create-crm-starter 0.1.0

package/template/extras/mobile/mobile/eas.json

@@ -0,0 +1,22 @@
+{
+  "cli": {
+    "version": ">= 5.0.0",
+    "appVersionSource": "remote"
+  },
+  "build": {
+    "development": {
+      "developmentClient": true,
+      "distribution": "internal"
+    },
+    "preview": {
+      "distribution": "internal",
+      "ios": { "simulator": false }
+    },
+    "production": {
+      "autoIncrement": true
+    }
+  },
+  "submit": {
+    "production": {}
+  }
+}

package/template/extras/mobile/mobile/lib/api.ts

@@ -0,0 +1,253 @@
+import { apiBaseUrl, getToken } from './auth';
+
+/** Shapes returned by the /api/mobile/v1 endpoints (kept in sync by hand). */
+export interface ApiJob {
+  id: string;
+  customerId: string;
+  customerName: string;
+  serviceType: string;
+  status: string;
+  priority: string;
+  scheduledAt?: string;
+  arrivalWindow?: string;
+  assigneeIds: string[];
+  lineItems: { description: string; qty: number; unitPrice: number }[];
+  total: number;
+  notes?: string;
+}
+
+export interface ApiAddress {
+  line1: string;
+  line2?: string;
+  city: string;
+  state: string;
+  postalCode: string;
+}
+
+export interface ApiCustomer {
+  id: string;
+  name: string;
+  phones: string[];
+  emails: string[];
+  serviceAddresses: ApiAddress[];
+}
+
+export interface ApiAttachment {
+  id: string;
+  url: string;
+  kind: string;
+  contentType: string;
+  sizeBytes: number;
+  uploadedAt: string;
+}
+
+export interface ApiChecklistItem {
+  id: string;
+  label: string;
+  kind: string;
+  required: boolean;
+  completed: boolean;
+  value?: string;
+}
+
+export interface ApiChecklist {
+  id: string;
+  templateName: string;
+  items: ApiChecklistItem[];
+  allRequiredComplete: boolean;
+  progressPct: number;
+}
+
+export interface ApiTimeState {
+  entries: { id: string; clockIn: string; clockOut: string | null }[];
+  openEntryId: string | null;
+}
+
+export interface ApiInvoiceLine {
+  description: string;
+  qty: number;
+  unitPrice: number;
+}
+
+export interface ApiInvoice {
+  id: string;
+  invoiceNumber: string;
+  status: string;
+  lineItems: ApiInvoiceLine[];
+  total: number;
+  amountPaid: number;
+  amountDue: number;
+  payments: { id: string; amount: number; method: string; recordedAt: string }[];
+}
+
+export interface ApiPriceBookItem {
+  id: string;
+  name: string;
+  unitPrice: number;
+  unitCost: number;
+  defaultQty: number;
+}
+
+export interface ApiPriceBookCategory {
+  id: string;
+  name: string;
+  items: ApiPriceBookItem[];
+}
+
+export interface ApiThread {
+  customerId: string;
+  customerName: string;
+  customerPhone: string;
+  lastBody: string;
+  lastAt: string;
+}
+
+export interface ApiMessage {
+  id: string;
+  direction: 'inbound' | 'outbound';
+  body: string;
+  createdAt: string;
+}
+
+export interface ApiError extends Error {
+  status?: number;
+}
+
+async function request<T>(path: string, init?: RequestInit): Promise<T> {
+  const token = await getToken();
+  const res = await fetch(`${apiBaseUrl}${path}`, {
+    ...init,
+    headers: {
+      Accept: 'application/json',
+      ...(init?.body ? { 'Content-Type': 'application/json' } : {}),
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      ...(init?.headers ?? {}),
+    },
+  });
+  if (!res.ok) {
+    const err: ApiError = new Error(`Request failed (${res.status})`);
+    err.status = res.status;
+    throw err;
+  }
+  return (await res.json()) as T;
+}
+
+export const api = {
+  me: () =>
+    request<{ user: { id: string; email: string; name: string | null; role: string }; business: { name: string; phone?: string; brand: { primary: string; accent: string } } }>(
+      '/api/mobile/v1/me',
+    ),
+  jobs: (scope: 'today' | 'mine' | 'all' = 'today') =>
+    request<{ jobs: ApiJob[] }>(`/api/mobile/v1/jobs?scope=${scope}`),
+  job: (id: string) =>
+    request<{ job: ApiJob; attachments: ApiAttachment[]; customer: ApiCustomer | null }>(
+      `/api/mobile/v1/jobs/${id}`,
+    ),
+  setStatus: (id: string, status: string) =>
+    request<{ ok: true; status: string }>(`/api/mobile/v1/jobs/${id}/status`, {
+      method: 'POST',
