@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/staff/api/timesheets/projects/kpis/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/projects/kpis/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { StaffTeamMember } from '../../../../data/entities'\nimport {\n  computeCollabProjectsKpis,\n  computePmProjectsKpis,\n} from '../../../../lib/timesheets-projects/computeProjectsKpis'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nconst VIEW_FEATURE = 'staff.timesheets.projects.view'\nconst MANAGE_FEATURE = 'staff.timesheets.projects.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nconst deltaSchema = z.object({\n  current: z.number(),\n  previous: z.number(),\n  deltaPct: z.number().nullable(),\n})\n\nconst pmResponseSchema = z.object({\n  role: z.literal('pm'),\n  totals: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n    onHold: z.number().int(),\n    completed: z.number().int(),\n  }),\n  hoursWeek: deltaSchema,\n  hoursMonth: deltaSchema,\n  teamActive: z.object({ count: z.number().int() }),\n  assignedToMe: z.object({ total: z.number().int(), active: z.number().int() }),\n})\n\nconst collabResponseSchema = z.object({\n  role: z.literal('collab'),\n  myProjects: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n  }),\n  myHoursWeek: deltaSchema,\n  myHoursMonth: deltaSchema,\n})\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth) {\n      throw new CrudHttpError(401, {\n        error: translate('staff.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const rbac = container.resolve('rbacService') as RbacService\n    const isPm = await rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    if (isPm) {\n      const result = await computePmProjectsKpis({\n        em,\n        tenantId,\n        organizationId,\n        callerStaffMemberId: staffMember?.id ?? null,\n      })\n      return session.respond(200, result)\n    }\n\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate(\n          'staff.timesheets.errors.noStaffMember',\n          'No staff member linked to your account.',\n        ),\n      })\n    }\n\n    const result = await computeCollabProjectsKpis({\n      em,\n      tenantId,\n      organizationId,\n      staffMemberId: staffMember.id,\n    })\n    return session.respond(200, result)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.projects.kpis failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      {\n        error: translate(\n          'staff.timesheets.errors.projectsKpis',\n          'Failed to load project KPIs.',\n        ),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Timesheet projects KPIs',\n  methods: {\n    GET: {\n      summary: 'Aggregate KPIs for the timesheets Projects page',\n      description:\n        'Returns a role-aware KPI payload. Users with `staff.timesheets.projects.manage` get the PM shape (portfolio totals, monthly team hours, active team member count). Other viewers get the Collaborator shape scoped to their own memberships and hours.',\n      responses: [\n        {\n          status: 200,\n          description: 'PM or Collaborator KPIs',\n          schema: z.union([pmResponseSchema, collabResponseSchema]),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        {\n          status: 403,\n          description: 'Missing viewing feature or no staff member linked',\n          schema: z.object({ error: z.string() }),\n        },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAItC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,MAAM,EAAE,QAAQ,IAAI;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EAChD,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,QAAQ;AAAA,EACxB,YAAY,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,CAAC;AAAA,EACD,aAAa;AAAA,EACb,cAAc;AAChB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,cAAc;AAAA,MAC9D,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,OAAO,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG;AAAA,MACrE;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,MAAM;AACR,YAAMA,UAAS,MAAM,sBAAsB;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,qBAAqB,aAAa,MAAM;AAAA,MAC1C,CAAC;AACD,aAAO,QAAQ,QAAQ,KAAKA,OAAM;AAAA,IACpC;AAEA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,0BAA0B;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,IAC7B,CAAC;AACD,WAAO,QAAQ,QAAQ,KAAK,MAAM;AAAA,EACpC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,CAAC,kBAAkB,oBAAoB,CAAC;AAAA,QAC1D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { StaffTeamMember } from '../../../../data/entities'\nimport {\n  computeCollabProjectsKpis,\n  computePmProjectsKpis,\n} from '../../../../lib/timesheets-projects/computeProjectsKpis'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff')\n\nconst VIEW_FEATURE = 'staff.timesheets.projects.view'\nconst MANAGE_FEATURE = 'staff.timesheets.projects.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nconst deltaSchema = z.object({\n  current: z.number(),\n  previous: z.number(),\n  deltaPct: z.number().nullable(),\n})\n\nconst pmResponseSchema = z.object({\n  role: z.literal('pm'),\n  totals: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n    onHold: z.number().int(),\n    completed: z.number().int(),\n  }),\n  hoursWeek: deltaSchema,\n  hoursMonth: deltaSchema,\n  teamActive: z.object({ count: z.number().int() }),\n  assignedToMe: z.object({ total: z.number().int(), active: z.number().int() }),\n})\n\nconst collabResponseSchema = z.object({\n  role: z.literal('collab'),\n  myProjects: z.object({\n    total: z.number().int(),\n    active: z.number().int(),\n  }),\n  myHoursWeek: deltaSchema,\n  myHoursMonth: deltaSchema,\n})\n\nexport async function GET(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth) {\n      throw new CrudHttpError(401, {\n        error: translate('staff.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = container.resolve('em') as EntityManager\n    const rbac = container.resolve('rbacService') as RbacService\n    const isPm = await rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n\n    const staffMember = await findOneWithDecryption(\n      em.fork(),\n      StaffTeamMember,\n      { userId: auth.sub, tenantId, organizationId, deletedAt: null },\n      {},\n      { tenantId, organizationId },\n    )\n\n    if (isPm) {\n      const result = await computePmProjectsKpis({\n        em,\n        tenantId,\n        organizationId,\n        callerStaffMemberId: staffMember?.id ?? null,\n      })\n      return session.respond(200, result)\n    }\n\n    if (!staffMember) {\n      throw new CrudHttpError(403, {\n        error: translate(\n          'staff.timesheets.errors.noStaffMember',\n          'No staff member linked to your account.',\n        ),\n      })\n    }\n\n    const result = await computeCollabProjectsKpis({\n      em,\n      tenantId,\n      organizationId,\n      staffMemberId: staffMember.id,\n    })\n    return session.respond(200, result)\n  } catch (err) {\n    if (err instanceof CrudHttpError) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.projects.kpis failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      {\n        error: translate(\n          'staff.timesheets.errors.projectsKpis',\n          'Failed to load project KPIs.',\n        ),\n      },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Timesheet projects KPIs',\n  methods: {\n    GET: {\n      summary: 'Aggregate KPIs for the timesheets Projects page',\n      description:\n        'Returns a role-aware KPI payload. Users with `staff.timesheets.projects.manage` get the PM shape (portfolio totals, monthly team hours, active team member count). Other viewers get the Collaborator shape scoped to their own memberships and hours.',\n      responses: [\n        {\n          status: 200,\n          description: 'PM or Collaborator KPIs',\n          schema: z.union([pmResponseSchema, collabResponseSchema]),\n        },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        {\n          status: 403,\n          description: 'Missing viewing feature or no staff member linked',\n          schema: z.object({ error: z.string() }),\n        },\n        { status: 500, description: 'Aggregation failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAItC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,MAAM,EAAE,QAAQ,IAAI;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,CAAC;AAAA,EACD,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,EAChD,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,QAAQ;AAAA,EACxB,YAAY,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,CAAC;AAAA,EACD,aAAa;AAAA,EACb,cAAc;AAChB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,cAAc;AAAA,MAC9D,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,eAAe;AAAA,MAC/D,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,OAAO,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG;AAAA,MACrE;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,UAAU,gBAAgB,WAAW,KAAK;AAAA,MAC9D,CAAC;AAAA,MACD,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,QAAI,MAAM;AACR,YAAMA,UAAS,MAAM,sBAAsB;AAAA,QACzC;AAAA,QACA;AAAA,QACA;AAAA,QACA,qBAAqB,aAAa,MAAM;AAAA,MAC1C,CAAC;AACD,aAAO,QAAQ,QAAQ,KAAKA,OAAM;AAAA,IACpC;AAEA,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,0BAA0B;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,IAC7B,CAAC;AACD,WAAO,QAAQ,QAAQ,KAAK,MAAM;AAAA,EACpC,SAAS,KAAK;AACZ,QAAI,eAAe,eAAe;AAChC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,MAAM,CAAC,kBAAkB,oBAAoB,CAAC;AAAA,QAC1D;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["result"]
 }

package/dist/modules/staff/api/timesheets/reports/[id]/close/route.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { resolveFeatureAccess } from "../../../../../lib/time-tracking/featureAccess.js";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { z } from "zod";
 import { forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
@@ -69,7 +70,7 @@ async function POST(req) {
       container,
       auth,
       organizationScope,
-      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,
       organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: req
     };

package/dist/modules/staff/api/timesheets/reports/[id]/close/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/reports/%5Bid%5D/close/route.ts"],
-  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/[id]/close` \u2014 US-G3, screen 14's primary\n * action.\n *\n * Gated on `staff.timesheets.lock`, the feature that already existed for exactly\n * this (\"Lock time periods\"), rather than on a new one. Exporting a PDF does NOT\n * come through here: screen 14 note 5 makes closing the only thing that freezes,\n * so a download can never silently lock a team's timesheet.\n *\n * The whole freeze is one transaction inside the command. This file's job is\n * auth, scope, the mutation guard and turning the command's refusals into the\n * bodies the screen can act on.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeReportCommandIds,\n  type StaffTimeReportCloseResult,\n} from '../../../../../commands/timesheets-reports'\nimport { resolveReportRequestContext } from '../../shared'\nimport {\n  evaluateReportClosePolicies,\n  notifyReportClosed,\n} from '../../../../../lib/timesheets-reports/reportApprovalPolicies'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/close' })\n\nconst LOCK_FEATURE = 'staff.timesheets.lock'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [LOCK_FEATURE] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'close' })\n    const { container, auth, organizationScope, tenantId, organizationId, reportId, translate, grantedFeatures } =\n      context\n\n    // Checked unconditionally. The `grantedFeatures &&` this replaces turned the\n    // check off whenever the grant read failed \u2014 harmless here only because the\n    // route metadata happens to require the same feature, which is exactly the\n    // shape that leaked rates on the report routes where no such backstop existed.\n    if (!(await resolveFeatureAccess(container, auth.sub ?? null, [LOCK_FEATURE], { tenantId, organizationId })).allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n\n    // EP-41 runs strictly AFTER the ACL gate above and can only refuse. A policy\n    // never grants, so nothing here can open a report a caller has no feature for.