chore: remove accidentally created nul file

Archive three completed changes to archive/:
- api-resource-standard (70 tasks, 14 resource classes)
- capacity-expert-mode (68 tasks, expert mode planning grid)
- enhanced-allocation (62 tasks, planning fidelity + reporting)

Sync all delta specs to main specs/:
- api-resource-standard: API response standardization
- capacity-expert-mode: Expert mode toggle, grid, KPIs, batch API
- resource-allocation: Month execution comparison, bulk, untracked
- untracked-allocation: Null team member support
- allocation-indicators: Variance indicators (red/amber/neutral)
- monthly-budget: Explicit project-month planning

All changes verified and tested (157 tests passing).

.gitignore

@@ -0,0 +1,27 @@
+# Dependencies
+node_modules/
+frontend/node_modules/
+backend/vendor/
+
+# Frontend build and framework artifacts
+frontend/.svelte-kit/
+frontend/build/
+frontend/test-results/
+frontend/playwright-report/
+frontend/.vite/
+
+# Runtime data and local services
+data/postgres/
+data/redis/
+
+# Logs and local env files
+*.log
+.env
+.env.*
+*.local
+
+# OS and editor files
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/

.opencode/command/ralph.md

@@ -0,0 +1,44 @@
+---
+description: Run Open Ralph Wiggum loops in this repository
+---
+
+Run Open Ralph Wiggum in the current repository with OpenCode as the default agent.
+
+**Input**: The argument after `/ralph` is the Ralph task prompt. Optional Ralph flags may be included.
+
+**Steps**
+
+1. **Require task input**
+
+   If no argument is provided, ask:
+   > "What task should Ralph run? Include success criteria and completion promise if you have one."
+
+   Stop after asking.
+
+2. **Install Ralph locally in `.opencode`**
+
+   ```bash
+   npm install --prefix ".opencode" @th0rgal/ralph-wiggum
+   ```
+
+3. **Run Ralph loop**
+
+   If the user did not provide iteration bounds, use:
+   ```bash
+   npx --prefix ".opencode" ralph "<input>" --agent opencode --max-iterations 10
+   ```
+
+   If the user included explicit flags (for example `--max-iterations`, `--tasks`, `--model`), preserve them and append `--agent opencode` only when agent is not specified.
+
+4. **After run, show control commands**
+
+   ```bash
+   npx --prefix ".opencode" ralph --status
+   npx --prefix ".opencode" ralph --add-context "Focus on <area>"
+   ```
+
+**Guardrails**
+
+- Do not add `open-ralph-wiggum` to OpenCode plugin config.
+- Keep the run scoped to this repository.
+- Prefer bounded loops with `--max-iterations`.

.opencode/package-lock.json

@@ -0,0 +1,45 @@
+{
+  "name": ".opencode",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "@opencode-ai/plugin": "1.2.14",
+        "@th0rgal/ralph-wiggum": "^1.2.2"
+      }
+    },
+    "node_modules/@opencode-ai/plugin": {
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/plugin/-/plugin-1.2.14.tgz",
+      "integrity": "sha512-36dPaIaNPMjA5jnFAbOzvKe78dbUkKXF8hgs8PNRXiAaTSzoIapBC/xkADVRO66tmLyZhoGFSBkVeJUpOyyiew==",
+      "license": "MIT",
+      "dependencies": {
+        "@opencode-ai/sdk": "1.2.14",
+        "zod": "4.1.8"
+      }
+    },
+    "node_modules/@opencode-ai/sdk": {
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/sdk/-/sdk-1.2.14.tgz",
+      "integrity": "sha512-nPkWAmzgPJYyfCJAV4NG7HTfN/iuO3B6fv8sT26NhPiR+EqD9i8sh4X1LwI7wEbbMOwWOX1PhrssW6gXQOOQZQ==",
+      "license": "MIT"
+    },
+    "node_modules/@th0rgal/ralph-wiggum": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@th0rgal/ralph-wiggum/-/ralph-wiggum-1.2.2.tgz",
+      "integrity": "sha512-yhDydpF8mstC+1qTz2SQxcRrMHrwnHWflBRXEUfutPN9Pm9nYMYD04n6Km0Td9xBMjw+yf3vMwNZU91nRidO7Q==",
+      "license": "MIT",
+      "bin": {
+        "ralph": "bin/ralph.js"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.1.8",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    }
+  }
+}

