? intercepted.descriptor.filename.trim()\n        : file.filename\n    const contentType =\n      typeof intercepted.descriptor.contentType === 'string' && intercepted.descriptor.contentType.trim().length > 0\n        ? intercepted.descriptor.contentType.trim()\n        : file.contentType\n\n    return new NextResponse(new Uint8Array(file.body), {\n      status: 200,\n      headers: {\n        'content-type': contentType,\n        'content-disposition': `attachment; filename=\"${filename}\"`,\n        'cache-control': 'no-store',\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.reports.export failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Export a customer report',\n  methods: {\n    GET: {\n      summary: 'Export a customer report',\n      get query() {\n        return exportQuerySchema()\n      },\n      description:\n        'Renders the report as `pdf` (mirrors the on-screen sheet, client-facing), `csv` or `xlsx` (raw accounting columns: date, project, task, person, description, raw and rounded minutes, billable, rate, amount). Honours the report grouping \u2014 overridable per request with `?grouping=` \u2014 plus its filters, rounding and currency. Appends an `exported` report event; exporting never locks entries. Rates and amounts are omitted for a caller without staff.timesheets.rates.view.',\n      responses: [{ status: 200, description: 'The rendered report file' }],\n      errors: [\n        { status: 400, description: 'Unsupported format' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        { status: 404, description: 'Report not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAkBA,SAAS,oBAAoB;AAE7B,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,iBAAiB,4BAA4B;AACtD,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,SAAS;AAClB,SAAS,6BAA6B,yBAAyC;AAC/E;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAGlF,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAMA,SAAS,UAAU,QAA0F;AAC3G,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL,QAAQ,OAAO,IAAI,QAAQ;AAAA,IAC3B,UAAU,kBAAkB,QAAQ,IAAK,WAA8B;AAAA,EACzE;AACF;AAOA,SAAS,oBAAkC;AACzC,SAAO,EAAE,OAAO;AAAA,IACd,QAAQ,EAAE,KAAK,6BAA6B,CAA0B;AAAA,IACtE,UAAU,EAAE,KAAK,kBAAkB,CAA0B,EAAE,SAAS;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,aAAa,WAA0C;AAC9D,SAAO;AAAA,IACL,eAAe,UAAU,8CAA8C,yBAAyB;AAAA,IAChG,UAAU,UAAU,8CAA8C,WAAW;AAAA,IAC7E,WAAW,UAAU,+CAA+C,WAAW;AAAA,IAC/E,QAAQ,UAAU,4CAA4C,QAAQ;AAAA,IACtE,MAAM,UAAU,+CAA+C,MAAM;AAAA,IACrE,MAAM,UAAU,0CAA0C,MAAM;AAAA,IAChE,MAAM,UAAU,0CAA0C,MAAM;AAAA,IAChE,QAAQ,UAAU,4CAA4C,QAAQ;AAAA,IACtE,OAAO,UAAU,2CAA2C,kBAAkB;AAAA,IAC9E,WAAW;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,IACA,aAAa,UAAU,iDAAiD,mBAAmB;AAAA,IAC3F,eAAe,UAAU,mDAAmD,aAAa;AAAA,IACzF,MAAM,UAAU,2CAA2C,MAAM;AAAA,IACjE,SAAS,UAAU,8CAA8C,SAAS;AAAA,IAC1E,MAAM,UAAU,2CAA2C,MAAM;AAAA,IACjE,QAAQ,UAAU,6CAA6C,QAAQ;AAAA,IACvE,aAAa,UAAU,kDAAkD,aAAa;AAAA,IACtF,UAAU,UAAU,+CAA+C,UAAU;AAAA,IAC7E,KAAK,UAAU,0CAA0C,KAAK;AAAA,IAC9D,IAAI,UAAU,yCAAyC,IAAI;AAAA,IAC3D,YAAY,UAAU,iDAAiD,aAAa;AAAA,IACpF,gBAAgB,UAAU,qDAAqD,iBAAiB;AAAA,EAClG;AACF;AAEA,SAAS,cAAc,WAAsB,aAAqB,WAA2B;AAC3F,MAAI,CAAC,YAAa,QAAO,UAAU,4CAA4C,aAAa;AAC5F,QAAM,iBACJ,cAAc,YACV,UAAU,gDAAgD,gBAAgB,IAC1E,UAAU,2CAA2C,WAAW;AACtE,SAAO,UAAU,6CAA6C,qCAAqC,EAChG,QAAQ,aAAa,OAAO,WAAW,CAAC,EACxC,QAAQ,eAAe,cAAc;AAC1C;AAEA,SAAS,iBAAiB,UAAsD,UAA0B;AACxG,MAAI,CAAC,SAAU,QAAO;AACtB,aAAW,OAAO,CAAC,QAAQ,eAAe,gBAAgB,aAAa,YAAY,GAAG;AACpF,UAAM,QAAQ,SAAS,GAAG;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,SAAS,CAAC;AAK5E,UAAM,EAAE,WAAW,MAAM,UAAU,gBAAgB,UAAU,WAAW,aAAa,gBAAgB,IACnG;AAEF,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,EAAE,QAAQ,WAAW,SAAS,IAAI,UAAU,QAAQ,YAAY;AACtE,UAAM,SAAS,4BAA4B,SAAS;AACpD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,QACA,kBAAkB,6BAA6B;AAAA,MACjD,CAAC;AAAA,IACH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