@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/staff/api/timesheets/time-entries/[id]/duplicate/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/duplicate/route.ts"],
-  "sourcesContent": ["/**\n * US-D6 \u2014 \"repeat yesterday\", for one entry.\n *\n * The row action on screen 10 and the per-row copy button on screen 1 both land\n * here. The route is deliberately thin: T4.2 already put the whole copy in the\n * `staff.timesheets.time_entries.duplicate` command, which resolves the SOURCE,\n * runs it past the lock gate and then delegates the write to the create command\n * so the copy inherits ownership enforcement, project access, the billable and\n * currency defaults, rounding (D-7), tag syncing and the audit entry unchanged.\n * Nothing here re-implements any of that.\n *\n * Two things the route owns that the command cannot:\n *\n *  1. **Existence is decided by the caller's project access, not by the row.** The\n *     source is looked up through the same intersection the list route applies \u2014\n *     entries on projects the caller belongs to, plus their own project-less\n *     entries \u2014 and anything outside it answers `404`, never `403`. A `403` on a\n *     project the caller cannot see would confirm the entry exists and name the\n *     project it belongs to.\n *  2. **`date` and `durationMinutes` overrides.** US-D6 ends with \"I adjust the\n *     duration and the date\", so both travel with the copy request instead of\n *     costing a follow-up PUT that would briefly show the wrong duration.\n *\n * `tagIds` is passed in by the caller rather than read off the junction: the\n * command writes tags only through the tag commands and never touches\n * `staff_time_entry_tags`, and the client already holds the source's `tags[]`\n * from the list response.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeEntry } from '../../../../../data/entities'\nimport { staffTimeEntryCommandIds } from '../../../../../commands/timesheets-entries'\nimport { resolveProjectAccess, type ProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../../../lib/time-tracking/settings'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/duplicate' })\n\nconst MANAGE_OWN_FEATURE = 'staff.timesheets.manage_own'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_OWN_FEATURE] },\n}\n\nconst duplicateRequestSchema = z.object({\n  date: z.coerce.date().optional(),\n  durationMinutes: z.number().int().min(0).max(1440).optional(),\n  tagIds: z.array(z.string().uuid()).max(50).optional(),\n})\n\nconst duplicateResponseSchema = z.object({\n  id: z.string().uuid(),\n  sourceId: z.string().uuid(),\n})\n\nconst lockedConflictSchema = z.object({\n  code: z.literal('time_entry_locked'),\n  error: z.string(),\n  lockedReportId: z.string().uuid().nullable(),\n  lockedEntryIds: z.array(z.string().uuid()),\n  lockedReportIds: z.array(z.string().uuid()),\n})\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/duplicate/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string,\n  organizationId: string,\n  grantedFeatures: readonly string[],\n): Promise<ProjectAccess> {\n  const em = container.resolve('em') as EntityManager\n  return resolveProjectAccess({\n    em: em.fork(),\n    userId,\n    tenantId,\n    organizationId,\n    userFeatures: grantedFeatures,\n    assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n  })\n}\n\n/**\n * The per-row form of the list route's `$or` intersection: an entry on a project\n * is visible to the members of that project, and a project-less entry is visible\n * only to the member who logged it.\n */\nfunction isTimeEntryVisible(\n  entry: { staffMemberId: string; timeProjectId?: string | null },\n  access: ProjectAccess,\n): boolean {\n  if (access.canManageAll) return true\n  const projectId = entry.timeProjectId ?? null\n  if (projectId) return access.projectIds.includes(projectId)\n  return access.staffMemberId !== null && access.staffMemberId === entry.staffMemberId\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const timeEntryId = extractEntryIdFromUrl(req)\n    if (!timeEntryId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const manageOwn = await resolveFeatureAccess(container, actorId, [MANAGE_OWN_FEATURE], { tenantId, organizationId })\n    if (!manageOwn.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageOwn.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = duplicateRequestSchema.parse(session.body)\n\n    // The source is resolved here, before the command, purely so an entry the\n    // caller cannot see answers 404 instead of the command's 403 \u2014 which would\n    // confirm the entry exists and name the project that hides it.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const source = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: timeEntryId, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n    const access = await loadProjectAccess(container, actorId || null, tenantId, organizationId, grantedFeatures)\n    if (!source || !isTimeEntryVisible(source, access)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found, deleted, or not owned by you.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: timeEntryId,\n        operation: 'create',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? duplicateRequestSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<unknown, { timeEntryId: string }>(\n      staffTimeEntryCommandIds.duplicate,\n      { input: { ...effective, id: timeEntryId }, ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    if (result?.timeEntryId) {\n      void emitStaffEvent('staff.timesheets.time_entry.copied', {\n        id: result.timeEntryId,\n        sourceId: timeEntryId,\n        tenantId,\n        organizationId,\n      }, { persistent: true }).catch((err) => {\n        logger.error('staff.timesheets emit time_entry.copied failed', { err })\n      })\n    }\n\n    return session.respond(201, { id: result?.timeEntryId ?? null, sourceId: timeEntryId })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.time-entries.duplicate failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Duplicate a time entry',\n  methods: {\n    POST: {\n      summary: 'Duplicate a time entry',\n      description:\n        'US-D6. Copies an existing time entry, carrying its task, project, description, billable flag and rate override across. `date` and `durationMinutes` override the copy without a second request; `tagIds` sets the copy tag set (the caller passes the source tags it already holds from the list response). The copy is written through the create command, so ownership, project access, the billable and currency defaults, and the tenant rounding rule apply to it exactly as they do to a hand-made entry. A source locked into a closed report is refused with 409 `time_entry_locked`; a source the caller cannot see answers 404.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: duplicateRequestSchema,\n      },\n      responses: [\n        { status: 201, description: 'Copy created', schema: duplicateResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid body or missing scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.manage_own' },\n        { status: 404, description: 'Time entry not found, deleted, or outside the caller project access' },\n        {\n          status: 409,\n          description: 'The source entry is locked into a closed report; nothing was copied',\n          schema: lockedConflictSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AA6BA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,0CAA0C;AAGnD,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,4BAAgD;AACzD,SAAS,gCAAgC;AACzC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,wCAAwC,CAAC;AAEjG,MAAM,qBAAqB;AAC3B,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EAC/B,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC5D,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AACtD,CAAC;AAED,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,mBAAmB;AAAA,EACnC,OAAO,EAAE,OAAO;AAAA,EAChB,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC5C,CAAC;AAID,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,oCAAoC;AACrE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACA,iBACwB;AACxB,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO,qBAAqB;AAAA,IAC1B,IAAI,GAAG,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,EAC3E,CAAC;AACH;AAOA,SAAS,mBACP,OACA,QACS;AACT,MAAI,OAAO,aAAc,QAAO;AAChC,QAAM,YAAY,MAAM,iBAAiB;AACzC,MAAI,UAAW,QAAO,OAAO,WAAW,SAAS,SAAS;AAC1D,SAAO,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,MAAM;AACzE;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,sBAAsB,GAAG;AAC7C,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,0CAA0C,mBAAmB;AAAA,MAChF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAI5B,UAAM,YAAY,MAAM,qBAAqB,WAAW,SAAS,CAAC,kBAAkB,GAAG,EAAE,UAAU,eAAe,CAAC;AACnH,QAAI,CAAC,UAAU,SAAS;AACtB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,UAAU;AAElC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,uBAAuB,MAAM,QAAQ,IAAI;AAKxD,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,aAAa,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC7D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,SAAS,MAAM,kBAAkB,WAAW,WAAW,MAAM,UAAU,gBAAgB,eAAe;AAC5G,QAAI,CAAC,UAAU,CAAC,mBAAmB,QAAQ,MAAM,GAAG;AAClD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,qDAAqD;AAAA,MACjH,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,uBAAuB,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAC1E;AAEJ,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,MAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC,yBAAyB;AAAA,MACzB,EAAE,OAAO,EAAE,GAAG,WAAW,IAAI,YAAY,GAAG,IAAI;AAAA,IAClD;AAEA,UAAM,YAAY,gBAAgB;AAElC,QAAI,QAAQ,aAAa;AACvB,WAAK,eAAe,sCAAsC;AAAA,QACxD,IAAI,OAAO;AAAA,QACX,UAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,eAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,MACxE,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,QAAQ,eAAe,MAAM,UAAU,YAAY,CAAC;AAAA,EACxF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,wBAAwB;AAAA,MAC9E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,sEAAsE;AAAA,QAClG;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * US-D6 \u2014 \"repeat yesterday\", for one entry.