@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/staff/api/timesheets/reports/preview/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/reports/preview/route.ts"],
-  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/preview` \u2014 screen 13's live numbers.\n *\n * It persists nothing. It exists because the project pick-list has to show what\n * each project would contribute BEFORE a report row exists, and because the\n * already-reported panel (D-5) has to be answerable at configuration time \u2014 the\n * whole point of that panel is to be read before the report is generated, not\n * after.\n *\n * It is a POST because the input is a project selection plus a period, not a\n * URL-shaped filter. It is nonetheless a **read**: it runs no command, writes no\n * row and therefore wires no mutation guard, which would otherwise run\n * after-success callbacks for a mutation that never happened. Authorization is\n * `staff.timesheets.reports.view` plus the same `resolveProjectAccess`\n * narrowing every other timesheets route uses.\n *\n * Two refusals are deliberate and named:\n *\n *  - **`422 report_currency_conflict`** when the selected projects disagree on a\n *    currency (risk R2). The body lists the currencies and the offending\n *    projects, because \"pick one currency\" is unactionable otherwise.\n *  - **`422 report_project_not_found`** when a requested project is outside the\n *    caller's access. Dropping it silently would produce a smaller, plausible\n *    total that nobody could explain.\n */\n\nimport { resolveMoneyVisibility } from '../../../../lib/time-tracking/moneyVisibility'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { staffTimeReportPreviewSchema } from '../../../../data/validators'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from '../../../../lib/time-tracking/access'\nimport { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'\nimport { readTimeTrackingSettings } from '../../../../lib/time-tracking/settings'\nimport { loadReportData } from '../../../../lib/timesheets-reports/loadReportData'\nimport {\n  computeReportTotals,\n  resolveEntryValues,\n  resolveReportCurrency,\n  sumAmounts,\n  type ReportGroup,\n  type ReportInputEntry,\n} from '../../../../lib/timesheets-reports/reportTotals'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/preview' })\n\nconst VIEW_FEATURE = 'staff.timesheets.reports.view'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nexport type PreviewProjectTotals = {\n  id: string\n  name: string\n  hourlyRate: number | null\n  currencyCode: string | null\n  entryCount: number\n  billableMinutes: number\n  nonbillableMinutes: number\n  amount: number | null\n}\n\n/**\n * Per-project figures for the pick-list. They depend only on (project, period)\n * and never on which other projects are ticked, so the screen can render every\n * candidate \u2014 including one with no entries, which stays listed but unticked and\n * greyed (screen 13 note 2) rather than disappearing.\n *\n * The amounts here go through the same `resolveEntryValues` the totals use, so a\n * row's figure and the grand total can never come from two different rules.\n */\nexport function summarizeProjectsForPreview(\n  projects: readonly { id: string; name: string; hourlyRate: number | null; currencyCode: string | null }[],\n  entries: readonly ReportInputEntry[],\n  options: { includeAlreadyReported: boolean; excludeNonBillable: boolean; canSeeMoney: boolean },\n): PreviewProjectTotals[] {\n  const byProject = new Map<string, ReportInputEntry[]>()\n  for (const entry of entries) {\n    const bucket = byProject.get(entry.timeProjectId)\n    if (bucket) bucket.push(entry)\n    else byProject.set(entry.timeProjectId, [entry])\n  }\n\n  return projects.map((project) => {\n    const projectEntries = byProject.get(project.id) ?? []\n    let billableMinutes = 0\n    let nonbillableMinutes = 0\n    const amounts: Array<number | null> = []\n    let entryCount = 0\n\n    for (const entry of projectEntries) {\n      if (entry.frozen && !options.includeAlreadyReported) continue\n      const values = resolveEntryValues(entry, project)\n      if (!values.isBillable) {\n        if (options.excludeNonBillable) continue\n        nonbillableMinutes += values.minutes\n        entryCount += 1\n        continue\n      }\n      billableMinutes += values.minutes\n      amounts.push(values.amount)\n      entryCount += 1\n    }\n\n    return {\n      id: project.id,\n      name: project.name,\n      hourlyRate: options.canSeeMoney ? project.hourlyRate : null,\n      currencyCode: project.currencyCode,\n      entryCount,\n      billableMinutes,\n      nonbillableMinutes,\n      amount: options.canSeeMoney ? sumAmounts(amounts) : null,\n    }\n  })\n}\n\n/** Money is absent from the payload \u2014 not zeroed \u2014 for a caller without `rates.view`. */\nfunction stripMoney(groups: ReportGroup[]): ReportGroup[] {\n  return groups.map((group) => ({\n    ...group,\n    rate: null,\n    amount: 0,\n    lines: group.lines.map(function strip(line): ReportGroup['lines'][number] {\n      return { ...line, rate: null, amount: 0, children: line.children.map(strip) }\n    }),\n  }))\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    // Both questions go through the module's single RBAC authority, which asks the\n    // service and fails closed on every path. The hand-rolled grant read this\n    // replaces returned `string[] | null`, and a null it could not explain was read\n    // as \"no restriction\" \u2014 that is how rates reached a plain report viewer, since\n    // this route requires only `reports.view`.\n    const manageAccess = await resolveFeatureAccess(container, auth.sub ?? null, [MANAGE_PROJECTS_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n    const grantedFeatures = manageAccess.grantedFeatures\n    const canSeeMoney = await resolveMoneyVisibility(container, auth.sub ?? null, {\n      tenantId,\n      organizationId,\n    })\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffTimeReportPreviewSchema.parse(session.body)\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const access = await resolveProjectAccess({\n      em,\n      userId: auth.sub ?? null,\n      tenantId,\n      organizationId,\n      canManageAll: manageAccess.allowed,\n      userFeatures: grantedFeatures,\n      assignmentGraceDays: await readAssignmentGraceDays(container, tenantId),\n    })\n\n    const requestedIds = Array.from(new Set(parsed.timeProjectIds))\n    const deniedIds = access.canManageAll\n      ? []\n      : requestedIds.filter((id) => !access.projectIds.includes(id))\n    if (deniedIds.length > 0) {\n      const message = translate(\n        'staff.time_tracking.reports.errors.projectNotFound',\n        'Some of the selected projects are not available.',\n      )\n      throw new CrudHttpError(422, {\n        code: 'report_project_not_found',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        missingProjectIds: deniedIds,\n      })\n    }\n\n    const data = await loadReportData({\n      em,\n      scope: { tenantId, organizationId },\n      timeProjectIds: requestedIds,\n      periodFrom: parsed.periodFrom,\n      periodTo: parsed.periodTo,\n    })\n\n    if (data.projects.length !== requestedIds.length) {\n      const found = new Set(data.projects.map((project) => project.id))\n      const message = translate(\n        'staff.time_tracking.reports.errors.projectNotFound',\n        'Some of the selected projects are not available.',\n      )\n      throw new CrudHttpError(422, {\n        code: 'report_project_not_found',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        missingProjectIds: requestedIds.filter((id) => !found.has(id)),\n      })\n    }\n\n    // Risk R2, asserted before a single amount is produced.\n    const currency = resolveReportCurrency(\n      data.projects.map((project) => ({\n        id: project.id,\n        name: project.name,\n        currencyCode: project.currencyCode,\n      })),\n    )\n    if (!currency.ok) {\n      const message = translate(\n        'staff.time_tracking.reports.errors.currencyConflict',\n        'A report always covers one currency. Selected projects use {currencies}.',\n      ).replace('{currencies}', currency.currencies.join(', '))\n      throw new CrudHttpError(422, {\n        code: 'report_currency_conflict',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        currencies: currency.currencies,\n        offenders: currency.offenders.map((project) => ({\n          id: project.id,\n          name: project.name,\n          currencyCode: project.currencyCode ?? null,\n        })),\n      })\n    }\n\n    const totals = computeReportTotals({\n      entries: data.entries,\n      projects: data.projects,\n      directory: data.directory,\n      options: {\n        grouping: parsed.grouping,\n        nonbillableMode: parsed.nonbillableMode,\n        includeAlreadyReported: parsed.includeAlreadyReported,\n      },\n      labels: reportLabels(translate),\n    })\n\n    const configService = safeConfigService(container)\n    const settings = configService\n      ? await readTimeTrackingSettings(configService, { tenantId })\n      : null\n\n    return session.respond(200, {\n      currencyCode: currency.currencyCode,\n      grouping: parsed.grouping,\n      nonbillableMode: parsed.nonbillableMode,\n      includeAlreadyReported: parsed.includeAlreadyReported,\n      showRates: parsed.showRates && canSeeMoney,\n      projects: summarizeProjectsForPreview(data.projects, data.entries, {\n        includeAlreadyReported: parsed.includeAlreadyReported,\n        excludeNonBillable: parsed.nonbillableMode === 'exclude',\n        canSeeMoney,\n      }),\n      groups: canSeeMoney ? totals.groups : stripMoney(totals.groups),\n      totals: {\n        entryCount: totals.entryCount,\n        billableMinutes: totals.billableMinutes,\n        nonbillableMinutes: totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? totals.totalAmount : null,\n      },\n      alreadyReportedCount: totals.alreadyReportedCount,\n      alreadyReportedMinutes: totals.alreadyReportedMinutes,\n      alreadyReportedIn: totals.alreadyReportedIn,\n      rounding: {\n        unitMinutes: settings?.rounding.unitMinutes ?? 0,\n        direction: settings?.rounding.direction ?? 'up',\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.preview failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nfunction safeConfigService(container: ContainerLike): ModuleConfigService | null {\n  try {\n    return container.resolve('moduleConfigService') as ModuleConfigService\n  } catch {\n    return null\n  }\n}\n\nasync function readAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  const configService = safeConfigService(container)\n  if (!configService) return null\n  try {\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    return null\n  }\n}\n\nexport function reportLabels(translate: (key: string, fallback: string) => string) {\n  return {\n    unassignedTask: translate('staff.time_tracking.reports.sheet.noTask', 'No task'),\n    unassignedPerson: translate('staff.time_tracking.reports.sheet.noPerson', 'Unassigned'),\n    nonbillableGroup: translate('staff.time_tracking.reports.sheet.nonbillable', 'Non-billable time'),\n  }\n}\n\nconst previewLineSchema: z.ZodType<unknown> = z.lazy(() =>\n  z.object({\n    key: z.string(),\n    label: z.string(),\n    minutes: z.number().int(),\n    rate: z.number().nullable(),\n    amount: z.number(),\n    entryCount: z.number().int(),\n    hasOverride: z.boolean(),\n    children: z.array(previewLineSchema),\n  }),\n)\n\nconst previewResponseSchema = z.object({\n  currencyCode: z.string().nullable(),\n  grouping: z.string(),\n  nonbillableMode: z.enum(['separate', 'exclude']),\n  includeAlreadyReported: z.boolean(),\n  showRates: z.boolean(),\n  projects: z.array(\n    z.object({\n      id: z.string().uuid(),\n      name: z.string(),\n      hourlyRate: z.number().nullable(),\n      currencyCode: z.string().nullable(),\n      entryCount: z.number().int(),\n      billableMinutes: z.number().int(),\n      nonbillableMinutes: z.number().int(),\n      amount: z.number().nullable(),\n    }),\n  ),\n  groups: z.array(\n    z.object({\n      key: z.string(),\n      kind: z.enum(['project', 'nonbillable']),\n      label: z.string(),\n      rate: z.number().nullable(),\n      minutes: z.number().int(),\n      amount: z.number(),\n      entryCount: z.number().int(),\n      lines: z.array(previewLineSchema),\n    }),\n  ),\n  totals: z.object({\n    entryCount: z.number().int(),\n    billableMinutes: z.number().int(),\n    nonbillableMinutes: z.number().int(),\n    totalAmount: z.number().nullable(),\n  }),\n  alreadyReportedCount: z.number().int(),\n  alreadyReportedMinutes: z.number().int(),\n  alreadyReportedIn: z.array(\n    z.object({\n      reportId: z.string().uuid(),\n      reference: z.string().nullable(),\n      title: z.string().nullable(),\n      entryCount: z.number().int(),\n      minutes: z.number().int(),\n    }),\n  ),\n  rounding: z.object({ unitMinutes: z.number().int(), direction: z.string() }),\n})\n\nconst currencyConflictSchema = z.object({\n  code: z.literal('report_currency_conflict'),\n  error: z.string(),\n  currencies: z.array(z.string()),\n  offenders: z.array(\n    z.object({ id: z.string().uuid(), name: z.string(), currencyCode: z.string().nullable() }),\n  ),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Preview a customer report',\n  methods: {\n    POST: {\n      summary: 'Preview a customer report',\n      description:\n        'Computes report totals for a project selection and period WITHOUT persisting anything. Powers the live per-project numbers and the range summary of the report config screen. Money is rounded at the entry and summed upward (D-7), so the grand total does not change when the grouping changes. Entries already frozen in a closed report are excluded unless `includeAlreadyReported` is set, and are reported as `alreadyReportedCount` / `alreadyReportedMinutes` / `alreadyReportedIn` either way (D-5). Amounts and rates are omitted for a caller without staff.timesheets.rates.view.