.opencode/skills/open-ralph-wiggum/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: open-ralph-wiggum
+description: Run autonomous Ralph loops in the current repository using OpenCode as the default agent.
+license: MIT
+compatibility: Requires Node.js/npm and OpenCode CLI configured with a working model.
+metadata:
+  author: th0rgal
+  source: https://github.com/Th0rgal/open-ralph-wiggum
+---
+
+Use Open Ralph Wiggum to run repeatable autonomous coding loops from OpenCode.
+
+**Input**: The user message after this skill should include the task prompt for Ralph. Optional Ralph flags can be passed as part of the message.
+
+**Steps**
+
+1. **Validate a task prompt exists**
+
+   If no task prompt is provided, ask for one clear prompt and stop.
+
+2. **Ensure Ralph CLI is available in this repo**
+
+   Run:
+   ```bash
+   npm install --prefix ".opencode" @th0rgal/ralph-wiggum
+   ```
+
+3. **Run Ralph with OpenCode agent (default)**
+
+   Use local binary via `npx` so no global install is required:
+   ```bash
+   npx --prefix ".opencode" ralph "<user prompt>" --agent opencode --max-iterations 10
+   ```
+
+   If the user already included `--max-iterations`, keep their value.
+
+4. **Report result and next controls**
+
+   Mention how to monitor or steer loop if still running:
+   - `npx --prefix ".opencode" ralph --status`
+   - `npx --prefix ".opencode" ralph --add-context "<hint>"`
+
+**Guardrails**
+
+- Do not register Ralph as an OpenCode plugin. It is a CLI wrapper, not a plugin.
+- Keep execution in the current repository.
+- Do not use unlimited iterations by default; always set `--max-iterations` unless user explicitly asks otherwise.

.ralph/ralph-history.json

@@ -0,0 +1,178 @@
+{
+  "iterations": [
+    {
+      "iteration": 1,
+      "startedAt": "2026-02-18T19:18:48.446Z",
+      "endedAt": "2026-02-18T19:18:53.115Z",
+      "durationMs": 1302,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [
+        ".opencode/skills/open-ralph-wiggum/",
+        ".ralph/"
+      ],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 2,
+      "startedAt": "2026-02-18T19:18:57.638Z",
+      "endedAt": "2026-02-18T19:19:02.087Z",
+      "durationMs": 1135,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 3,
+      "startedAt": "2026-02-18T19:19:06.524Z",
+      "endedAt": "2026-02-18T19:19:11.037Z",
+      "durationMs": 1212,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 4,
+      "startedAt": "2026-02-18T19:19:15.470Z",
+      "endedAt": "2026-02-18T19:19:19.996Z",
+      "durationMs": 1234,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 5,
+      "startedAt": "2026-02-18T19:19:24.447Z",
+      "endedAt": "2026-02-18T19:19:28.947Z",
+      "durationMs": 1167,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 6,
+      "startedAt": "2026-02-18T19:19:33.395Z",
+      "endedAt": "2026-02-18T19:19:37.864Z",
+      "durationMs": 1159,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 7,
+      "startedAt": "2026-02-18T19:19:42.294Z",
+      "endedAt": "2026-02-18T19:19:46.806Z",
+      "durationMs": 1172,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 8,
+      "startedAt": "2026-02-18T19:19:51.271Z",
+      "endedAt": "2026-02-18T19:19:55.730Z",
+      "durationMs": 1147,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 9,
+      "startedAt": "2026-02-18T19:20:00.161Z",
+      "endedAt": "2026-02-18T19:20:04.602Z",
+      "durationMs": 1153,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 10,
+      "startedAt": "2026-02-18T19:20:09.028Z",
+      "endedAt": "2026-02-18T19:20:13.478Z",
+      "durationMs": 1149,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": [
+        "\u001b[91m\u001b[1mError: \u001b[0mSession not found"
+      ]
+    },
+    {
+      "iteration": 10,
+      "startedAt": "2026-02-26T03:41:24.806Z",
+      "endedAt": "2026-02-26T03:43:03.164Z",
+      "durationMs": 91537,
+      "agent": "opencode",
+      "model": "",
+      "toolsUsed": {},
+      "filesModified": [
+        "openspec/changes/enhanced-allocation/"
+      ],
+      "exitCode": 1,
+      "completionDetected": false,
+      "errors": []
+    }
+  ],
+  "totalDurationMs": 103367,
+  "struggleIndicators": {
+    "repeatedErrors": {},
+    "noProgressIterations": 0,
+    "shortIterations": 0
+  }
+}

.ralph/ralph-opencode.config.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "permission": {
+    "read": "allow",
+    "edit": "allow",
+    "glob": "allow",
+    "grep": "allow",
+    "list": "allow",
+    "bash": "allow",
+    "task": "allow",
+    "webfetch": "allow",
+    "websearch": "allow",
+    "codesearch": "allow",
+    "todowrite": "allow",
+    "todoread": "allow",
+    "question": "allow",
+    "lsp": "allow",
+    "external_directory": "allow"
+  }
+}