\n    const approvalContext = {\n      tenantId,\n      organizationId,\n      reportId,\n      actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n      actorFeatures: grantedFeatures,\n      status: 'draft',\n    }\n    const refusal = evaluateReportClosePolicies(approvalContext)\n    if (refusal) {\n      throw forbidden(translate(refusal.messageKey, translate('staff.errors.forbidden', 'Forbidden')))\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: auth.sub ?? '',\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n        resourceId: reportId,\n        operation: 'update',\n        mutationPayload: { id: reportId },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<{ id: string }, StaffTimeReportCloseResult>(\n      staffTimeReportCommandIds.close,\n      { input: { id: reportId }, ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    for (const failure of await notifyReportClosed({ ...approvalContext, status: 'closed' })) {\n      logger.error('staff.timesheets.reports.close approval hook failed', {\n        policyId: failure.policyId,\n        err: failure.error,\n      })\n    }\n\n    const response = await session.respond(200, {\n      id: result?.reportId ?? reportId,\n      status: 'closed',\n      lockedEntryCount: result?.lockedEntryCount ?? 0,\n      totalAmount: result?.totalAmount ?? 0,\n      totalBillableMinutes: result?.totalBillableMinutes ?? 0,\n      totalNonbillableMinutes: result?.totalNonbillableMinutes ?? 0,\n    })\n    if (logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          // Explicitly no undo token: unwinding a billing freeze is the unlock\n          // endpoint, which demands a reason and its own feature. A one-click\n          // undo bar over a closed invoice is exactly what US-G3 forbids.\n          undoToken: '',\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n          resourceId: logEntry.resourceId ?? reportId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.close failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst closeResponseSchema = z.object({\n  id: z.string().uuid(),\n  status: z.literal('closed'),\n  lockedEntryCount: z.number().int(),\n  totalAmount: z.number(),\n  totalBillableMinutes: z.number().int(),\n  totalNonbillableMinutes: z.number().int(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Close and lock a customer report',\n  methods: {\n    POST: {\n      summary: 'Close and lock a customer report',\n      description:\n        'Freezes the report: writes one staff_time_report_entries snapshot per covered entry (raw minutes, rounded minutes, rate, currency, amount, billable), stamps locked_report_id / locked_at on entries that are not already locked by an earlier report, freezes the report totals and appends a `closed` event \u2014 all in one transaction. Exporting never locks; this endpoint is the only thing that does.',\n      responses: [{ status: 200, description: 'Report closed', schema: closeResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing report id or scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.lock, or refused by a registered report approval policy' },\n        { status: 404, description: 'Report not found or not accessible' },\n        { status: 409, description: 'Report is already closed (report_closed)' },\n        { status: 422, description: 'Report covers no entries (report_empty)' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAcA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAClB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAExF,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,QAAQ,CAAC;AAC3E,UAAM,EAAE,WAAW,MAAM,mBAAmB,UAAU,gBAAgB,UAAU,WAAW,gBAAgB,IACzG;AAMF,QAAI,EAAE,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,YAAY,GAAG,EAAE,UAAU,eAAe,CAAC,GAAG,SAAS;AACpH,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AAIA,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MACvD,eAAe;AAAA,MACf,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,4BAA4B,eAAe;AAC3D,QAAI,SAAS;AACX,YAAM,UAAU,UAAU,QAAQ,YAAY,UAAU,0BAA0B,WAAW,CAAC,CAAC;AAAA,IACjG;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,IAChG,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,KAAK,OAAO;AAAA,QACpB;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB,EAAE,IAAI,SAAS;AAAA,MAClC;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,MACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C,0BAA0B;AAAA,MAC1B,EAAE,OAAO,EAAE,IAAI,SAAS,GAAG,IAAI;AAAA,IACjC;AAEA,UAAM,YAAY,gBAAgB;AAElC,eAAW,WAAW,MAAM,mBAAmB,EAAE,GAAG,iBAAiB,QAAQ,SAAS,CAAC,GAAG;AACxF,aAAO,MAAM,uDAAuD;AAAA,QAClE,UAAU,QAAQ;AAAA,QAClB,KAAK,QAAQ;AAAA,MACf,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,YAAY;AAAA,MACxB,QAAQ;AAAA,MACR,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ,eAAe;AAAA,MACpC,sBAAsB,QAAQ,wBAAwB;AAAA,MACtD,yBAAyB,QAAQ,2BAA2B;AAAA,IAC9D,CAAC;AACD,QAAI,UAAU,MAAM,UAAU,WAAW;AACvC,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA;AAAA;AAAA;AAAA,UAIb,WAAW;AAAA,UACX,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,QAAQ,QAAQ;AAAA,EAC1B,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,aAAa,EAAE,OAAO;AAAA,EACtB,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAC1C,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,mFAAmF;AAAA,QAC/G,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,0CAA0C;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/[id]/close` \u2014 US-G3, screen 14's primary\n * action.\n *\n * Gated on `staff.timesheets.lock`, the feature that already existed for exactly\n * this (\"Lock time periods\"), rather than on a new one. Exporting a PDF does NOT\n * come through here: screen 14 note 5 makes closing the only thing that freezes,\n * so a download can never silently lock a team's timesheet.\n *\n * The whole freeze is one transaction inside the command. This file's job is\n * auth, scope, the mutation guard and turning the command's refusals into the\n * bodies the screen can act on.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { z } from 'zod'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeReportCommandIds,\n  type StaffTimeReportCloseResult,\n} from '../../../../../commands/timesheets-reports'\nimport { resolveReportRequestContext } from '../../shared'\nimport {\n  evaluateReportClosePolicies,\n  notifyReportClosed,\n} from '../../../../../lib/timesheets-reports/reportApprovalPolicies'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/close' })\n\nconst LOCK_FEATURE = 'staff.timesheets.lock'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [LOCK_FEATURE] },\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'close' })\n    const { container, auth, organizationScope, tenantId, organizationId, reportId, translate, grantedFeatures } =\n      context\n\n    // Checked unconditionally. The `grantedFeatures &&` this replaces turned the\n    // check off whenever the grant read failed \u2014 harmless here only because the\n    // route metadata happens to require the same feature, which is exactly the\n    // shape that leaked rates on the report routes where no such backstop existed.\n    if (!(await resolveFeatureAccess(container, auth.sub ?? null, [LOCK_FEATURE], { tenantId, organizationId })).allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n\n    // EP-41 runs strictly AFTER the ACL gate above and can only refuse. A policy\n    // never grants, so nothing here can open a report a caller has no feature for.\n    const approvalContext = {\n      tenantId,\n      organizationId,\n      reportId,\n      actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n      actorFeatures: grantedFeatures,\n      status: 'draft',\n    }\n    const refusal = evaluateReportClosePolicies(approvalContext)\n    if (refusal) {\n      throw forbidden(translate(refusal.messageKey, translate('staff.errors.forbidden', 'Forbidden')))\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: auth.sub ?? '',\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n        resourceId: reportId,\n        operation: 'update',\n        mutationPayload: { id: reportId },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<{ id: string }, StaffTimeReportCloseResult>(\n      staffTimeReportCommandIds.close,\n      { input: { id: reportId }, ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    for (const failure of await notifyReportClosed({ ...approvalContext, status: 'closed' })) {\n      logger.error('staff.timesheets.reports.close approval hook failed', {\n        policyId: failure.policyId,\n        err: failure.error,\n      })\n    }\n\n    const response = await session.respond(200, {\n      id: result?.reportId ?? reportId,\n      status: 'closed',\n      lockedEntryCount: result?.lockedEntryCount ?? 0,\n      totalAmount: result?.totalAmount ?? 0,\n      totalBillableMinutes: result?.totalBillableMinutes ?? 0,\n      totalNonbillableMinutes: result?.totalNonbillableMinutes ?? 0,\n    })\n    if (logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          // Explicitly no undo token: unwinding a billing freeze is the unlock\n          // endpoint, which demands a reason and its own feature. A one-click\n          // undo bar over a closed invoice is exactly what US-G3 forbids.\n          undoToken: '',\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n          resourceId: logEntry.resourceId ?? reportId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.close failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst closeResponseSchema = z.object({\n  id: z.string().uuid(),\n  status: z.literal('closed'),\n  lockedEntryCount: z.number().int(),\n  totalAmount: z.number(),\n  totalBillableMinutes: z.number().int(),\n  totalNonbillableMinutes: z.number().int(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Close and lock a customer report',\n  methods: {\n    POST: {\n      summary: 'Close and lock a customer report',\n      description:\n        'Freezes the report: writes one staff_time_report_entries snapshot per covered entry (raw minutes, rounded minutes, rate, currency, amount, billable), stamps locked_report_id / locked_at on entries that are not already locked by an earlier report, freezes the report totals and appends a `closed` event \u2014 all in one transaction. Exporting never locks; this endpoint is the only thing that does.',\n      responses: [{ status: 200, description: 'Report closed', schema: closeResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing report id or scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.lock, or refused by a registered report approval policy' },\n        { status: 404, description: 'Report not found or not accessible' },\n        { status: 409, description: 'Report is already closed (report_closed)' },\n        { status: 422, description: 'Report covers no entries (report_empty)' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAcA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,yCAAyC;AAClD,SAAS,SAAS;AAClB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAExF,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,QAAQ,CAAC;AAC3E,UAAM,EAAE,WAAW,MAAM,mBAAmB,UAAU,gBAAgB,UAAU,WAAW,gBAAgB,IACzG;AAMF,QAAI,EAAE,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,YAAY,GAAG,EAAE,UAAU,eAAe,CAAC,GAAG,SAAS;AACpH,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AAIA,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MACvD,eAAe;AAAA,MACf,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,4BAA4B,eAAe;AAC3D,QAAI,SAAS;AACX,YAAM,UAAU,UAAU,QAAQ,YAAY,UAAU,0BAA0B,WAAW,CAAC,CAAC;AAAA,IACjG;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,IAChG,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,KAAK,OAAO;AAAA,QACpB;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB,EAAE,IAAI,SAAS;AAAA,MAClC;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,MACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C,0BAA0B;AAAA,MAC1B,EAAE,OAAO,EAAE,IAAI,SAAS,GAAG,IAAI;AAAA,IACjC;AAEA,UAAM,YAAY,gBAAgB;AAElC,eAAW,WAAW,MAAM,mBAAmB,EAAE,GAAG,iBAAiB,QAAQ,SAAS,CAAC,GAAG;AACxF,aAAO,MAAM,uDAAuD;AAAA,QAClE,UAAU,QAAQ;AAAA,QAClB,KAAK,QAAQ;AAAA,MACf,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,YAAY;AAAA,MACxB,QAAQ;AAAA,MACR,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ,eAAe;AAAA,MACpC,sBAAsB,QAAQ,wBAAwB;AAAA,MACtD,yBAAyB,QAAQ,2BAA2B;AAAA,IAC9D,CAAC;AACD,QAAI,UAAU,MAAM,UAAU,WAAW;AACvC,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA;AAAA;AAAA;AAAA,UAIb,WAAW;AAAA,UACX,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,QAAQ,QAAQ;AAAA,EAC1B,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,aAAa,EAAE,OAAO;AAAA,EACtB,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,yBAAyB,EAAE,OAAO,EAAE,IAAI;AAC1C,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,mFAAmF;AAAA,QAC/G,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,0CAA0C;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/[id]/export/route.js

@@ -7,6 +7,7 @@ import { StaffTimeReport, StaffTimeReportEvent } from "../../../../../data/entit
 import { loadReportProjectIds } from "../../../../../commands/timesheets-reports.js";
 import { buildReportSheet } from "../../../../../lib/timesheets-reports/buildReportSheet.js";
 import { buildReportRows } from "../../../../../lib/timesheets-reports/reportRows.js";
+import { formatReportPeriodDate } from "../../../../../lib/timesheets-reports/reportPeriod.js";
 import {
   normalizeReportExportFormat,
   serializeReportExport,
@@ -132,8 +133,8 @@ async function GET(req) {
       directory: sheet.directory,