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeReportPreviewSchema,\n      },\n      responses: [{ status: 200, description: 'Computed totals', schema: previewResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid body or missing scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        {\n          status: 422,\n          description: 'Selected projects disagree on a currency, or one is not accessible',\n          schema: currencyConflictSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AA0BA,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAG7B,SAAS,oBAAoB;AAC7B,SAAS,oCAAoC;AAC7C,SAAS,gCAAgC;AACzC,SAAS,yBAAyB,4BAA4B;AAC9D,SAAS,4BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,iCAAiC,CAAC;AAE1F,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAsBO,SAAS,4BACd,UACA,SACA,SACwB;AACxB,QAAM,YAAY,oBAAI,IAAgC;AACtD,aAAW,SAAS,SAAS;AAC3B,UAAM,SAAS,UAAU,IAAI,MAAM,aAAa;AAChD,QAAI,OAAQ,QAAO,KAAK,KAAK;AAAA,QACxB,WAAU,IAAI,MAAM,eAAe,CAAC,KAAK,CAAC;AAAA,EACjD;AAEA,SAAO,SAAS,IAAI,CAAC,YAAY;AAC/B,UAAM,iBAAiB,UAAU,IAAI,QAAQ,EAAE,KAAK,CAAC;AACrD,QAAI,kBAAkB;AACtB,QAAI,qBAAqB;AACzB,UAAM,UAAgC,CAAC;AACvC,QAAI,aAAa;AAEjB,eAAW,SAAS,gBAAgB;AAClC,UAAI,MAAM,UAAU,CAAC,QAAQ,uBAAwB;AACrD,YAAM,SAAS,mBAAmB,OAAO,OAAO;AAChD,UAAI,CAAC,OAAO,YAAY;AACtB,YAAI,QAAQ,mBAAoB;AAChC,8BAAsB,OAAO;AAC7B,sBAAc;AACd;AAAA,MACF;AACA,yBAAmB,OAAO;AAC1B,cAAQ,KAAK,OAAO,MAAM;AAC1B,oBAAc;AAAA,IAChB;AAEA,WAAO;AAAA,MACL,IAAI,QAAQ;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,YAAY,QAAQ,cAAc,QAAQ,aAAa;AAAA,MACvD,cAAc,QAAQ;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ,cAAc,WAAW,OAAO,IAAI;AAAA,IACtD;AAAA,EACF,CAAC;AACH;AAGA,SAAS,WAAW,QAAsC;AACxD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,IAAI,SAAS,MAAM,MAAoC;AACxE,aAAO,EAAE,GAAG,MAAM,MAAM,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,KAAK,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH,EAAE;AACJ;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAOA,UAAM,eAAe,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,uBAAuB,GAAG;AAAA,MACtG;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,kBAAkB,aAAa;AACrC,UAAM,cAAc,MAAM,uBAAuB,WAAW,KAAK,OAAO,MAAM;AAAA,MAC5E;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,6BAA6B,MAAM,QAAQ,IAAI;AAE9D,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,qBAAqB;AAAA,MACxC;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB;AAAA,MACA;AAAA,MACA,cAAc,aAAa;AAAA,MAC3B,cAAc;AAAA,MACd,qBAAqB,MAAM,wBAAwB,WAAW,QAAQ;AAAA,IACxE,CAAC;AAED,UAAM,eAAe,MAAM,KAAK,IAAI,IAAI,OAAO,cAAc,CAAC;AAC9D,UAAM,YAAY,OAAO,eACrB,CAAC,IACD,aAAa,OAAO,CAAC,OAAO,CAAC,OAAO,WAAW,SAAS,EAAE,CAAC;AAC/D,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC,gBAAgB;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,IACnB,CAAC;AAED,QAAI,KAAK,SAAS,WAAW,aAAa,QAAQ;AAChD,YAAM,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE,CAAC;AAChE,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,mBAAmB,aAAa,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;AAAA,MAC/D,CAAC;AAAA,IACH;AAGA,UAAM,WAAW;AAAA,MACf,KAAK,SAAS,IAAI,CAAC,aAAa;AAAA,QAC9B,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB,EAAE;AAAA,IACJ;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF,EAAE,QAAQ,gBAAgB,SAAS,WAAW,KAAK,IAAI,CAAC;AACxD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,YAAY,SAAS;AAAA,QACrB,WAAW,SAAS,UAAU,IAAI,CAAC,aAAa;AAAA,UAC9C,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,cAAc,QAAQ,gBAAgB;AAAA,QACxC,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,oBAAoB;AAAA,MACjC,SAAS,KAAK;AAAA,MACd,UAAU,KAAK;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,QACP,UAAU,OAAO;AAAA,QACjB,iBAAiB,OAAO;AAAA,QACxB,wBAAwB,OAAO;AAAA,MACjC;AAAA,MACA,QAAQ,aAAa,SAAS;AAAA,IAChC,CAAC;AAED,UAAM,gBAAgB,kBAAkB,SAAS;AACjD,UAAM,WAAW,gBACb,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC,IAC1D;AAEJ,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,cAAc,SAAS;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,iBAAiB,OAAO;AAAA,MACxB,wBAAwB,OAAO;AAAA,MAC/B,WAAW,OAAO,aAAa;AAAA,MAC/B,UAAU,4BAA4B,KAAK,UAAU,KAAK,SAAS;AAAA,QACjE,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO,oBAAoB;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,MACD,QAAQ,cAAc,OAAO,SAAS,WAAW,OAAO,MAAM;AAAA,MAC9D,QAAQ;AAAA,QACN,YAAY,OAAO;AAAA,QACnB,iBAAiB,OAAO;AAAA,QACxB,oBAAoB,OAAO;AAAA,QAC3B,aAAa,cAAc,OAAO,cAAc;AAAA,MAClD;AAAA,MACA,sBAAsB,OAAO;AAAA,MAC7B,wBAAwB,OAAO;AAAA,MAC/B,mBAAmB,OAAO;AAAA,MAC1B,UAAU;AAAA,QACR,aAAa,UAAU,SAAS,eAAe;AAAA,QAC/C,WAAW,UAAU,SAAS,aAAa;AAAA,MAC7C;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,2CAA2C,EAAE,IAAI,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAIA,SAAS,kBAAkB,WAAsD;AAC/E,MAAI;AACF,WAAO,UAAU,QAAQ,qBAAqB;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,wBAAwB,WAA0B,UAA0C;AACzG,QAAM,gBAAgB,kBAAkB,SAAS;AACjD,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI;AACF,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,WAAsD;AACjF,SAAO;AAAA,IACL,gBAAgB,UAAU,4CAA4C,SAAS;AAAA,IAC/E,kBAAkB,UAAU,8CAA8C,YAAY;AAAA,IACtF,kBAAkB,UAAU,iDAAiD,mBAAmB;AAAA,EAClG;AACF;AAEA,MAAM,oBAAwC,EAAE;AAAA,EAAK,MACnD,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,OAAO;AAAA,IACd,OAAO,EAAE,OAAO;AAAA,IAChB,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,IACxB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,QAAQ,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,aAAa,EAAE,QAAQ;AAAA,IACvB,UAAU,EAAE,MAAM,iBAAiB;AAAA,EACrC,CAAC;AACH;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,UAAU,EAAE,OAAO;AAAA,EACnB,iBAAiB,EAAE,KAAK,CAAC,YAAY,SAAS,CAAC;AAAA,EAC/C,wBAAwB,EAAE,QAAQ;AAAA,EAClC,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE;AAAA,IACV,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,MAAM,EAAE,OAAO;AAAA,MACf,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,MAChC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,MAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,MACnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,EAAE;AAAA,IACR,EAAE,OAAO;AAAA,MACP,KAAK,EAAE,OAAO;AAAA,MACd,MAAM,EAAE,KAAK,CAAC,WAAW,aAAa,CAAC;AAAA,MACvC,OAAO,EAAE,OAAO;AAAA,MAChB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,MACxB,QAAQ,EAAE,OAAO;AAAA,MACjB,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,OAAO,EAAE,MAAM,iBAAiB;AAAA,IAClC,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,IACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AAAA,EACD,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,wBAAwB,EAAE,OAAO,EAAE,IAAI;AAAA,EACvC,mBAAmB,EAAE;AAAA,IACnB,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,MAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EACA,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,QAAQ,0BAA0B;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC9B,WAAW,EAAE;AAAA,IACX,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EAC3F;AACF,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/reports/preview` \u2014 screen 13's live numbers.\n *\n * It persists nothing. It exists because the project pick-list has to show what\n * each project would contribute BEFORE a report row exists, and because the\n * already-reported panel (D-5) has to be answerable at configuration time \u2014 the\n * whole point of that panel is to be read before the report is generated, not\n * after.\n *\n * It is a POST because the input is a project selection plus a period, not a\n * URL-shaped filter. It is nonetheless a **read**: it runs no command, writes no\n * row and therefore wires no mutation guard, which would otherwise run\n * after-success callbacks for a mutation that never happened. Authorization is\n * `staff.timesheets.reports.view` plus the same `resolveProjectAccess`\n * narrowing every other timesheets route uses.\n *\n * Two refusals are deliberate and named:\n *\n *  - **`422 report_currency_conflict`** when the selected projects disagree on a\n *    currency (risk R2). The body lists the currencies and the offending\n *    projects, because \"pick one currency\" is unactionable otherwise.\n *  - **`422 report_project_not_found`** when a requested project is outside the\n *    caller's access. Dropping it silently would produce a smaller, plausible\n *    total that nobody could explain.\n */\n\nimport { resolveMoneyVisibility } from '../../../../lib/time-tracking/moneyVisibility'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { staffTimeReportPreviewSchema } from '../../../../data/validators'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from '../../../../lib/time-tracking/access'\nimport { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'\nimport { readTimeTrackingSettings } from '../../../../lib/time-tracking/settings'\nimport { loadReportData } from '../../../../lib/timesheets-reports/loadReportData'\nimport {\n  computeReportTotals,\n  resolveEntryValues,\n  resolveReportCurrency,\n  sumAmounts,\n  type ReportGroup,\n  type ReportInputEntry,\n} from '../../../../lib/timesheets-reports/reportTotals'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/reports/preview' })\n\nconst VIEW_FEATURE = 'staff.timesheets.reports.view'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n}\n\nexport type PreviewProjectTotals = {\n  id: string\n  name: string\n  hourlyRate: number | null\n  currencyCode: string | null\n  entryCount: number\n  billableMinutes: number\n  nonbillableMinutes: number\n  amount: number | null\n}\n\n/**\n * Per-project figures for the pick-list. They depend only on (project, period)\n * and never on which other projects are ticked, so the screen can render every\n * candidate \u2014 including one with no entries, which stays listed but unticked and\n * greyed (screen 13 note 2) rather than disappearing.\n *\n * The amounts here go through the same `resolveEntryValues` the totals use, so a\n * row's figure and the grand total can never come from two different rules.\n */\nexport function summarizeProjectsForPreview(\n  projects: readonly { id: string; name: string; hourlyRate: number | null; currencyCode: string | null }[],\n  entries: readonly ReportInputEntry[],\n  options: { includeAlreadyReported: boolean; excludeNonBillable: boolean; canSeeMoney: boolean },\n): PreviewProjectTotals[] {\n  const byProject = new Map<string, ReportInputEntry[]>()\n  for (const entry of entries) {\n    const bucket = byProject.get(entry.timeProjectId)\n    if (bucket) bucket.push(entry)\n    else byProject.set(entry.timeProjectId, [entry])\n  }\n\n  return projects.map((project) => {\n    const projectEntries = byProject.get(project.id) ?? []\n    let billableMinutes = 0\n    let nonbillableMinutes = 0\n    const amounts: Array<number | null> = []\n    let entryCount = 0\n\n    for (const entry of projectEntries) {\n      if (entry.frozen && !options.includeAlreadyReported) continue\n      const values = resolveEntryValues(entry, project)\n      if (!values.isBillable) {\n        if (options.excludeNonBillable) continue\n        nonbillableMinutes += values.minutes\n        entryCount += 1\n        continue\n      }\n      billableMinutes += values.minutes\n      amounts.push(values.amount)\n      entryCount += 1\n    }\n\n    return {\n      id: project.id,\n      name: project.name,\n      hourlyRate: options.canSeeMoney ? project.hourlyRate : null,\n      currencyCode: project.currencyCode,\n      entryCount,\n      billableMinutes,\n      nonbillableMinutes,\n      amount: options.canSeeMoney ? sumAmounts(amounts) : null,\n    }\n  })\n}\n\n/** Money is absent from the payload \u2014 not zeroed \u2014 for a caller without `rates.view`. */\nfunction stripMoney(groups: ReportGroup[]): ReportGroup[] {\n  return groups.map((group) => ({\n    ...group,\n    rate: null,\n    amount: 0,\n    lines: group.lines.map(function strip(line): ReportGroup['lines'][number] {\n      return { ...line, rate: null, amount: 0, children: line.children.map(strip) }\n    }),\n  }))\n}\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope?.tenantId ?? auth.tenantId ?? null\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!tenantId || !organizationId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    // Both questions go through the module's single RBAC authority, which asks the\n    // service and fails closed on every path. The hand-rolled grant read this\n    // replaces returned `string[] | null`, and a null it could not explain was read\n    // as \"no restriction\" \u2014 that is how rates reached a plain report viewer, since\n    // this route requires only `reports.view`.