+      body: JSON.stringify({ status }),
+    }),
+  signUpload: (jobId: string, contentType: string, ext?: string) =>
+    request<{ uploadUrl: string; key: string; publicUrl: string }>(
+      '/api/mobile/v1/uploads/sign',
+      { method: 'POST', body: JSON.stringify({ jobId, contentType, ext }) },
+    ),
+  recordAttachment: (
+    jobId: string,
+    body: { key: string; url: string; kind: string; contentType: string; sizeBytes: number },
+  ) =>
+    request<{ attachment: { id: string; url: string; kind: string } }>(
+      `/api/mobile/v1/jobs/${jobId}/attachments`,
+      { method: 'POST', body: JSON.stringify(body) },
+    ),
+  registerDevice: (token: string, platform = 'ios') =>
+    request<{ ok: true }>('/api/mobile/v1/devices', {
+      method: 'POST',
+      body: JSON.stringify({ token, platform }),
+    }),
+
+  // --- Checklists + time tracking ---
+  checklists: (jobId: string) =>
+    request<{ checklists: ApiChecklist[] }>(`/api/mobile/v1/jobs/${jobId}/checklists`),
+  setChecklistItem: (
+    jobId: string,
+    body: { jobChecklistId: string; itemId: string; completed?: boolean; value?: string },
+  ) =>
+    request<{ ok: true }>(`/api/mobile/v1/jobs/${jobId}/checklists/item`, {
+      method: 'POST',
+      body: JSON.stringify(body),
+    }),
+  time: (jobId: string) => request<ApiTimeState>(`/api/mobile/v1/jobs/${jobId}/time`),
+  clockIn: (jobId: string) =>
+    request<{ entryId: string }>(`/api/mobile/v1/jobs/${jobId}/time/clock-in`, { method: 'POST', body: '{}' }),
+  clockOut: (jobId: string) =>
+    request<{ ok: true }>(`/api/mobile/v1/jobs/${jobId}/time/clock-out`, { method: 'POST', body: '{}' }),
+
+  // --- Invoices + payment ---
+  jobInvoice: (jobId: string) =>
+    request<{ invoice: ApiInvoice | null; payPath?: string }>(`/api/mobile/v1/jobs/${jobId}/invoice`),
+  createInvoiceFromJob: (jobId: string) =>
+    request<{ invoiceId: string; publicToken: string; payPath: string }>(
+      `/api/mobile/v1/jobs/${jobId}/invoice`,
+      { method: 'POST', body: '{}' },
+    ),
+  invoice: (id: string) =>
+    request<{ invoice: ApiInvoice; payPath: string | null }>(`/api/mobile/v1/invoices/${id}`),
+  recordPayment: (invoiceId: string, body: { amount: number; method: string; note?: string }) =>
+    request<{ ok: true }>(`/api/mobile/v1/invoices/${invoiceId}/payments`, {
+      method: 'POST',
+      body: JSON.stringify(body),
+    }),
+
+  // --- Estimate builder ---
+  priceBook: () => request<{ categories: ApiPriceBookCategory[] }>('/api/mobile/v1/price-book'),
+  createEstimate: (body: {
+    customerId: string;
+    lineItems: { description: string; qty: number; unitPrice: number; unitCost?: number }[];
+    notes?: string;
+  }) =>
+    request<{ estimateId: string }>('/api/mobile/v1/estimates', {
+      method: 'POST',
+      body: JSON.stringify(body),
+    }),
+
+  // --- SMS inbox ---
+  smsThreads: () => request<{ threads: ApiThread[] }>('/api/mobile/v1/sms/threads'),
+  smsMessages: (customerId: string) =>
+    request<{ messages: ApiMessage[] }>(`/api/mobile/v1/sms/threads/${customerId}`),
+  sendSms: (body: { to: string; body: string; customerId?: string }) =>
+    request<{ ok: true }>('/api/mobile/v1/sms/send', { method: 'POST', body: JSON.stringify(body) }),
+};
+
+/**
+ * Uploads a local file URI to R2 via a presigned URL, then records the
+ * attachment row. Returns the public URL.
+ */
+export async function uploadJobPhoto(
+  jobId: string,
+  fileUri: string,
+  contentType: string,
+  kind: 'photo' | 'signature' = 'photo',
+): Promise<string> {
+  const ext = contentType.split('/')[1] ?? 'jpg';
+  const { uploadUrl, key, publicUrl } = await api.signUpload(jobId, contentType, ext);
+
+  const fileRes = await fetch(fileUri);
+  const blob = await fileRes.blob();
+  const put = await fetch(uploadUrl, {
+    method: 'PUT',
+    headers: { 'Content-Type': contentType },
+    body: blob,
+  });
+  if (!put.ok) throw new Error(`Upload failed (${put.status})`);
+
+  await api.recordAttachment(jobId, {
+    key,
+    url: publicUrl,
+    kind,
+    contentType,
+    sizeBytes: (blob as { size?: number }).size ?? 0,
+  });
+  return publicUrl;
+}