       labels
     });
-    const periodFrom = report.periodFrom instanceof Date ? report.periodFrom.toISOString().slice(0, 10) : "";
-    const periodTo = report.periodTo instanceof Date ? report.periodTo.toISOString().slice(0, 10) : "";
+    const periodFrom = formatReportPeriodDate(report.periodFrom) ?? "";
+    const periodTo = formatReportPeriodDate(report.periodTo) ?? "";
     const file = serializeReportExport(format, {
       reference: report.reference,
       title: report.title,

package/dist/modules/staff/api/timesheets/reports/[id]/export/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/reports/%5Bid%5D/export/route.ts"],
-  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/reports/[id]/export?format=pdf|csv|xlsx` \u2014 US-G4.\n *\n * Two rules from screen 14:\n *\n *  - **Note 3.** The export inherits the current grouping, filters, rounding and\n *    currency, because it is produced from the same `buildReportSheet` the page\n *    rendered. PDF mirrors that sheet; CSV and XLSX add the raw accounting\n *    columns (date, person, description, raw vs rounded minutes).\n *  - **Note 5.** Exporting NEVER locks. The only write here is an append-only\n *    `exported` report event, which is what lets the unlock dialog say \"the PDF\n *    was downloaded on the 20th\" before someone restates a billed hour.\n *\n * The event is appended after the file is built, so a failed render leaves no\n * trace of an export that never happened; a failed event write is logged and\n * does not deny the caller their file.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeReport, StaffTimeReportEvent } from '../../../../../data/entities'\nimport { loadReportProjectIds } from '../../../../../commands/timesheets-reports'\nimport { buildReportSheet } from '../../../../../lib/timesheets-reports/buildReportSheet'\nimport { buildReportRows } from '../../../../../lib/timesheets-reports/reportRows'\nimport {\n  normalizeReportExportFormat,\n  serializeReportExport,\n  supportedReportExportFormats,\n  type ReportExportLabels,\n} from '../../../../../lib/timesheets-reports/reportExport'\nimport {\n  hasReportGrouping,\n  reportGroupingIds,\n  type ReportGrouping,\n} from '../../../../../lib/timesheets-reports/reportGroupings'\nimport { z } from 'zod'\nimport { resolveReportRequestContext, reportSheetLabels, type Translate } from '../../shared'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/export' })\n\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.view'] },\n}\n\n/**\n * EP-35 / EP-36: both accepted sets come from their registries, so a contributed\n * format or grouping is accepted here without this file being edited.\n */\nfunction readQuery(params: URLSearchParams): { format: string | null; grouping: ReportGrouping | undefined } {\n  const grouping = params.get('grouping')\n  return {\n    format: params.get('format'),\n    grouping: hasReportGrouping(grouping) ? (grouping as ReportGrouping) : undefined,\n  }\n}\n\n/**\n * Read lazily rather than frozen at module load: a module registering a format\n * after this route file is first imported must still appear in the published\n * schema.\n */\nfunction exportQuerySchema(): z.ZodTypeAny {\n  return z.object({\n    format: z.enum(supportedReportExportFormats() as [string, ...string[]]),\n    grouping: z.enum(reportGroupingIds() as [string, ...string[]]).optional(),\n  })\n}\n\nfunction exportLabels(translate: Translate): ReportExportLabels {\n  return {\n    documentTitle: translate('staff.time_tracking.reports.sheet.overline', 'Time and cost statement'),\n    issuedBy: translate('staff.time_tracking.reports.sheet.issuedBy', 'Issued by'),\n    reference: translate('staff.time_tracking.reports.sheet.reference', 'Reference'),\n    period: translate('staff.time_tracking.reports.sheet.period', 'Period'),\n    line: translate('staff.time_tracking.reports.sheet.lineLabel', 'Line'),\n    time: translate('staff.time_tracking.reports.sheet.time', 'Time'),\n    rate: translate('staff.time_tracking.reports.sheet.rate', 'Rate'),\n    amount: translate('staff.time_tracking.reports.sheet.amount', 'Amount'),\n    total: translate('staff.time_tracking.reports.sheet.total', 'Total to invoice'),\n    totalHint: translate(\n      'staff.time_tracking.reports.sheet.totalHint',\n      '{billable} billable \u00B7 {nonbillable} non-billable \u00B7 {rounding}',\n    ),\n    nonbillable: translate('staff.time_tracking.reports.sheet.nonbillable', 'Non-billable time'),\n    overrideBadge: translate('staff.time_tracking.reports.sheet.overrideBadge', 'agreed rate'),\n    date: translate('staff.time_tracking.reports.export.date', 'Date'),\n    project: translate('staff.time_tracking.reports.export.project', 'Project'),\n    task: translate('staff.time_tracking.reports.export.task', 'Task'),\n    person: translate('staff.time_tracking.reports.export.person', 'Person'),\n    description: translate('staff.time_tracking.reports.export.description', 'Description'),\n    billable: translate('staff.time_tracking.reports.export.billable', 'Billable'),\n    yes: translate('staff.time_tracking.reports.export.yes', 'Yes'),\n    no: translate('staff.time_tracking.reports.export.no', 'No'),\n    rawMinutes: translate('staff.time_tracking.reports.export.rawMinutes', 'Raw minutes'),\n    roundedMinutes: translate('staff.time_tracking.reports.export.roundedMinutes', 'Rounded minutes'),\n  }\n}\n\nfunction roundingLabel(translate: Translate, unitMinutes: number, direction: string): string {\n  if (!unitMinutes) return translate('staff.time_tracking.reports.rounding.off', 'no rounding')\n  const directionLabel =\n    direction === 'nearest'\n      ? translate('staff.time_tracking.reports.rounding.nearest', 'to the nearest')\n      : translate('staff.time_tracking.reports.rounding.up', 'always up')\n  return translate('staff.time_tracking.reports.rounding.rule', 'rounding {minutes} min, {direction}')\n    .replace('{minutes}', String(unitMinutes))\n    .replace('{direction}', directionLabel)\n}\n\nfunction readCustomerName(snapshot: Record<string, unknown> | null | undefined, fallback: string): string {\n  if (!snapshot) return fallback\n  for (const key of ['name', 'displayName', 'display_name', 'legalName', 'legal_name']) {\n    const value = snapshot[key]\n    if (typeof value === 'string' && value.trim().length > 0) return value.trim()\n  }\n  return fallback\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'export' })\n    // `canSeeMoney` comes from the shared context and is never re-derived here:\n    // the previous `grantedFeatures === null || authorize(...)` opened the money\n    // fields whenever the grant read failed, and this route requires only\n    // `reports.view`, so nothing else stood in the way.\n    const { container, auth, tenantId, organizationId, reportId, translate, canSeeMoney, grantedFeatures } =\n      context\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const { format: rawFormat, grouping } = readQuery(session.searchParams)\n    const format = normalizeReportExportFormat(rawFormat)\n    if (!format) {\n      throw new CrudHttpError(400, {\n        error: translate(\n          'staff.time_tracking.reports.errors.unsupportedFormat',\n          'Supported export formats are pdf, csv and xlsx.',\n        ),\n        supportedFormats: supportedReportExportFormats(),\n      })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const report = await em.findOne(StaffTimeReport, {\n      id: reportId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!report) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.reports.errors.notFound', 'Report not found or not accessible.'),\n      })\n    }\n\n    const timeProjectIds = await loadReportProjectIds(em, report.id, { tenantId, organizationId })\n    const labels = reportSheetLabels(translate)\n    const sheet = await buildReportSheet({\n      em,\n      scope: { tenantId, organizationId },\n      report,\n      timeProjectIds,\n      labels,\n      grouping,\n    })\n    const rows = buildReportRows({\n      entries: sheet.entries,\n      projects: sheet.projects,\n      directory: sheet.directory,\n      labels,\n    })\n\n    const periodFrom = report.periodFrom instanceof Date ? report.periodFrom.toISOString().slice(0, 10) : ''\n    const periodTo = report.periodTo instanceof Date ? report.periodTo.toISOString().slice(0, 10) : ''\n\n    const file = serializeReportExport(format, {\n      reference: report.reference,\n      title: report.title,\n      customerName: readCustomerName(report.customerSnapshot, report.title),\n      periodLabel: `${periodFrom} \u2013 ${periodTo}`,\n      issuedByLabel: null,\n      issuedAtLabel: report.closedAt ? report.closedAt.toISOString().slice(0, 10) : null,\n      currencyCode: sheet.currencyCode,\n      showRates: (report.showRates ?? true) && canSeeMoney,\n      groups: sheet.totals.groups,\n      rows: canSeeMoney ? rows : rows.map((row) => ({ ...row, rate: null, amount: null })),\n      totals: {\n        billableMinutes: sheet.totals.billableMinutes,\n        nonbillableMinutes: sheet.totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? sheet.totals.totalAmount : 0,\n      },\n      roundingLabel: roundingLabel(\n        translate,\n        report.roundingUnitMinutes ?? 0,\n        report.roundingDirection ?? 'up',\n      ),\n      labels: exportLabels(translate),\n    })\n\n    // Append-only audit. Never a lock \u2014 screen 14 note 5.\n    try {\n      const eventEm = (container.resolve('em') as EntityManager).fork()\n      eventEm.persist(\n        eventEm.create(StaffTimeReportEvent, {\n          tenantId,\n          organizationId,\n          reportId: report.id,\n          eventType: 'exported',\n          reason: null,\n          actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n          metadata: { format, grouping: sheet.grouping, rowCount: rows.length },\n          createdAt: new Date(),\n        }),\n      )\n      await eventEm.flush()\n    } catch (err) {\n      // The caller already has a correct file; refusing it because the audit row\n      // failed would be the wrong trade.\n      logger.error('staff.timesheets.reports.export audit event failed', { err })\n    }\n\n    void emitStaffEvent('staff.timesheets.time_report.exported', {\n      id: report.id,\n      tenantId,\n      organizationId,\n      reference: report.reference,\n      format,\n      grouping: sheet.grouping,\n      rowCount: rows.length,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_report.exported failed', { err })\n    })\n\n    // The after-pass cannot rewrite an export's bytes, so what it shapes is the\n    // file's descriptor: an interceptor may rename the download or restate its\n    // media type, and a failing one replaces the file with its own error.\n    const intercepted = await session.respondWithDescriptor({\n      reportId: report.id,\n      reference: report.reference,\n      format,\n      grouping: sheet.grouping,\n      rowCount: rows.length,\n      filename: file.filename,\n      contentType: file.contentType,\n    })\n    if (!intercepted.ok) return intercepted.response\n\n    const filename =\n      typeof intercepted.descriptor.filename === 'string' && intercepted.descriptor.filename.trim().length > 0\n        ? intercepted.descriptor.filename.trim()\n        : file.filename\n    const contentType =\n      typeof intercepted.descriptor.contentType === 'string' && intercepted.descriptor.contentType.trim().length > 0\n        ? intercepted.descriptor.contentType.trim()\n        : file.contentType\n\n    return new NextResponse(new Uint8Array(file.body), {\n      status: 200,\n      headers: {\n        'content-type': contentType,\n        'content-disposition': `attachment; filename=\"${filename}\"`,\n        'cache-control': 'no-store',\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.reports.export failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Export a customer report',\n  methods: {\n    GET: {\n      summary: 'Export a customer report',\n      get query() {\n        return exportQuerySchema()\n      },\n      description:\n        'Renders the report as `pdf` (mirrors the on-screen sheet, client-facing), `csv` or `xlsx` (raw accounting columns: date, project, task, person, description, raw and rounded minutes, billable, rate, amount). Honours the report grouping \u2014 overridable per request with `?grouping=` \u2014 plus its filters, rounding and currency. Appends an `exported` report event; exporting never locks entries. Rates and amounts are omitted for a caller without staff.timesheets.rates.view.',\n      responses: [{ status: 200, description: 'The rendered report file' }],\n      errors: [\n        { status: 400, description: 'Unsupported format' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        { status: 404, description: 'Report