\n    const manageAccess = await resolveFeatureAccess(container, auth.sub ?? null, [MANAGE_PROJECTS_FEATURE], {\n      tenantId,\n      organizationId,\n    })\n    const grantedFeatures = manageAccess.grantedFeatures\n    const canSeeMoney = await resolveMoneyVisibility(container, auth.sub ?? null, {\n      tenantId,\n      organizationId,\n    })\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: { container, userId: auth.sub, tenantId, organizationId, userFeatures: grantedFeatures },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const parsed = staffTimeReportPreviewSchema.parse(session.body)\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const access = await resolveProjectAccess({\n      em,\n      userId: auth.sub ?? null,\n      tenantId,\n      organizationId,\n      canManageAll: manageAccess.allowed,\n      userFeatures: grantedFeatures,\n      assignmentGraceDays: await readAssignmentGraceDays(container, tenantId),\n    })\n\n    const requestedIds = Array.from(new Set(parsed.timeProjectIds))\n    const deniedIds = access.canManageAll\n      ? []\n      : requestedIds.filter((id) => !access.projectIds.includes(id))\n    if (deniedIds.length > 0) {\n      const message = translate(\n        'staff.time_tracking.reports.errors.projectNotFound',\n        'Some of the selected projects are not available.',\n      )\n      throw new CrudHttpError(422, {\n        code: 'report_project_not_found',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        missingProjectIds: deniedIds,\n      })\n    }\n\n    const data = await loadReportData({\n      em,\n      scope: { tenantId, organizationId },\n      timeProjectIds: requestedIds,\n      periodFrom: parsed.periodFrom,\n      periodTo: parsed.periodTo,\n    })\n\n    if (data.projects.length !== requestedIds.length) {\n      const found = new Set(data.projects.map((project) => project.id))\n      const message = translate(\n        'staff.time_tracking.reports.errors.projectNotFound',\n        'Some of the selected projects are not available.',\n      )\n      throw new CrudHttpError(422, {\n        code: 'report_project_not_found',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        missingProjectIds: requestedIds.filter((id) => !found.has(id)),\n      })\n    }\n\n    // Risk R2, asserted before a single amount is produced.\n    const currency = resolveReportCurrency(\n      data.projects.map((project) => ({\n        id: project.id,\n        name: project.name,\n        currencyCode: project.currencyCode,\n      })),\n    )\n    if (!currency.ok) {\n      const message = translate(\n        'staff.time_tracking.reports.errors.currencyConflict',\n        'A report always covers one currency. Selected projects use {currencies}.',\n      ).replace('{currencies}', currency.currencies.join(', '))\n      throw new CrudHttpError(422, {\n        code: 'report_currency_conflict',\n        error: message,\n        fieldErrors: { timeProjectIds: message },\n        currencies: currency.currencies,\n        offenders: currency.offenders.map((project) => ({\n          id: project.id,\n          name: project.name,\n          currencyCode: project.currencyCode ?? null,\n        })),\n      })\n    }\n\n    const totals = computeReportTotals({\n      entries: data.entries,\n      projects: data.projects,\n      directory: data.directory,\n      options: {\n        grouping: parsed.grouping,\n        nonbillableMode: parsed.nonbillableMode,\n        includeAlreadyReported: parsed.includeAlreadyReported,\n      },\n      labels: reportLabels(translate),\n    })\n\n    const configService = safeConfigService(container)\n    const settings = configService\n      ? await readTimeTrackingSettings(configService, { tenantId })\n      : null\n\n    return session.respond(200, {\n      currencyCode: currency.currencyCode,\n      grouping: parsed.grouping,\n      nonbillableMode: parsed.nonbillableMode,\n      includeAlreadyReported: parsed.includeAlreadyReported,\n      showRates: parsed.showRates && canSeeMoney,\n      projects: summarizeProjectsForPreview(data.projects, data.entries, {\n        includeAlreadyReported: parsed.includeAlreadyReported,\n        excludeNonBillable: parsed.nonbillableMode === 'exclude',\n        canSeeMoney,\n      }),\n      groups: canSeeMoney ? totals.groups : stripMoney(totals.groups),\n      totals: {\n        entryCount: totals.entryCount,\n        billableMinutes: totals.billableMinutes,\n        nonbillableMinutes: totals.nonbillableMinutes,\n        totalAmount: canSeeMoney ? totals.totalAmount : null,\n      },\n      alreadyReportedCount: totals.alreadyReportedCount,\n      alreadyReportedMinutes: totals.alreadyReportedMinutes,\n      alreadyReportedIn: totals.alreadyReportedIn,\n      rounding: {\n        unitMinutes: settings?.rounding.unitMinutes ?? 0,\n        direction: settings?.rounding.direction ?? 'up',\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('staff.timesheets.reports.preview failed', { err })\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\ntype ContainerLike = { resolve: (name: string) => unknown }\n\nfunction safeConfigService(container: ContainerLike): ModuleConfigService | null {\n  try {\n    return container.resolve('moduleConfigService') as ModuleConfigService\n  } catch {\n    return null\n  }\n}\n\nasync function readAssignmentGraceDays(container: ContainerLike, tenantId: string): Promise<number | null> {\n  const configService = safeConfigService(container)\n  if (!configService) return null\n  try {\n    const settings = await readTimeTrackingSettings(configService, { tenantId })\n    return settings.access.assignmentGraceDays\n  } catch {\n    return null\n  }\n}\n\nexport function reportLabels(translate: (key: string, fallback: string) => string) {\n  return {\n    unassignedTask: translate('staff.time_tracking.reports.sheet.noTask', 'No task'),\n    unassignedPerson: translate('staff.time_tracking.reports.sheet.noPerson', 'Unassigned'),\n    nonbillableGroup: translate('staff.time_tracking.reports.sheet.nonbillable', 'Non-billable time'),\n  }\n}\n\nconst previewLineSchema: z.ZodType<unknown> = z.lazy(() =>\n  z.object({\n    key: z.string(),\n    label: z.string(),\n    minutes: z.number().int(),\n    rate: z.number().nullable(),\n    amount: z.number(),\n    entryCount: z.number().int(),\n    hasOverride: z.boolean(),\n    children: z.array(previewLineSchema),\n  }),\n)\n\nconst previewResponseSchema = z.object({\n  currencyCode: z.string().nullable(),\n  grouping: z.string(),\n  nonbillableMode: z.enum(['separate', 'exclude']),\n  includeAlreadyReported: z.boolean(),\n  showRates: z.boolean(),\n  projects: z.array(\n    z.object({\n      id: z.string().uuid(),\n      name: z.string(),\n      hourlyRate: z.number().nullable(),\n      currencyCode: z.string().nullable(),\n      entryCount: z.number().int(),\n      billableMinutes: z.number().int(),\n      nonbillableMinutes: z.number().int(),\n      amount: z.number().nullable(),\n    }),\n  ),\n  groups: z.array(\n    z.object({\n      key: z.string(),\n      kind: z.enum(['project', 'nonbillable']),\n      label: z.string(),\n      rate: z.number().nullable(),\n      minutes: z.number().int(),\n      amount: z.number(),\n      entryCount: z.number().int(),\n      lines: z.array(previewLineSchema),\n    }),\n  ),\n  totals: z.object({\n    entryCount: z.number().int(),\n    billableMinutes: z.number().int(),\n    nonbillableMinutes: z.number().int(),\n    totalAmount: z.number().nullable(),\n  }),\n  alreadyReportedCount: z.number().int(),\n  alreadyReportedMinutes: z.number().int(),\n  alreadyReportedIn: z.array(\n    z.object({\n      reportId: z.string().uuid(),\n      reference: z.string().nullable(),\n      title: z.string().nullable(),\n      entryCount: z.number().int(),\n      minutes: z.number().int(),\n    }),\n  ),\n  rounding: z.object({ unitMinutes: z.number().int(), direction: z.string() }),\n})\n\nconst currencyConflictSchema = z.object({\n  code: z.literal('report_currency_conflict'),\n  error: z.string(),\n  currencies: z.array(z.string()),\n  offenders: z.array(\n    z.object({ id: z.string().uuid(), name: z.string(), currencyCode: z.string().nullable() }),\n  ),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Preview a customer report',\n  methods: {\n    POST: {\n      summary: 'Preview a customer report',\n      description:\n        'Computes report totals for a project selection and period WITHOUT persisting anything. Powers the live per-project numbers and the range summary of the report config screen. Money is rounded at the entry and summed upward (D-7), so the grand total does not change when the grouping changes. Entries already frozen in a closed report are excluded unless `includeAlreadyReported` is set, and are reported as `alreadyReportedCount` / `alreadyReportedMinutes` / `alreadyReportedIn` either way (D-5). Amounts and rates are omitted for a caller without staff.timesheets.rates.view.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTimeReportPreviewSchema,\n      },\n      responses: [{ status: 200, description: 'Computed totals', schema: previewResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid body or missing scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.reports.view' },\n        {\n          status: 422,\n          description: 'Selected projects disagree on a currency, or one is not accessible',\n          schema: currencyConflictSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AA0BA,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAG7B,SAAS,oBAAoB;AAC7B,SAAS,oCAAoC;AAC7C,SAAS,gCAAgC;AACzC,SAAS,yBAAyB,4BAA4B;AAC9D,SAAS,4BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,iCAAiC,CAAC;AAE1F,MAAM,eAAe;AAEd,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAsBO,SAAS,4BACd,UACA,SACA,SACwB;AACxB,QAAM,YAAY,oBAAI,IAAgC;AACtD,aAAW,SAAS,SAAS;AAC3B,UAAM,SAAS,UAAU,IAAI,MAAM,aAAa;AAChD,QAAI,OAAQ,QAAO,KAAK,KAAK;AAAA,QACxB,WAAU,IAAI,MAAM,eAAe,CAAC,KAAK,CAAC;AAAA,EACjD;AAEA,SAAO,SAAS,IAAI,CAAC,YAAY;AAC/B,UAAM,iBAAiB,UAAU,IAAI,QAAQ,EAAE,KAAK,CAAC;AACrD,QAAI,kBAAkB;AACtB,QAAI,qBAAqB;AACzB,UAAM,UAAgC,CAAC;AACvC,QAAI,aAAa;AAEjB,eAAW,SAAS,gBAAgB;AAClC,UAAI,MAAM,UAAU,CAAC,QAAQ,uBAAwB;AACrD,YAAM,SAAS,mBAAmB,OAAO,OAAO;AAChD,UAAI,CAAC,OAAO,YAAY;AACtB,YAAI,QAAQ,mBAAoB;AAChC,8BAAsB,OAAO;AAC7B,sBAAc;AACd;AAAA,MACF;AACA,yBAAmB,OAAO;AAC1B,cAAQ,KAAK,OAAO,MAAM;AAC1B,oBAAc;AAAA,IAChB;AAEA,WAAO;AAAA,MACL,IAAI,QAAQ;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,YAAY,QAAQ,cAAc,QAAQ,aAAa;AAAA,MACvD,cAAc,QAAQ;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ,cAAc,WAAW,OAAO,IAAI;AAAA,IACtD;AAAA,EACF,CAAC;AACH;AAGA,SAAS,WAAW,QAAsC;AACxD,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,GAAG;AAAA,IACH,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,OAAO,MAAM,MAAM,IAAI,SAAS,MAAM,MAAoC;AACxE,aAAO,EAAE,GAAG,MAAM,MAAM,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,KAAK,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH,EAAE;AACJ;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,OAAO,YAAY,KAAK,YAAY;AACrD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAOA,UAAM,eAAe,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,uBAAuB,GAAG;AAAA,MACtG;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,kBAAkB,aAAa;AACrC,UAAM,cAAc,MAAM,uBAAuB,WAAW,KAAK,OAAO,MAAM;AAAA,MAC5E;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO,EAAE,WAAW,QAAQ,KAAK,KAAK,UAAU,gBAAgB,cAAc,gBAAgB;AAAA,MAC9F,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,SAAS,6BAA6B,MAAM,QAAQ,IAAI;AAE9D,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,MAAM,qBAAqB;AAAA,MACxC;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB;AAAA,MACA;AAAA,MACA,cAAc,aAAa;AAAA,MAC3B,cAAc;AAAA,MACd,qBAAqB,MAAM,wBAAwB,WAAW,QAAQ;AAAA,IACxE,CAAC;AAED,UAAM,eAAe,MAAM,KAAK,IAAI,IAAI,OAAO,cAAc,CAAC;AAC9D,UAAM,YAAY,OAAO,eACrB,CAAC,IACD,aAAa,OAAO,CAAC,OAAO,CAAC,OAAO,WAAW,SAAS,EAAE,CAAC;AAC/D,QAAI,UAAU,SAAS,GAAG;AACxB,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,eAAe;AAAA,MAChC;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC,gBAAgB;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,IACnB,CAAC;AAED,QAAI,KAAK,SAAS,WAAW,aAAa,QAAQ;AAChD,YAAM,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,QAAQ,EAAE,CAAC;AAChE,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,mBAAmB,aAAa,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;AAAA,MAC/D,CAAC;AAAA,IACH;AAGA,UAAM,WAAW;AAAA,MACf,KAAK,SAAS,IAAI,CAAC,aAAa;AAAA,QAC9B,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ;AAAA,QACd,cAAc,QAAQ;AAAA,MACxB,EAAE;AAAA,IACJ;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,MACF,EAAE,QAAQ,gBAAgB,SAAS,WAAW,KAAK,IAAI,CAAC;AACxD,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa,EAAE,gBAAgB,QAAQ;AAAA,QACvC,YAAY,SAAS;AAAA,QACrB,WAAW,SAAS,UAAU,IAAI,CAAC,aAAa;AAAA,UAC9C,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,cAAc,QAAQ,gBAAgB;AAAA,QACxC,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,oBAAoB;AAAA,MACjC,SAAS,KAAK;AAAA,MACd,UAAU,KAAK;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,SAAS;AAAA,QACP,UAAU,OAAO;AAAA,QACjB,iBAAiB,OAAO;AAAA,QACxB,wBAAwB,OAAO;AAAA,MACjC;AAAA,MACA,QAAQ,aAAa,SAAS;AAAA,IAChC,CAAC;AAED,UAAM,gBAAgB,kBAAkB,SAAS;AACjD,UAAM,WAAW,gBACb,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC,IAC1D;AAEJ,WAAO,QAAQ,QAAQ,KAAK;AAAA,MAC1B,cAAc,SAAS;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,iBAAiB,OAAO;AAAA,MACxB,wBAAwB,OAAO;AAAA,MAC/B,WAAW,OAAO,aAAa;AAAA,MAC/B,UAAU,4BAA4B,KAAK,UAAU,KAAK,SAAS;AAAA,QACjE,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO,oBAAoB;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,MACD,QAAQ,cAAc,OAAO,SAAS,WAAW,OAAO,MAAM;AAAA,MAC9D,QAAQ;AAAA,QACN,YAAY,OAAO;AAAA,QACnB,iBAAiB,OAAO;AAAA,QACxB,oBAAoB,OAAO;AAAA,QAC3B,aAAa,cAAc,OAAO,cAAc;AAAA,MAClD;AAAA,MACA,sBAAsB,OAAO;AAAA,MAC7B,wBAAwB,OAAO;AAAA,MAC/B,mBAAmB,OAAO;AAAA,MAC1B,UAAU;AAAA,QACR,aAAa,UAAU,SAAS,eAAe;AAAA,QAC/C,WAAW,UAAU,SAAS,aAAa;AAAA,MAC7C;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,QAC3F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,2CAA2C,EAAE,IAAI,CAAC;AAC/D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAIA,SAAS,kBAAkB,WAAsD;AAC/E,MAAI;AACF,WAAO,UAAU,QAAQ,qBAAqB;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,wBAAwB,WAA0B,UAA0C;AACzG,QAAM,gBAAgB,kBAAkB,SAAS;AACjD,MAAI,CAAC,cAAe,QAAO;AAC3B,MAAI;AACF,UAAM,WAAW,MAAM,yBAAyB,eAAe,EAAE,SAAS,CAAC;AAC3E,WAAO,SAAS,OAAO;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,WAAsD;AACjF,SAAO;AAAA,IACL,gBAAgB,UAAU,4CAA4C,SAAS;AAAA,IAC/E,kBAAkB,UAAU,8CAA8C,YAAY;AAAA,IACtF,kBAAkB,UAAU,iDAAiD,mBAAmB;AAAA,EAClG;AACF;AAEA,MAAM,oBAAwC,EAAE;AAAA,EAAK,MACnD,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,OAAO;AAAA,IACd,OAAO,EAAE,OAAO;AAAA,IAChB,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,IACxB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC1B,QAAQ,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,aAAa,EAAE,QAAQ;AAAA,IACvB,UAAU,EAAE,MAAM,iBAAiB;AAAA,EACrC,CAAC;AACH;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,UAAU,EAAE,OAAO;AAAA,EACnB,iBAAiB,EAAE,KAAK,CAAC,YAAY,SAAS,CAAC;AAAA,EAC/C,wBAAwB,EAAE,QAAQ;AAAA,EAClC,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE;AAAA,IACV,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,MAAM,EAAE,OAAO;AAAA,MACf,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,MAChC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,MAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,MACnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,EAAE;AAAA,IACR,EAAE,OAAO;AAAA,MACP,KAAK,EAAE,OAAO;AAAA,MACd,MAAM,EAAE,KAAK,CAAC,WAAW,aAAa,CAAC;AAAA,MACvC,OAAO,EAAE,OAAO;AAAA,MAChB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,MACxB,QAAQ,EAAE,OAAO;AAAA,MACjB,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,OAAO,EAAE,MAAM,iBAAiB;AAAA,IAClC,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,IAC3B,iBAAiB,EAAE,OAAO,EAAE,IAAI;AAAA,IAChC,oBAAoB,EAAE,OAAO,EAAE,IAAI;AAAA,IACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AAAA,EACD,sBAAsB,EAAE,OAAO,EAAE,IAAI;AAAA,EACrC,wBAAwB,EAAE,OAAO,EAAE,IAAI;AAAA,EACvC,mBAAmB,EAAE;AAAA,IACnB,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,MAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,YAAY,EAAE,OAAO,EAAE,IAAI;AAAA,MAC3B,SAAS,EAAE,OAAO,EAAE,IAAI;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EACA,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,MAAM,EAAE,QAAQ,0BAA0B;AAAA,EAC1C,OAAO,EAAE,OAAO;AAAA,EAChB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC9B,WAAW,EAAE;AAAA,IACX,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EAC3F;AACF,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/reports/shared.js

@@ -3,6 +3,7 @@ import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.j
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { reportSheetLabels } from "../../../lib/timesheets-reports/reportLabels.js";
@@ -26,7 +27,7 @@ async function resolveReportRequestContext(req, options) {
   }
   const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
   const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null;
-  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null;
   if (!tenantId || !organizationId) {
     throw new CrudHttpError(400, {
       error: translate("staff.errors.missingScope", "Missing tenant or organization scope.")

package/dist/modules/staff/api/timesheets/reports/shared.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/timesheets/reports/shared.ts"],
-  "sourcesContent": ["/**\n * Shared boilerplate for the hand-written report sub-routes (`sheet`, `close`,\n * `unlock`, `export`).\n *\n * Four routes needing the same six lines of auth, scope, id extraction and\n * granted-feature resolution is exactly the situation where one of them\n * eventually forgets the tenant filter. Resolving it in one place makes that\n * impossible rather than unlikely.\n */\n\nimport { RATES_FEATURE } from '../../../lib/time-tracking/moneyVisibility'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { reportSheetLabels } from '../../../lib/timesheets-reports/reportLabels'\n\nexport { reportSheetLabels }\n\n/**\n * Cap on the raw rows a sheet response carries. A report covering a quarter of a\n * ten-person team can run into the thousands, and the screen paginates anyway;\n * the response says when it truncated rather than quietly serving a short list.\n */\nexport const MAX_SHEET_ROWS = 500\n\nexport type Translate = (key: string, fallback: string) => string\n\nexport type ReportRequestContext = {\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>\n  organizationScope: Awaited<ReturnType<typeof resolveOrganizationScopeForRequest>>\n  tenantId: string\n  organizationId: string\n  reportId: string\n  translate: Translate\n  /**\n   * The caller's grants, for the plumbing that takes a list: the approval\n   * policies, the interceptor context and the mutation-guard registry. Always an\n   * array, never `null` \u2014 a nullable grant list is what let \"RBAC could not\n   * answer\" read as \"no restriction\" on these routes.\n   *\n   * Empty means the same thing whether RBAC answered \"nothing\" or could not\n   * answer at all, and every consumer treats it the same fail-closed way: an\n   * approval policy that requires a feature refuses, a feature-gated interceptor\n   * does not run, and a feature-gated guard does not run. Authorization never\n   * rests on it \u2014 `canSeeMoney` and each route's own `resolveFeatureAccess` gate\n   * are the decisions, and both fail closed on their own. `resolveFeatureAccess`\n   * logs a grant list it could not read, so an outage is visible to operators\n   * without a flag here that no caller can act on.\n   */\n  grantedFeatures: string[]\n  /** Fail-closed `staff.timesheets.rates.view` decision \u2014 never re-derive it. */\n  canSeeMoney: boolean\n}\n\nexport function extractReportIdFromUrl(url: string | undefined, segment: string): string | null {\n  if (!url) return null\n  try {\n    const pathname = new URL(url).pathname\n    const match = pathname.match(new RegExp(`/reports/([^/]+)/${segment}`))\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport async function resolveReportRequestContext(\n  req: Request,\n  options: { segment: string },\n): Promise<ReportRequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) {\n    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const reportId = extractReportIdFromUrl(req.url, options.segment)\n  if (!reportId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.reports.errors.idRequired', 'Report id is required.'),\n    })\n  }\n\n  // One lookup, through the module's single RBAC authority, answering both\n  // questions the four routes ask: may this caller see money, and what is the\n  // grant list the plumbing wants. Decided here, once, so no route re-derives it\n  // and none can pick the other failure direction.\n  //\n  // `resolveFeatureAccess` fails closed on every path \u2014 an unresolvable service,\n  // a service that cannot answer, a call that throws \u2014 so an RBAC outage hides\n  // rates and costs instead of handing them to a plain report viewer.\n  const ratesAccess = await resolveFeatureAccess(container, auth.sub ?? null, [RATES_FEATURE], {\n    tenantId,\n    organizationId,\n  })\n\n  return {\n    container,\n    auth,\n    organizationScope,\n    tenantId,\n    organizationId,\n    reportId,\n    translate,\n    grantedFeatures: ratesAccess.grantedFeatures,\n    canSeeMoney: ratesAccess.allowed,\n  }\n}\n"],
-  "mappings": "AAUA,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAS3B,MAAM,iBAAiB;AAgCvB,SAAS,uBAAuB,KAAyB,SAAgC;AAC9F,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,GAAG,EAAE;AAC9B,UAAM,QAAQ,SAAS,MAAM,IAAI,OAAO,oBAAoB,OAAO,EAAE,CAAC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,4BACpB,KACA,SAC+B;AAC/B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,EAChG;AAEA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,uBAAuB,IAAI,KAAK,QAAQ,OAAO;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,iDAAiD,wBAAwB;AAAA,IAC5F,CAAC;AAAA,EACH;AAUA,QAAM,cAAc,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,aAAa,GAAG;AAAA,IAC3F;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,YAAY;AAAA,IAC7B,aAAa,YAAY;AAAA,EAC3B;AACF;",
+  "sourcesContent": ["/**\n * Shared boilerplate for the hand-written report sub-routes (`sheet`, `close`,\n * `unlock`, `export`).\n *\n * Four routes needing the same six lines of auth, scope, id extraction and\n * granted-feature resolution is exactly the situation where one of them\n * eventually forgets the tenant filter. Resolving it in one place makes that\n * impossible rather than unlikely.\n */\n\nimport { RATES_FEATURE } from '../../../lib/time-tracking/moneyVisibility'\nimport { resolveFeatureAccess } from '../../../lib/time-tracking/featureAccess'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { reportSheetLabels } from '../../../lib/timesheets-reports/reportLabels'\n\nexport { reportSheetLabels }\n\n/**\n * Cap on the raw rows a sheet response carries. A report covering a quarter of a\n * ten-person team can run into the thousands, and the screen paginates anyway;\n * the response says when it truncated rather than quietly serving a short list.\n */\nexport const MAX_SHEET_ROWS = 500\n\nexport type Translate = (key: string, fallback: string) => string\n\nexport type ReportRequestContext = {\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>\n  organizationScope: Awaited<ReturnType<typeof resolveOrganizationScopeForRequest>>\n  tenantId: string\n  organizationId: string\n  reportId: string\n  translate: Translate\n  /**\n   * The caller's grants, for the plumbing that takes a list: the approval\n   * policies, the interceptor context and the mutation-guard registry. Always an\n   * array, never `null` \u2014 a nullable grant list is what let \"RBAC could not\n   * answer\" read as \"no restriction\" on these routes.\n   *\n   * Empty means the same thing whether RBAC answered \"nothing\" or could not\n   * answer at all, and every consumer treats it the same fail-closed way: an\n   * approval policy that requires a feature refuses, a feature-gated interceptor\n   * does not run, and a feature-gated guard does not run. Authorization never\n   * rests on it \u2014 `canSeeMoney` and each route's own `resolveFeatureAccess` gate\n   * are the decisions, and both fail closed on their own. `resolveFeatureAccess`\n   * logs a grant list it could not read, so an outage is visible to operators\n   * without a flag here that no caller can act on.\n   */\n  grantedFeatures: string[]\n  /** Fail-closed `staff.timesheets.rates.view` decision \u2014 never re-derive it. */\n  canSeeMoney: boolean\n}\n\nexport function extractReportIdFromUrl(url: string | undefined, segment: string): string | null {\n  if (!url) return null\n  try {\n    const pathname = new URL(url).pathname\n    const match = pathname.match(new RegExp(`/reports/([^/]+)/${segment}`))\n    return match?.[1] ?? null\n  } catch {\n    return null\n  }\n}\n\nexport async function resolveReportRequestContext(\n  req: Request,\n  options: { segment: string },\n): Promise<ReportRequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) {\n    throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null\n  if (!tenantId || !organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const reportId = extractReportIdFromUrl(req.url, options.segment)\n  if (!reportId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.reports.errors.idRequired', 'Report id is required.'),\n    })\n  }\n\n  // One lookup, through the module's single RBAC authority, answering both\n  // questions the four routes ask: may this caller see money, and what is the\n  // grant list the plumbing wants. Decided here, once, so no route re-derives it\n  // and none can pick the other failure direction.\n  //\n  // `resolveFeatureAccess` fails closed on every path \u2014 an unresolvable service,\n  // a service that cannot answer, a call that throws \u2014 so an RBAC outage hides\n  // rates and costs instead of handing them to a plain report viewer.\n  const ratesAccess = await resolveFeatureAccess(container, auth.sub ?? null, [RATES_FEATURE], {\n    tenantId,\n    organizationId,\n  })\n\n  return {\n    container,\n    auth,\n    organizationScope,\n    tenantId,\n    organizationId,\n    reportId,\n    translate,\n    grantedFeatures: ratesAccess.grantedFeatures,\n    canSeeMoney: ratesAccess.allowed,\n  }\n}\n"],
+  "mappings": "AAUA,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,yBAAyB;AAS3B,MAAM,iBAAiB;AAgCvB,SAAS,uBAAuB,KAAyB,SAAgC;AAC9F,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,GAAG,EAAE;AAC9B,UAAM,QAAQ,SAAS,MAAM,IAAI,OAAO,oBAAoB,OAAO,EAAE,CAAC;AACtE,WAAO,QAAQ,CAAC,KAAK;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,4BACpB,KACA,SAC+B;AAC/B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,EAChG;AAEA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAM,iBAAiB,kCAAkC,mBAAmB,IAAI,KAAK;AACrF,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,uBAAuB,IAAI,KAAK,QAAQ,OAAO;AAChE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,iDAAiD,wBAAwB;AAAA,IAC5F,CAAC;AAAA,EACH;AAUA,QAAM,cAAc,MAAM,qBAAqB,WAAW,KAAK,OAAO,MAAM,CAAC,aAAa,GAAG;AAAA,IAC3F;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,YAAY;AAAA,IAC7B,aAAa,YAAY;AAAA,EAC3B;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/settings/reapply-rounding/route.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -47,7 +48,7 @@ async function POST(req) {
       });
     }
     const actorId = typeof auth.sub === "string" && auth.sub.trim().length > 0 ? auth.sub : "system";
-    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null;
     const access = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId });
     if (!access.allowed) {
       throw forbidden(translate("staff.errors.forbidden", "Forbidden"));

package/dist/modules/staff/api/timesheets/settings/reapply-rounding/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/settings/reapply-rounding/route.ts"],
-  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/settings/reapply-rounding` \u2014 screen 16 note 3 (T7.3).\n *\n * The mockup draws retroactive rounding as a switch. It is implemented as an\n * **action**, because the two are not the same promise: a switch that rewrites\n * `rounded_minutes` across a tenant's history when the settings form is saved\n * changes invoiced amounts as a side effect of an unrelated save. This endpoint\n * makes it something a person does, once, on purpose, with a progress bar and a\n * final count.\n *\n * It enqueues; it does not do the work. Restating a tenant's entries is exactly the\n * long-running job the progress module exists for, so the response is a `202` with\n * a `progressJobId` that the top bar picks up on its own.\n *\n * Locked entries are never touched \u2014 the candidate query excludes them and the\n * command excludes them again, independently.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ProgressService } from '../../../../../progress/lib/progressService'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../guards'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n  STAFF_TIME_REAPPLY_ROUNDING_QUEUE,\n  countReapplyRoundingCandidates,\n  getStaffQueue,\n  type ReapplyRoundingScope,\n} from '../../../../lib/time-tracking/reapplyRounding'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/settings/reapply-rounding' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.settings.manage'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.settings\nconst RESOURCE_ID = 'time_tracking'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst responseSchema = z.object({\n  ok: z.boolean(),\n  progressJobId: z.string().uuid().nullable(),\n  /** Entries eligible for restatement \u2014 locked ones are not among them. */\n  candidateCount: z.number().int(),\n})\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n    if (!tenantId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const actorId = typeof auth.sub === 'string' && auth.sub.trim().length > 0 ? auth.sub : 'system'\n    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const access = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!access.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = access.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: {\n        container,\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n        tenantGlobal: true,\n      },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: RESOURCE_ID,\n        operation: 'update',\n        mutationPayload: { action: 'reapply-rounding' },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const scope: ReapplyRoundingScope = {\n      tenantId,\n      // `filterIds === null` means the caller may act across every organization of\n      // the tenant, which is what a tenant-global rule is about; anything narrower\n      // restates only what the caller can already see.\n      organizationIds: organizationScope?.filterIds ?? (organizationId ? [organizationId] : null),\n      userId: actorId,\n    }\n\n    const em = container.resolve('em') as EntityManager\n    const candidateCount = await countReapplyRoundingCandidates(em.fork(), scope)\n    if (candidateCount === 0) {\n      // Nothing to restate: no job, no progress bar, no queue traffic. The caller\n      // gets an honest zero rather than a job that completes instantly.\n      await guardResult.runAfterSuccess()\n      return session.respond(200, responseSchema.parse({ ok: true, progressJobId: null, candidateCount: 0 }))\n    }\n\n    const progressService = container.resolve('progressService') as ProgressService\n    const progressJob = await progressService.createJob(\n      {\n        jobType: STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n        name: translate('staff.time_tracking.settings.retro.jobName', 'Reapply rounding to existing entries'),\n        description: translate(\n          'staff.time_tracking.settings.retro.jobDescription',\n          'Recomputing rounded time on existing entries. Locked entries are not changed.',\n        ),\n        totalCount: candidateCount,\n        cancellable: true,\n        meta: { source: 'staff.timesheets.settings.reapply-rounding' },\n      },\n      { tenantId, organizationId, userId: actorId },\n    )\n\n    const queue = getStaffQueue(STAFF_TIME_REAPPLY_ROUNDING_QUEUE)\n    await queue.enqueue({ progressJobId: progressJob.id, scope })\n\n    await guardResult.runAfterSuccess()\n\n    void emitStaffEvent('staff.timesheets.time_tracking.rounding_reapplied', {\n      tenantId,\n      organizationId,\n      progressJobId: progressJob.id,\n      candidateCount,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_tracking.rounding_reapplied failed', { err })\n    })\n\n    return session.respond(202, responseSchema.parse({ ok: true, progressJobId: progressJob.id, candidateCount }))\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.settings.reapply-rounding failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reapply the rounding rule to existing entries',\n  methods: {\n    POST: {\n      summary: 'Queue a retroactive rounding job',\n      description:\n        'Enqueues a `ProgressJob` that recomputes `rounded_minutes` on existing time entries under the tenant\u2019s current rounding rule. Entries locked into a closed report are excluded \u2014 a billed amount is never restated. Returns `202` with `progressJobId`, or `200` with a null job id when there is nothing to restate.',\n      responses: [\n        { status: 200, description: 'Nothing to restate', schema: responseSchema },\n        { status: 202, description: 'Job queued', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Missing staff.timesheets.settings.manage' },\n        { status: 500, description: 'Queueing failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAkBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAG/B,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,2CAA2C,CAAC;AAEpG,MAAM,iBAAiB;AACvB,MAAM,gBAAgB,mCAAmC;AACzD,MAAM,cAAc;AAEb,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ;AAAA,EACd,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE1C,gBAAgB,EAAE,OAAO,EAAE,IAAI;AACjC,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,UAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,IAAI,KAAK,MAAM;AACxF,UAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AAKtE,UAAM,SAAS,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AAC5G,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,OAAO;AAE/B,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB,EAAE,QAAQ,mBAAmB;AAAA,MAChD;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,QAA8B;AAAA,MAClC;AAAA;AAAA;AAAA;AAAA,MAIA,iBAAiB,mBAAmB,cAAc,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACtF,QAAQ;AAAA,IACV;AAEA,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,iBAAiB,MAAM,+BAA+B,GAAG,KAAK,GAAG,KAAK;AAC5E,QAAI,mBAAmB,GAAG;AAGxB,YAAM,YAAY,gBAAgB;AAClC,aAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,MAAM,gBAAgB,EAAE,CAAC,CAAC;AAAA,IACxG;AAEA,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,cAAc,MAAM,gBAAgB;AAAA,MACxC;AAAA,QACE,SAAS;AAAA,QACT,MAAM,UAAU,8CAA8C,sCAAsC;AAAA,QACpG,aAAa;AAAA,UACX;AAAA,UACA;AAAA,QACF;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,MAAM,EAAE,QAAQ,6CAA6C;AAAA,MAC/D;AAAA,MACA,EAAE,UAAU,gBAAgB,QAAQ,QAAQ;AAAA,IAC9C;AAEA,UAAM,QAAQ,cAAc,iCAAiC;AAC7D,UAAM,MAAM,QAAQ,EAAE,eAAe,YAAY,IAAI,MAAM,CAAC;AAE5D,UAAM,YAAY,gBAAgB;AAElC,SAAK,eAAe,qDAAqD;AAAA,MACvE;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,iEAAiE,EAAE,IAAI,CAAC;AAAA,IACvF,CAAC;AAED,WAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,YAAY,IAAI,eAAe,CAAC,CAAC;AAAA,EAC/G,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AACzE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,eAAe;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,eAAe;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * `POST /api/staff/timesheets/settings/reapply-rounding` \u2014 screen 16 note 3 (T7.3).\n *\n * The mockup draws retroactive rounding as a switch. It is implemented as an\n * **action**, because the two are not the same promise: a switch that rewrites\n * `rounded_minutes` across a tenant's history when the settings form is saved\n * changes invoiced amounts as a side effect of an unrelated save. This endpoint\n * makes it something a person does, once, on purpose, with a progress bar and a\n * final count.\n *\n * It enqueues; it does not do the work. Restating a tenant's entries is exactly the\n * long-running job the progress module exists for, so the response is a `202` with\n * a `progressJobId` that the top bar picks up on its own.\n *\n * Locked entries are never touched \u2014 the candidate query excludes them and the\n * command excludes them again, independently.\n */\n\nimport { NextResponse } from 'next/server'\nimport { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ProgressService } from '../../../../../progress/lib/progressService'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../guards'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n  STAFF_TIME_REAPPLY_ROUNDING_QUEUE,\n  countReapplyRoundingCandidates,\n  getStaffQueue,\n  type ReapplyRoundingScope,\n} from '../../../../lib/time-tracking/reapplyRounding'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/settings/reapply-rounding' })\n\nconst MANAGE_FEATURE = 'staff.timesheets.settings.manage'\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.settings\nconst RESOURCE_ID = 'time_tracking'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst responseSchema = z.object({\n  ok: z.boolean(),\n  progressJobId: z.string().uuid().nullable(),\n  /** Entries eligible for restatement \u2014 locked ones are not among them. */\n  candidateCount: z.number().int(),\n})\n\nexport async function POST(req: Request) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth) {\n      throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = organizationScope?.tenantId ?? auth.tenantId ?? null\n    if (!tenantId) {\n      throw new CrudHttpError(400, {\n        error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n      })\n    }\n\n    const actorId = typeof auth.sub === 'string' && auth.sub.trim().length > 0 ? auth.sub : 'system'\n    const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null\n\n    // One lookup through the module's single RBAC authority: the decision is\n    // checked unconditionally and fails closed, and the grant list the plumbing\n    // takes comes from the same answer instead of a second, nullable read.\n    const access = await resolveFeatureAccess(container, actorId, [MANAGE_FEATURE], { tenantId, organizationId })\n    if (!access.allowed) {\n      throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))\n    }\n    const grantedFeatures = access.grantedFeatures\n\n    const interceptors = await runTimesheetInterceptors({\n      request: req,\n      method: 'POST',\n      scope: {\n        container,\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n        tenantGlobal: true,\n      },\n      body: await readJsonSafe<Record<string, unknown>>(req, {}),\n    })\n    if (!interceptors.ok) return interceptors.response\n    const { session } = interceptors\n\n    const guardResult = await runRouteMutationGuards({\n      container,\n      req,\n      auth: {\n        userId: actorId,\n        tenantId,\n        organizationId,\n        userFeatures: grantedFeatures,\n      },\n      input: {\n        resourceKind: RESOURCE_KIND,\n        resourceId: RESOURCE_ID,\n        operation: 'update',\n        mutationPayload: { action: 'reapply-rounding' },\n      },\n    })\n    if (!guardResult.ok) return guardResult.response\n\n    const scope: ReapplyRoundingScope = {\n      tenantId,\n      // `filterIds === null` means the caller may act across every organization of\n      // the tenant, which is what a tenant-global rule is about; anything narrower\n      // restates only what the caller can already see.\n      organizationIds: organizationScope?.filterIds ?? (organizationId ? [organizationId] : null),\n      userId: actorId,\n    }\n\n    const em = container.resolve('em') as EntityManager\n    const candidateCount = await countReapplyRoundingCandidates(em.fork(), scope)\n    if (candidateCount === 0) {\n      // Nothing to restate: no job, no progress bar, no queue traffic. The caller\n      // gets an honest zero rather than a job that completes instantly.