,qCAAqC;AAAA,MACvG,CAAC;AAAA,IACH;AAEA,UAAM,iBAAiB,MAAM,qBAAqB,IAAI,OAAO,IAAI,EAAE,UAAU,eAAe,CAAC;AAC7F,UAAM,SAAS,kBAAkB,SAAS;AAC1C,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACnC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,gBAAgB;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAED,UAAM,aAAa,uBAAuB,OAAO,UAAU,KAAK;AAChE,UAAM,WAAW,uBAAuB,OAAO,QAAQ,KAAK;AAE5D,UAAM,OAAO,sBAAsB,QAAQ;AAAA,MACzC,WAAW,OAAO;AAAA,MAClB,OAAO,OAAO;AAAA,MACd,cAAc,iBAAiB,OAAO,kBAAkB,OAAO,KAAK;AAAA,MACpE,aAAa,GAAG,UAAU,WAAM,QAAQ;AAAA,MACxC,eAAe;AAAA,MACf,eAAe,OAAO,WAAW,OAAO,SAAS,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAAA,MAC9E,cAAc,MAAM;AAAA,MACpB,YAAY,OAAO,aAAa,SAAS;AAAA,MACzC,QAAQ,MAAM,OAAO;AAAA,MACrB,MAAM,cAAc,OAAO,KAAK,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,MAAM,MAAM,QAAQ,KAAK,EAAE;AAAA,MACnF,QAAQ;AAAA,QACN,iBAAiB,MAAM,OAAO;AAAA,QAC9B,oBAAoB,MAAM,OAAO;AAAA,QACjC,aAAa,cAAc,MAAM,OAAO,cAAc;AAAA,MACxD;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,OAAO,uBAAuB;AAAA,QAC9B,OAAO,qBAAqB;AAAA,MAC9B;AAAA,MACA,QAAQ,aAAa,SAAS;AAAA,IAChC,CAAC;AAGD,QAAI;AACF,YAAM,UAAW,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAChE,cAAQ;AAAA,QACN,QAAQ,OAAO,sBAAsB;AAAA,UACnC;AAAA,UACA;AAAA,UACA,UAAU,OAAO;AAAA,UACjB,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,UACvD,UAAU,EAAE,QAAQ,UAAU,MAAM,UAAU,UAAU,KAAK,OAAO;AAAA,UACpE,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM,QAAQ,MAAM;AAAA,IACtB,SAAS,KAAK;AAGZ,aAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAAA,IAC5E;AAEA,SAAK,eAAe,yCAAyC;AAAA,MAC3D,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,IACjB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AAAA,IAC3E,CAAC;AAKD,UAAM,cAAc,MAAM,QAAQ,sBAAsB;AAAA,MACtD,UAAU,OAAO;AAAA,MACjB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,aAAa,KAAK;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,WACJ,OAAO,YAAY,WAAW,aAAa,YAAY,YAAY,WAAW,SAAS,KAAK,EAAE,SAAS,IACnG,YAAY,WAAW,SAAS,KAAK,IACrC,KAAK;AACX,UAAM,cACJ,OAAO,YAAY,WAAW,gBAAgB,YAAY,YAAY,WAAW,YAAY,KAAK,EAAE,SAAS,IACzG,YAAY,WAAW,YAAY,KAAK,IACxC,KAAK;AAEX,WAAO,IAAI,aAAa,IAAI,WAAW,KAAK,IAAI,GAAG;AAAA,MACjD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,uBAAuB,yBAAyB,QAAQ;AAAA,QACxD,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,IAAI,QAAQ;AACV,eAAO,kBAAkB;AAAA,MAC3B;AAAA,MACA,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,CAAC;AAAA,MACpE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB;AAAA,QACjD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/[id]/sheet/route.js

@@ -7,6 +7,7 @@ import { StaffTimeReport, StaffTimeReportEvent } from "../../../../../data/entit
 import { loadReportProjectIds } from "../../../../../commands/timesheets-reports.js";
 import { buildReportSheet } from "../../../../../lib/timesheets-reports/buildReportSheet.js";
 import { buildReportRows } from "../../../../../lib/timesheets-reports/reportRows.js";
+import { formatReportPeriodDate } from "../../../../../lib/timesheets-reports/reportPeriod.js";
 import { hasReportGrouping } from "../../../../../lib/timesheets-reports/reportGroupings.js";
 import { resolveReportRequestContext, reportSheetLabels, MAX_SHEET_ROWS } from "../../shared.js";
 import {
@@ -75,8 +76,8 @@ async function GET(req) {
         customerId: report.customerId,
         customerSnapshot: report.customerSnapshot ?? null,
         periodKind: report.periodKind,
-        periodFrom: report.periodFrom instanceof Date ? report.periodFrom.toISOString().slice(0, 10) : null,
-        periodTo: report.periodTo instanceof Date ? report.periodTo.toISOString().slice(0, 10) : null,
+        periodFrom: formatReportPeriodDate(report.periodFrom),
+        periodTo: formatReportPeriodDate(report.periodTo),
         currencyCode: sheet.currencyCode,
         grouping: sheet.grouping,
         nonbillableMode: sheet.nonbillableMode,