not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAkBA,SAAS,oBAAoB;AAE7B,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,iBAAiB,4BAA4B;AACtD,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,SAAS;AAClB,SAAS,6BAA6B,yBAAyC;AAC/E;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAGlF,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAMA,SAAS,UAAU,QAA0F;AAC3G,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL,QAAQ,OAAO,IAAI,QAAQ;AAAA,IAC3B,UAAU,kBAAkB,QAAQ,IAAK,WAA8B;AAAA,EACzE;AACF;AAOA,SAAS,oBAAkC;AACzC,SAAO,EAAE,OAAO;AAAA,IACd,QAAQ,EAAE,KAAK,6BAA6B,CAA0B;AAAA,IACtE,UAAU,EAAE,KAAK,kBAAkB,CAA0B,EAAE,SAAS;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,aAAa,WAA0C;AAC9D,SAAO;AAAA,IACL,eAAe,UAAU,8CAA8C,yBAAyB;AAAA,IAChG,UAAU,UAAU,8CAA8C,WAAW;AAAA,IAC7E,WAAW,UAAU,+CAA+C,WAAW;AAAA,IAC/E,QAAQ,UAAU,4CAA4C,QAAQ;AAAA,IACtE,MAAM,UAAU,+CAA+C,MAAM;AAAA,IACrE,MAAM,UAAU,0CAA0C,MAAM;AAAA,IAChE,MAAM,UAAU,0CAA0C,MAAM;AAAA,IAChE,QAAQ,UAAU,4CAA4C,QAAQ;AAAA,IACtE,OAAO,UAAU,2CAA2C,kBAAkB;AAAA,IAC9E,WAAW;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,IACA,aAAa,UAAU,iDAAiD,mBAAmB;AAAA,IAC3F,eAAe,UAAU,mDAAmD,aAAa;AAAA,IACzF,MAAM,UAAU,2CAA2C,MAAM;AAAA,IACjE,SAAS,UAAU,8CAA8C,SAAS;AAAA,IAC1E,MAAM,UAAU,2CAA2C,MAAM;AAAA,IACjE,QAAQ,UAAU,6CAA6C,QAAQ;AAAA,IACvE,aAAa,UAAU,kDAAkD,aAAa;AAAA,IACtF,UAAU,UAAU,+CAA+C,UAAU;AAAA,IAC7E,KAAK,UAAU,0CAA0C,KAAK;AAAA,IAC9D,IAAI,UAAU,yCAAyC,IAAI;AAAA,IAC3D,YAAY,UAAU,iDAAiD,aAAa;AAAA,IACpF,gBAAgB,UAAU,qDAAqD,iBAAiB;AAAA,EAClG;AACF;AAEA,SAAS,cAAc,WAAsB,aAAqB,WAA2B;AAC3F,MAAI,CAAC,YAAa,QAAO,UAAU,4CAA4C,aAAa;AAC5F,QAAM,iBACJ,cAAc,YACV,UAAU,gDAAgD,gBAAgB,IAC1E,UAAU,2CAA2C,WAAW;AACtE,SAAO,UAAU,6CAA6C,qCAAqC,EAChG,QAAQ,aAAa,OAAO,WAAW,CAAC,EACxC,QAAQ,eAAe,cAAc;AAC1C;AAEA,SAAS,iBAAiB,UAAsD,UAA0B;AACxG,MAAI,CAAC,SAAU,QAAO;AACtB,aAAW,OAAO,CAAC,QAAQ,eAAe,gBAAgB,aAAa,YAAY,GAAG;AACpF,UAAM,QAAQ,SAAS,GAAG;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,SAAS,CAAC;AAK5E,UAAM,EAAE,WAAW,MAAM,UAAU,gBAAgB,UAAU,WAAW,aAAa,gBAAgB,IACnG;AAEF,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,EAAE,QAAQ,WAAW,SAAS,IAAI,UAAU,QAAQ,YAAY;AACtE,UAAM,SAAS,4BAA4B,SAAS;AACpD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,QACA,kBAAkB,6BAA6B;AAAA,MACjD,CAAC;AAAA,IACH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,qCAAqC;AAAA,MACvG,CAAC;AAAA,IACH;AAEA,UAAM,iBAAiB,MAAM,qBAAqB,IAAI,OAAO,IAAI,EAAE,UAAU,eAAe,CAAC;AAC7F,UAAM,SAAS,kBAAkB,SAAS;AAC1C,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACnC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,gBAAgB;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAED,UAAM,aAAa,OAAO,sBAAsB,OAAO,OAAO,WAAW,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AACtG,UAAM,WAAW,OAAO,oBAAoB,OAAO,OAAO,SAAS,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAEhG,UAAM,OAAO,sBAAsB,QAAQ;AAAA,MACzC,WAAW,OAAO;AAAA,MAClB,OAAO,OAAO;AAAA,MACd,cAAc,iBAAiB,OAAO,kBAAkB,OAAO,KAAK;AAAA,MACpE,aAAa,GAAG,UAAU,WAAM,QAAQ;AAAA,MACxC,eAAe;AAAA,MACf,eAAe,OAAO,WAAW,OAAO,SAAS,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAAA,MAC9E,cAAc,MAAM;AAAA,MACpB,YAAY,OAAO,aAAa,SAAS;AAAA,MACzC,QAAQ,MAAM,OAAO;AAAA,MACrB,MAAM,cAAc,OAAO,KAAK,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,MAAM,MAAM,QAAQ,KAAK,EAAE;AAAA,MACnF,QAAQ;AAAA,QACN,iBAAiB,MAAM,OAAO;AAAA,QAC9B,oBAAoB,MAAM,OAAO;AAAA,QACjC,aAAa,cAAc,MAAM,OAAO,cAAc;AAAA,MACxD;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,OAAO,uBAAuB;AAAA,QAC9B,OAAO,qBAAqB;AAAA,MAC9B;AAAA,MACA,QAAQ,aAAa,SAAS;AAAA,IAChC,CAAC;AAGD,QAAI;AACF,YAAM,UAAW,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAChE,cAAQ;AAAA,QACN,QAAQ,OAAO,sBAAsB;AAAA,UACnC;AAAA,UACA;AAAA,UACA,UAAU,OAAO;AAAA,UACjB,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,UACvD,UAAU,EAAE,QAAQ,UAAU,MAAM,UAAU,UAAU,KAAK,OAAO;AAAA,UACpE,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM,QAAQ,MAAM;AAAA,IACtB,SAAS,KAAK;AAGZ,aAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAAA,IAC5E;AAEA,SAAK,eAAe,yCAAyC;AAAA,MAC3D,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,IACjB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AAAA,IAC3E,CAAC;AAKD,UAAM,cAAc,MAAM,QAAQ,sBAAsB;AAAA,MACtD,UAAU,OAAO;AAAA,MACjB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,aAAa,KAAK;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,WACJ,OAAO,YAAY,WAAW,aAAa,YAAY,YAAY,WAAW,SAAS,KAAK,EAAE,SAAS,IACnG,YAAY,WAAW,SAAS,KAAK,IACrC,KAAK;AACX,UAAM,cACJ,OAAO,YAAY,WAAW,gBAAgB,YAAY,YAAY,WAAW,YAAY,KAAK,EAAE,SAAS,IACzG,YAAY,WAAW,YAAY,KAAK,IACxC,KAAK;AAEX,WAAO,IAAI,aAAa,IAAI,WAAW,KAAK,IAAI,GAAG;AAAA,MACjD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,uBAAuB,yBAAyB,QAAQ;AAAA,QACxD,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,IAAI,QAAQ;AACV,eAAO,kBAAkB;AAAA,MAC3B;AAAA,MACA,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,CAAC;AAAA,MACpE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB;AAAA,QACjD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/reports/[id]/export?format=pdf|csv|xlsx` \u2014 US-G4.\n *\n * Two rules from screen 14:\n *\n *  - **Note 3.** The export inherits the current grouping, filters, rounding and\n *    currency, because it is produced from the same `buildReportSheet` the page\n *    rendered. PDF mirrors that sheet; CSV and XLSX add the raw accounting\n *    columns (date, person, description, raw vs rounded minutes).\n *  - **Note 5.** Exporting NEVER locks. The only write here is an append-only\n *    `exported` report event, which is what lets the unlock dialog say \"the PDF\n *    was downloaded on the 20th\" before someone restates a billed hour.\n *\n * The event is appended after the file is built, so a failed render leaves no\n * trace of an export that never happened; a failed event write is logged and\n * does not deny the caller their file.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeReport, StaffTimeReportEvent } from '../../../../../data/entities'\nimport { loadReportProjectIds } from '../../../../../commands/timesheets-reports'\nimport { buildReportSheet } from '../../../../../lib/timesheets-reports/buildReportSheet'\nimport { buildReportRows } from '../../../../../lib/timesheets-reports/reportRows'\nimport { formatReportPeriodDate } from '../../../../../lib/timesheets-reports/reportPeriod'\nimport {\n  normalizeReportExportFormat,\n  serializeReportExport,\n  supportedReportExportFormats,\n  type ReportExportLabels,\n} from '../../../../../lib/timesheets-reports/reportExport'\nimport {\n  hasReportGrouping,\n  reportGroupingIds,\n  type ReportGrouping,\n} from '../../../../../lib/timesheets-reports/reportGroupings'\nimport { z } from 'zod'\nimport { resolveReportRequestContext, reportSheetLabels, type Translate } from '../../shared'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/export' })\n\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.view'] },\n}\n\n/**\n * EP-35 / EP-36: both accepted sets come from their registries, so a contributed\n * format or grouping is accepted here without this file being edited.\n */\nfunction readQuery(params: URLSearchParams): { format: string | null; grouping: ReportGrouping | undefined } {\n  const grouping = params.get('grouping')\n  return {\n    format: params.get('format'),\n    grouping: hasReportGrouping(grouping) ? (grouping as ReportGrouping) : undefined,\n  }\n}\n\n/**\n * Read lazily rather than frozen at module load: a module registering a format\n * after this route file is first imported must still appear in the published\n * schema.\n */\nfunction exportQuerySchema(): z.ZodTypeAny {\n  return z.object({\n    format: z.enum(supportedReportExportFormats() as [string, ...string[]]),\n    grouping: z.enum(reportGroupingIds() as [string, ...string[]]).optional(),\n  })\n}\n\nfunction exportLabels(translate: Translate): ReportExportLabels {\n  return {\n    documentTitle: translate('staff.time_tracking.reports.sheet.overline', 'Time and cost statement'),\n    issuedBy: translate('staff.time_tracking.reports.sheet.issuedBy', 'Issued by'),\n    reference: translate('staff.time_tracking.reports.sheet.reference', 'Reference'),\n    period: translate('staff.time_tracking.reports.sheet.period', 'Period'),\n    line: translate('staff.time_tracking.reports.sheet.lineLabel', 'Line'),\n    time: translate('staff.time_tracking.reports.sheet.time', 'Time'),\n    rate: translate('staff.time_tracking.reports.sheet.rate', 'Rate'),\n    amount: translate('staff.time_tracking.reports.sheet.amount', 'Amount'),\n    total: translate('staff.time_tracking.reports.sheet.total', 'Total to invoice'),\n    totalHint: translate(\n      'staff.time_tracking.reports.sheet.totalHint',\n      '{billable} billable \u00B7 {nonbillable} non-billable \u00B7 {rounding}',\n    ),\n    nonbillable: translate('staff.time_tracking.reports.sheet.nonbillable', 'Non-billable time'),\n    overrideBadge: translate('staff.time_tracking.reports.sheet.overrideBadge', 'agreed rate'),\n    date: translate('staff.time_tracking.reports.export.date', 'Date'),\n    project: translate('staff.time_tracking.reports.export.project', 'Project'),\n    task: translate('staff.time_tracking.reports.export.task', 'Task'),\n    person: translate('staff.time_tracking.reports.export.person', 'Person'),\n    description: translate('staff.time_tracking.reports.export.description', 'Description'),\n    billable: translate('staff.time_tracking.reports.export.billable', 'Billable'),\n    yes: translate('staff.time_tracking.reports.export.yes', 'Yes'),\n    no: translate('staff.time_tracking.reports.export.no', 'No'),\n    rawMinutes: translate('staff.time_tracking.reports.export.rawMinutes', 'Raw minutes'),\n    roundedMinutes: translate('staff.time_tracking.reports.export.roundedMinutes', 'Rounded minutes'),\n  }\n}\n\nfunction roundingLabel(translate: Translate, unitMinutes: number, direction: string): string {\n  if (!unitMinutes) return translate('staff.time_tracking.reports.rounding.off', 'no rounding')\n  const directionLabel =\n    direction === 'nearest'\n      ? translate('staff.time_tracking.reports.rounding.nearest', 'to the nearest')\n      : translate('staff.time_tracking.reports.rounding.up', 'always up')\n  return translate('staff.time_tracking.reports.rounding.rule', 'rounding {minutes} min, {direction}')\n    .replace('{minutes}', String(unitMinutes))\n    .replace('{direction}', directionLabel)\n}\n\nfunction readCustomerName(snapshot: Record<string, unknown> | null | undefined, fallback: string): string {\n  if (!snapshot) return fallback\n  for (const key of ['name', 'displayName', 'display_name', 'legalName', 'legal_name']) {\n    const value = snapshot[key]\n    if (typeof value === 'string' && value.trim().length > 0) return value.trim()\n  }\n  return fallback\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'export' })\n    // `canSeeMoney` comes from the shared context and is never re-derived here:\n    // the previous `grantedFeatures === null || authorize(...)` opened the money\n    // fields whenever the grant read failed, and this route requires only\n    // `reports.view`, so nothing else stood in the way.\n    const { container, auth, tenantId, organizationId, reportId, translate, canSeeMoney, grantedFeatures } =\n      context\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const { format: rawFormat, grouping } = readQuery(session.searchParams)\n    const format = normalizeReportExportFormat(rawFormat)\n    if (!format) {\n      throw new CrudHttpError(400, {\n        error: translate(\n          'staff.time_tracking.reports.errors.unsupportedFormat',\n          'Supported export formats are pdf, csv and xlsx.',\n        ),\n        supportedFormats: supportedReportExportFormats(),\n      })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const report = await em.findOne(StaffTimeReport, {\n      id: reportId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!report) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.reports.errors.notFound', 'Report not found or not accessible.'),\n      })\n    }\n\n    const timeProjectIds = await loadReportProjectIds(em, report.id, { tenantId, organizationId })\n    const labels = reportSheetLabels(translate)\n    const sheet = await buildReportSheet({\n      em,\n      scope: { tenantId, organizationId },\n      report,\n      timeProjectIds,\n      labels,\n      grouping,\n    })\n    const rows = buildReportRows({\n      entries: sheet.entries,\n      projects: sheet.projects,\n      directory: sheet.directory,\n      labels,\n    })\n\n    const periodFrom = formatReportPeriodDate(report.periodFrom) ?? ''\n    const periodTo = formatReportPeriodDate(report.periodTo) ?? ''\n\n    const file = serializeReportExport(format, {\n      reference: report.reference,\n      title: report.title,\n      customerName: readCustomerName(report.customerSnapshot, report.title),\n      periodLabel: `${periodFrom} \u2013 ${periodTo}`,\n      issuedByLabel: null,\n      issuedAtLabel: report.closedAt ? report.closedAt.toISOString().slice(0, 10) : null,\n      currencyCode: sheet.currencyCode,\n      showRates: (report.showRates ?? true) && canSeeMoney,\n      groups: sheet.totals.groups,\n      rows: canSeeMoney ? rows : rows.map((row) => ({ ...row, rate: null, amount: null })),\n      totals: {\n        billableMinutes: sheet.totals.billableMinutes,\n        nonbillableMinutes: sheet.totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? sheet.totals.totalAmount : 0,\n      },\n      roundingLabel: roundingLabel(\n        translate,\n        report.roundingUnitMinutes ?? 