.slim/cartography.json

@@ -0,0 +1,32 @@
+{
+  "metadata": {
+    "version": "1.0.0",
+    "last_run": "2026-02-17T15:00:03.799320Z",
+    "root": "C:\\dev\\kimi-headroom",
+    "include_patterns": [
+      "**/*.ts",
+      "**/*.json",
+      "**/*.yaml",
+      "**/*.yml",
+      "**/*.js"
+    ],
+    "exclude_patterns": [
+      "**/*.test.ts",
+      "**/dist/**",
+      "**/node_modules/**",
+      "**/*.min.js",
+      "**/*.map"
+    ],
+    "exceptions": []
+  },
+  "file_hashes": {
+    "openspec\\changes\\headroom-foundation\\.openspec.yaml": "cafa573d0d11cc3531e4cbdb09aea2a6",
+    "openspec\\config.yaml": "63c26766698dd49488b53c274bfec0f9"
+  },
+  "folder_hashes": {
+    "openspec/changes": "",
+    "openspec/changes/headroom-foundation": "",
+    ".": "072f78e51abbd298a4f984fc2d143028",
+    "openspec": ""
+  }
+}

backend/.agents/skills/pest-testing/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: pest-testing
+description: "Tests applications using the Pest 3 PHP framework. Activates when writing tests, creating unit or feature tests, adding assertions, testing Livewire components, architecture testing, debugging test failures, working with datasets or mocking; or when the user mentions test, spec, TDD, expects, assertion, coverage, or needs to verify functionality works."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Pest Testing 3
+
+## When to Apply
+
+Activate this skill when:
+- Creating new tests (unit or feature)
+- Modifying existing tests
+- Debugging test failures
+- Working with datasets, mocking, or test organization
+- Writing architecture tests
+
+## Documentation
+
+Use `search-docs` for detailed Pest 3 patterns and documentation.
+
+## Basic Usage
+
+### Creating Tests
+
+All tests must be written using Pest. Use `php artisan make:test --pest {name}`.
+
+### Test Organization
+
+- Tests live in the `tests/Feature` and `tests/Unit` directories.
+- Do NOT remove tests without approval - these are core application code.
+- Test happy paths, failure paths, and edge cases.
+
+### Basic Test Structure
+
+<!-- Basic Pest Test Example -->
+```php
+it('is true', function () {
+    expect(true)->toBeTrue();
+});
+```
+
+### Running Tests
+
+- Run minimal tests with filter before finalizing: `php artisan test --compact --filter=testName`.
+- Run all tests: `php artisan test --compact`.
+- Run file: `php artisan test --compact tests/Feature/ExampleTest.php`.
+
+## Assertions
+
+Use specific assertions (`assertSuccessful()`, `assertNotFound()`) instead of `assertStatus()`:
+
+<!-- Pest Response Assertion -->
+```php
+it('returns all', function () {
+    $this->postJson('/api/docs', [])->assertSuccessful();
+});
+```
+
+| Use | Instead of |
+|-----|------------|
+| `assertSuccessful()` | `assertStatus(200)` |
+| `assertNotFound()` | `assertStatus(404)` |
+| `assertForbidden()` | `assertStatus(403)` |
+
+## Mocking
+
+Import mock function before use: `use function Pest\Laravel\mock;`
+
+## Datasets
+
+Use datasets for repetitive tests (validation rules, etc.):
+
+<!-- Pest Dataset Example -->
+```php
+it('has emails', function (string $email) {
+    expect($email)->not->toBeEmpty();
+})->with([
+    'james' => 'james@laravel.com',
+    'taylor' => 'taylor@laravel.com',
+]);
+```
+
+## Pest 3 Features
+
+### Architecture Testing
+
+Pest 3 includes architecture testing to enforce code conventions:
+
+<!-- Architecture Test Example -->
+```php
+arch('controllers')
+    ->expect('App\Http\Controllers')
+    ->toExtendNothing()
+    ->toHaveSuffix('Controller');
+
+arch('models')
+    ->expect('App\Models')
+    ->toExtend('Illuminate\Database\Eloquent\Model');
+
+arch('no debugging')
+    ->expect(['dd', 'dump', 'ray'])
+    ->not->toBeUsed();
+```
+
+### Type Coverage
+
+Pest 3 provides improved type coverage analysis. Run with `--type-coverage` flag.
+
+## Common Pitfalls
+
+- Not importing `use function Pest\Laravel\mock;` before using mock
+- Using `assertStatus(200)` instead of `assertSuccessful()`
+- Forgetting datasets for repetitive validation tests
+- Deleting tests without approval