\n *\n * The row action on screen 10 and the per-row copy button on screen 1 both land\n * here. The route is deliberately thin: T4.2 already put the whole copy in the\n * `staff.timesheets.time_entries.duplicate` command, which resolves the SOURCE,\n * runs it past the lock gate and then delegates the write to the create command\n * so the copy inherits ownership enforcement, project access, the billable and\n * currency defaults, rounding (D-7), tag syncing and the audit entry unchanged.\n * Nothing here re-implements any of that.\n *\n * Two things the route owns that the command cannot:\n *\n *  1. **Existence is decided by the caller's project access, not by the row.** The\n *     source is looked up through the same intersection the list route applies \u2014\n *     entries on projects the caller belongs to, plus their own project-less\n *     entries \u2014 and anything outside it answers `404`, never `403`. A `403` on a\n *     project the caller cannot see would confirm the entry exists and name the\n *     project it belongs to.\n *  2. **`date` and `durationMinutes` overrides.** US-D6 ends with \"I adjust the\n *     duration and the date\", so both travel with the copy request instead of\n *     costing a follow-up PUT that would briefly show the wrong duration.\n *\n * `tagIds` is passed in by the caller rather than read off the junction: the\n * command writes tags only through the tag commands and never touches\n * `staff_time_entry_tags`, and the client already holds the source's `tags[]`\n * from the list response.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { StaffTimeEntry } from '../../../../../data/entities'\nimport { staffTimeEntryCommandIds } from '../../../../../commands/timesheets-entries'\nimport { resolveProjectAccess, type ProjectAccess } from '../../../../../lib/time-tracking/access'\nimport { readTimeTrackingSettings } from '../../../../../lib/time-tracking/settings'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/duplicate' })\n\nconst MANAGE_OWN_FEATURE = 'staff.timesheets.manage_own'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_OWN_FEATURE] },\n}\n\nconst duplicateRequestSchema = z.object({\n  date: z.coerce.date().optional(),\n  durationMinutes: z.number().int().min(0).max(1440).optional(),\n  tagIds: z.array(z.string().uuid()).max(50).optional(),\n})\n\nconst duplicateResponseSchema = z.object({\n  id: z.string().uuid(),\n  sourceId: z.string().uuid(),\n})\n\nconst lockedConflictSchema = z.object({\n  code: z.literal('time_entry_locked'),\n  error: z.string(),\n  lockedReportId: z.string().uuid().nullable(),\n  lockedEntryIds: z.array(z.string().uuid()),\n  lockedReportIds: z.array(z.string().uuid()),\n})\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/duplicate/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nasync function resolveAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  try {\n    const configService = container.resolve('moduleConfigService') as ModuleConfigService\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    // Fail safe to the documented default rather than widening the window.\n    return null\n  }\n}\n\nasync function loadProjectAccess(\n  container: ContainerLike,\n  userId: string | null,\n  tenantId: string,\n  organizationId: string,\n  grantedFeatures: readonly string[],\n): Promise<ProjectAccess> {\n  const em = container.resolve('em') as EntityManager\n  return resolveProjectAccess({\n    em: em.fork(),\n    userId,\n    tenantId,\n    organizationId,\n    userFeatures: grantedFeatures,\n    assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId),\n  })\n}\n\n/**\n * The per-row form of the list route's `$or` intersection: an entry on a project\n * is visible to the members of that project, and a project-less entry is visible\n * only to the member who logged it.\n */\nfunction isTimeEntryVisible(\n  entry: { staffMemberId: string; timeProjectId?: string | null },\n  access: ProjectAccess,\n): boolean {\n  if (access.canManageAll) return true\n  const projectId = entry.timeProjectId ?? null\n  if (projectId) return access.projectIds.includes(projectId)\n  return access.staffMemberId !== null && access.staffMemberId === entry.staffMemberId\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const timeEntryId = extractEntryIdFromUrl(req)\n    if (!timeEntryId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.'),\n      })\n    }\n\n    const actorId = auth.sub ?? ''\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const manageOwn = await resolveFeatureAccess(container, actorId, [MANAGE_OWN_FEATURE], { tenantId, organizationId })\n    if (!manageOwn.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = manageOwn.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: actorId, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = duplicateRequestSchema.parse(session.body)\n\n    // The source is resolved here, before the command, purely so an entry the\n    // caller cannot see answers 404 instead of the command's 403 \u2014 which would\n    // confirm the entry exists and name the project that hides it.\n    const em = (container.resolve('em') as EntityManager).fork()\n    const source = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: timeEntryId, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n    const access = await loadProjectAccess(container, actorId || null, tenantId, organizationId, grantedFeatures)\n    if (!source || !isTimeEntryVisible(source, access)) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found, deleted, or not owned by you.'),\n      })\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: timeEntryId,\n        operation: 'create',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? duplicateRequestSchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<unknown, { timeEntryId: string }>(\n      staffTimeEntryCommandIds.duplicate,\n      { input: { ...effective, id: timeEntryId }, ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    if (result?.timeEntryId) {\n      void emitStaffEvent('staff.timesheets.time_entry.copied', {\n        id: result.timeEntryId,\n        sourceId: timeEntryId,\n        tenantId,\n        organizationId,\n      }, { persistent: true }).catch((err) => {\n        logger.error('staff.timesheets emit time_entry.copied failed', { err })\n      })\n    }\n\n    return session.respond(201, { id: result?.timeEntryId ?? null, sourceId: timeEntryId })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.time-entries.duplicate failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Duplicate a time entry',\n  methods: {\n    POST: {\n      summary: 'Duplicate a time entry',\n      description:\n        'US-D6. Copies an existing time entry, carrying its task, project, description, billable flag and rate override across. `date` and `durationMinutes` override the copy without a second request; `tagIds` sets the copy tag set (the caller passes the source tags it already holds from the list response). The copy is written through the create command, so ownership, project access, the billable and currency defaults, and the tenant rounding rule apply to it exactly as they do to a hand-made entry. A source locked into a closed report is refused with 409 `time_entry_locked`; a source the caller cannot see answers 404.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: duplicateRequestSchema,\n      },\n      responses: [\n        { status: 201, description: 'Copy created', schema: duplicateResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid body or missing scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.manage_own' },\n        { status: 404, description: 'Time entry not found, deleted, or outside the caller project access' },\n        {\n          status: 409,\n          description: 'The source entry is locked into a closed report; nothing was copied',\n          schema: lockedConflictSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AA6BA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,0CAA0C;AAGnD,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,4BAAgD;AACzD,SAAS,gCAAgC;AACzC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,wCAAwC,CAAC;AAEjG,MAAM,qBAAqB;AAC3B,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EAC/B,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC5D,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AACtD,CAAC;AAED,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,mBAAmB;AAAA,EACnC,OAAO,EAAE,OAAO;AAAA,EAChB,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC5C,CAAC;AAID,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,oCAAoC;AACrE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,2BAA2B,WAA0B,UAA0C;AAC5G,MAAI;AACF,UAAM,gBAAgB,UAAU,QAAQ,qBAAqB;AAC7D,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBACb,WACA,QACA,UACA,gBACA,iBACwB;AACxB,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO,qBAAqB;AAAA,IAC1B,IAAI,GAAG,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,qBAAqB,MAAM,2BAA2B,WAAW,QAAQ;AAAA,EAC3E,CAAC;AACH;AAOA,SAAS,mBACP,OACA,QACS;AACT,MAAI,OAAO,aAAc,QAAO;AAChC,QAAM,YAAY,MAAM,iBAAiB;AACzC,MAAI,UAAW,QAAO,OAAO,WAAW,SAAS,SAAS;AAC1D,SAAO,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,MAAM;AACzE;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,sBAAsB,GAAG;AAC7C,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,0CAA0C,mBAAmB;AAAA,MAChF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,KAAK,OAAO;AAI5B,UAAM,YAAY,MAAM,qBAAqB,WAAW,SAAS,CAAC,kBAAkB,GAAG,EAAE,UAAU,eAAe,CAAC;AACnH