0,\n        report.roundingDirection ?? 'up',\n      ),\n      labels: exportLabels(translate),\n    })\n\n    // Append-only audit. Never a lock \u2014 screen 14 note 5.\n    try {\n      const eventEm = (container.resolve('em') as EntityManager).fork()\n      eventEm.persist(\n        eventEm.create(StaffTimeReportEvent, {\n          tenantId,\n          organizationId,\n          reportId: report.id,\n          eventType: 'exported',\n          reason: null,\n          actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n          metadata: { format, grouping: sheet.grouping, rowCount: rows.length },\n          createdAt: new Date(),\n        }),\n      )\n      await eventEm.flush()\n    } catch (err) {\n      // The caller already has a correct file; refusing it because the audit row\n      // failed would be the wrong trade.\n      logger.error('staff.timesheets.reports.export audit event failed', { err })\n    }\n\n    void emitStaffEvent('staff.timesheets.time_report.exported', {\n      id: report.id,\n      tenantId,\n      organizationId,\n      reference: report.reference,\n      format,\n      grouping: sheet.grouping,\n      rowCount: rows.length,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_report.exported failed', { err })\n    })\n\n    // The after-pass cannot rewrite an export's bytes, so what it shapes is the\n    // file's descriptor: an interceptor may rename the download or restate its\n    // media type, and a failing one replaces the file with its own error.\n    const intercepted = await session.respondWithDescriptor({\n      reportId: report.id,\n      reference: report.reference,\n      format,\n      grouping: sheet.grouping,\n      rowCount: rows.length,\n      filename: file.filename,\n      contentType: file.contentType,\n    })\n    if (!intercepted.ok) return intercepted.response\n\n    const filename =\n      typeof intercepted.descriptor.filename === 'string' && intercepted.descriptor.filename.trim().length > 0\n        ? intercepted.descriptor.filename.trim()\n        : file.filename\n    const contentType =\n      typeof intercepted.descriptor.contentType === 'string' && intercepted.descriptor.contentType.trim().length > 0\n        ? intercepted.descriptor.contentType.trim()\n        : file.contentType\n\n    return new NextResponse(new Uint8Array(file.body), {\n      status: 200,\n      headers: {\n        'content-type': contentType,\n        'content-disposition': `attachment; filename=\"${filename}\"`,\n        'cache-control': 'no-store',\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.reports.export failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Export a customer report',\n  methods: {\n    GET: {\n      summary: 'Export a customer report',\n      get query() {\n        return exportQuerySchema()\n      },\n      description:\n        'Renders the report as `pdf` (mirrors the on-screen sheet, client-facing), `csv` or `xlsx` (raw accounting columns: date, project, task, person, description, raw and rounded minutes, billable, rate, amount). Honours the report grouping \u2014 overridable per request with `?grouping=` \u2014 plus its filters, rounding and currency. Appends an `exported` report event; exporting never locks entries. Rates and amounts are omitted for a caller without staff.timesheets.rates.view.',\n      responses: [{ status: 200, description: 'The rendered report file' }],\n      errors: [\n        { status: 400, description: 'Unsupported format' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        { status: 404, description: 'Report not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAkBA,SAAS,oBAAoB;AAE7B,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,iBAAiB,4BAA4B;AACtD,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,SAAS;AAClB,SAAS,6BAA6B,yBAAyC;AAC/E;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAGlF,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAMA,SAAS,UAAU,QAA0F;AAC3G,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL,QAAQ,OAAO,IAAI,QAAQ;AAAA,IAC3B,UAAU,kBAAkB,QAAQ,IAAK,WAA8B;AAAA,EACzE;AACF;AAOA,SAAS,oBAAkC;AACzC,SAAO,EAAE,OAAO;AAAA,IACd,QAAQ,EAAE,KAAK,6BAA6B,CAA0B;AAAA,IACtE,UAAU,EAAE,KAAK,kBAAkB,CAA0B,EAAE,SAAS;AAAA,EAC1E,CAAC;AACH;AAEA,SAAS,aAAa,WAA0C;AAC9D,SAAO;AAAA,IACL,eAAe,UAAU,8CAA8C,yBAAyB;AAAA,IAChG,UAAU,UAAU,8CAA8C,WAAW;AAAA,IAC7E,WAAW,UAAU,+CAA+C,WAAW;AAAA,IAC/E,QAAQ,UAAU,4CAA4C,QAAQ;AAAA,IACtE,MAAM,UAAU,+CAA+C,MAAM;AAAA,IACrE,MAAM,UAAU,0CAA0C,MAAM;AAAA,IAChE,MAAM,UAAU,0CAA0C,MAAM;AAAA,IAChE,QAAQ,UAAU,4CAA4C,QAAQ;AAAA,IACtE,OAAO,UAAU,2CAA2C,kBAAkB;AAAA,IAC9E,WAAW;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,IACA,aAAa,UAAU,iDAAiD,mBAAmB;AAAA,IAC3F,eAAe,UAAU,mDAAmD,aAAa;AAAA,IACzF,MAAM,UAAU,2CAA2C,MAAM;AAAA,IACjE,SAAS,UAAU,8CAA8C,SAAS;AAAA,IAC1E,MAAM,UAAU,2CAA2C,MAAM;AAAA,IACjE,QAAQ,UAAU,6CAA6C,QAAQ;AAAA,IACvE,aAAa,UAAU,kDAAkD,aAAa;AAAA,IACtF,UAAU,UAAU,+CAA+C,UAAU;AAAA,IAC7E,KAAK,UAAU,0CAA0C,KAAK;AAAA,IAC9D,IAAI,UAAU,yCAAyC,IAAI;AAAA,IAC3D,YAAY,UAAU,iDAAiD,aAAa;AAAA,IACpF,gBAAgB,UAAU,qDAAqD,iBAAiB;AAAA,EAClG;AACF;AAEA,SAAS,cAAc,WAAsB,aAAqB,WAA2B;AAC3F,MAAI,CAAC,YAAa,QAAO,UAAU,4CAA4C,aAAa;AAC5F,QAAM,iBACJ,cAAc,YACV,UAAU,gDAAgD,gBAAgB,IAC1E,UAAU,2CAA2C,WAAW;AACtE,SAAO,UAAU,6CAA6C,qCAAqC,EAChG,QAAQ,aAAa,OAAO,WAAW,CAAC,EACxC,QAAQ,eAAe,cAAc;AAC1C;AAEA,SAAS,iBAAiB,UAAsD,UAA0B;AACxG,MAAI,CAAC,SAAU,QAAO;AACtB,aAAW,OAAO,CAAC,QAAQ,eAAe,gBAAgB,aAAa,YAAY,GAAG;AACpF,UAAM,QAAQ,SAAS,GAAG;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,SAAS,CAAC;AAK5E,UAAM,EAAE,WAAW,MAAM,UAAU,gBAAgB,UAAU,WAAW,aAAa,gBAAgB,IACnG;AAEF,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,EAAE,QAAQ,WAAW,SAAS,IAAI,UAAU,QAAQ,YAAY;AACtE,UAAM,SAAS,4BAA4B,SAAS;AACpD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,QACA,kBAAkB,6BAA6B;AAAA,MACjD,CAAC;AAAA,IACH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,qCAAqC;AAAA,MACvG,CAAC;AAAA,IACH;AAEA,UAAM,iBAAiB,MAAM,qBAAqB,IAAI,OAAO,IAAI,EAAE,UAAU,eAAe,CAAC;AAC7F,UAAM,SAAS,kBAAkB,SAAS;AAC1C,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACnC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,OAAO,gBAAgB;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAED,UAAM,aAAa,uBAAuB,OAAO,UAAU,KAAK;AAChE,UAAM,WAAW,uBAAuB,OAAO,QAAQ,KAAK;AAE5D,UAAM,OAAO,sBAAsB,QAAQ;AAAA,MACzC,WAAW,OAAO;AAAA,MAClB,OAAO,OAAO;AAAA,MACd,cAAc,iBAAiB,OAAO,kBAAkB,OAAO,KAAK;AAAA,MACpE,aAAa,GAAG,UAAU,WAAM,QAAQ;AAAA,MACxC,eAAe;AAAA,MACf,eAAe,OAAO,WAAW,OAAO,SAAS,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAAA,MAC9E,cAAc,MAAM;AAAA,MACpB,YAAY,OAAO,aAAa,SAAS;AAAA,MACzC,QAAQ,MAAM,OAAO;AAAA,MACrB,MAAM,cAAc,OAAO,KAAK,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,MAAM,MAAM,QAAQ,KAAK,EAAE;AAAA,MACnF,QAAQ;AAAA,QACN,iBAAiB,MAAM,OAAO;AAAA,QAC9B,oBAAoB,MAAM,OAAO;AAAA,QACjC,aAAa,cAAc,MAAM,OAAO,cAAc;AAAA,MACxD;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,OAAO,uBAAuB;AAAA,QAC9B,OAAO,qBAAqB;AAAA,MAC9B;AAAA,MACA,QAAQ,aAAa,SAAS;AAAA,IAChC,CAAC;AAGD,QAAI;AACF,YAAM,UAAW,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAChE,cAAQ;AAAA,QACN,QAAQ,OAAO,sBAAsB;AAAA,UACnC;AAAA,UACA;AAAA,UACA,UAAU,OAAO;AAAA,UACjB,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,UACvD,UAAU,EAAE,QAAQ,UAAU,MAAM,UAAU,UAAU,KAAK,OAAO;AAAA,UACpE,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAC;AAAA,MACH;AACA,YAAM,QAAQ,MAAM;AAAA,IACtB,SAAS,KAAK;AAGZ,aAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAAA,IAC5E;AAEA,SAAK,eAAe,yCAAyC;AAAA,MAC3D,IAAI,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,IACjB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AAAA,IAC3E,CAAC;AAKD,UAAM,cAAc,MAAM,QAAQ,sBAAsB;AAAA,MACtD,UAAU,OAAO;AAAA,MACjB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,aAAa,KAAK;AAAA,IACpB,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,WACJ,OAAO,YAAY,WAAW,aAAa,YAAY,YAAY,WAAW,SAAS,KAAK,EAAE,SAAS,IACnG,YAAY,WAAW,SAAS,KAAK,IACrC,KAAK;AACX,UAAM,cACJ,OAAO,YAAY,WAAW,gBAAgB,YAAY,YAAY,WAAW,YAAY,KAAK,EAAE,SAAS,IACzG,YAAY,WAAW,YAAY,KAAK,IACxC,KAAK;AAEX,WAAO,IAAI,aAAa,IAAI,WAAW,KAAK,IAAI,GAAG;AAAA,MACjD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,uBAAuB,yBAAyB,QAAQ;AAAA,QACxD,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,IAAI,QAAQ;AACV,eAAO,kBAAkB;AAAA,MAC3B;AAAA,MACA,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,CAAC;AAAA,MACpE,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB;AAAA,QACjD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/[id]/sheet/route.js

@@ -7,6 +7,7 @@ import { StaffTimeReport, StaffTimeReportEvent } from "../../../../../data/entit
 import { loadReportProjectIds } from "../../../../../commands/timesheets-reports.js";
 import { buildReportSheet } from "../../../../../lib/timesheets-reports/buildReportSheet.js";
 import { buildReportRows } from "../../../../../lib/timesheets-reports/reportRows.js";
+import { formatReportPeriodDate } from "../../../../../lib/timesheets-reports/reportPeriod.js";
 import { hasReportGrouping } from "../../../../../lib/timesheets-reports/reportGroupings.js";
 import { resolveReportRequestContext, reportSheetLabels, MAX_SHEET_ROWS } from "../../shared.js";
 import {
@@ -75,8 +76,8 @@ async function GET(req) {
         customerId: report.customerId,
         customerSnapshot: report.customerSnapshot ?? null,
         periodKind: report.periodKind,
-        periodFrom: report.periodFrom instanceof Date ? report.periodFrom.toISOString().slice(0, 10) : null,
-        periodTo: report.periodTo instanceof Date ? report.periodTo.toISOString().slice(0, 10) : null,
+        periodFrom: formatReportPeriodDate(report.periodFrom),
+        periodTo: formatReportPeriodDate(report.periodTo),
         currencyCode: sheet.currencyCode,
         grouping: sheet.grouping,
         nonbillableMode: sheet.nonbillableMode,

package/dist/modules/staff/api/timesheets/reports/[id]/sheet/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/reports/%5Bid%5D/sheet/route.ts"],
-  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/reports/[id]/sheet` \u2014 everything screens 14 and 15\n * render: the report header, the grouped sheet, the raw entry rows and the\n * close/unlock/export history.\n *\n * It is a separate route from the CRUD detail because the sheet is COMPUTED. A\n * draft is computed live (and therefore moves when an entry is edited); a closed\n * report is rebuilt from its own freeze records, so a later rounding change\n * cannot restate an invoice the client already has (risk R1). One endpoint\n * answering both keeps the page from having to know which case it is in.\n *\n * `?grouping=` re-groups the same numbers without persisting the choice, which\n * is what lets screen 14 flip between task / person / day and still print the\n * same grand total (D-7).\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeReport, StaffTimeReportEvent } from '../../../../../data/entities'\nimport { loadReportProjectIds } from '../../../../../commands/timesheets-reports'\nimport { buildReportSheet } from '../../../../../lib/timesheets-reports/buildReportSheet'\nimport { buildReportRows } from '../../../../../lib/timesheets-reports/reportRows'\nimport { hasReportGrouping, type ReportGrouping } from '../../../../../lib/timesheets-reports/reportGroupings'\nimport { resolveReportRequestContext, reportSheetLabels, MAX_SHEET_ROWS } from '../../shared'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/sheet' })\n\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.view'] },\n}\n\n/** EP-36: the accepted set is the grouping registry, not a literal union. */\nfunction readGrouping(params: URLSearchParams): ReportGrouping | undefined {\n  const value = params.get('grouping')\n  return hasReportGrouping(value) ? (value as ReportGrouping) : undefined\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'sheet' })\n    // See the note in the export route: this decision is made once, fail-closed,\n    // in `buildReportRequestContext`.