package/template/extras/mobile/mobile/lib/auth.ts

@@ -0,0 +1,51 @@
+import * as SecureStore from 'expo-secure-store';
+
+const TOKEN_KEY = 'crm.session.token';
+
+/**
+ * Minimal bearer-token auth against the CRM's Better-Auth endpoints. The
+ * server has the bearer() plugin enabled (added by the mobile-api installer),
+ * so sign-in returns a session token in the `set-auth-token` response header.
+ * We stash it in the device keychain and send it as `Authorization: Bearer
+ * <token>` on every API call.
+ */
+export const apiBaseUrl = (process.env.EXPO_PUBLIC_API_URL ?? '').replace(/\/+$/, '');
+
+export async function getToken(): Promise<string | null> {
+  return SecureStore.getItemAsync(TOKEN_KEY);
+}
+
+async function setToken(token: string): Promise<void> {
+  await SecureStore.setItemAsync(TOKEN_KEY, token);
+}
+
+export async function clearToken(): Promise<void> {
+  await SecureStore.deleteItemAsync(TOKEN_KEY);
+}
+
+export async function signIn(email: string, password: string): Promise<void> {
+  const res = await fetch(`${apiBaseUrl}/api/auth/sign-in/email`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ email, password }),
+  });
+  if (!res.ok) {
+    const msg = await res.text().catch(() => '');
+    throw new Error(msg || `Sign-in failed (${res.status})`);
+  }
+  // Better-Auth bearer plugin returns the token in this header.
+  const token = res.headers.get('set-auth-token');
+  if (!token) throw new Error('No session token returned. Is the mobile-api enabled on the server?');
+  await setToken(token);
+}
+
+export async function signOut(): Promise<void> {
+  const token = await getToken();
+  if (token) {
+    await fetch(`${apiBaseUrl}/api/auth/sign-out`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}` },
+    }).catch(() => {});
+  }
+  await clearToken();
+}

package/template/extras/mobile/mobile/lib/format.ts

@@ -0,0 +1,23 @@
+import { Platform } from 'react-native';
+import type { ApiAddress } from './api';
+
+export function money(cents: number): string {
+  return `$${(cents / 100).toLocaleString('en-US', { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;
+}
+
+export function formatAddress(a?: ApiAddress | null): string {
+  if (!a) return '';
+  return [a.line1, a.line2, `${a.city}, ${a.state} ${a.postalCode}`].filter(Boolean).join(', ');
+}
+
+/** Deep link that opens the platform's Maps app with directions. */
+export function mapsUrl(a?: ApiAddress | null): string {
+  const q = encodeURIComponent(formatAddress(a));
+  return Platform.OS === 'ios'
+    ? `http://maps.apple.com/?daddr=${q}`
+    : `https://www.google.com/maps/dir/?api=1&destination=${q}`;
+}
+
+export function statusLabel(status: string): string {
+  return status.replace(/_/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
+}