,QAAI,CAAC,UAAU,SAAS;AACtB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,UAAU;AAElC,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,SAAS,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC7F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,uBAAuB,MAAM,QAAQ,IAAI;AAKxD,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,aAAa,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC7D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,SAAS,MAAM,kBAAkB,WAAW,WAAW,MAAM,UAAU,gBAAgB,eAAe;AAC5G,QAAI,CAAC,UAAU,CAAC,mBAAmB,QAAQ,MAAM,GAAG;AAClD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,qDAAqD;AAAA,MACjH,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,uBAAuB,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAC1E;AAEJ,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,MAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC,yBAAyB;AAAA,MACzB,EAAE,OAAO,EAAE,GAAG,WAAW,IAAI,YAAY,GAAG,IAAI;AAAA,IAClD;AAEA,UAAM,YAAY,gBAAgB;AAElC,QAAI,QAAQ,aAAa;AACvB,WAAK,eAAe,sCAAsC;AAAA,QACxD,IAAI,OAAO;AAAA,QACX,UAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,eAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,MACxE,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,QAAQ,eAAe,MAAM,UAAU,YAAY,CAAC;AAAA,EACxF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AACtE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,wBAAwB;AAAA,MAC9E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,sEAAsE;AAAA,QAClG;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/[segmentId]/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -50,7 +51,7 @@ async function PATCH(req) {
   const container = await createRequestContainer();
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
   const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!tenantId || !organizationId) {
     return NextResponse.json({ error: "Missing tenant or organization scope." }, { status: 400 });
   }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/[segmentId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/segments/%5BsegmentId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../../data/entities'\nimport { staffTimeEntrySegmentUpdateSchema } from '../../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../../lib/staffMemberResolver'\nimport { emitStaffEvent } from '../../../../../../events'\nimport { runTimesheetInterceptors } from '../../../../_shared/withTimesheetInterceptors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../../guards'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/segments' })\n\nconst routeMetadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nfunction extractIdsFromUrl(request?: Request): { entryId: string; segmentId: string } | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments\\/([^/]+)/)\n    if (!match?.[1] || !match?.[2]) return null\n    return { entryId: match[1], segmentId: match[2] }\n  } catch {\n    return null\n  }\n}\n\nexport async function PATCH(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const ids = extractIdsFromUrl(req)\n  if (!ids) {\n    return NextResponse.json({ error: 'Segment id is required' }, { status: 400 })\n  }\n\n  const rawBody = await readJsonSafe<Record<string, unknown>>(req, null)\n  if (!rawBody) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    return NextResponse.json({ error: 'Missing tenant or organization scope.' }, { status: 400 })\n  }\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: 'PATCH',\n    scope: { container, userId: auth.sub, tenantId, organizationId },\n    body: rawBody,\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...session.body, id: ids.segmentId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const scopeCtx = { tenantId, organizationId }\n\n  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx)\n  if (!entry) {\n    return NextResponse.json({ error: 'Time entry not found' }, { status: 404 })\n  }\n\n  const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n  if (!staffMember || entry.staffMemberId !== staffMember.id) {\n    return NextResponse.json({ error: 'You can only manage your own time entries.' }, { status: 403 })\n  }\n\n  const segment = await findOneWithDecryption(em, StaffTimeEntrySegment, {\n    id: ids.segmentId,\n    timeEntryId: ids.entryId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  }, {}, scopeCtx)\n\n  if (!segment) {\n    return NextResponse.json({ error: 'Segment not found' }, { status: 404 })\n  }\n\n  const guardResult = await runStaffMutationGuards(\n    container,\n    {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: segment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  // Apply the segment edit inside a single transaction with a PESSIMISTIC_WRITE\n  // lock on the parent time entry row, re-loading the segment under the lock so\n  // concurrent segment edits / timer-stop recomputes on the same entry serialize\n  // instead of racing on a shared in-memory snapshot (issue #2416).\n  let updatedSegment: StaffTimeEntrySegment\n  try {\n    updatedSegment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: ids.entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: 'Time entry not found' })\n      }\n\n      const lockedSegment = await findOneWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { id: ids.segmentId, timeEntryId: ids.entryId, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n      if (!lockedSegment) {\n        throw new CrudHttpError(404, { error: 'Segment not found' })\n      }\n\n      if (parsed.data.startedAt !== undefined) {\n        lockedSegment.startedAt = parsed.data.startedAt\n      }\n      if (parsed.data.endedAt !== undefined) {\n        lockedSegment.endedAt = parsed.data.endedAt ?? null\n      }\n      if (parsed.data.segmentType !== undefined) {\n        lockedSegment.segmentType = parsed.data.segmentType\n      }\n\n      await trx.flush()\n      return lockedSegment\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: updatedSegment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  void emitStaffEvent('staff.timesheets.time_entry_segment.updated', {\n    id: updatedSegment.id,\n    timeEntryId: updatedSegment.timeEntryId,\n    tenantId,\n    organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_entry_segment.updated failed', { err })\n  })\n\n  return session.respond(200, {\n    ok: true,\n    item: {\n      id: updatedSegment.id,\n      timeEntryId: updatedSegment.timeEntryId,\n      startedAt: updatedSegment.startedAt,\n      endedAt: updatedSegment.endedAt,\n      segmentType: updatedSegment.segmentType,\n      createdAt: updatedSegment.createdAt,\n      updatedAt: updatedSegment.updatedAt,\n    },\n  })\n}\n\nconst errorSchema = z.object({ error: z.string() })\nconst segmentResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    timeEntryId: z.string(),\n    startedAt: z.string(),\n    endedAt: z.string().nullable(),\n    segmentType: z.enum(['work', 'break']),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry segment management',\n  methods: {\n    PATCH: {\n      summary: 'Update a time entry segment',\n      description: 'Updates fields on an existing time entry segment (startedAt, endedAt, segmentType).',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentUpdateSchema.omit({ id: true }),\n      },\n      responses: [\n        { status: 200, description: 'Segment updated successfully', schema: segmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing segment id', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Segment not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,eAAe,uBAAuB;AAE/C,SAAS,gBAAgB;AACzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB;AAAA,EACpB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEO,MAAM,WAAW;AAExB,SAAS,kBAAkB,SAAkE;AAC3F,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,4CAA4C;AAC7E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAG,QAAO;AACvC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,kBAAkB,GAAG;AACjC,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,UAAU,MAAM,aAAsC,KAAK,IAAI;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,SAAS,kCAAkC,UAAU,EAAE,GAAG,QAAQ,MAAM,IAAI,IAAI,UAAU,CAAC;AACjG,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,QAAM,QAAQ,MAAM,sBAAsB,IAAI,gBAAgB,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK,GAAG,CAAC,GAAG,QAAQ;AAC1I,MAAI,CAAC,OAAO;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,MAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,QAAM,UAAU,MAAM,sBAAsB,IAAI,uBAAuB;AAAA,IACrE,IAAI,IAAI;AAAA,IACR,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,QAAQ;AAEf,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QAC7D,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAEA,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,WAAW,aAAa,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzF,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC7D;AAEA,UAAI,OAAO,KAAK,cAAc,QAAW;AACvC,sBAAc,YAAY,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,KAAK,YAAY,QAAW;AACrC,sBAAc,UAAU,OAAO,KAAK,WAAW;AAAA,MACjD;AACA,UAAI,OAAO,KAAK,gBAAgB,QAAW;AACzC,sBAAc,cAAc,OAAO,KAAK;AAAA,MAC1C;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,eAAe;AAAA,MAC3B,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,OAAK,eAAe,+CAA+C;AAAA,IACjE,IAAI,eAAe;AAAA,IACnB,aAAa,eAAe;AAAA,IAC5B;AAAA,IACA;AAAA,EACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAAA,EACjF,CAAC;AAED,SAAO,QAAQ,QAAQ,KAAK;AAAA,IAC1B,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,eAAe;AAAA,MACnB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,SAAS,eAAe;AAAA,MACxB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,WAAW,eAAe;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClD,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,IACrC,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,EACtB,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,kCAAkC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,sBAAsB;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,QACzF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../../data/entities'\nimport { staffTimeEntrySegmentUpdateSchema } from '../../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../../lib/staffMemberResolver'\nimport { emitStaffEvent } from '../../../../../../events'\nimport { runTimesheetInterceptors } from '../../../../_shared/withTimesheetInterceptors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../../guards'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/time-entries/segments' })\n\nconst routeMetadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport const metadata = routeMetadata\n\nfunction extractIdsFromUrl(request?: Request): { entryId: string; segmentId: string } | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments\\/([^/]+)/)\n    if (!match?.