\n    const { container, auth, tenantId, organizationId, reportId, translate, canSeeMoney, grantedFeatures } =\n      context\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const report = await em.findOne(StaffTimeReport, {\n      id: reportId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!report) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.reports.errors.notFound', 'Report not found or not accessible.'),\n      })\n    }\n\n    const timeProjectIds = await loadReportProjectIds(em, report.id, { tenantId, organizationId })\n    const labels = reportSheetLabels(translate)\n    const sheet = await buildReportSheet({\n      em,\n      scope: { tenantId, organizationId },\n      report,\n      timeProjectIds,\n      labels,\n      grouping: readGrouping(session.searchParams),\n    })\n\n    const rows = buildReportRows({\n      entries: sheet.entries,\n      projects: sheet.projects,\n      directory: sheet.directory,\n      labels,\n    })\n\n    const events = await em.find(\n      StaffTimeReportEvent,\n      { reportId: report.id, tenantId, organizationId },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    return session.respond(200, {\n      report: {\n        id: report.id,\n        reference: report.reference,\n        title: report.title,\n        status: report.status,\n        customerId: report.customerId,\n        customerSnapshot: report.customerSnapshot ?? null,\n        periodKind: report.periodKind,\n        periodFrom: report.periodFrom instanceof Date ? report.periodFrom.toISOString().slice(0, 10) : null,\n        periodTo: report.periodTo instanceof Date ? report.periodTo.toISOString().slice(0, 10) : null,\n        currencyCode: sheet.currencyCode,\n        grouping: sheet.grouping,\n        nonbillableMode: sheet.nonbillableMode,\n        includeAlreadyReported: report.includeAlreadyReported ?? false,\n        showRates: (report.showRates ?? true) && canSeeMoney,\n        roundingUnitMinutes: report.roundingUnitMinutes ?? 0,\n        roundingDirection: report.roundingDirection ?? 'up',\n        closedAt: report.closedAt ? report.closedAt.toISOString() : null,\n        closedByUserId: report.closedByUserId ?? null,\n        createdByUserId: report.createdByUserId ?? null,\n        createdAt: report.createdAt ? report.createdAt.toISOString() : null,\n        updatedAt: report.updatedAt ? report.updatedAt.toISOString() : null,\n        timeProjectIds,\n      },\n      groups: canSeeMoney ? sheet.totals.groups : stripAmounts(sheet.totals.groups),\n      totals: {\n        entryCount: sheet.totals.entryCount,\n        billableMinutes: sheet.totals.billableMinutes,\n        nonbillableMinutes: sheet.totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? sheet.totals.totalAmount : null,\n      },\n      alreadyReportedCount: sheet.totals.alreadyReportedCount,\n      alreadyReportedMinutes: sheet.totals.alreadyReportedMinutes,\n      alreadyReportedIn: sheet.totals.alreadyReportedIn,\n      rows: rows.slice(0, MAX_SHEET_ROWS).map((row) => ({\n        ...row,\n        rate: canSeeMoney ? row.rate : null,\n        amount: canSeeMoney ? row.amount : null,\n      })),\n      rowCount: rows.length,\n      rowsTruncated: rows.length > MAX_SHEET_ROWS,\n      events: events.map((event) => ({\n        id: event.id,\n        eventType: event.eventType,\n        reason: event.reason ?? null,\n        actorUserId: event.actorUserId ?? null,\n        metadata: event.metadata ?? null,\n        createdAt: event.createdAt ? event.createdAt.toISOString() : null,\n      })),\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.reports.sheet failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\ntype SheetGroups = Awaited<ReturnType<typeof buildReportSheet>>['totals']['groups']\n\n/** Money is absent, not zeroed, for a caller without `rates.view`. */\nfunction stripAmounts(groups: SheetGroups): SheetGroups {\n  return groups.map((group) => ({\n    ...group,\n    rate: null,\n    amount: 0,\n    lines: group.lines.map(function strip(line): SheetGroups[number]['lines'][number] {\n      return { ...line, rate: null, amount: 0, children: line.children.map(strip) }\n    }),\n  }))\n}\n\nconst sheetResponseSchema = z.object({\n  report: z.object({\n    id: z.string().uuid(),\n    reference: z.string(),\n    title: z.string(),\n    status: z.enum(['draft', 'closed']),\n    currencyCode: z.string().nullable(),\n    periodFrom: z.string().nullable(),\n    periodTo: z.string().nullable(),\n    showRates: z.boolean(),\n  }),\n  totals: z.object({\n    entryCount: z.number().int(),\n    billableMinutes: z.number().int(),\n    nonbillableMinutes: z.number().int(),\n    totalAmount: z.number().nullable(),\n  }),\n  rowCount: z.number().int(),\n  rowsTruncated: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Read a customer report sheet',\n  methods: {\n    GET: {\n      summary: 'Read a customer report sheet',\n      description:\n        'Returns the report header, the grouped sheet, the raw entry rows and the close/unlock/export history. A draft is computed live; a closed report is rebuilt from its own frozen snapshots so a later rounding or rate change cannot restate it. `?grouping=project_task|project_person|project_day` re-groups the same numbers without persisting the choice \u2014 the grand total is invariant under it (D-7). Amounts are omitted for a caller without staff.timesheets.rates.view.',\n      responses: [{ status: 200, description: 'Report sheet', schema: sheetResponseSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        { status: 404, description: 'Report not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAgBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAKlB,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,SAAS,iBAAiB,4BAA4B;AACtD,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,uBAAuB;AAChC,SAAS,yBAA8C;AACvD,SAAS,6BAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAGjF,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAGA,SAAS,aAAa,QAAqD;AACzE,QAAM,QAAQ,OAAO,IAAI,UAAU;AACnC,SAAO,kBAAkB,KAAK,IAAK,QAA2B;AAChE;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,QAAQ,CAAC;AAG3E,UAAM,EAAE,WAAW,MAAM,UAAU,gBAAgB,UAAU,WAAW,aAAa,gBAAgB,IACnG;AAEF,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,qCAAqC;AAAA,MACvG,CAAC;AAAA,IACH;AAEA,UAAM,iBAAiB,MAAM,qBAAqB,IAAI,OAAO,IAAI,EAAE,UAAU,eAAe,CAAC;AAC7F,UAAM,SAAS,kBAAkB,SAAS;AAC1C,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACnC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,aAAa,QAAQ,YAAY;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,gBAAgB;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAED,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,OAAO,IAAI,UAAU,eAAe;AAAA,MAChD,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,QAAQ;AAAA,QACN,IAAI,OAAO;AAAA,QACX,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO;AAAA,QACd,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,QACnB,kBAAkB,OAAO,oBAAoB;AAAA,QAC7C,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO,sBAAsB,OAAO,OAAO,WAAW,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAAA,QAC/F,UAAU,OAAO,oBAAoB,OAAO,OAAO,SAAS,YAAY,EAAE,MAAM,GAAG,EAAE,IAAI;AAAA,QACzF,cAAc,MAAM;AAAA,QACpB,UAAU,MAAM;AAAA,QAChB,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,OAAO,0BAA0B;AAAA,QACzD,YAAY,OAAO,aAAa,SAAS;AAAA,QACzC,qBAAqB,OAAO,uBAAuB;AAAA,QACnD,mBAAmB,OAAO,qBAAqB;AAAA,QAC/C,UAAU,OAAO,WAAW,OAAO,SAAS,YAAY,IAAI;AAAA,QAC5D,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,iBAAiB,OAAO,mBAAmB;AAAA,QAC3C,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,QAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,QAC/D;AAAA,MACF;AAAA,MACA,QAAQ,cAAc,MAAM,OAAO,SAAS,aAAa,MAAM,OAAO,MAAM;AAAA,MAC5E,QAAQ;AAAA,QACN,YAAY,MAAM,OAAO;AAAA,QACzB,iBAAiB,MAAM,OAAO;AAAA,QAC9B,oBAAoB,MAAM,OAAO;AAAA,QACjC,aAAa,cAAc,MAAM,OAAO,cAAc;AAAA,MACxD;AAAA,MACA,sBAAsB,MAAM,OAAO;AAAA,MACnC,wBAAwB,MAAM,OAAO;AAAA,MACrC,mBAAmB,MAAM,OAAO;AAAA,MAChC,MAAM,KAAK,MAAM,GAAG,cAAc,EAAE,IAAI,CAAC,SAAS;AAAA,QAChD,GAAG;AAAA,QACH,MAAM,cAAc,IAAI,OAAO;AAAA,QAC/B,QAAQ,cAAc,IAAI,SAAS;AAAA,MACrC,EAAE;AAAA,MACF,UAAU,KAAK;AAAA,MACf,eAAe,KAAK,SAAS;AAAA,MAC7B,QAAQ,OAAO,IAAI,CAAC,WAAW;AAAA,QAC7B,IAAI,MAAM;AAAA,QACV,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM,UAAU;AAAA,QACxB,aAAa,MAAM,eAAe;AAAA,QAClC,UAAU,MAAM,YAAY;AAAA,QAC5B,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,MAC/D,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAKA,SAAS,aAAa,QAAkC;AACtD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,IAAI,SAAS,MAAM,MAA4C;AAChF,aAAO,EAAE,GAAG,MAAM,MAAM,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,KAAK,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH,EAAE;AACJ;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ,EAAE,OAAO;AAAA,IACf,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,IACpB,OAAO,EAAE,OAAO;AAAA,IAChB,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,IAClC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,WAAW,EAAE,QAAQ;AAAA,EACvB,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,IACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AAAA,EACD,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,eAAe,EAAE,QAAQ;AAC3B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `GET /api/staff/timesheets/reports/[id]/sheet` \u2014 everything screens 14 and 15\n * render: the report header, the grouped sheet, the raw entry rows and the\n * close/unlock/export history.\n *\n * It is a separate route from the CRUD detail because the sheet is COMPUTED. A\n * draft is computed live (and therefore moves when an entry is edited); a closed\n * report is rebuilt from its own freeze records, so a later rounding change\n * cannot restate an invoice the client already has (risk R1). One endpoint\n * answering both keeps the page from having to know which case it is in.\n *\n * `?grouping=` re-groups the same numbers without persisting the choice, which\n * is what lets screen 14 flip between task / person / day and still print the\n * same grand total (D-7).\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTimeReport, StaffTimeReportEvent } from '../../../../../data/entities'\nimport { loadReportProjectIds } from '../../../../../commands/timesheets-reports'\nimport { buildReportSheet } from '../../../../../lib/timesheets-reports/buildReportSheet'\nimport { buildReportRows } from '../../../../../lib/timesheets-reports/reportRows'\nimport { formatReportPeriodDate } from '../../../../../lib/timesheets-reports/reportPeriod'\nimport { hasReportGrouping, type ReportGrouping } from '../../../../../lib/timesheets-reports/reportGroupings'\nimport { resolveReportRequestContext, reportSheetLabels, MAX_SHEET_ROWS } from '../../shared'\nimport {\n  readSearchParamsRecord,\n  runTimesheetInterceptors,\n} from '../../../_shared/withTimesheetInterceptors'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/sheet' })\n\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.reports.view'] },\n}\n\n/** EP-36: the accepted set is the grouping registry, not a literal union. */\nfunction readGrouping(params: URLSearchParams): ReportGrouping | undefined {\n  const value = params.get('grouping')\n  return hasReportGrouping(value) ? (value as ReportGrouping) : undefined\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'sheet' })\n    // See the note in the export route: this decision is made once, fail-closed,\n    // in `buildReportRequestContext`.\n    const { container, auth, tenantId, organizationId, reportId, translate, canSeeMoney, grantedFeatures } =\n      context\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'GET',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      query: readSearchParamsRecord(req.url),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const report = await em.findOne(StaffTimeReport, {\n      id: reportId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (!report) {\n      throw new CrudHttpError(404, {\n        error: translate('staff.time_tracking.reports.errors.notFound', 'Report not found or not accessible.'),\n      })\n    }\n\n    const timeProjectIds = await loadReportProjectIds(em, report.id, { tenantId, organizationId })\n    const labels = reportSheetLabels(translate)\n    const sheet = await buildReportSheet({\n      em,\n      scope: { tenantId, organizationId },\n      report,\n      timeProjectIds,\n      labels,\n      grouping: readGrouping(session.searchParams),\n    })\n\n    const rows = buildReportRows({\n      entries: sheet.entries,\n      projects: sheet.projects,\n      directory: sheet.directory,\n      labels,\n    })\n\n    const events = await em.find(\n      StaffTimeReportEvent,\n      { reportId: report.id, tenantId, organizationId },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    return session.respond(200, {\n      report: {\n        id: report.id,\n        reference: report.reference,\n        title: report.title,\n        status: report.status,\n        customerId: report.customerId,\n        customerSnapshot: report.customerSnapshot ?? null,\n        periodKind: report.periodKind,\n        periodFrom: formatReportPeriodDate(report.periodFrom),\n        periodTo: formatReportPeriodDate(report.periodTo),\n        currencyCode: sheet.currencyCode,\n        grouping: sheet.grouping,\n        nonbillableMode: sheet.nonbillableMode,\n        includeAlreadyReported: report.includeAlreadyReported ?? false,\n        showRates: (report.showRates ?? true) && canSeeMoney,\n        roundingUnitMinutes: report.roundingUnitMinutes ?? 