package/template/extras/mobile/mobile/lib/push.ts

@@ -0,0 +1,24 @@
+import * as Notifications from 'expo-notifications';
+import { Platform } from 'react-native';
+import { api } from './api';
+
+/**
+ * Asks for push permission, gets the Expo push token, and registers it with
+ * the CRM so the server can notify this tech of new job assignments. Safe to
+ * call on every login — best-effort, never throws.
+ */
+export async function registerForPush(): Promise<void> {
+  try {
+    const { status: existing } = await Notifications.getPermissionsAsync();
+    let status = existing;
+    if (status !== 'granted') {
+      status = (await Notifications.requestPermissionsAsync()).status;
+    }
+    if (status !== 'granted') return;
+
+    const tokenData = await Notifications.getExpoPushTokenAsync();
+    await api.registerDevice(tokenData.data, Platform.OS);
+  } catch (err) {
+    console.warn('[push] registration skipped:', err);
+  }
+}

package/template/extras/mobile/mobile/lib/theme.ts

@@ -0,0 +1,16 @@
+import { brand } from '../app.brand';
+
+/** App color palette, driven by the per-client brand colors. */
+export const theme = {
+  primary: brand.primaryColor,
+  accent: brand.accentColor,
+  bg: '#f8fafc',
+  card: '#ffffff',
+  text: '#0f172a',
+  muted: '#64748b',
+  border: '#e2e8f0',
+  danger: '#dc2626',
+  success: '#16a34a',
+} as const;
+
+export const appName = brand.name;

package/template/extras/mobile/mobile/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "crm-mobile",
+  "version": "0.1.0",
+  "private": true,
+  "main": "expo-router/entry",
+  "scripts": {
+    "start": "expo start",
+    "ios": "expo start --ios",
+    "android": "expo start --android",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "expo": "~53.0.0",
+    "expo-constants": "~17.1.3",
+    "expo-image-picker": "~16.1.4",
+    "expo-linking": "~7.1.4",
+    "expo-notifications": "~0.31.2",
+    "expo-router": "~5.0.6",
+    "expo-secure-store": "~14.2.3",
+    "expo-status-bar": "~2.2.3",
+    "expo-web-browser": "~14.1.6",
+    "react": "19.0.0",
+    "react-native": "0.79.2",
+    "react-native-safe-area-context": "5.4.0",
+    "react-native-screens": "~4.10.0",
+    "react-native-signature-canvas": "^4.7.2",
+    "react-native-webview": "13.13.5",
+    "@tanstack/react-query": "^5.62.0"
+  },
+  "devDependencies": {
+    "@types/react": "~19.0.10",
+    "typescript": "~5.8.3"
+  }
+}

package/template/extras/mobile/mobile/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "expo/tsconfig.base",
+  "compilerOptions": {
+    "strict": true,
+    "skipLibCheck": true,
+    "paths": {
+      "@/*": ["./*"]
+    }
+  },
+  "include": ["**/*.ts", "**/*.tsx", ".expo/types/**/*.ts", "expo-env.d.ts"]
+}

package/template/extras/mobile-api/drizzle/src/app/api/mobile/v1/customers/[id]/route.ts

@@ -0,0 +1,18 @@
+import type { NextRequest } from 'next/server';
+import { getCustomer } from '@/lib/customers/data';
+import { json, jsonError, preflight } from '@/lib/mobile/cors';
+import { requireApiUser } from '@/lib/mobile/guard';
+
+export const dynamic = 'force-dynamic';
+export const OPTIONS = preflight;
+
+/** GET /api/mobile/v1/customers/:id — quick lookup for a job's customer. */
+export async function GET(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const user = await requireApiUser(req, ['technician', 'dispatcher']);
+  if (user instanceof Response) return user;
+
+  const { id } = await params;
+  const customer = await getCustomer(id);
+  if (!customer) return jsonError(404, 'Customer not found');
+  return json({ customer });
+}

package/template/extras/mobile-api/drizzle/src/app/api/mobile/v1/devices/route.ts