[1] || !match?.[2]) return null\n    return { entryId: match[1], segmentId: match[2] }\n  } catch {\n    return null\n  }\n}\n\nexport async function PATCH(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const ids = extractIdsFromUrl(req)\n  if (!ids) {\n    return NextResponse.json({ error: 'Segment id is required' }, { status: 400 })\n  }\n\n  const rawBody = await readJsonSafe<Record<string, unknown>>(req, null)\n  if (!rawBody) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!tenantId || !organizationId) {\n    return NextResponse.json({ error: 'Missing tenant or organization scope.' }, { status: 400 })\n  }\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: 'PATCH',\n    scope: { container, userId: auth.sub, tenantId, organizationId },\n    body: rawBody,\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const parsed = staffTimeEntrySegmentUpdateSchema.safeParse({ ...session.body, id: ids.segmentId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const scopeCtx = { tenantId, organizationId }\n\n  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id: ids.entryId, tenantId, organizationId, deletedAt: null }, {}, scopeCtx)\n  if (!entry) {\n    return NextResponse.json({ error: 'Time entry not found' }, { status: 404 })\n  }\n\n  const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n  if (!staffMember || entry.staffMemberId !== staffMember.id) {\n    return NextResponse.json({ error: 'You can only manage your own time entries.' }, { status: 403 })\n  }\n\n  const segment = await findOneWithDecryption(em, StaffTimeEntrySegment, {\n    id: ids.segmentId,\n    timeEntryId: ids.entryId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  }, {}, scopeCtx)\n\n  if (!segment) {\n    return NextResponse.json({ error: 'Segment not found' }, { status: 404 })\n  }\n\n  const guardResult = await runStaffMutationGuards(\n    container,\n    {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: segment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data as unknown as Record<string, unknown>,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  // Apply the segment edit inside a single transaction with a PESSIMISTIC_WRITE\n  // lock on the parent time entry row, re-loading the segment under the lock so\n  // concurrent segment edits / timer-stop recomputes on the same entry serialize\n  // instead of racing on a shared in-memory snapshot (issue #2416).\n  let updatedSegment: StaffTimeEntrySegment\n  try {\n    updatedSegment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: ids.entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: 'Time entry not found' })\n      }\n\n      const lockedSegment = await findOneWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { id: ids.segmentId, timeEntryId: ids.entryId, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n      if (!lockedSegment) {\n        throw new CrudHttpError(404, { error: 'Segment not found' })\n      }\n\n      if (parsed.data.startedAt !== undefined) {\n        lockedSegment.startedAt = parsed.data.startedAt\n      }\n      if (parsed.data.endedAt !== undefined) {\n        lockedSegment.endedAt = parsed.data.endedAt ?? null\n      }\n      if (parsed.data.segmentType !== undefined) {\n        lockedSegment.segmentType = parsed.data.segmentType\n      }\n\n      await trx.flush()\n      return lockedSegment\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n      resourceId: updatedSegment.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  void emitStaffEvent('staff.timesheets.time_entry_segment.updated', {\n    id: updatedSegment.id,\n    timeEntryId: updatedSegment.timeEntryId,\n    tenantId,\n    organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_entry_segment.updated failed', { err })\n  })\n\n  return session.respond(200, {\n    ok: true,\n    item: {\n      id: updatedSegment.id,\n      timeEntryId: updatedSegment.timeEntryId,\n      startedAt: updatedSegment.startedAt,\n      endedAt: updatedSegment.endedAt,\n      segmentType: updatedSegment.segmentType,\n      createdAt: updatedSegment.createdAt,\n      updatedAt: updatedSegment.updatedAt,\n    },\n  })\n}\n\nconst errorSchema = z.object({ error: z.string() })\nconst segmentResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    timeEntryId: z.string(),\n    startedAt: z.string(),\n    endedAt: z.string().nullable(),\n    segmentType: z.enum(['work', 'break']),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry segment management',\n  methods: {\n    PATCH: {\n      summary: 'Update a time entry segment',\n      description: 'Updates fields on an existing time entry segment (startedAt, endedAt, segmentType).',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentUpdateSchema.omit({ id: true }),\n      },\n      responses: [\n        { status: 200, description: 'Segment updated successfully', schema: segmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing segment id', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Segment not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,eAAe,uBAAuB;AAE/C,SAAS,gBAAgB;AACzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB;AAAA,EACpB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC/E;AAEO,MAAM,WAAW;AAExB,SAAS,kBAAkB,SAAkE;AAC3F,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,4CAA4C;AAC7E,QAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAG,QAAO;AACvC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,kBAAkB,GAAG;AACjC,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,UAAU,MAAM,aAAsC,KAAK,IAAI;AACrE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,IAC/D,MAAM;AAAA,EACR,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,SAAS,kCAAkC,UAAU,EAAE,GAAG,QAAQ,MAAM,IAAI,IAAI,UAAU,CAAC;AACjG,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,QAAM,QAAQ,MAAM,sBAAsB,IAAI,gBAAgB,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK,GAAG,CAAC,GAAG,QAAQ;AAC1I,MAAI,CAAC,OAAO;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,MAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,QAAM,UAAU,MAAM,sBAAsB,IAAI,uBAAuB;AAAA,IACrE,IAAI,IAAI;AAAA,IACR,aAAa,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,QAAQ;AAEf,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa;AAAA,MAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QAC7D,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAEA,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,EAAE,IAAI,IAAI,WAAW,aAAa,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzF,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC7D;AAEA,UAAI,OAAO,KAAK,cAAc,QAAW;AACvC,sBAAc,YAAY,OAAO,KAAK;AAAA,MACxC;AACA,UAAI,OAAO,KAAK,YAAY,QAAW;AACrC,sBAAc,UAAU,OAAO,KAAK,WAAW;AAAA,MACjD;AACA,UAAI,OAAO,KAAK,gBAAgB,QAAW;AACzC,sBAAc,cAAc,OAAO,KAAK;AAAA,MAC1C;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AAEA,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,mCAAmC;AAAA,MACjD,YAAY,eAAe;AAAA,MAC3B,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,OAAK,eAAe,+CAA+C;AAAA,IACjE,IAAI,eAAe;AAAA,IACnB,aAAa,eAAe;AAAA,IAC5B;AAAA,IACA;AAAA,EACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAAA,EACjF,CAAC;AAED,SAAO,QAAQ,QAAQ,KAAK;AAAA,IAC1B,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,eAAe;AAAA,MACnB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,SAAS,eAAe;AAAA,MACxB,aAAa,eAAe;AAAA,MAC5B,WAAW,eAAe;AAAA,MAC1B,WAAW,eAAe;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClD,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,aAAa,EAAE,OAAO;AAAA,IACtB,WAAW,EAAE,OAAO;AAAA,IACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,IACrC,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,EACtB,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,kCAAkC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,MAC7D;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,sBAAsB;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,QACzF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
@@ -42,7 +43,7 @@ async function POST(req) {
     if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, { error: translate("staff.errors.missingScope", "Missing tenant or organization scope.") });
     }