\n      await guardResult.runAfterSuccess()\n      return session.respond(200, responseSchema.parse({ ok: true, progressJobId: null, candidateCount: 0 }))\n    }\n\n    const progressService = container.resolve('progressService') as ProgressService\n    const progressJob = await progressService.createJob(\n      {\n        jobType: STAFF_TIME_REAPPLY_ROUNDING_JOB_TYPE,\n        name: translate('staff.time_tracking.settings.retro.jobName', 'Reapply rounding to existing entries'),\n        description: translate(\n          'staff.time_tracking.settings.retro.jobDescription',\n          'Recomputing rounded time on existing entries. Locked entries are not changed.',\n        ),\n        totalCount: candidateCount,\n        cancellable: true,\n        meta: { source: 'staff.timesheets.settings.reapply-rounding' },\n      },\n      { tenantId, organizationId, userId: actorId },\n    )\n\n    const queue = getStaffQueue(STAFF_TIME_REAPPLY_ROUNDING_QUEUE)\n    await queue.enqueue({ progressJobId: progressJob.id, scope })\n\n    await guardResult.runAfterSuccess()\n\n    void emitStaffEvent('staff.timesheets.time_tracking.rounding_reapplied', {\n      tenantId,\n      organizationId,\n      progressJobId: progressJob.id,\n      candidateCount,\n    }, { persistent: true }).catch((err) => {\n      logger.error('staff.timesheets emit time_tracking.rounding_reapplied failed', { err })\n    })\n\n    return session.respond(202, responseSchema.parse({ ok: true, progressJobId: progressJob.id, candidateCount }))\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('staff.timesheets.settings.reapply-rounding failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('staff.errors.internal', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reapply the rounding rule to existing entries',\n  methods: {\n    POST: {\n      summary: 'Queue a retroactive rounding job',\n      description:\n        'Enqueues a `ProgressJob` that recomputes `rounded_minutes` on existing time entries under the tenant\u2019s current rounding rule. Entries locked into a closed report are excluded \u2014 a billed amount is never restated. Returns `202` with `progressJobId`, or `200` with a null job id when there is nothing to restate.',\n      responses: [\n        { status: 200, description: 'Nothing to restate', schema: responseSchema },\n        { status: 202, description: 'Job queued', schema: responseSchema },\n        { status: 400, description: 'Missing scope', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Missing staff.timesheets.settings.manage' },\n        { status: 500, description: 'Queueing failure', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAkBA,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,WAAW,uBAAuB;AAC1D,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAG/B,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,2CAA2C,CAAC;AAEpG,MAAM,iBAAiB;AACvB,MAAM,gBAAgB,mCAAmC;AACzD,MAAM,cAAc;AAEb,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ;AAAA,EACd,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE1C,gBAAgB,EAAE,OAAO,EAAE,IAAI;AACjC,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAAA,IAChG;AAEA,UAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,UAAM,WAAW,mBAAmB,YAAY,KAAK,YAAY;AACjE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,MACvF,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,IAAI,KAAK,MAAM;AACxF,UAAM,iBAAiB,kCAAkC,mBAAmB,IAAI,KAAK;AAKrF,UAAM,SAAS,MAAM,qBAAqB,WAAW,SAAS,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AAC5G,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,UAAU,UAAU,0BAA0B,WAAW,CAAC;AAAA,IAClE;AACA,UAAM,kBAAkB,OAAO;AAE/B,UAAM,eAAe,MAAM,yBAAyB;AAAA,MAClD,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,QACL;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,MACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,IAC3D,CAAC;AACD,QAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,UAAM,EAAE,QAAQ,IAAI;AAEpB,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA,MACA,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,iBAAiB,EAAE,QAAQ,mBAAmB;AAAA,MAChD;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,QAA8B;AAAA,MAClC;AAAA;AAAA;AAAA;AAAA,MAIA,iBAAiB,mBAAmB,cAAc,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACtF,QAAQ;AAAA,IACV;AAEA,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,iBAAiB,MAAM,+BAA+B,GAAG,KAAK,GAAG,KAAK;AAC5E,QAAI,mBAAmB,GAAG;AAGxB,YAAM,YAAY,gBAAgB;AAClC,aAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,MAAM,gBAAgB,EAAE,CAAC,CAAC;AAAA,IACxG;AAEA,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,cAAc,MAAM,gBAAgB;AAAA,MACxC;AAAA,QACE,SAAS;AAAA,QACT,MAAM,UAAU,8CAA8C,sCAAsC;AAAA,QACpG,aAAa;AAAA,UACX;AAAA,UACA;AAAA,QACF;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,MAAM,EAAE,QAAQ,6CAA6C;AAAA,MAC/D;AAAA,MACA,EAAE,UAAU,gBAAgB,QAAQ,QAAQ;AAAA,IAC9C;AAEA,UAAM,QAAQ,cAAc,iCAAiC;AAC7D,UAAM,MAAM,QAAQ,EAAE,eAAe,YAAY,IAAI,MAAM,CAAC;AAE5D,UAAM,YAAY,gBAAgB;AAElC,SAAK,eAAe,qDAAqD;AAAA,MACvE;AAAA,MACA;AAAA,MACA,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,aAAO,MAAM,iEAAiE,EAAE,IAAI,CAAC;AAAA,IACvF,CAAC;AAED,WAAO,QAAQ,QAAQ,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,eAAe,YAAY,IAAI,eAAe,CAAC,CAAC;AAAA,EAC/G,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,qDAAqD,EAAE,IAAI,CAAC;AACzE,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,eAAe;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,eAAe;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/tags/entry-assignments/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -50,7 +51,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/staff/api/timesheets/tags/entry-assignments/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/tags/entry-assignments/route.ts"],
-  "sourcesContent": ["/**\n * Time entry tag assignment (T3.4) \u2014 the tag list of the entry form on screen 8\n * and the badges the entries list of screen 10 renders.\n *\n * Mirrors the task endpoint: `POST` adds, `DELETE` removes, both idempotent, and\n * both filter through `resolveProjectAccess` before the entry is even loaded. An\n * entry frozen in a closed report is refused by the command with `409`.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeEntryTagAssignmentSchema,\n  type StaffTimeEntryTagAssignmentInput,\n} from '../../../../data/validators'\nimport { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { loadTagProjectAccess, requireAccessibleTimeEntry, type TagAssignmentScope } from '../access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags/entry-assignments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.entryTag\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nconst assignResponseSchema = z.object({\n  timeEntryId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  assignedTagIds: z.array(z.string().uuid()),\n  alreadyAssignedTagIds: z.array(z.string().uuid()),\n})\n\nconst unassignResponseSchema = z.object({\n  timeEntryId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  removedTagIds: z.array(z.string().uuid()),\n  notAssignedTagIds: z.array(z.string().uuid()),\n})\n\ntype AssignmentResult = {\n  targetId: string\n  assignedTagIds: string[]\n  alreadyAssignedTagIds: string[]\n  tagIds: string[]\n}\n\ntype UnassignmentResult = {\n  targetId: string\n  removedTagIds: string[]\n  notAssignedTagIds: string[]\n  tagIds: string[]\n}\n\nasync function buildContext(\n  req: Request,\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction requireAssignmentScope(\n  ctx: CommandRuntimeContext,\n  translate: (key: string, fallback?: string) => string,\n): TagAssignmentScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const userId = ctx.auth?.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return { tenantId, organizationId, userId }\n}\n\nasync function handle(req: Request, commandId: string, operation: 'create' | 'delete'): Promise<Response> {\n  const { ctx, translate } = await buildContext(req)\n  const scope = requireAssignmentScope(ctx, translate)\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: operation === 'create' ? 'POST' : 'DELETE',\n    scope: {\n      container: ctx.container,\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    body: await readJsonSafe<Record<string, unknown>>(req, {}),\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const input = parseScopedCommandInput(staffTimeEntryTagAssignmentSchema, session.body, ctx, translate)\n\n  const access = await loadTagProjectAccess(ctx.container, scope)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTimeEntry(em, input.timeEntryId, scope, access, translate)\n\n  const guardResult = await runStaffMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.timeEntryId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n      status: guardResult.errorStatus ?? 422,\n    })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { result, logEntry } = await commandBus.execute<\n    StaffTimeEntryTagAssignmentInput,\n    AssignmentResult | UnassignmentResult\n  >(commandId, { input, ctx })\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.timeEntryId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  // A tag write is a change to the entry itself, so it travels as the entry's own\n  // `updated` event rather than an assignment-shaped one no subscriber knows about.\n  void emitStaffEvent('staff.timesheets.time_entry.updated', {\n    id: input.timeEntryId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_entry.updated failed', { err })\n  })\n\n  const assignment = result as AssignmentResult | undefined\n  const unassignment = result as UnassignmentResult | undefined\n  const payload =\n    operation === 'create'\n      ? {\n          timeEntryId: input.timeEntryId,\n          tagIds: assignment?.tagIds ?? [],\n          assignedTagIds: assignment?.assignedTagIds ?? [],\n          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],\n        }\n      : {\n          timeEntryId: input.timeEntryId,\n          tagIds: unassignment?.tagIds ?? [],\n          removedTagIds: unassignment?.removedTagIds ?? [],\n          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],\n        }\n\n  const response = await session.respond(200, payload)\n  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n    response.headers.set(\n      'x-om-operation',\n      serializeOperationMetadata({\n        id: logEntry.id,\n        undoToken: logEntry.undoToken,\n        commandId: logEntry.commandId,\n        actionLabel: logEntry.actionLabel ?? null,\n        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n        resourceId: logEntry.resourceId ?? input.timeEntryId,\n        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n      }),\n    )\n  }\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.assignEntry, 'create')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.entry-assignments.POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.unassignEntry, 'delete')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.entry-assignments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry tag assignments',\n  methods: {\n    POST: {\n      summary: 'Assign tags to a time entry',\n      description:\n        'Adds tags to a time entry. Idempotent \u2014 a tag the entry already carries comes back in alreadyAssignedTagIds. Refused with 404 when the entry is outside the caller\\'s project access, and with 409 when it is locked in a closed report.',\n      requestBody: { contentType: 'application/json', schema: staffTimeEntryTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Time entry not found or not accessible' },\n        { status: 409, description: 'Time entry locked in a closed report' },\n        { status: 422, description: 'Unknown tag ids' },\n      ],\n    },\n    DELETE: {\n      summary: 'Unassign tags from a time entry',\n      description:\n        'Removes tags from a time entry. Idempotent \u2014 a tag the entry does not carry comes back in notAssignedTagIds.',\n      requestBody: { contentType: 'application/json', schema: staffTimeEntryTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Time entry not found or not accessible' },\n        { status: 409, description: 'Time entry locked in a closed report' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAQA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,kCAA2D;AAE1F,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,wCAAwC,CAAC;AAEjG,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC9C,CAAC;AAgBD,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,uBACP,KACA,WACoB;AACpB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,SAAS,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO;AAC5C;AAEA,eAAe,OAAO,KAAc,WAAmB,WAAmD;AACxG,QAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,QAAM,QAAQ,uBAAuB,KAAK,SAAS;AAEnD,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ,cAAc,WAAW,SAAS;AAAA,IAC1C,OAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,EAC3D,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,QAAQ,wBAAwB,mCAAmC,QAAQ,MAAM,KAAK,SAAS;AAErG,QAAM,SAAS,MAAM,qBAAqB,IAAI,WAAW,KAAK;AAC9D,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,2BAA2B,IAAI,MAAM,aAAa,OAAO,QAAQ,SAAS;AAEhF,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,MACzF,QAAQ,YAAY,eAAe;AAAA,IACrC,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,WAAW,EAAE,OAAO,IAAI,CAAC;AAE3B,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAIA,OAAK,eAAe,uCAAuC;AAAA,IACzD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,aAAa;AACnB,QAAM,eAAe;AACrB,QAAM,UACJ,cAAc,WACV;AAAA,IACE,aAAa,MAAM;AAAA,IACnB,QAAQ,YAAY,UAAU,CAAC;AAAA,IAC/B,gBAAgB,YAAY,kBAAkB,CAAC;AAAA,IAC/C,uBAAuB,YAAY,yBAAyB,CAAC;AAAA,EAC/D,IACA;AAAA,IACE,aAAa,MAAM;AAAA,IACnB,QAAQ,cAAc,UAAU,CAAC;AAAA,IACjC,eAAe,cAAc,iBAAiB,CAAC;AAAA,IAC/C,mBAAmB,cAAc,qBAAqB,CAAC;AAAA,EACzD;AAEN,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,OAAO;AACnD,MAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,2BAA2B;AAAA,QACzB,IAAI,SAAS;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS,eAAe;AAAA,QACrC,cAAc,SAAS,gBAAgB;AAAA,QACvC,YAAY,SAAS,cAAc,MAAM;AAAA,QACzC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,aAAa,QAAQ;AAAA,EACvE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,qDAAqD;AAAA,EACjF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,eAAe,QAAQ;AAAA,EACzE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,uDAAuD;AAAA,EACnF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAC1F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,qBAAqB,CAAC;AAAA,MACvF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAC1F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Time entry tag assignment (T3.4) \u2014 the tag list of the entry form on screen 8\n * and the badges the entries list of screen 10 renders.