backend/.codex/config.toml

@@ -0,0 +1,4 @@
+[mcp_servers.laravel-boost]
+command = "php"
+args = ["artisan", "boost:mcp"]
+cwd = "C:\\dev\\kimi-headroom\\backend"

backend/.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[compose.yaml]
+indent_size = 4

backend/.env.example

@@ -0,0 +1,65 @@
+APP_NAME=Laravel
+APP_ENV=local
+APP_KEY=
+APP_DEBUG=true
+APP_URL=http://localhost
+
+APP_LOCALE=en
+APP_FALLBACK_LOCALE=en
+APP_FAKER_LOCALE=en_US
+
+APP_MAINTENANCE_DRIVER=file
+# APP_MAINTENANCE_STORE=database
+
+# PHP_CLI_SERVER_WORKERS=4
+
+BCRYPT_ROUNDS=12
+
+LOG_CHANNEL=stack
+LOG_STACK=single
+LOG_DEPRECATIONS_CHANNEL=null
+LOG_LEVEL=debug
+
+DB_CONNECTION=sqlite
+# DB_HOST=127.0.0.1
+# DB_PORT=3306
+# DB_DATABASE=laravel
+# DB_USERNAME=root
+# DB_PASSWORD=
+
+SESSION_DRIVER=database
+SESSION_LIFETIME=120
+SESSION_ENCRYPT=false
+SESSION_PATH=/
+SESSION_DOMAIN=null
+
+BROADCAST_CONNECTION=log
+FILESYSTEM_DISK=local
+QUEUE_CONNECTION=database
+
+CACHE_STORE=database
+# CACHE_PREFIX=
+
+MEMCACHED_HOST=127.0.0.1
+
+REDIS_CLIENT=phpredis
+REDIS_HOST=127.0.0.1
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
+MAIL_MAILER=log
+MAIL_SCHEME=null
+MAIL_HOST=127.0.0.1
+MAIL_PORT=2525
+MAIL_USERNAME=null
+MAIL_PASSWORD=null
+MAIL_FROM_ADDRESS="hello@example.com"
+MAIL_FROM_NAME="${APP_NAME}"
+
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_DEFAULT_REGION=us-east-1
+AWS_BUCKET=
+AWS_USE_PATH_STYLE_ENDPOINT=false
+
+VITE_APP_NAME="${APP_NAME}"

backend/.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.blade.php diff=html
+*.css diff=css
+*.html diff=html
+*.md diff=markdown
+*.php diff=php
+
+/.github export-ignore
+CHANGELOG.md export-ignore
+.styleci.yml export-ignore

backend/.gitignore

@@ -0,0 +1,24 @@
+*.log
+.DS_Store
+.env
+.env.backup
+.env.production
+.phpactor.json
+.phpunit.result.cache
+/.fleet
+/.idea
+/.nova
+/.phpunit.cache
+/.vscode
+/.zed
+/auth.json
+/node_modules
+/public/build
+/public/hot
+/public/storage
+/storage/*.key
+/storage/pail
+/vendor
+Homestead.json
+Homestead.yaml
+Thumbs.db