package/dist/modules/staff/api/timesheets/time-entries/[id]/segments/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/segments/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { staffTimeEntrySegmentCreateSchema } from '../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const input = parseScopedCommandInput(\n      staffTimeEntrySegmentCreateSchema,\n      { ...session.body, timeEntryId: entryId },\n      {\n        container,\n        auth,\n        organizationScope: scope,\n        selectedOrganizationId: organizationId,\n        organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n        request: req,\n      },\n      translate,\n    )\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n        resourceId: entry.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input as unknown as Record<string, unknown>,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Create the segment inside a single transaction with a PESSIMISTIC_WRITE\n    // lock on the parent time entry row, so segment writes serialize against\n    // concurrent timer-stop / segment mutations that recompute the entry from a\n    // shared snapshot (issue #2416).\n    const segment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n\n      const segmentData = {\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        timeEntryId: input.timeEntryId,\n        startedAt: input.startedAt,\n        endedAt: input.endedAt ?? null,\n        segmentType: input.segmentType,\n      }\n      const created = trx.create(StaffTimeEntrySegment, segmentData as never)\n\n      await trx.flush()\n      return created\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n        resourceId: segment.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    void emitStaffEvent('staff.timesheets.time_entry_segment.created', {\n      id: segment.id,\n      timeEntryId: segment.timeEntryId,\n      tenantId,\n      organizationId,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_entry_segment.created failed', { err })\n    })\n\n    return session.respond(201, {\n      id: segment.id,\n      timeEntryId: segment.timeEntryId,\n      startedAt: segment.startedAt,\n      endedAt: segment.endedAt ?? null,\n      segmentType: segment.segmentType,\n      createdAt: segment.createdAt,\n    })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.segments.create failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.segmentCreate', 'Failed to create time entry segment.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Add a segment to a time entry',\n  methods: {\n    POST: {\n      summary: 'Add a segment to a time entry',\n      description: 'Creates a new work or break segment for the specified time entry.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentCreateSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Segment created',\n          schema: z.object({\n            id: z.string().uuid(),\n            timeEntryId: z.string().uuid(),\n            startedAt: z.string(),\n            endedAt: z.string().nullable(),\n            segmentType: z.enum(['work', 'break']),\n            createdAt: z.string(),\n          }),\n        },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,mCAAmC;AACpE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,GAAG,QAAQ,MAAM,aAAa,QAAQ;AAAA,MACxC;AAAA,QACE;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,QAClE,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,UAAU,MAAM,GAAG,cAAc,OAAO,QAAQ;AACpD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAEA,YAAM,cAAc;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM,WAAW;AAAA,QAC1B,aAAa,MAAM;AAAA,MACrB;AACA,YAAM,UAAU,IAAI,OAAO,uBAAuB,WAAoB;AAEtE,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,QAAQ;AAAA,QACpB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,SAAK,eAAe,+CAA+C;AAAA,MACjE,IAAI,QAAQ;AAAA,MACZ,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,IAAI,QAAQ;AAAA,MACZ,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,SAAS,QAAQ,WAAW;AAAA,MAC5B,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wDAAwD,EAAE,IAAI,CAAC;AAC5E,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yCAAyC,sCAAsC,EAAE;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,YACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,YAC7B,WAAW,EAAE,OAAO;AAAA,YACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,YACrC,WAAW,EAAE,OAAO;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { staffTimeEntrySegmentCreateSchema } from '../../../../../data/validators'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/segments/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const input = parseScopedCommandInput(\n      staffTimeEntrySegmentCreateSchema,\n      { ...session.body, timeEntryId: entryId },\n      {\n        container,\n        auth,\n        organizationScope: scope,\n        selectedOrganizationId: organizationId,\n        organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n        request: req,\n      },\n      translate,\n    )\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n        resourceId: entry.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input as unknown as Record<string, unknown>,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Create the segment inside a single transaction with a PESSIMISTIC_WRITE\n    // lock on the parent time entry row, so segment writes serialize against\n    // concurrent timer-stop / segment mutations that recompute the entry from a\n    // shared snapshot (issue #2416).\n    const segment = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n\n      const segmentData = {\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        timeEntryId: input.timeEntryId,\n        startedAt: input.startedAt,\n        endedAt: input.endedAt ?? null,\n        segmentType: input.segmentType,\n      }\n      const created = trx.create(StaffTimeEntrySegment, segmentData as never)\n\n      await trx.flush()\n      return created\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntrySegment,\n        resourceId: segment.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    void emitStaffEvent('staff.timesheets.time_entry_segment.created', {\n      id: segment.id,\n      timeEntryId: segment.timeEntryId,\n      tenantId,\n      organizationId,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_entry_segment.created failed', { err })\n    })\n\n    return session.respond(201, {\n      id: segment.id,\n      timeEntryId: segment.timeEntryId,\n      startedAt: segment.startedAt,\n      endedAt: segment.endedAt ?? null,\n      segmentType: segment.segmentType,\n      createdAt: segment.createdAt,\n    })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.segments.create failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.segmentCreate', 'Failed to create time entry segment.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Add a segment to a time entry',\n  methods: {\n    POST: {\n      summary: 'Add a segment to a time entry',\n      description: 'Creates a new work or break segment for the specified time entry.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeEntrySegmentCreateSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Segment created',\n          schema: z.object({\n            id: z.string().uuid(),\n            timeEntryId: z.string().uuid(),\n            startedAt: z.string(),\n            endedAt: z.string().nullable(),\n            segmentType: z.enum(['work', 'break']),\n            createdAt: z.string(),\n          }),\n        },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yCAAyC;AAClD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AAEzC,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,mCAAmC;AACpE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,GAAG,QAAQ,MAAM,aAAa,QAAQ;AAAA,MACxC;AAAA,QACE;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,QAClE,SAAS;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,UAAU,MAAM,GAAG,cAAc,OAAO,QAAQ;AACpD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAEA,YAAM,cAAc;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,SAAS,MAAM,WAAW;AAAA,QAC1B,aAAa,MAAM;AAAA,MACrB;AACA,YAAM,UAAU,IAAI,OAAO,uBAAuB,WAAoB;AAEtE,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,QAAQ;AAAA,QACpB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,SAAK,eAAe,+CAA+C;AAAA,MACjE,IAAI,QAAQ;AAAA,MACZ,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,2DAA2D,EAAE,IAAI,CAAC;AAAA,IACjF,CAAC;AAED,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,IAAI,QAAQ;AAAA,MACZ,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,MACnB,SAAS,QAAQ,WAAW;AAAA,MAC5B,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wDAAwD,EAAE,IAAI,CAAC;AAC5E,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yCAAyC,sCAAsC,EAAE;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,YACpB,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,YAC7B,WAAW,EAAE,OAAO;AAAA,YACpB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAAA,YACrC,WAAW,EAAE,OAAO;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/timer-start/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -41,7 +42,7 @@ async function POST(req) {
     if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, { error: translate("staff.errors.missingScope", "Missing tenant or organization scope.") });
     }