\n *\n * Mirrors the task endpoint: `POST` adds, `DELETE` removes, both idempotent, and\n * both filter through `resolveProjectAccess` before the entry is even loaded. An\n * entry frozen in a closed report is refused by the command with `409`.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeEntryTagAssignmentSchema,\n  type StaffTimeEntryTagAssignmentInput,\n} from '../../../../data/validators'\nimport { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { loadTagProjectAccess, requireAccessibleTimeEntry, type TagAssignmentScope } from '../access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags/entry-assignments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.entryTag\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nconst assignResponseSchema = z.object({\n  timeEntryId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  assignedTagIds: z.array(z.string().uuid()),\n  alreadyAssignedTagIds: z.array(z.string().uuid()),\n})\n\nconst unassignResponseSchema = z.object({\n  timeEntryId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  removedTagIds: z.array(z.string().uuid()),\n  notAssignedTagIds: z.array(z.string().uuid()),\n})\n\ntype AssignmentResult = {\n  targetId: string\n  assignedTagIds: string[]\n  alreadyAssignedTagIds: string[]\n  tagIds: string[]\n}\n\ntype UnassignmentResult = {\n  targetId: string\n  removedTagIds: string[]\n  notAssignedTagIds: string[]\n  tagIds: string[]\n}\n\nasync function buildContext(\n  req: Request,\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction requireAssignmentScope(\n  ctx: CommandRuntimeContext,\n  translate: (key: string, fallback?: string) => string,\n): TagAssignmentScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const userId = ctx.auth?.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return { tenantId, organizationId, userId }\n}\n\nasync function handle(req: Request, commandId: string, operation: 'create' | 'delete'): Promise<Response> {\n  const { ctx, translate } = await buildContext(req)\n  const scope = requireAssignmentScope(ctx, translate)\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: operation === 'create' ? 'POST' : 'DELETE',\n    scope: {\n      container: ctx.container,\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    body: await readJsonSafe<Record<string, unknown>>(req, {}),\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const input = parseScopedCommandInput(staffTimeEntryTagAssignmentSchema, session.body, ctx, translate)\n\n  const access = await loadTagProjectAccess(ctx.container, scope)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTimeEntry(em, input.timeEntryId, scope, access, translate)\n\n  const guardResult = await runStaffMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.timeEntryId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n      status: guardResult.errorStatus ?? 422,\n    })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { result, logEntry } = await commandBus.execute<\n    StaffTimeEntryTagAssignmentInput,\n    AssignmentResult | UnassignmentResult\n  >(commandId, { input, ctx })\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.timeEntryId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  // A tag write is a change to the entry itself, so it travels as the entry's own\n  // `updated` event rather than an assignment-shaped one no subscriber knows about.\n  void emitStaffEvent('staff.timesheets.time_entry.updated', {\n    id: input.timeEntryId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_entry.updated failed', { err })\n  })\n\n  const assignment = result as AssignmentResult | undefined\n  const unassignment = result as UnassignmentResult | undefined\n  const payload =\n    operation === 'create'\n      ? {\n          timeEntryId: input.timeEntryId,\n          tagIds: assignment?.tagIds ?? [],\n          assignedTagIds: assignment?.assignedTagIds ?? [],\n          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],\n        }\n      : {\n          timeEntryId: input.timeEntryId,\n          tagIds: unassignment?.tagIds ?? [],\n          removedTagIds: unassignment?.removedTagIds ?? [],\n          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],\n        }\n\n  const response = await session.respond(200, payload)\n  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n    response.headers.set(\n      'x-om-operation',\n      serializeOperationMetadata({\n        id: logEntry.id,\n        undoToken: logEntry.undoToken,\n        commandId: logEntry.commandId,\n        actionLabel: logEntry.actionLabel ?? null,\n        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n        resourceId: logEntry.resourceId ?? input.timeEntryId,\n        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n      }),\n    )\n  }\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.assignEntry, 'create')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.entry-assignments.POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.unassignEntry, 'delete')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.entry-assignments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Time entry tag assignments',\n  methods: {\n    POST: {\n      summary: 'Assign tags to a time entry',\n      description:\n        'Adds tags to a time entry. Idempotent \u2014 a tag the entry already carries comes back in alreadyAssignedTagIds. Refused with 404 when the entry is outside the caller\\'s project access, and with 409 when it is locked in a closed report.',\n      requestBody: { contentType: 'application/json', schema: staffTimeEntryTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Time entry not found or not accessible' },\n        { status: 409, description: 'Time entry locked in a closed report' },\n        { status: 422, description: 'Unknown tag ids' },\n      ],\n    },\n    DELETE: {\n      summary: 'Unassign tags from a time entry',\n      description:\n        'Removes tags from a time entry. Idempotent \u2014 a tag the entry does not carry comes back in notAssignedTagIds.',\n      requestBody: { contentType: 'application/json', schema: staffTimeEntryTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Time entry not found or not accessible' },\n        { status: 409, description: 'Time entry locked in a closed report' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAQA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,kCAA2D;AAE1F,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,wCAAwC,CAAC;AAEjG,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC9C,CAAC;AAgBD,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,uBACP,KACA,WACoB;AACpB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,SAAS,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO;AAC5C;AAEA,eAAe,OAAO,KAAc,WAAmB,WAAmD;AACxG,QAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,QAAM,QAAQ,uBAAuB,KAAK,SAAS;AAEnD,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ,cAAc,WAAW,SAAS;AAAA,IAC1C,OAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,EAC3D,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,QAAQ,wBAAwB,mCAAmC,QAAQ,MAAM,KAAK,SAAS;AAErG,QAAM,SAAS,MAAM,qBAAqB,IAAI,WAAW,KAAK;AAC9D,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,2BAA2B,IAAI,MAAM,aAAa,OAAO,QAAQ,SAAS;AAEhF,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,MACzF,QAAQ,YAAY,eAAe;AAAA,IACrC,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,WAAW,EAAE,OAAO,IAAI,CAAC;AAE3B,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAIA,OAAK,eAAe,uCAAuC;AAAA,IACzD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,mDAAmD,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,aAAa;AACnB,QAAM,eAAe;AACrB,QAAM,UACJ,cAAc,WACV;AAAA,IACE,aAAa,MAAM;AAAA,IACnB,QAAQ,YAAY,UAAU,CAAC;AAAA,IAC/B,gBAAgB,YAAY,kBAAkB,CAAC;AAAA,IAC/C,uBAAuB,YAAY,yBAAyB,CAAC;AAAA,EAC/D,IACA;AAAA,IACE,aAAa,MAAM;AAAA,IACnB,QAAQ,cAAc,UAAU,CAAC;AAAA,IACjC,eAAe,cAAc,iBAAiB,CAAC;AAAA,IAC/C,mBAAmB,cAAc,qBAAqB,CAAC;AAAA,EACzD;AAEN,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,OAAO;AACnD,MAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,2BAA2B;AAAA,QACzB,IAAI,SAAS;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS,eAAe;AAAA,QACrC,cAAc,SAAS,gBAAgB;AAAA,QACvC,YAAY,SAAS,cAAc,MAAM;AAAA,QACzC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,aAAa,QAAQ;AAAA,EACvE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,qDAAqD;AAAA,EACjF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,eAAe,QAAQ;AAAA,EACzE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,uDAAuD;AAAA,EACnF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAC1F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,qBAAqB,CAAC;AAAA,MACvF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kCAAkC;AAAA,MAC1F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/tags/task-assignments/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -50,7 +51,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/staff/api/timesheets/tags/task-assignments/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/staff/api/timesheets/tags/task-assignments/route.ts"],
-  "sourcesContent": ["/**\n * Task tag assignment (T3.4) \u2014 the \"Dodaj tag\" chip in the task drawer of screen\n * 7 and the badges on the board cards of screen 6.\n *\n * `POST` adds the tags, `DELETE` removes them; both are idempotent, so the drawer\n * can re-send its chip list without special-casing what was already there.\n *\n * Every call resolves the caller's project access before it touches the task \u2014\n * see `../access.ts` for why that lookup and the 404 are shaped the way they are.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskTagAssignmentSchema,\n  type StaffTimeTaskTagAssignmentInput,\n} from '../../../../data/validators'\nimport { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { loadTagProjectAccess, requireAccessibleTask, type TagAssignmentScope } from '../access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags/task-assignments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.taskTag\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nconst assignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  assignedTagIds: z.array(z.string().uuid()),\n  alreadyAssignedTagIds: z.array(z.string().uuid()),\n})\n\nconst unassignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  removedTagIds: z.array(z.string().uuid()),\n  notAssignedTagIds: z.array(z.string().uuid()),\n})\n\ntype AssignmentResult = {\n  targetId: string\n  assignedTagIds: string[]\n  alreadyAssignedTagIds: string[]\n  tagIds: string[]\n}\n\ntype UnassignmentResult = {\n  targetId: string\n  removedTagIds: string[]\n  notAssignedTagIds: string[]\n  tagIds: string[]\n}\n\nasync function buildContext(\n  req: Request,\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction requireAssignmentScope(\n  ctx: CommandRuntimeContext,\n  translate: (key: string, fallback?: string) => string,\n): TagAssignmentScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const userId = ctx.auth?.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return { tenantId, organizationId, userId }\n}\n\nasync function handle(\n  req: Request,\n  commandId: string,\n  operation: 'create' | 'delete',\n): Promise<Response> {\n  const { ctx, translate } = await buildContext(req)\n  const scope = requireAssignmentScope(ctx, translate)\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: operation === 'create' ? 'POST' : 'DELETE',\n    scope: {\n      container: ctx.container,\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    body: await readJsonSafe<Record<string, unknown>>(req, {}),\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const input = parseScopedCommandInput(staffTimeTaskTagAssignmentSchema, session.body, ctx, translate)\n\n  const access = await loadTagProjectAccess(ctx.container, scope)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, input.taskId, scope, access, translate)\n\n  const guardResult = await runStaffMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n      status: guardResult.errorStatus ?? 422,\n    })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { result, logEntry } = await commandBus.execute<\n    StaffTimeTaskTagAssignmentInput,\n    AssignmentResult | UnassignmentResult\n  >(commandId, { input, ctx })\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  // A tag write is a change to the task itself, so it travels as the task's own\n  // `updated` event rather than an assignment-shaped one no subscriber knows about.