backend/.junie/guidelines.md

@@ -0,0 +1,234 @@
+<laravel-boost-guidelines>
+=== foundation rules ===
+
+# Laravel Boost Guidelines
+
+The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.
+
+## Foundational Context
+
+This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
+
+- php - 8.5.2
+- laravel/framework (LARAVEL) - v12
+- laravel/prompts (PROMPTS) - v0
+- laravel/mcp (MCP) - v0
+- laravel/pint (PINT) - v1
+- laravel/sail (SAIL) - v1
+- pestphp/pest (PEST) - v3
+- phpunit/phpunit (PHPUNIT) - v11
+
+## Skills Activation
+
+This project has domain-specific skills available. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
+
+- `pest-testing` — Tests applications using the Pest 3 PHP framework. Activates when writing tests, creating unit or feature tests, adding assertions, testing Livewire components, architecture testing, debugging test failures, working with datasets or mocking; or when the user mentions test, spec, TDD, expects, assertion, coverage, or needs to verify functionality works.
+
+## Conventions
+
+- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
+- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
+- Check for existing components to reuse before writing a new one.
+
+## Verification Scripts
+
+- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.
+
+## Application Structure & Architecture
+
+- Stick to existing directory structure; don't create new base folders without approval.
+- Do not change the application's dependencies without approval.
+
+## Frontend Bundling
+
+- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
+
+## Documentation Files
+
+- You must only create documentation files if explicitly requested by the user.
+
+## Replies
+
+- Be concise in your explanations - focus on what's important rather than explaining obvious details.
+
+=== boost rules ===
+
+# Laravel Boost
+
+- Laravel Boost is an MCP server that comes with powerful tools designed specifically for this application. Use them.
+
+## Artisan
+
+- Use the `list-artisan-commands` tool when you need to call an Artisan command to double-check the available parameters.
+
+## URLs
+
+- Whenever you share a project URL with the user, you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain/IP, and port.
+
+## Tinker / Debugging
+
+- You should use the `tinker` tool when you need to execute PHP to debug code or query Eloquent models directly.
+- Use the `database-query` tool when you only need to read from the database.
+- Use the `database-schema` tool to inspect table structure before writing migrations or models.
+
+## Reading Browser Logs With the `browser-logs` Tool
+
+- You can read browser logs, errors, and exceptions using the `browser-logs` tool from Boost.
+- Only recent browser logs will be useful - ignore old logs.
+
+## Searching Documentation (Critically Important)
+
+- Boost comes with a powerful `search-docs` tool you should use before trying other approaches when working with Laravel or Laravel ecosystem packages. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
+- Search the documentation before making code changes to ensure we are taking the correct approach.
+- Use multiple, broad, simple, topic-based queries at once. For example: `['rate limiting', 'routing rate limiting', 'routing']`. The most relevant results will be returned first.
+- Do not add package names to queries; package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
+
+### Available Search Syntax
+
+1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'.
+2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit".
+3. Quoted Phrases (Exact Position) - query="infinite scroll" - words must be adjacent and in that order.
+4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit".
+5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms.
+
+=== php rules ===
+
+# PHP
+
+- Always use curly braces for control structures, even for single-line bodies.
+
+## Constructors
+
+- Use PHP 8 constructor property promotion in `__construct()`.
+    - `public function __construct(public GitHub $github) { }`
+- Do not allow empty `__construct()` methods with zero parameters unless the constructor is private.
+
+## Type Declarations
+
+- Always use explicit return type declarations for methods and functions.
+- Use appropriate PHP type hints for method parameters.
+
+<!-- Explicit Return Types and Method Params -->
+```php
+protected function isAccessible(User $user, ?string $path = null): bool
+{
+    ...
+}
+```
+
+## Enums
+
+- Typically, keys in an Enum should be TitleCase. For example: `FavoritePerson`, `BestLake`, `Monthly`.
+
+## Comments
+
+- Prefer PHPDoc blocks over inline comments. Never use comments within the code itself unless the logic is exceptionally complex.
+
+## PHPDoc Blocks
+
+- Add useful array shape type definitions when appropriate.
+
+=== tests rules ===
+
+# Test Enforcement
+
+- Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
+- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test --compact` with a specific filename or filter.
+
+=== laravel/core rules ===
+
+# Do Things the Laravel Way
+
+- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using the `list-artisan-commands` tool.
+- If you're creating a generic PHP class, use `php artisan make:class`.
+- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
+
+## Database
+
+- Always use proper Eloquent relationship methods with return type hints. Prefer relationship methods over raw queries or manual joins.
+- Use Eloquent models and relationships before suggesting raw database queries.
+- Avoid `DB::`; prefer `Model::query()`. Generate code that leverages Laravel's ORM capabilities rather than bypassing them.
+- Generate code that prevents N+1 query problems by using eager loading.
+- Use Laravel's query builder for very complex database operations.
+
+### Model Creation
+
+- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `list-artisan-commands` to check the available options to `php artisan make:model`.
+
+### APIs & Eloquent Resources
+
+- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
+
+## Controllers & Validation
+
+- Always create Form Request classes for validation rather than inline validation in controllers. Include both validation rules and custom error messages.
+- Check sibling Form Requests to see if the application uses array or string based validation rules.
+
+## Authentication & Authorization
+
+- Use Laravel's built-in authentication and authorization features (gates, policies, Sanctum, etc.).
+
+## URL Generation
+
+- When generating links to other pages, prefer named routes and the `route()` function.
+
+## Queues
+
+- Use queued jobs for time-consuming operations with the `ShouldQueue` interface.
+
+## Configuration
+
+- Use environment variables only in configuration files - never use the `env()` function directly outside of config files. Always use `config('app.name')`, not `env('APP_NAME')`.
+
+## Testing
+
+- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
+- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
+- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
+
+## Vite Error
+
+- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
+
+=== laravel/v12 rules ===
+
+# Laravel 12
+
+- CRITICAL: ALWAYS use `search-docs` tool for version-specific Laravel documentation and updated code examples.
+- Since Laravel 11, Laravel has a new streamlined file structure which this project uses.
+
+## Laravel 12 Structure
+
+- In Laravel 12, middleware are no longer registered in `app/Http/Kernel.php`.
+- Middleware are configured declaratively in `bootstrap/app.php` using `Application::configure()->withMiddleware()`.
+- `bootstrap/app.php` is the file to register middleware, exceptions, and routing files.
+- `bootstrap/providers.php` contains application specific service providers.
+- The `app\Console\Kernel.php` file no longer exists; use `bootstrap/app.php` or `routes/console.php` for console configuration.
+- Console commands in `app/Console/Commands/` are automatically available and do not require manual registration.
+
+## Database
+
+- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
+- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
+
+### Models
+
+- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
+
+=== pint/core rules ===
+
+# Laravel Pint Code Formatter
+
+- You must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
+- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.
+
+=== pest/core rules ===
+
+## Pest
+
+- This project uses Pest for testing. Create tests: `php artisan make:test --pest {name}`.
+- Run tests: `php artisan test --compact` or filter: `php artisan test --compact --filter=testName`.
+- Do NOT delete tests without approval.
+- CRITICAL: ALWAYS use `search-docs` tool for version-specific Pest documentation and updated code examples.
+- IMPORTANT: Activate `pest-testing` every time you're working with a Pest or testing-related task.
+</laravel-boost-guidelines>