package/dist/modules/staff/api/timesheets/time-entries/[id]/timer-start/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/timer-start/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { assertTimeEntryUnlocked } from '../../../../../commands/timesheets-entries'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { emitStaffEvent } from '../../../../../events'\nimport { invalidateStaffTimeEntryCache } from '../../../../../lib/timesheets/timeEntryCacheInvalidation'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/timer-start/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    // Running a timer on a frozen entry is only ever the first half of changing\n    // its duration, so it is refused at the same gate the entries command uses.\n    assertTimeEntryUnlocked(entry, translate)\n\n    if (entry.startedAt) {\n      return NextResponse.json(\n        { error: translate('staff.timesheets.errors.timerAlreadyStarted', 'Timer is already started for this entry.') },\n        { status: 409 },\n      )\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Start the timer inside a single transaction with a PESSIMISTIC_WRITE lock\n    // on the time entry row, re-checking startedAt under the lock so two\n    // concurrent timer-start calls on the same entry cannot both create an\n    // initial work segment (issue #2416).\n    const now = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n      // Re-checked under the row lock: a report close committed between the\n      // pre-flight read and this transaction would otherwise slip through.\n      assertTimeEntryUnlocked(lockedEntry, translate)\n      if (lockedEntry.startedAt) {\n        throw new CrudHttpError(409, {\n          error: translate('staff.timesheets.errors.timerAlreadyStarted', 'Timer is already started for this entry.'),\n        })\n      }\n\n      // Single-active-timer invariant (issue #2855): reject the start when the\n      // staff member already has another running entry (started_at set,\n      // ended_at null). Without this guard a second surface (dashboard widget,\n      // another tab) could create and start a parallel timer, leaving two\n      // concurrent running entries and the \"stopped timer comes back running\"\n      // symptom reported in #2456.\n      const otherRunningEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        {\n          tenantId,\n          organizationId,\n          staffMemberId: lockedEntry.staffMemberId,\n          id: { $ne: lockedEntry.id },\n          startedAt: { $ne: null },\n          endedAt: null,\n          deletedAt: null,\n        },\n        {},\n        scopeCtx,\n      )\n      if (otherRunningEntry) {\n        throw new CrudHttpError(409, {\n          error: translate(\n            'staff.timesheets.errors.timerAlreadyRunning',\n            'Another timer is already running. Stop it before starting a new one.',\n          ),\n        })\n      }\n\n      const startedAt = new Date()\n      lockedEntry.startedAt = startedAt\n      lockedEntry.source = 'timer'\n\n      const segmentData = {\n        tenantId,\n        organizationId,\n        timeEntryId: lockedEntry.id,\n        startedAt,\n        segmentType: 'work' as const,\n      }\n      trx.create(StaffTimeEntrySegment, segmentData as never)\n\n      await trx.flush()\n      return startedAt\n    })\n\n    await invalidateStaffTimeEntryCache(\n      container,\n      { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },\n      tenantId,\n      'timer_started',\n    )\n\n    void emitStaffEvent('staff.timesheets.time_entry.timer_started', {\n      id: entry.id,\n      staffMemberId: entry.staffMemberId,\n      tenantId: entry.tenantId,\n      organizationId: entry.organizationId,\n      startedAt: now.toISOString(),\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit timer_started failed', { err })\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return session.respond(200, { ok: true })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.timer-start failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStart', 'Failed to start timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Start timer for a time entry',\n  methods: {\n    POST: {\n      summary: 'Start timer for a time entry',\n      description: 'Starts the timer on a time entry by setting startedAt and creating an initial work segment.',\n      responses: [\n        { status: 200, description: 'Timer started', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        {\n          status: 409,\n          description:\n            'Timer already started, another timer is already running for this staff member, or the entry is locked in a closed report (code time_entry_locked)',\n          schema: z.object({ error: z.string(), code: z.string().optional(), lockedReportId: z.string().uuid().nullable().optional() }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,qCAAqC;AAC9C,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,sCAAsC;AACvE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,IACjE,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAIA,4BAAwB,OAAO,SAAS;AAExC,QAAI,MAAM,WAAW;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,+CAA+C,0CAA0C,EAAE;AAAA,QAC9G,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,MAAM,MAAM,GAAG,cAAc,OAAO,QAAQ;AAChD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAGA,8BAAwB,aAAa,SAAS;AAC9C,UAAI,YAAY,WAAW;AACzB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,+CAA+C,0CAA0C;AAAA,QAC5G,CAAC;AAAA,MACH;AAQA,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,YAAY;AAAA,UAC3B,IAAI,EAAE,KAAK,YAAY,GAAG;AAAA,UAC1B,WAAW,EAAE,KAAK,KAAK;AAAA,UACvB,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,QACA,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,mBAAmB;AACrB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAEA,YAAM,YAAY,oBAAI,KAAK;AAC3B,kBAAY,YAAY;AACxB,kBAAY,SAAS;AAErB,YAAM,cAAc;AAAA,QAClB;AAAA,QACA;AAAA,QACA,aAAa,YAAY;AAAA,QACzB;AAAA,QACA,aAAa;AAAA,MACf;AACA,UAAI,OAAO,uBAAuB,WAAoB;AAEtD,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAED,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,IAAI,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,MAC/E;AAAA,MACA;AAAA,IACF;AAEA,SAAK,eAAe,6CAA6C;AAAA,MAC/D,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW,IAAI,YAAY;AAAA,IAC7B,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,IACpE,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1C,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,oDAAoD,EAAE,IAAI,CAAC;AACxE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE;AAAA,MACnF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAAA,QAC9H;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { assertTimeEntryUnlocked } from '../../../../../commands/timesheets-entries'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { emitStaffEvent } from '../../../../../events'\nimport { invalidateStaffTimeEntryCache } from '../../../../../lib/timesheets/timeEntryCacheInvalidation'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/timer-start/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    // Running a timer on a frozen entry is only ever the first half of changing\n    // its duration, so it is refused at the same gate the entries command uses.\n    assertTimeEntryUnlocked(entry, translate)\n\n    if (entry.startedAt) {\n      return NextResponse.json(\n        { error: translate('staff.timesheets.errors.timerAlreadyStarted', 'Timer is already started for this entry.') },\n        { status: 409 },\n      )\n    }\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Start the timer inside a single transaction with a PESSIMISTIC_WRITE lock\n    // on the time entry row, re-checking startedAt under the lock so two\n    // concurrent timer-start calls on the same entry cannot both create an\n    // initial work segment (issue #2416).\n    const now = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n      // Re-checked under the row lock: a report close committed between the\n      // pre-flight read and this transaction would otherwise slip through.\n      assertTimeEntryUnlocked(lockedEntry, translate)\n      if (lockedEntry.startedAt) {\n        throw new CrudHttpError(409, {\n          error: translate('staff.timesheets.errors.timerAlreadyStarted', 'Timer is already started for this entry.'),\n        })\n      }\n\n      // Single-active-timer invariant (issue #2855): reject the start when the\n      // staff member already has another running entry (started_at set,\n      // ended_at null). Without this guard a second surface (dashboard widget,\n      // another tab) could create and start a parallel timer, leaving two\n      // concurrent running entries and the \"stopped timer comes back running\"\n      // symptom reported in #2456.\n      const otherRunningEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        {\n          tenantId,\n          organizationId,\n          staffMemberId: lockedEntry.staffMemberId,\n          id: { $ne: lockedEntry.id },\n          startedAt: { $ne: null },\n          endedAt: null,\n          deletedAt: null,\n        },\n        {},\n        scopeCtx,\n      )\n      if (otherRunningEntry) {\n        throw new CrudHttpError(409, {\n          error: translate(\n            'staff.timesheets.errors.timerAlreadyRunning',\n            'Another timer is already running. Stop it before starting a new one.',\n          ),\n        })\n      }\n\n      const startedAt = new Date()\n      lockedEntry.startedAt = startedAt\n      lockedEntry.source = 'timer'\n\n      const segmentData = {\n        tenantId,\n        organizationId,\n        timeEntryId: lockedEntry.id,\n        startedAt,\n        segmentType: 'work' as const,\n      }\n      trx.create(StaffTimeEntrySegment, segmentData as never)\n\n      await trx.flush()\n      return startedAt\n    })\n\n    await invalidateStaffTimeEntryCache(\n      container,\n      { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },\n      tenantId,\n      'timer_started',\n    )\n\n    void emitStaffEvent('staff.timesheets.time_entry.timer_started', {\n      id: entry.id,\n      staffMemberId: entry.staffMemberId,\n      tenantId: entry.tenantId,\n      organizationId: entry.organizationId,\n      startedAt: now.toISOString(),\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit timer_started failed', { err })\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return session.respond(200, { ok: true })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.timer-start failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStart', 'Failed to start timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Start timer for a time entry',\n  methods: {\n    POST: {\n      summary: 'Start timer for a time entry',\n      description: 'Starts the timer on a time entry by setting startedAt and creating an initial work segment.',\n      responses: [\n        { status: 200, description: 'Timer started', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        {\n          status: 409,\n          description:\n            'Timer already started, another timer is already running for this staff member, or the entry is locked in a closed report (code time_entry_locked)',\n          schema: z.object({ error: z.string(), code: z.string().optional(), lockedReportId: z.string().uuid().nullable().optional() }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,qCAAqC;AAC9C,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,sCAAsC;AACvE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,IACjE,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAIA,4BAAwB,OAAO,SAAS;AAExC,QAAI,MAAM,WAAW;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,+CAA+C,0CAA0C,EAAE;AAAA,QAC9G,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,MAAM,MAAM,GAAG,cAAc,OAAO,QAAQ;AAChD,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAGA,8BAAwB,aAAa,SAAS;AAC9C,UAAI,YAAY,WAAW;AACzB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,+CAA+C,0CAA0C;AAAA,QAC5G,CAAC;AAAA,MACH;AAQA,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,eAAe,YAAY;AAAA,UAC3B,IAAI,EAAE,KAAK,YAAY,GAAG;AAAA,UAC1B,WAAW,EAAE,KAAK,KAAK;AAAA,UACvB,SAAS;AAAA,UACT,WAAW;AAAA,QACb;AAAA,QACA,CAAC;AAAA,QACD;AAAA,MACF;AACA,UAAI,mBAAmB;AACrB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAEA,YAAM,YAAY,oBAAI,KAAK;AAC3B,kBAAY,YAAY;AACxB,kBAAY,SAAS;AAErB,YAAM,cAAc;AAAA,QAClB;AAAA,QACA;AAAA,QACA,aAAa,YAAY;AAAA,QACzB;AAAA,QACA,aAAa;AAAA,MACf;AACA,UAAI,OAAO,uBAAuB,WAAoB;AAEtD,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAED,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,IAAI,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,MAC/E;AAAA,MACA;AAAA,IACF;AAEA,SAAK,eAAe,6CAA6C;AAAA,MAC/D,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW,IAAI,YAAY;AAAA,IAC7B,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,IACpE,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC1C,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,oDAAoD,EAAE,IAAI,CAAC;AACxE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE;AAAA,MACnF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAAA,QAC9H;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/[id]/timer-stop/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -41,7 +42,7 @@ async function POST(req) {
     if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, { error: translate("staff.errors.missingScope", "Missing tenant or organization scope.") });
     }

package/dist/modules/staff/api/timesheets/time-entries/[id]/timer-stop/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/time-entries/%5Bid%5D/timer-stop/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { assertTimeEntryUnlocked, resolveRoundedMinutes } from '../../../../../commands/timesheets-entries'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { emitStaffEvent } from '../../../../../events'\nimport { invalidateStaffTimeEntryCache } from '../../../../../lib/timesheets/timeEntryCacheInvalidation'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/timer-stop/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    // Stopping a timer rewrites `duration_minutes`, which is exactly what a\n    // closed report froze \u2014 same gate as the entries command.\n    assertTimeEntryUnlocked(entry, translate)\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Recompute and persist the timer state inside a single transaction with a\n    // PESSIMISTIC_WRITE lock on the time entry row, so concurrent timer-stop /\n    // segment writes on the same entry serialize instead of racing on a shared\n    // in-memory snapshot (issue #2416).\n    const { now, durationMinutes } = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n      // Re-checked under the row lock: a report close committed between the\n      // pre-flight read and this transaction would otherwise slip through.\n      assertTimeEntryUnlocked(lockedEntry, translate)\n\n      const segments = await findWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { timeEntryId: lockedEntry.id, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n\n      const activeSegment = segments.find((segment) => !segment.endedAt)\n      if (!activeSegment) {\n        throw new CrudHttpError(409, {\n          error: translate('staff.timesheets.errors.noActiveSegment', 'No active timer segment found for this entry.'),\n        })\n      }\n\n      const stoppedAt = new Date()\n      activeSegment.endedAt = stoppedAt\n      lockedEntry.endedAt = stoppedAt\n\n      const allSegments = segments.map((segment) => {\n        if (segment.id === activeSegment.id) {\n          return { ...segment, endedAt: stoppedAt }\n        }\n        return segment\n      })\n\n      const totalWorkMinutes = allSegments\n        .filter((segment) => segment.segmentType === 'work' && segment.startedAt && segment.endedAt)\n        .reduce((sum, segment) => {\n          const startMs = new Date(segment.startedAt).getTime()\n          const endMs = new Date(segment.endedAt!).getTime()\n          return sum + (endMs - startMs)\n        }, 0)\n\n      const computedMinutes = Math.round(totalWorkMinutes / 60000)\n      lockedEntry.durationMinutes = computedMinutes\n      // This route writes a duration outside the entries command, and D-7 makes\n      // `rounded_minutes` the only input to cost \u2014 so it is restated here with the\n      // same tenant rule the command applies, not left stale from the zero-minute\n      // value the timer was created with.\n      lockedEntry.roundedMinutes = await resolveRoundedMinutes(\n        container,\n        tenantId,\n        computedMinutes,\n        organizationId,\n      )\n\n      await trx.flush()\n      return { now: stoppedAt, durationMinutes: computedMinutes }\n    })\n\n    await invalidateStaffTimeEntryCache(\n      container,\n      { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },\n      tenantId,\n      'timer_stopped',\n    )\n\n    void emitStaffEvent('staff.timesheets.time_entry.timer_stopped', {\n      id: entry.id,\n      staffMemberId: entry.staffMemberId,\n      tenantId: entry.tenantId,\n      organizationId: entry.organizationId,\n      stoppedAt: now.toISOString(),\n      durationMinutes,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit timer_stopped failed', { err })\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return session.respond(200, { ok: true, durationMinutes })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.timer-stop failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStop', 'Failed to stop timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Stop timer for a time entry',\n  methods: {\n    POST: {\n      summary: 'Stop timer for a time entry',\n      description: 'Stops the active timer segment, recalculates total work duration in minutes, and updates the time entry.',\n      responses: [\n        {\n          status: 200,\n          description: 'Timer stopped',\n          schema: z.object({ ok: z.literal(true), durationMinutes: z.number() }),\n        },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        {\n          status: 409,\n          description: 'No active timer segment, or the entry is locked in a closed report (code time_entry_locked)',\n          schema: z.object({ error: z.string(), code: z.string().optional(), lockedReportId: z.string().uuid().nullable().optional() }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAE1D,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yBAAyB,6BAA6B;AAC/D,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,qCAAqC;AAC9C,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,qCAAqC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,IACjE,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAIA,4BAAwB,OAAO,SAAS;AAExC,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,EAAE,KAAK,gBAAgB,IAAI,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrE,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAGA,8BAAwB,aAAa,SAAS;AAE9C,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA,EAAE,aAAa,YAAY,IAAI,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzE,CAAC;AAAA,QACD;AAAA,MACF;AAEA,YAAM,gBAAgB,SAAS,KAAK,CAAC,YAAY,CAAC,QAAQ,OAAO;AACjE,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,2CAA2C,+CAA+C;AAAA,QAC7G,CAAC;AAAA,MACH;AAEA,YAAM,YAAY,oBAAI,KAAK;AAC3B,oBAAc,UAAU;AACxB,kBAAY,UAAU;AAEtB,YAAM,cAAc,SAAS,IAAI,CAAC,YAAY;AAC5C,YAAI,QAAQ,OAAO,cAAc,IAAI;AACnC,iBAAO,EAAE,GAAG,SAAS,SAAS,UAAU;AAAA,QAC1C;AACA,eAAO;AAAA,MACT,CAAC;AAED,YAAM,mBAAmB,YACtB,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAU,QAAQ,aAAa,QAAQ,OAAO,EAC1F,OAAO,CAAC,KAAK,YAAY;AACxB,cAAM,UAAU,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ;AACpD,cAAM,QAAQ,IAAI,KAAK,QAAQ,OAAQ,EAAE,QAAQ;AACjD,eAAO,OAAO,QAAQ;AAAA,MACxB,GAAG,CAAC;AAEN,YAAM,kBAAkB,KAAK,MAAM,mBAAmB,GAAK;AAC3D,kBAAY,kBAAkB;AAK9B,kBAAY,iBAAiB,MAAM;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO,EAAE,KAAK,WAAW,iBAAiB,gBAAgB;AAAA,IAC5D,CAAC;AAED,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,IAAI,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,MAC/E;AAAA,MACA;AAAA,IACF;AAEA,SAAK,eAAe,6CAA6C;AAAA,MAC/D,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW,IAAI,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,IACpE,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,MAAM,gBAAgB,CAAC;AAAA,EAC3D,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AACvE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,qCAAqC,uBAAuB,EAAE;AAAA,MACjF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,iBAAiB,EAAE,OAAO,EAAE,CAAC;AAAA,QACvE;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAAA,QAC9H;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeEntry, StaffTimeEntrySegment } from '../../../../../data/entities'\nimport { assertTimeEntryUnlocked, resolveRoundedMinutes } from '../../../../../commands/timesheets-entries'\nimport { getStaffMemberByUserId } from '../../../../../lib/staffMemberResolver'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../../guards'\nimport { emitStaffEvent } from '../../../../../events'\nimport { invalidateStaffTimeEntryCache } from '../../../../../lib/timesheets/timeEntryCacheInvalidation'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('staff')\n\nfunction extractEntryIdFromUrl(request?: Request): string | null {\n  if (!request?.url) return null\n  try {\n    const url = new URL(request.url)\n    const match = url.pathname.match(/\\/time-entries\\/([^/]+)\\/timer-stop/)\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.manage_own'] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const scopeCtx = { tenantId, organizationId }\n\n    const entryId = extractEntryIdFromUrl(req)\n    if (!entryId) {\n      throw new CrudHttpError(400, { error: translate('staff.timesheets.errors.missingEntryId', 'Missing entry ID.') })\n    }\n\n    const entry = await findOneWithDecryption(\n      em,\n      StaffTimeEntry,\n      { id: entryId, tenantId, organizationId, deletedAt: null },\n      {},\n      scopeCtx,\n    )\n    if (!entry) {\n      throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n    }\n\n    const staffMember = await getStaffMemberByUserId(em, auth.sub, tenantId, organizationId)\n    if (!staffMember || entry.staffMemberId !