\n  void emitStaffEvent('staff.timesheets.time_task.updated', {\n    id: input.taskId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_task.updated failed', { err })\n  })\n\n  const assignment = result as AssignmentResult | undefined\n  const unassignment = result as UnassignmentResult | undefined\n  const payload =\n    operation === 'create'\n      ? {\n          taskId: input.taskId,\n          tagIds: assignment?.tagIds ?? [],\n          assignedTagIds: assignment?.assignedTagIds ?? [],\n          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],\n        }\n      : {\n          taskId: input.taskId,\n          tagIds: unassignment?.tagIds ?? [],\n          removedTagIds: unassignment?.removedTagIds ?? [],\n          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],\n        }\n\n  const response = await session.respond(200, payload)\n  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n    response.headers.set(\n      'x-om-operation',\n      serializeOperationMetadata({\n        id: logEntry.id,\n        undoToken: logEntry.undoToken,\n        commandId: logEntry.commandId,\n        actionLabel: logEntry.actionLabel ?? null,\n        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n        resourceId: logEntry.resourceId ?? input.taskId,\n        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n      }),\n    )\n  }\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.assignTask, 'create')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.unassignTask, 'delete')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task tag assignments',\n  methods: {\n    POST: {\n      summary: 'Assign tags to a task',\n      description:\n        'Adds tags to a task. Idempotent \u2014 a tag the task already carries comes back in alreadyAssignedTagIds instead of failing. Refused with 404 when the task is outside the caller\\'s project access.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n        { status: 422, description: 'Unknown tag ids' },\n      ],\n    },\n    DELETE: {\n      summary: 'Unassign tags from a task',\n      description:\n        'Removes tags from a task. Idempotent \u2014 a tag the task does not carry comes back in notAssignedTagIds instead of failing.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAUA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,6BAAsD;AAErF,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC9C,CAAC;AAgBD,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,uBACP,KACA,WACoB;AACpB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,SAAS,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO;AAC5C;AAEA,eAAe,OACb,KACA,WACA,WACmB;AACnB,QAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,QAAM,QAAQ,uBAAuB,KAAK,SAAS;AAEnD,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ,cAAc,WAAW,SAAS;AAAA,IAC1C,OAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,EAC3D,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,QAAQ,wBAAwB,kCAAkC,QAAQ,MAAM,KAAK,SAAS;AAEpG,QAAM,SAAS,MAAM,qBAAqB,IAAI,WAAW,KAAK;AAC9D,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,sBAAsB,IAAI,MAAM,QAAQ,OAAO,QAAQ,SAAS;AAEtE,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,MACzF,QAAQ,YAAY,eAAe;AAAA,IACrC,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,WAAW,EAAE,OAAO,IAAI,CAAC;AAE3B,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAIA,OAAK,eAAe,sCAAsC;AAAA,IACxD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,EACxE,CAAC;AAED,QAAM,aAAa;AACnB,QAAM,eAAe;AACrB,QAAM,UACJ,cAAc,WACV;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,YAAY,UAAU,CAAC;AAAA,IAC/B,gBAAgB,YAAY,kBAAkB,CAAC;AAAA,IAC/C,uBAAuB,YAAY,yBAAyB,CAAC;AAAA,EAC/D,IACA;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,cAAc,UAAU,CAAC;AAAA,IACjC,eAAe,cAAc,iBAAiB,CAAC;AAAA,IAC/C,mBAAmB,cAAc,qBAAqB,CAAC;AAAA,EACzD;AAEN,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,OAAO;AACnD,MAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,2BAA2B;AAAA,QACzB,IAAI,SAAS;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS,eAAe;AAAA,QACrC,cAAc,SAAS,gBAAgB;AAAA,QACvC,YAAY,SAAS,cAAc,MAAM;AAAA,QACzC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,YAAY,QAAQ;AAAA,EACtE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,oDAAoD;AAAA,EAChF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,cAAc,QAAQ;AAAA,EACxE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,sDAAsD;AAAA,EAClF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,qBAAqB,CAAC;AAAA,MACvF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Task tag assignment (T3.4) \u2014 the \"Dodaj tag\" chip in the task drawer of screen\n * 7 and the badges on the board cards of screen 6.\n *\n * `POST` adds the tags, `DELETE` removes them; both are idempotent, so the drawer\n * can re-send its chip list without special-casing what was already there.\n *\n * Every call resolves the caller's project access before it touches the task \u2014\n * see `../access.ts` for why that lookup and the 404 are shaped the way they are.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { emitStaffEvent } from '../../../../events'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'\nimport {\n  staffTimeTaskTagAssignmentSchema,\n  type StaffTimeTaskTagAssignmentInput,\n} from '../../../../data/validators'\nimport { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'\nimport {\n  STAFF_TIME_TRACKING_RESOURCE_KINDS,\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../../guards'\nimport { loadTagProjectAccess, requireAccessibleTask, type TagAssignmentScope } from '../access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tags/task-assignments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.taskTag\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },\n}\n\nconst assignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  assignedTagIds: z.array(z.string().uuid()),\n  alreadyAssignedTagIds: z.array(z.string().uuid()),\n})\n\nconst unassignResponseSchema = z.object({\n  taskId: z.string().uuid(),\n  tagIds: z.array(z.string().uuid()),\n  removedTagIds: z.array(z.string().uuid()),\n  notAssignedTagIds: z.array(z.string().uuid()),\n})\n\ntype AssignmentResult = {\n  targetId: string\n  assignedTagIds: string[]\n  alreadyAssignedTagIds: string[]\n  tagIds: string[]\n}\n\ntype UnassignmentResult = {\n  targetId: string\n  removedTagIds: string[]\n  notAssignedTagIds: string[]\n  tagIds: string[]\n}\n\nasync function buildContext(\n  req: Request,\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nfunction requireAssignmentScope(\n  ctx: CommandRuntimeContext,\n  translate: (key: string, fallback?: string) => string,\n): TagAssignmentScope {\n  const tenantId = ctx.auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const userId = ctx.auth?.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n  return { tenantId, organizationId, userId }\n}\n\nasync function handle(\n  req: Request,\n  commandId: string,\n  operation: 'create' | 'delete',\n): Promise<Response> {\n  const { ctx, translate } = await buildContext(req)\n  const scope = requireAssignmentScope(ctx, translate)\n\n  const interceptors = await runTimesheetInterceptors({\n    request: req,\n    method: operation === 'create' ? 'POST' : 'DELETE',\n    scope: {\n      container: ctx.container,\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    body: await readJsonSafe<Record<string, unknown>>(req, {}),\n  })\n  if (!interceptors.ok) return interceptors.response\n  const { session } = interceptors\n\n  const input = parseScopedCommandInput(staffTimeTaskTagAssignmentSchema, session.body, ctx, translate)\n\n  const access = await loadTagProjectAccess(ctx.container, scope)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, input.taskId, scope, access, translate)\n\n  const guardResult = await runStaffMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input,\n    },\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n      status: guardResult.errorStatus ?? 422,\n    })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { result, logEntry } = await commandBus.execute<\n    StaffTimeTaskTagAssignmentInput,\n    AssignmentResult | UnassignmentResult\n  >(commandId, { input, ctx })\n\n  if (guardResult.afterSuccessCallbacks.length) {\n    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: input.taskId,\n      operation,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n  }\n\n  // A tag write is a change to the task itself, so it travels as the task's own\n  // `updated` event rather than an assignment-shaped one no subscriber knows about.\n  void emitStaffEvent('staff.timesheets.time_task.updated', {\n    id: input.taskId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  }, { persistent: true }).catch((err) => {\n    logger.error('staff.timesheets emit time_task.updated failed', { err })\n  })\n\n  const assignment = result as AssignmentResult | undefined\n  const unassignment = result as UnassignmentResult | undefined\n  const payload =\n    operation === 'create'\n      ? {\n          taskId: input.taskId,\n          tagIds: assignment?.tagIds ?? [],\n          assignedTagIds: assignment?.assignedTagIds ?? [],\n          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],\n        }\n      : {\n          taskId: input.taskId,\n          tagIds: unassignment?.tagIds ?? [],\n          removedTagIds: unassignment?.removedTagIds ?? [],\n          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],\n        }\n\n  const response = await session.respond(200, payload)\n  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n    response.headers.set(\n      'x-om-operation',\n      serializeOperationMetadata({\n        id: logEntry.id,\n        undoToken: logEntry.undoToken,\n        commandId: logEntry.commandId,\n        actionLabel: logEntry.actionLabel ?? null,\n        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n        resourceId: logEntry.resourceId ?? input.taskId,\n        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n      }),\n    )\n  }\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.assignTask, 'create')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    return await handle(req, staffTimeTagCommandIds.unassignTask, 'delete')\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tags.task-assignments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task tag assignments',\n  methods: {\n    POST: {\n      summary: 'Assign tags to a task',\n      description:\n        'Adds tags to a task. Idempotent \u2014 a tag the task already carries comes back in alreadyAssignedTagIds instead of failing. Refused with 404 when the task is outside the caller\\'s project access.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n        { status: 422, description: 'Unknown tag ids' },\n      ],\n    },\n    DELETE: {\n      summary: 'Unassign tags from a task',\n      description:\n        'Removes tags from a task. Idempotent \u2014 a tag the task does not carry comes back in notAssignedTagIds instead of failing.',\n      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },\n      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or missing organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAE/B,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,6BAAsD;AAErF,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,uCAAuC,CAAC;AAEhG,MAAM,gBAAgB,mCAAmC;AAElD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACzC,uBAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACjC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC9C,CAAC;AAgBD,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,SAAS,uBACP,KACA,WACoB;AACpB,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,SAAS,IAAI,MAAM,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,gBAAgB,OAAO;AAC5C;AAEA,eAAe,OACb,KACA,WACA,WACmB;AACnB,QAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,QAAM,QAAQ,uBAAuB,KAAK,SAAS;AAEnD,QAAM,eAAe,MAAM,yBAAyB;AAAA,IAClD,SAAS;AAAA,IACT,QAAQ,cAAc,WAAW,SAAS;AAAA,IAC1C,OAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC;AAAA,EAC3D,CAAC;AACD,MAAI,CAAC,aAAa,GAAI,QAAO,aAAa;AAC1C,QAAM,EAAE,QAAQ,IAAI;AAEpB,QAAM,QAAQ,wBAAwB,kCAAkC,QAAQ,MAAM,KAAK,SAAS;AAEpG,QAAM,SAAS,MAAM,qBAAqB,IAAI,WAAW,KAAK;AAC9D,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,sBAAsB,IAAI,MAAM,QAAQ,OAAO,QAAQ,SAAS;AAEtE,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,MACzF,QAAQ,YAAY,eAAe;AAAA,IACrC,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,WAAW,EAAE,OAAO,IAAI,CAAC;AAE3B,MAAI,YAAY,sBAAsB,QAAQ;AAC5C,UAAM,kCAAkC,YAAY,uBAAuB;AAAA,MACzE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB;AAAA,MACA,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAIA,OAAK,eAAe,sCAAsC;AAAA,IACxD,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,CAAC,QAAQ;AACtC,WAAO,MAAM,kDAAkD,EAAE,IAAI,CAAC;AAAA,EACxE,CAAC;AAED,QAAM,aAAa;AACnB,QAAM,eAAe;AACrB,QAAM,UACJ,cAAc,WACV;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,YAAY,UAAU,CAAC;AAAA,IAC/B,gBAAgB,YAAY,kBAAkB,CAAC;AAAA,IAC/C,uBAAuB,YAAY,yBAAyB,CAAC;AAAA,EAC/D,IACA;AAAA,IACE,QAAQ,MAAM;AAAA,IACd,QAAQ,cAAc,UAAU,CAAC;AAAA,IACjC,eAAe,cAAc,iBAAiB,CAAC;AAAA,IAC/C,mBAAmB,cAAc,qBAAqB,CAAC;AAAA,EACzD;AAEN,QAAM,WAAW,MAAM,QAAQ,QAAQ,KAAK,OAAO;AACnD,MAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,2BAA2B;AAAA,QACzB,IAAI,SAAS;AAAA,QACb,WAAW,SAAS;AAAA,QACpB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS,eAAe;AAAA,QACrC,cAAc,SAAS,gBAAgB;AAAA,QACvC,YAAY,SAAS,cAAc,MAAM;AAAA,QACzC,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,YAAY,QAAQ;AAAA,EACtE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,oDAAoD;AAAA,EAChF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,WAAO,MAAM,OAAO,KAAK,uBAAuB,cAAc,QAAQ;AAAA,EACxE,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,sDAAsD;AAAA,EAClF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,qBAAqB,CAAC;AAAA,MACvF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,kBAAkB;AAAA,MAChD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iCAAiC;AAAA,MACzF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,uBAAuB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/tasks/[id]/comments/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -82,7 +83,7 @@ async function buildRouteContext(req) {
     container,
     auth,
     organizationScope,
-    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,
     organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };