# Tasks

## 1. Shared response contract

- [x] 1.1 In a workspace authorized for `packages/shared`, add exported success/failure envelope, detail, and pagination types while retaining AuthResponse as the auth payload; verify package build/typecheck and valid discriminated-union narrowing in API/client consumers.
- [x] 1.2 Add API envelope helpers and pagination validation/metadata helpers; verify empty results, invalid page inputs, pageSize limits, out-of-range pages, and bodyless success with focused contract tests.
- [x] 1.3 Add explicit serialization utilities where needed for decimal money, UTC instants, and date-only values; verify exact decimal strings and date-only values across timezone boundaries with focused tests, and document wire examples in API source documentation.

## 2. Error handling and correlation

- [x] 2.1 Add request-ID middleware before parsing, consistent response headers, CORS exposure, and structured redacted logging; verify parser failures retain matching header/body/log IDs and incoming IDs or sensitive request data are not trusted or logged.
- [x] 2.2 Implement typed domain errors, an HTTP mapping/catalog with Indonesian messages, safe validation details, and contextual Prisma normalization; verify known conflicts, missing targets, temporary outages, and unknown/programming failures map correctly without leaking diagnostics.
- [x] 2.3 Replace the existing global handler and wire API not-found handling after routes/docs; verify malformed JSON, oversized bodies, 404s, rejected async handlers, and headers-sent delegation with focused tests.
- [x] 2.4 Document the error code/status catalog, message-language rule, and logging policy; verify every implemented public error code is represented and examples satisfy the shared failure type.

## 3. Existing architecture alignment and API migration

- [x] 3.1 Preserve the existing routes/controllers/services/validators/middlewares/config/interfaces layout and config/prisma.ts. Restore auth/Prisma files moved by the interrupted implementation, place new helpers in the existing layer folders, and audit service dependencies and explicit DTO mapping; verify API typecheck and existing authentication behavior tests pass with no modules/http/domain/infrastructure directories.
- [x] 3.2 Convert versioned success responses and direct auth/origin/rate-limit failures to the new envelope; update auth contract tests for 422 field validation, 401/403/429 envelopes, Retry-After, and 204 logout while preserving cookie, role/account, cache-control, and origin protections.
- [x] 3.3 Retain Swagger scanning in the existing routes directory and replace old auth schemas/examples with the shared envelope semantics; verify source and compiled-runtime docs contain auth paths, revised statuses, request IDs, and correct bodyless logout.
- [x] 3.4 Update `src/README.md` with responsibilities of the existing layer folders, logical feature ownership, dependency direction, DTO mapping in services, transaction ownership, and future domain acceptance rules; verify actual auth imports obey the documented direction and no new architectural directory trees or generic repositories were introduced.
- [x] 3.5 Reconcile the request-boundary idempotency guidance in `prisma/schema-design.md` with stable retry keys and document future tests for atomic rollback, competing issues, duplicate retries, and preserved history; verify this is documentation only and does not add domain endpoints or database migrations.

## 4. Frontend companion migration

- [x] 4.1 In a workspace authorized for `apps/app`, update auth HTTP types and success decoding to the envelope payload, use stable codes/status for branching, and read nested safe error messages with Indonesian network/unexpected-response fallbacks; verify login, current-user, unauthorized, and logout behavior using client contract tests.
- [x] 4.2 Document the coordinated release and rollback requirement alongside the frontend/API integration notes; verify the notes identify the old/new auth response shapes and prohibit releasing only one incompatible side.

## 5. Integration verification

- [x] 5.1 Run API typecheck, build, and the existing Vitest regression suite (including auth, CORS, API, app, Swagger, and seeder tests) plus the new contract tests; record commands/results and ensure validation does not require applying a database migration.
- [x] 5.2 Run shared-package and frontend typecheck/build plus client contract tests in the companion workspace; verify one end-to-end login/current-user/logout flow and an Indonesian validation failure against the changed API before marking the compatibility work complete.
- [x] 5.3 Review capability scenario coverage and record which conditional Inventory/Maintenance scenarios are deferred to their feature changes; verify no task or completion report claims implemented stock transactions, scheduling, or history features.

## Architecture revision checkpoint

The existing folder structure is preserved. The seven foundation tasks retain their behavior and verification history; their helpers now live in the existing layer folders. Task 3.1 restored auth and Prisma to their original paths. All 17 implementation tasks are complete; verification.md records the checks, client/API HTTP flow and deferred domain scenarios. Review and OpenSpec sync/archive remain workflow follow-up.

## Workflow follow-up

- After implementation and review, sync/archive this change through OpenSpec to publish the three capabilities as durable core specifications.
- Future Inventory and Maintenance changes must include real database concurrency/rollback tests for their applicable module-boundary requirements.