== staffMember.id) {\n      throw new CrudHttpError(403, { error: translate('staff.timesheets.errors.notOwner', 'You can only manage your own time entries.') })\n    }\n\n    // Stopping a timer rewrites `duration_minutes`, which is exactly what a\n    // closed report froze \u2014 same gate as the entries command.\n    assertTimeEntryUnlocked(entry, translate)\n\n    const guardResult = await runStaffMutationGuards(\n      container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    // Recompute and persist the timer state inside a single transaction with a\n    // PESSIMISTIC_WRITE lock on the time entry row, so concurrent timer-stop /\n    // segment writes on the same entry serialize instead of racing on a shared\n    // in-memory snapshot (issue #2416).\n    const { now, durationMinutes } = await em.transactional(async (trx) => {\n      const lockedEntry = await findOneWithDecryption(\n        trx,\n        StaffTimeEntry,\n        { id: entryId, tenantId, organizationId, deletedAt: null },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n        scopeCtx,\n      )\n      if (!lockedEntry) {\n        throw new CrudHttpError(404, { error: translate('staff.timesheets.errors.entryNotFound', 'Time entry not found.') })\n      }\n      // Re-checked under the row lock: a report close committed between the\n      // pre-flight read and this transaction would otherwise slip through.\n      assertTimeEntryUnlocked(lockedEntry, translate)\n\n      const segments = await findWithDecryption(\n        trx,\n        StaffTimeEntrySegment,\n        { timeEntryId: lockedEntry.id, tenantId, organizationId, deletedAt: null },\n        {},\n        scopeCtx,\n      )\n\n      const activeSegment = segments.find((segment) => !segment.endedAt)\n      if (!activeSegment) {\n        throw new CrudHttpError(409, {\n          error: translate('staff.timesheets.errors.noActiveSegment', 'No active timer segment found for this entry.'),\n        })\n      }\n\n      const stoppedAt = new Date()\n      activeSegment.endedAt = stoppedAt\n      lockedEntry.endedAt = stoppedAt\n\n      const allSegments = segments.map((segment) => {\n        if (segment.id === activeSegment.id) {\n          return { ...segment, endedAt: stoppedAt }\n        }\n        return segment\n      })\n\n      const totalWorkMinutes = allSegments\n        .filter((segment) => segment.segmentType === 'work' && segment.startedAt && segment.endedAt)\n        .reduce((sum, segment) => {\n          const startMs = new Date(segment.startedAt).getTime()\n          const endMs = new Date(segment.endedAt!).getTime()\n          return sum + (endMs - startMs)\n        }, 0)\n\n      const computedMinutes = Math.round(totalWorkMinutes / 60000)\n      lockedEntry.durationMinutes = computedMinutes\n      // This route writes a duration outside the entries command, and D-7 makes\n      // `rounded_minutes` the only input to cost \u2014 so it is restated here with the\n      // same tenant rule the command applies, not left stale from the zero-minute\n      // value the timer was created with.\n      lockedEntry.roundedMinutes = await resolveRoundedMinutes(\n        container,\n        tenantId,\n        computedMinutes,\n        organizationId,\n      )\n\n      await trx.flush()\n      return { now: stoppedAt, durationMinutes: computedMinutes }\n    })\n\n    await invalidateStaffTimeEntryCache(\n      container,\n      { id: entry.id, organizationId: entry.organizationId, tenantId: entry.tenantId },\n      tenantId,\n      'timer_stopped',\n    )\n\n    void emitStaffEvent('staff.timesheets.time_entry.timer_stopped', {\n      id: entry.id,\n      staffMemberId: entry.staffMemberId,\n      tenantId: entry.tenantId,\n      organizationId: entry.organizationId,\n      stoppedAt: now.toISOString(),\n      durationMinutes,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit timer_stopped failed', { err })\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub ?? '',\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeEntry,\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return session.respond(200, { ok: true, durationMinutes })\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.time-entries.timer-stop failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.timesheets.errors.timerStop', 'Failed to stop timer.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Stop timer for a time entry',\n  methods: {\n    POST: {\n      summary: 'Stop timer for a time entry',\n      description: 'Stops the active timer segment, recalculates total work duration in minutes, and updates the time entry.',\n      responses: [\n        {\n          status: 200,\n          description: 'Timer stopped',\n          schema: z.object({ ok: z.literal(true), durationMinutes: z.number() }),\n        },\n        { status: 404, description: 'Time entry not found', schema: z.object({ error: z.string() }) },\n        {\n          status: 409,\n          description: 'No active timer segment, or the entry is locked in a closed report (code time_entry_locked)',\n          schema: z.object({ error: z.string(), code: z.string().optional(), lockedReportId: z.string().uuid().nullable().optional() }),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAE1D,SAAS,gBAAgB;AAEzB,SAAS,gBAAgB,6BAA6B;AACtD,SAAS,yBAAyB,6BAA6B;AAC/D,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,qCAAqC;AAC9C,SAAS,gCAAgC;AACzC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,SAAS,sBAAsB,SAAkC;AAC/D,MAAI,CAAC,SAAS,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,IAAI,SAAS,MAAM,qCAAqC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,uCAAuC,EAAE,CAAC;AAAA,IACzH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,IACjE,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,WAAW,EAAE,UAAU,eAAe;AAE5C,UAAM,UAAU,sBAAsB,GAAG;AACzC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,mBAAmB,EAAE,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACzD,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,IACrH;AAEA,UAAM,cAAc,MAAM,uBAAuB,IAAI,KAAK,KAAK,UAAU,cAAc;AACvF,QAAI,CAAC,eAAe,MAAM,kBAAkB,YAAY,IAAI;AAC1D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,4CAA4C,EAAE,CAAC;AAAA,IACrI;AAIA,4BAAwB,OAAO,SAAS;AAExC,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAMA,UAAM,EAAE,KAAK,gBAAgB,IAAI,MAAM,GAAG,cAAc,OAAO,QAAQ;AACrE,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,SAAS,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzD,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,yCAAyC,uBAAuB,EAAE,CAAC;AAAA,MACrH;AAGA,8BAAwB,aAAa,SAAS;AAE9C,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA,EAAE,aAAa,YAAY,IAAI,UAAU,gBAAgB,WAAW,KAAK;AAAA,QACzE,CAAC;AAAA,QACD;AAAA,MACF;AAEA,YAAM,gBAAgB,SAAS,KAAK,CAAC,YAAY,CAAC,QAAQ,OAAO;AACjE,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,2CAA2C,+CAA+C;AAAA,QAC7G,CAAC;AAAA,MACH;AAEA,YAAM,YAAY,oBAAI,KAAK;AAC3B,oBAAc,UAAU;AACxB,kBAAY,UAAU;AAEtB,YAAM,cAAc,SAAS,IAAI,CAAC,YAAY;AAC5C,YAAI,QAAQ,OAAO,cAAc,IAAI;AACnC,iBAAO,EAAE,GAAG,SAAS,SAAS,UAAU;AAAA,QAC1C;AACA,eAAO;AAAA,MACT,CAAC;AAED,YAAM,mBAAmB,YACtB,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAU,QAAQ,aAAa,QAAQ,OAAO,EAC1F,OAAO,CAAC,KAAK,YAAY;AACxB,cAAM,UAAU,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ;AACpD,cAAM,QAAQ,IAAI,KAAK,QAAQ,OAAQ,EAAE,QAAQ;AACjD,eAAO,OAAO,QAAQ;AAAA,MACxB,GAAG,CAAC;AAEN,YAAM,kBAAkB,KAAK,MAAM,mBAAmB,GAAK;AAC3D,kBAAY,kBAAkB;AAK9B,kBAAY,iBAAiB,MAAM;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,IAAI,MAAM;AAChB,aAAO,EAAE,KAAK,WAAW,iBAAiB,gBAAgB;AAAA,IAC5D,CAAC;AAED,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,IAAI,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,MAC/E;AAAA,MACA;AAAA,IACF;AAEA,SAAK,eAAe,6CAA6C;AAAA,MAC/D,IAAI,MAAM;AAAA,MACV,eAAe,MAAM;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW,IAAI,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,IACpE,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,OAAO;AAAA,QACpB,cAAc,mCAAmC;AAAA,QACjD,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,QAAQ,KAAK,EAAE,IAAI,MAAM,gBAAgB,CAAC;AAAA,EAC3D,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AACvE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,qCAAqC,uBAAuB,EAAE;AAAA,MACjF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,iBAAiB,EAAE,OAAO,EAAE,CAAC;AAAA,QACvE;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC5F;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAAA,QAC9H;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/time-entries/bulk/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -54,7 +55,7 @@ async function POST(req) {
     if (!auth) throw new CrudHttpError(401, { error: translate("staff.errors.unauthorized", "Unauthorized") });
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, { error: translate("staff.errors.missingScope", "Missing tenant or organization scope.") });
     }