0,\n        roundingDirection: report.roundingDirection ?? 'up',\n        closedAt: report.closedAt ? report.closedAt.toISOString() : null,\n        closedByUserId: report.closedByUserId ?? null,\n        createdByUserId: report.createdByUserId ?? null,\n        createdAt: report.createdAt ? report.createdAt.toISOString() : null,\n        updatedAt: report.updatedAt ? report.updatedAt.toISOString() : null,\n        timeProjectIds,\n      },\n      groups: canSeeMoney ? sheet.totals.groups : stripAmounts(sheet.totals.groups),\n      totals: {\n        entryCount: sheet.totals.entryCount,\n        billableMinutes: sheet.totals.billableMinutes,\n        nonbillableMinutes: sheet.totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? sheet.totals.totalAmount : null,\n      },\n      alreadyReportedCount: sheet.totals.alreadyReportedCount,\n      alreadyReportedMinutes: sheet.totals.alreadyReportedMinutes,\n      alreadyReportedIn: sheet.totals.alreadyReportedIn,\n      rows: rows.slice(0, MAX_SHEET_ROWS).map((row) => ({\n        ...row,\n        rate: canSeeMoney ? row.rate : null,\n        amount: canSeeMoney ? row.amount : null,\n      })),\n      rowCount: rows.length,\n      rowsTruncated: rows.length > MAX_SHEET_ROWS,\n      events: events.map((event) => ({\n        id: event.id,\n        eventType: event.eventType,\n        reason: event.reason ?? null,\n        actorUserId: event.actorUserId ?? null,\n        metadata: event.metadata ?? null,\n        createdAt: event.createdAt ? event.createdAt.toISOString() : null,\n      })),\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.timesheets.reports.sheet failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\ntype SheetGroups = Awaited<ReturnType<typeof buildReportSheet>>['totals']['groups']\n\n/** Money is absent, not zeroed, for a caller without `rates.view`. */\nfunction stripAmounts(groups: SheetGroups): SheetGroups {\n  return groups.map((group) => ({\n    ...group,\n    rate: null,\n    amount: 0,\n    lines: group.lines.map(function strip(line): SheetGroups[number]['lines'][number] {\n      return { ...line, rate: null, amount: 0, children: line.children.map(strip) }\n    }),\n  }))\n}\n\nconst sheetResponseSchema = z.object({\n  report: z.object({\n    id: z.string().uuid(),\n    reference: z.string(),\n    title: z.string(),\n    status: z.enum(['draft', 'closed']),\n    currencyCode: z.string().nullable(),\n    periodFrom: z.string().nullable(),\n    periodTo: z.string().nullable(),\n    showRates: z.boolean(),\n  }),\n  totals: z.object({\n    entryCount: z.number().int(),\n    billableMinutes: z.number().int(),\n    nonbillableMinutes: z.number().int(),\n    totalAmount: z.number().nullable(),\n  }),\n  rowCount: z.number().int(),\n  rowsTruncated: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Read a customer report sheet',\n  methods: {\n    GET: {\n      summary: 'Read a customer report sheet',\n      description:\n        'Returns the report header, the grouped sheet, the raw entry rows and the close/unlock/export history. A draft is computed live; a closed report is rebuilt from its own frozen snapshots so a later rounding or rate change cannot restate it. `?grouping=project_task|project_person|project_day` re-groups the same numbers without persisting the choice \u2014 the grand total is invariant under it (D-7). Amounts are omitted for a caller without staff.timesheets.rates.view.',\n      responses: [{ status: 200, description: 'Report sheet', schema: sheetResponseSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        { status: 404, description: 'Report not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAgBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAKlB,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,SAAS,iBAAiB,4BAA4B;AACtD,SAAS,4BAA4B;AACrC,SAAS,wBAAwB;AACjC,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AACvC,SAAS,yBAA8C;AACvD,SAAS,6BAA6B,mBAAmB,sBAAsB;AAC/E;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,+BAA+B,CAAC;AAGjF,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAGA,SAAS,aAAa,QAAqD;AACzE,QAAM,QAAQ,OAAO,IAAI,UAAU;AACnC,SAAO,kBAAkB,KAAK,IAAK,QAA2B;AAChE;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,QAAQ,CAAC;AAG3E,UAAM,EAAE,WAAW,MAAM,UAAU,gBAAgB,UAAU,WAAW,aAAa,gBAAgB,IACnG;AAEF,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,OAAO,uBAAuB,IAAI,GAAG;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC/C,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,+CAA+C,qCAAqC;AAAA,MACvG,CAAC;AAAA,IACH;AAEA,UAAM,iBAAiB,MAAM,qBAAqB,IAAI,OAAO,IAAI,EAAE,UAAU,eAAe,CAAC;AAC7F,UAAM,SAAS,kBAAkB,SAAS;AAC1C,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACnC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,aAAa,QAAQ,YAAY;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,gBAAgB;AAAA,MAC3B,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB;AAAA,IACF,CAAC;AAED,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,OAAO,IAAI,UAAU,eAAe;AAAA,MAChD,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,QAAQ;AAAA,QACN,IAAI,OAAO;AAAA,QACX,WAAW,OAAO;AAAA,QAClB,OAAO,OAAO;AAAA,QACd,QAAQ,OAAO;AAAA,QACf,YAAY,OAAO;AAAA,QACnB,kBAAkB,OAAO,oBAAoB;AAAA,QAC7C,YAAY,OAAO;AAAA,QACnB,YAAY,uBAAuB,OAAO,UAAU;AAAA,QACpD,UAAU,uBAAuB,OAAO,QAAQ;AAAA,QAChD,cAAc,MAAM;AAAA,QACpB,UAAU,MAAM;AAAA,QAChB,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,OAAO,0BAA0B;AAAA,QACzD,YAAY,OAAO,aAAa,SAAS;AAAA,QACzC,qBAAqB,OAAO,uBAAuB;AAAA,QACnD,mBAAmB,OAAO,qBAAqB;AAAA,QAC/C,UAAU,OAAO,WAAW,OAAO,SAAS,YAAY,IAAI;AAAA,QAC5D,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,iBAAiB,OAAO,mBAAmB;AAAA,QAC3C,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,QAC/D,WAAW,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,QAC/D;AAAA,MACF;AAAA,MACA,QAAQ,cAAc,MAAM,OAAO,SAAS,aAAa,MAAM,OAAO,MAAM;AAAA,MAC5E,QAAQ;AAAA,QACN,YAAY,MAAM,OAAO;AAAA,QACzB,iBAAiB,MAAM,OAAO;AAAA,QAC9B,oBAAoB,MAAM,OAAO;AAAA,QACjC,aAAa,cAAc,MAAM,OAAO,cAAc;AAAA,MACxD;AAAA,MACA,sBAAsB,MAAM,OAAO;AAAA,MACnC,wBAAwB,MAAM,OAAO;AAAA,MACrC,mBAAmB,MAAM,OAAO;AAAA,MAChC,MAAM,KAAK,MAAM,GAAG,cAAc,EAAE,IAAI,CAAC,SAAS;AAAA,QAChD,GAAG;AAAA,QACH,MAAM,cAAc,IAAI,OAAO;AAAA,QAC/B,QAAQ,cAAc,IAAI,SAAS;AAAA,MACrC,EAAE;AAAA,MACF,UAAU,KAAK;AAAA,MACf,eAAe,KAAK,SAAS;AAAA,MAC7B,QAAQ,OAAO,IAAI,CAAC,WAAW;AAAA,QAC7B,IAAI,MAAM;AAAA,QACV,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM,UAAU;AAAA,QACxB,aAAa,MAAM,eAAe;AAAA,QAClC,UAAU,MAAM,YAAY;AAAA,QAC5B,WAAW,MAAM,YAAY,MAAM,UAAU,YAAY,IAAI;AAAA,MAC/D,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAKA,SAAS,aAAa,QAAkC;AACtD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,IAAI,SAAS,MAAM,MAA4C;AAChF,aAAO,EAAE,GAAG,MAAM,MAAM,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,KAAK,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH,EAAE;AACJ;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ,EAAE,OAAO;AAAA,IACf,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,IACpB,OAAO,EAAE,OAAO;AAAA,IAChB,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,IAClC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,WAAW,EAAE,QAAQ;AAAA,EACvB,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,IACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AAAA,EACD,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,eAAe,EAAE,QAAQ;AAC3B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/[id]/unlock/route.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { resolveFeatureAccess } from "../../../../../lib/time-tracking/featureAccess.js";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { z } from "zod";
 import { forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
@@ -72,7 +73,7 @@ async function POST(req) {
       container,
       auth,
       organizationScope,
-      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,
       organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: req
     };
@@ -143,7 +144,7 @@ const openApi = {
   methods: {
     POST: {
       summary: "Unlock a closed customer report",
-      description: "Clears locked_report_id / locked_at on every entry this report froze, removes its freeze records so a previously billed hour stops being counted as already reported, returns the report to draft and appends an `unlocked` event carrying the reason, the actor and the totals that were frozen. The reason is mandatory. Requires staff.timesheets.reports.unlock, which is deliberately separate from staff.timesheets.lock.",
+      description: "Removes the freeze records of this report so a previously billed hour stops being counted as already reported by it, returns the report to draft and appends an `unlocked` event carrying the reason, the actor and the totals that were frozen. Clears locked_report_id / locked_at on every entry this report locked that no other closed report quotes; an entry another closed report re-included stays locked, and its lock moves to that report. `unlockedEntryCount` counts the entries actually freed. The reason is mandatory. Requires staff.timesheets.reports.unlock, which is deliberately separate from staff.timesheets.lock.",
       requestBody: { contentType: "application/json", schema: staffTimeReportUnlockSchema.pick({ reason: true }) },
       responses: [{ status: 200, description: "Report unlocked", schema: unlockResponseSchema }],
       errors: [

package/dist/modules/staff/api/timesheets/reports/[id]/unlock/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/reports/%5Bid%5D/unlock/route.ts"],
-  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/[id]/unlock` \u2014 screen 15.\n *\n * Gated on `staff.timesheets.reports.unlock`, deliberately a DIFFERENT feature\n * from `staff.timesheets.lock`. Screen 15 note 4 asked who may unlock and\n * observed that \u00A710 leaves nobody \"above\" a Team Leader; the answer is a\n * separate grant that can be withheld from a Team Leader who should not restate\n * billed time, rather than an admin role the requirements reject.\n *\n * The reason is mandatory at the schema level and is written verbatim into the\n * `unlocked` report event beside the actor and the timestamp, which is what\n * makes this the \"explicit, audited action\" US-G3 asks for rather than a confirm\n * dialog.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffTimeReportUnlockSchema } from '../../../../../data/validators'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeReportCommandIds,\n  type StaffTimeReportUnlockResult,\n} from '../../../../../commands/timesheets-reports'\nimport { resolveReportRequestContext } from '../../shared'\nimport { evaluateReportUnlockPolicies } from '../../../../../lib/timesheets-reports/reportApprovalPolicies'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/unlock' })\n\nconst UNLOCK_FEATURE = 'staff.timesheets.reports.unlock'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [UNLOCK_FEATURE] },\n}\n\nconst bodySchema = z.object({ reason: z.string().trim().min(1).max(2000) })\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'unlock' })\n    const { container, auth, organizationScope, tenantId, organizationId, reportId, translate, grantedFeatures } =\n      context\n\n    // Checked unconditionally. The `grantedFeatures &&` this replaces turned the\n    // check off whenever the grant read failed \u2014 harmless here only because the\n    // route metadata happens to require the same feature, which is exactly the\n    // shape that leaked rates on the report routes where no such backstop existed.\n    if (!(await resolveFeatureAccess(container, auth.sub ?? null, [UNLOCK_FEATURE], { tenantId, organizationId })).allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = bodySchema.parse(session.body)\n\n    // EP-41 runs strictly AFTER the ACL gate above and can only refuse. A\n    // four-eyes or accounting-period policy narrows who may unlock; nothing here\n    // widens it past staff.timesheets.reports.unlock.\n    const refusal = evaluateReportUnlockPolicies({\n      tenantId,\n      organizationId,\n      reportId,\n      actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n      actorFeatures: grantedFeatures,\n      status: 'closed',\n      reason: parsed.reason,\n    })\n    if (refusal) {\n      throw forbidden(translate(refusal.messageKey, translate('staff.errors.forbidden', 'Forbidden')))\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: auth.sub ?? '',\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n        resourceId: reportId,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? bodySchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      { id: string; reason: string },\n      StaffTimeReportUnlockResult\n    >(staffTimeReportCommandIds.unlock, {\n      input: { id: reportId, reason: effective.reason },\n      ctx,\n    })\n\n    await guardResult.runAfterSuccess()\n\n    const response = await session.respond(200, {\n      id: result?.reportId ?? reportId,\n      status: 'draft',\n      unlockedEntryCount: result?.unlockedEntryCount ?? 0,\n    })\n    if (logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          // Explicitly no undo token: unwinding a billing freeze is the unlock\n          // endpoint, which demands a reason and its own feature.\n          undoToken: '',\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n          resourceId: logEntry.resourceId ?? reportId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        {\n          error: translate(\n            'staff.time_tracking.reports.errors.reasonRequired',\n            'An unlock reason is required.',\n          ),\n          details: err.issues,\n        },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.unlock failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst unlockResponseSchema = z.object({\n  id: z.string().uuid(),\n  status: z.literal('draft'),\n  unlockedEntryCount: z.number().int(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Unlock a closed customer report',\n  methods: {\n    POST: {\n      summary: 'Unlock a closed customer report',\n      description:\n        'Clears locked_report_id / locked_at on every entry this report froze, removes its freeze records so a previously billed hour stops being counted as already reported, returns the report to draft and appends an `unlocked` event carrying the reason, the actor and the totals that were frozen. The reason is mandatory. Requires staff.timesheets.reports.unlock, which is deliberately separate from staff.timesheets.lock.',\n      requestBody: { contentType: 'application/json', schema: staffTimeReportUnlockSchema.pick({ reason: true }) },\n      responses: [{ status: 200, description: 'Report unlocked', schema: unlockResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing or empty reason' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.unlock, or refused by a registered report approval policy' },\n        { status: 404, description: 'Report not found or not accessible' },\n        { status: 409, description: 'Report is not closed (report_not_closed)' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAeA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAClB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,mCAAmC;AAC5C,SAAS,oCAAoC;AAE7C,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAE1E,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,SAAS,CAAC;AAC5E,UAAM,EAAE,WAAW,MAAM,mBAAmB,UAAU,gBAAgB,UAAU,WAAW,gBAAgB,IACzG;AAMF,QAAI,EAAE,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC,GAAG,SAAS;AACtH,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,WAAW,MAAM,QAAQ,IAAI;AAK5C,UAAM,UAAU,6BAA6B;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MACvD,eAAe;AAAA,MACf,QAAQ;AAAA,MACR,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,QAAI,SAAS;AACX,YAAM,UAAU,UAAU,QAAQ,YAAY,UAAU,0BAA0B,WAAW,CAAC,CAAC;AAAA,IACjG;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,KAAK,OAAO;AAAA,QACpB;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,WAAW,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAC9D;AAEJ,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,MACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,0BAA0B,QAAQ;AAAA,MAClC,OAAO,EAAE,IAAI,UAAU,QAAQ,UAAU,OAAO;AAAA,MAChD;AAAA,IACF,CAAC;AAED,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,YAAY;AAAA,MACxB,QAAQ;AAAA,MACR,oBAAoB,QAAQ,sBAAsB;AAAA,IACpD,CAAC;AACD,QAAI,UAAU,MAAM,UAAU,WAAW;AACvC,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA;AAAA;AAAA,UAGb,WAAW;AAAA,UACX,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,UACA,SAAS,IAAI;AAAA,QACf;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,QAAQ,OAAO;AAAA,EACzB,oBAAoB,EAAE,OAAO,EAAE,IAAI;AACrC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,4BAA4B,KAAK,EAAE,QAAQ,KAAK,CAAC,EAAE;AAAA,MAC3G,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,6FAA6F;AAAA,QACzH,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/[id]/unlock` \u2014 screen 15.\n *\n * Gated on `staff.timesheets.reports.unlock`, deliberately a DIFFERENT feature\n * from `staff.timesheets.lock`. Screen 15 note 4 asked who may unlock and\n * observed that \u00A710 leaves nobody \"above\" a Team Leader; the answer is a\n * separate grant that can be withheld from a Team Leader who should not restate\n * billed time, rather than an admin role the requirements reject.\n *\n * The reason is mandatory at the schema level and is written verbatim into the\n * `unlocked` report event beside the actor and the timestamp, which is what\n * makes this the \"explicit, audited action\" US-G3 asks for rather than a confirm\n * dialog.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../../lib/time-tracking/featureAccess'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { z } from 'zod'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffTimeReportUnlockSchema } from '../../../../../data/validators'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport { runTimesheetInterceptors } from '../../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeReportCommandIds,\n  type StaffTimeReportUnlockResult,\n} from '../../../../../commands/timesheets-reports'\nimport { resolveReportRequestContext } from '../../shared'\nimport { evaluateReportUnlockPolicies } from '../../../../../lib/timesheets-reports/reportApprovalPolicies'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/unlock' })\n\nconst UNLOCK_FEATURE = 'staff.timesheets.reports.unlock'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [UNLOCK_FEATURE] },\n}\n\nconst bodySchema = z.object({ reason: z.string().trim().min(1).max(2000) })\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveReportRequestContext(req, { segment: 'unlock' })\n    const { container, auth, organizationScope, tenantId, organizationId, reportId, translate, grantedFeatures } =\n      context\n\n    // Checked unconditionally. The `grantedFeatures &&` this replaces turned the\n    // check off whenever the grant read failed \u2014 harmless here only because the\n    // route metadata happens to require the same feature, which is exactly the\n    // shape that leaked rates on the report routes where no such backstop existed.\n    if (!(await resolveFeatureAccess(container, auth.sub ?? null, [UNLOCK_FEATURE], { tenantId, organizationId })).allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = bodySchema.parse(session.body)\n\n    // EP-41 runs strictly AFTER the ACL gate above and can only refuse. A\n    // four-eyes or accounting-period policy narrows who may unlock; nothing here\n    // widens it past staff.timesheets.reports.unlock.\n    const refusal = evaluateReportUnlockPolicies({\n      tenantId,\n      organizationId,\n      reportId,\n      actorUserId: typeof auth.sub === 'string' ? auth.sub : null,\n      actorFeatures: grantedFeatures,\n      status: 'closed',\n      reason: parsed.reason,\n    })\n    if (refusal) {\n      throw forbidden(translate(refusal.messageKey, translate('staff.errors.forbidden', 'Forbidden')))\n    }\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: auth.sub ?? '',\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n        resourceId: reportId,\n        operation: 'update',\n        mutationPayload: parsed,\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const effective = guardResult.modifiedPayload\n      ? bodySchema.parse({ ...parsed, ...guardResult.modifiedPayload })\n      : parsed\n\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      { id: string; reason: string },\n      StaffTimeReportUnlockResult\n    >(staffTimeReportCommandIds.unlock, {\n      input: { id: reportId, reason: effective.reason },\n      ctx,\n    })\n\n    await guardResult.runAfterSuccess()\n\n    const response = await session.respond(200, {\n      id: result?.reportId ?? reportId,\n      status: 'draft',\n      unlockedEntryCount: result?.unlockedEntryCount ?? 0,\n    })\n    if (logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          // Explicitly no undo token: unwinding a billing freeze is the unlock\n          // endpoint, which demands a reason and its own feature.\n          undoToken: '',\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STAFF_TIME_TRACKING_RESOURCE_KINDS.timeReport,\n          resourceId: logEntry.resourceId ?? reportId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        {\n          error: translate(\n            'staff.time_tracking.reports.errors.reasonRequired',\n            'An unlock reason is required.',\n          ),\n          details: err.issues,\n        },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.unlock failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nconst unlockResponseSchema = z.object({\n  id: z.string().uuid(),\n  status: z.literal('draft'),\n  unlockedEntryCount: z.number().int(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Unlock a closed customer report',\n  methods: {\n    POST: {\n      summary: 'Unlock a closed customer report',\n      description:\n        'Removes the freeze records of this report so a previously billed hour stops being counted as already reported by it, returns the report to draft and appends an `unlocked` event carrying the reason, the actor and the totals that were frozen. Clears locked_report_id / locked_at on every entry this report locked that no other closed report quotes; an entry another closed report re-included stays locked, and its lock moves to that report. `unlockedEntryCount` counts the entries actually freed. The reason is mandatory. Requires staff.timesheets.reports.unlock, which is deliberately separate from staff.timesheets.lock.',\n      requestBody: { contentType: 'application/json', schema: staffTimeReportUnlockSchema.pick({ reason: true }) },\n      responses: [{ status: 200, description: 'Report unlocked', schema: unlockResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing or empty reason' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.unlock, or refused by a registered report approval policy' },\n        { status: 404, description: 'Report not found or not accessible' },\n        { status: 409, description: 'Report is not closed (report_not_closed)' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAeA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,yCAAyC;AAClD,SAAS,SAAS;AAClB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAE7B,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,mCAAmC;AAC5C,SAAS,oCAAoC;AAE7C,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAE1E,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,KAAK,EAAE,SAAS,SAAS,CAAC;AAC5E,UAAM,EAAE,WAAW,MAAM,mBAAmB,UAAU,gBAAgB,UAAU,WAAW,gBAAgB,IACzG;AAMF,QAAI,EAAE,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC,GAAG,SAAS;AACtH,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AAEA,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,WAAW,MAAM,QAAQ,IAAI;AAK5C,UAAM,UAAU,6BAA6B;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MACvD,eAAe;AAAA,MACf,QAAQ;AAAA,MACR,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,QAAI,SAAS;AACX,YAAM,UAAU,UAAU,QAAQ,YAAY,UAAU,0BAA0B,WAAW,CAAC,CAAC;AAAA,IACjG;AAEA,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ,KAAK,OAAO;AAAA,QACpB;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc,mCAAmC;AAAA,QACjD,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,YAAY,YAAY,kBAC1B,WAAW,MAAM,EAAE,GAAG,QAAQ,GAAG,YAAY,gBAAgB,CAAC,IAC9D;AAEJ,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,MACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,0BAA0B,QAAQ;AAAA,MAClC,OAAO,EAAE,IAAI,UAAU,QAAQ,UAAU,OAAO;AAAA,MAChD;AAAA,IACF,CAAC;AAED,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK;AAAA,MAC1C,IAAI,QAAQ,YAAY;AAAA,MACxB,QAAQ;AAAA,MACR,oBAAoB,QAAQ,sBAAsB;AAAA,IACpD,CAAC;AACD,QAAI,UAAU,MAAM,UAAU,WAAW;AACvC,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA;AAAA;AAAA,UAGb,WAAW;AAAA,UACX,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB,mCAAmC;AAAA,UAC1E,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,UACA,SAAS,IAAI;AAAA,QACf;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,QAAQ,OAAO;AAAA,EACzB,oBAAoB,EAAE,OAAO,EAAE,IAAI;AACrC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,4BAA4B,KAAK,EAAE,QAAQ,KAAK,CAAC,EAAE;AAAA,MAC3G,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,6FAA6F;AAAA,QACzH,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/preview/route.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { createLogger } from "@open-mercato/shared/lib/logger";
@@ -83,7 +84,7 @@ async function POST(req) {
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
     const tenantId = scope?.tenantId ?? auth.tenantId ?? null;
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!tenantId || !organizationId) {
       throw new CrudHttpError(400, {
         error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")