@@ -0,0 +1,40 @@
+import type { NextRequest } from 'next/server';
+import { eq } from 'drizzle-orm';
+import { db } from '@/db/client';
+import { pushTokens } from '@/db/schema';
+import { json, jsonError, preflight } from '@/lib/mobile/cors';
+import { requireApiUser } from '@/lib/mobile/guard';
+
+export const dynamic = 'force-dynamic';
+export const OPTIONS = preflight;
+
+/**
+ * POST /api/mobile/v1/devices   body: { token, platform? }
+ * Registers (or re-owns) an Expo push token for the signed-in user. Called
+ * by the app on login after it gets a push permission grant.
+ */
+export async function POST(req: NextRequest) {
+  const user = await requireApiUser(req);
+  if (user instanceof Response) return user;
+
+  const body = (await req.json().catch(() => ({}))) as { token?: string; platform?: string };
+  if (!body.token) return jsonError(400, 'token is required');
+  const platform = body.platform ?? 'ios';
+
+  const existing = await db
+    .select({ id: pushTokens.id })
+    .from(pushTokens)
+    .where(eq(pushTokens.expoToken, body.token))
+    .limit(1);
+
+  if (existing.length > 0) {
+    await db
+      .update(pushTokens)
+      .set({ userId: user.id, platform })
+      .where(eq(pushTokens.expoToken, body.token));
+  } else {
+    await db.insert(pushTokens).values({ userId: user.id, expoToken: body.token, platform });
+  }
+
+  return json({ ok: true });
+}

package/template/extras/mobile-api/drizzle/src/app/api/mobile/v1/jobs/[id]/attachments/route.ts

@@ -0,0 +1,59 @@
+import type { NextRequest } from 'next/server';
+import { revalidatePath } from 'next/cache';
+import { db } from '@/db/client';
+import { jobAttachments } from '@/db/schema';
+import { getJobAttachments } from '@/lib/jobs/photos-actions';
+import { json, jsonError, preflight } from '@/lib/mobile/cors';
+import { requireApiUser } from '@/lib/mobile/guard';
+
+export const dynamic = 'force-dynamic';
+export const OPTIONS = preflight;
+
+/** GET /api/mobile/v1/jobs/:id/attachments — list photos/signatures. */
+export async function GET(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const user = await requireApiUser(req, ['technician', 'dispatcher']);
+  if (user instanceof Response) return user;
+  const { id } = await params;
+  return json({ attachments: await getJobAttachments(id) });
+}
+
+/**
+ * POST /api/mobile/v1/jobs/:id/attachments
+ * body: { key, url, kind?, contentType, sizeBytes?, caption? }
+ * Records an attachment AFTER the app has uploaded the bytes straight to R2
+ * via the presigned URL from POST /uploads/sign. `kind` is 'photo' or
+ * 'signature'.
+ */
+export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const user = await requireApiUser(req, ['technician', 'dispatcher']);
+  if (user instanceof Response) return user;
+
+  const { id } = await params;
+  const body = (await req.json().catch(() => ({}))) as {
+    key?: string;
+    url?: string;
+    kind?: string;
+    contentType?: string;
+    sizeBytes?: number;
+    caption?: string;
+  };
+  if (!body.key || !body.url || !body.contentType) {
+    return jsonError(400, 'key, url and contentType are required');
+  }
+
+  const [row] = await db
+    .insert(jobAttachments)
+    .values({
+      jobId: id,
+      key: body.key,
+      url: body.url,
+      kind: body.kind ?? 'photo',
+      contentType: body.contentType,
+      sizeBytes: body.sizeBytes ?? 0,
+      caption: body.caption ?? null,
+    })
+    .returning();
+
+  revalidatePath(`/jobs/${id}`);
+  return json({ attachment: { id: row.id, url: row.url, kind: row.kind } });
+}

package/template/extras/mobile-api/drizzle/src/app/api/mobile/v1/jobs/[id]/checklists/item/route.ts

@@ -0,0 +1,34 @@
+import type { NextRequest } from 'next/server';
+import { setJobChecklistItem } from '@/lib/checklists/actions';
+import { json, jsonError, preflight } from '@/lib/mobile/cors';
+import { requireApiUser } from '@/lib/mobile/guard';
+
+export const dynamic = 'force-dynamic';
+export const OPTIONS = preflight;
+
+/**
+ * POST /api/mobile/v1/jobs/:id/checklists/item
+ * body: { jobChecklistId, itemId, completed?, value? }
+ * Toggles a checklist item (or records a text answer) from the field.
+ */
+export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const user = await requireApiUser(req, ['technician', 'dispatcher']);
+  if (user instanceof Response) return user;
+  await params; // jobId is implicit in the checklist; validated server-side
+
+  const body = (await req.json().catch(() => ({}))) as {
+    jobChecklistId?: string;
+    itemId?: string;
+    completed?: boolean;
+    value?: string;
+  };
+  if (!body.jobChecklistId || !body.itemId) {
+    return jsonError(400, 'jobChecklistId and itemId are required');
+  }
+
+  await setJobChecklistItem(body.jobChecklistId, body.itemId, {
+    completed: body.completed,
+    value: body.value,
+  });
+  return json({ ok: true });
+}

package/template/extras/mobile-api/drizzle/src/app/api/mobile/v1/jobs/[id]/checklists/route.ts

@@ -0,0 +1,15 @@
+import type { NextRequest } from 'next/server';
+import { getJobChecklists } from '@/lib/checklists/data';
+import { json, preflight } from '@/lib/mobile/cors';
+import { requireApiUser } from '@/lib/mobile/guard';
+
+export const dynamic = 'force-dynamic';
+export const OPTIONS = preflight;
+
+/** GET /api/mobile/v1/jobs/:id/checklists — checklists attached to a job. */
+export async function GET(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const user = await requireApiUser(req, ['technician', 'dispatcher']);
+  if (user instanceof Response) return user;
+  const { id } = await params;
+  return json({ checklists: await getJobChecklists(id) });
+}

package/template/extras/mobile-api/drizzle/src/app/api/mobile/v1/jobs/[id]/route.ts

@@ -0,0 +1,35 @@
+import type { NextRequest } from 'next/server';
+import { getCustomer } from '@/lib/customers/data';
+import { getJob } from '@/lib/jobs/data';
+import { getJobAttachments } from '@/lib/jobs/photos-actions';
+import { json, jsonError, preflight } from '@/lib/mobile/cors';
+import { requireApiUser } from '@/lib/mobile/guard';
+
+export const dynamic = 'force-dynamic';
+export const OPTIONS = preflight;
+
+/**
+ * GET /api/mobile/v1/jobs/:id
+ * Full job detail for the field app: the job, its customer (address +
+ * phone for Navigate / Call), and its photo/signature attachments.
+ */
+export async function GET(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const user = await requireApiUser(req, ['technician', 'dispatcher']);
+  if (user instanceof Response) return user;
+
+  const { id } = await params;
+  const job = await getJob(id);
+  if (!job) return jsonError(404, 'Job not found');
+
+  // Techs can only open jobs assigned to them.
+  if (user.role === 'technician' && !job.assigneeIds.includes(user.id)) {
+    return jsonError(403, 'Forbidden');
+  }
+
+  const [attachments, customer] = await Promise.all([
+    getJobAttachments(id),
+    getCustomer(job.customerId),
+  ]);
+
+  return json({ job, attachments, customer });
+}

package/template/extras/mobile-api/drizzle/src/app/api/mobile/v1/jobs/[id]/status/route.ts

@@ -0,0 +1,28 @@
+import type { NextRequest } from 'next/server';
+import { setJobStatus } from '@/lib/jobs/actions';
+import { JOB_STATUSES, type JobStatus } from '@/lib/jobs/types';
+import { json, jsonError, preflight } from '@/lib/mobile/cors';
+import { requireApiUser } from '@/lib/mobile/guard';
+
+export const dynamic = 'force-dynamic';
+export const OPTIONS = preflight;
+
+/**
+ * POST /api/mobile/v1/jobs/:id/status   body: { status }
+ * Sets a job's status from the field (Start → in_progress, Complete →
+ * completed). Reuses the same `setJobStatus` action the web app uses.
+ */
+export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const user = await requireApiUser(req, ['technician', 'dispatcher']);
+  if (user instanceof Response) return user;
+
+  const { id } = await params;
+  const body = (await req.json().catch(() => ({}))) as { status?: string };
+  const status = body.status as JobStatus | undefined;
+  if (!status || !JOB_STATUSES.includes(status)) {
+    return jsonError(400, 'Invalid or missing status');
+  }
+
+  await setJobStatus(id, status);
+  return json({ ok: true, status });
+}