backend/.junie/mcp/mcp.json

@@ -0,0 +1,11 @@
+{
+    "mcpServers": {
+        "laravel-boost": {
+            "command": "C:\\Users\\simpl\\scoop\\apps\\php\\current\\php.exe",
+            "args": [
+                "C:\\dev\\kimi-headroom\\backend\\artisan",
+                "boost:mcp"
+            ]
+        }
+    }
+}

backend/.junie/skills/pest-testing/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: pest-testing
+description: "Tests applications using the Pest 3 PHP framework. Activates when writing tests, creating unit or feature tests, adding assertions, testing Livewire components, architecture testing, debugging test failures, working with datasets or mocking; or when the user mentions test, spec, TDD, expects, assertion, coverage, or needs to verify functionality works."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Pest Testing 3
+
+## When to Apply
+
+Activate this skill when:
+- Creating new tests (unit or feature)
+- Modifying existing tests
+- Debugging test failures
+- Working with datasets, mocking, or test organization
+- Writing architecture tests
+
+## Documentation
+
+Use `search-docs` for detailed Pest 3 patterns and documentation.
+
+## Basic Usage
+
+### Creating Tests
+
+All tests must be written using Pest. Use `php artisan make:test --pest {name}`.
+
+### Test Organization
+
+- Tests live in the `tests/Feature` and `tests/Unit` directories.
+- Do NOT remove tests without approval - these are core application code.
+- Test happy paths, failure paths, and edge cases.
+
+### Basic Test Structure
+
+<!-- Basic Pest Test Example -->
+```php
+it('is true', function () {
+    expect(true)->toBeTrue();
+});
+```
+
+### Running Tests
+
+- Run minimal tests with filter before finalizing: `php artisan test --compact --filter=testName`.
+- Run all tests: `php artisan test --compact`.
+- Run file: `php artisan test --compact tests/Feature/ExampleTest.php`.
+
+## Assertions
+
+Use specific assertions (`assertSuccessful()`, `assertNotFound()`) instead of `assertStatus()`:
+
+<!-- Pest Response Assertion -->
+```php
+it('returns all', function () {
+    $this->postJson('/api/docs', [])->assertSuccessful();
+});
+```
+
+| Use | Instead of |
+|-----|------------|
+| `assertSuccessful()` | `assertStatus(200)` |
+| `assertNotFound()` | `assertStatus(404)` |
+| `assertForbidden()` | `assertStatus(403)` |
+
+## Mocking
+
+Import mock function before use: `use function Pest\Laravel\mock;`
+
+## Datasets
+
+Use datasets for repetitive tests (validation rules, etc.):
+
+<!-- Pest Dataset Example -->
+```php
+it('has emails', function (string $email) {
+    expect($email)->not->toBeEmpty();
+})->with([
+    'james' => 'james@laravel.com',
+    'taylor' => 'taylor@laravel.com',
+]);
+```
+
+## Pest 3 Features
+
+### Architecture Testing
+
+Pest 3 includes architecture testing to enforce code conventions:
+
+<!-- Architecture Test Example -->
+```php
+arch('controllers')
+    ->expect('App\Http\Controllers')
+    ->toExtendNothing()
+    ->toHaveSuffix('Controller');
+
+arch('models')
+    ->expect('App\Models')
+    ->toExtend('Illuminate\Database\Eloquent\Model');
+
+arch('no debugging')
+    ->expect(['dd', 'dump', 'ray'])
+    ->not->toBeUsed();
+```
+
+### Type Coverage
+
+Pest 3 provides improved type coverage analysis. Run with `--type-coverage` flag.
+
+## Common Pitfalls
+
+- Not importing `use function Pest\Laravel\mock;` before using mock
+- Using `assertStatus(200)` instead of `assertSuccessful()`
+- Forgetting datasets for repetitive validation tests
+- Deleting tests without approval

backend/.scribe/.filehashes

@@ -0,0 +1,4 @@
+# GENERATED. YOU SHOULDN'T MODIFY OR DELETE THIS FILE.
+# Scribe uses this file to know when you change something manually in your docs.
+.scribe/intro.md=4bf90470e636417926ae5d9227747d45
+.scribe/auth.md=9bee2b1ef8a238b2e58613fa636d5f39

backend/.scribe/auth.md

@@ -0,0 +1,3 @@
+# Authenticating requests
+
+This API is not authenticated.

backend/.scribe/endpoints.cache/00.yaml

@@ -0,0 +1,226 @@
+## Autogenerated by Scribe. DO NOT MODIFY.
+
+name: Authentication
+description: |-
+
+  Endpoints for JWT authentication and session lifecycle.
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/auth/login
+    metadata:
+      custom: []
+      groupName: Authentication
+      groupDescription: |-
+
+        Endpoints for JWT authentication and session lifecycle.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Login and get tokens'
+      description: 'Authenticate with email and password to receive an access token and refresh token.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      email:
+        custom: []
+        name: email
+        description: 'User email address.'
+        required: true
+        example: user@example.com
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      password:
+        custom: []
+        name: password
+        description: 'User password.'
+        required: true
+        example: secret123
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      email: user@example.com
+      password: secret123
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "Alice Johnson",
+              "email": "user@example.com",
+              "role": "manager",
+              "active": true,
+              "created_at": "2026-01-01T00:00:00Z",
+              "updated_at": "2026-01-01T00:00:00Z"
+            },
+            "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
+            "refresh_token": "abc123def456",
+            "token_type": "bearer",
+            "expires_in": 3600
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 401
+        content: '{"message":"Invalid credentials"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 403
+        content: '{"message":"Account is inactive"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"errors":{"email":["The email field is required."],"password":["The password field is required."]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/auth/refresh
+    metadata:
+      custom: []
+      groupName: Authentication
+      groupDescription: |-
+
+        Endpoints for JWT authentication and session lifecycle.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Refresh access token'
+      description: 'Exchange a valid refresh token for a new access token and refresh token pair.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      refresh_token:
+        custom: []
+        name: refresh_token
+        description: 'Refresh token returned by login.'
+        required: true
+        example: abc123def456
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      refresh_token: abc123def456
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "Alice Johnson",
+              "email": "user@example.com",
+              "role": "manager",
+              "active": true,
+              "created_at": "2026-01-01T00:00:00Z",
+              "updated_at": "2026-01-01T00:00:00Z"
+            },
+            "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
+            "refresh_token": "newtoken123",
+            "token_type": "bearer",
+            "expires_in": 3600
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 401
+        content: '{"message":"Invalid or expired refresh token"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/auth/logout
+    metadata:
+      custom: []
+      groupName: Authentication
+      groupDescription: |-
+
+        Endpoints for JWT authentication and session lifecycle.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Logout current session'
+      description: 'Invalidate a refresh token and end the active authenticated session.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      refresh_token:
+        custom: []
+        name: refresh_token
+        description: 'Optional refresh token to invalidate immediately.'
+        required: false
+        example: abc123def456
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      refresh_token: abc123def456
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: '{"message":"Logged out successfully"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints.cache/01.yaml

@@ -0,0 +1,225 @@
+## Autogenerated by Scribe. DO NOT MODIFY.
+
+name: Endpoints
+description: ''
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/user
+    metadata:
+      custom: []
+      groupName: Endpoints
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: ''
+      description: ''
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 401
+        content: '{"message":"Authentication required"}'
+        headers:
+          cache-control: 'no-cache, private'
+          content-type: application/json
+          access-control-allow-origin: '*'
+        description: null
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/project-month-plans
+    metadata:
+      custom: []
+      groupName: Endpoints
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: |-
+        GET /api/project-month-plans?year=2026
+        Returns month-plan grid payload by project/month for the year.
+      description: ''
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 401
+        content: '{"message":"Authentication required"}'
+        headers:
+          cache-control: 'no-cache, private'
+          content-type: application/json
+          access-control-allow-origin: '*'
+        description: null
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: api/project-month-plans/bulk
+    metadata:
+      custom: []
+      groupName: Endpoints
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: |-
+        PUT /api/project-month-plans/bulk
+        Bulk upsert month plan cells.
+      description: ''
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      year:
+        custom: []
+        name: year
+        description: 'Must be at least 2020. Must not be greater than 2100.'
+        required: true
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      items:
+        custom: []
+        name: items
+        description: ''
+        required: true
+        example:
+          - []
+        type: 'object[]'
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'items[].project_id':
+        custom: []
+        name: 'items[].project_id'
+        description: 'Must be a valid UUID. The <code>id</code> of an existing record in the projects table.'
+        required: true
+        example: 6ff8f7f6-1eb3-3525-be4a-3932c805afed
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'items[].month':
+        custom: []
+        name: 'items[].month'
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'items[].planned_hours':
+        custom: []
+        name: 'items[].planned_hours'
+        description: 'Must be at least 0.'
+        required: false
+        example: 84
+        type: number
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      year: 1
+      items:
+        -
+          project_id: 6ff8f7f6-1eb3-3525-be4a-3932c805afed
+          month: 2026-02
+          planned_hours: 84
+    fileParameters: []
+    responses: []
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/ptos/{id}'
+    metadata:
+      custom: []
+      groupName: Endpoints
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: ''
+      description: ''
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'The ID of the pto.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: architecto
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses: []
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints.cache/02.yaml

@@ -0,0 +1,447 @@
+## Autogenerated by Scribe. DO NOT MODIFY.
+
+name: 'Team Members'
+description: |-
+
+  Endpoints for managing team members.
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/team-members
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List all team members'
+      description: 'Get a list of all team members with optional filtering by active status.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters:
+      active:
+        custom: []
+        name: active
+        description: 'Filter by active status.'
+        required: false
+        example: true
+        type: boolean
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanQueryParameters:
+      active: true
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "name": "John Doe",
+                "role": {
+                  "id": 1,
+                  "name": "Backend Developer"
+                },
+                "hourly_rate": "150.00",
+                "active": true,
+                "created_at": "2024-01-15T10:00:00.000000Z",
+                "updated_at": "2024-01-15T10:00:00.000000Z"
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/team-members
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Create a new team member'
+      description: 'Create a new team member with name, role, and hourly rate.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      name:
+        custom: []
+        name: name
+        description: 'Team member name.'
+        required: true
+        example: 'John Doe'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      role_id:
+        custom: []
+        name: role_id
+        description: 'Role ID.'
+        required: true
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      hourly_rate:
+        custom: []
+        name: hourly_rate
+        description: 'Hourly rate (must be > 0).'
+        required: true
+        example: '150.00'
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      active:
+        custom: []
+        name: active
+        description: 'Active status (defaults to true).'
+        required: false
+        example: true
+        type: boolean
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      name: 'John Doe'
+      role_id: 1
+      hourly_rate: '150.00'
+      active: true
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "John Doe",
+              "role": {
+                "id": 1,
+                "name": "Backend Developer"
+              },
+              "hourly_rate": "150.00",
+              "active": true,
+              "created_at": "2024-01-15T10:00:00.000000Z",
+              "updated_at": "2024-01-15T10:00:00.000000Z"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"name":["The name field is required."],"hourly_rate":["Hourly rate must be greater than 0"]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: 'api/team-members/{id}'
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get a single team member'
+      description: 'Get details of a specific team member by ID.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "John Doe",
+              "role": {
+                "id": 1,
+                "name": "Backend Developer"
+              },
+              "hourly_rate": "150.00",
+              "active": true,
+              "created_at": "2024-01-15T10:00:00.000000Z",
+              "updated_at": "2024-01-15T10:00:00.000000Z"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Team member not found"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+      - PATCH
+    uri: 'api/team-members/{id}'
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Update a team member'
+      description: 'Update details of an existing team member.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      name:
+        custom: []
+        name: name
+        description: 'Team member name.'
+        required: false
+        example: 'John Doe'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      role_id:
+        custom: []
+        name: role_id
+        description: 'Role ID.'
+        required: false
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      hourly_rate:
+        custom: []
+        name: hourly_rate
+        description: 'Hourly rate (must be > 0).'
+        required: false
+        example: '175.00'
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      active:
+        custom: []
+        name: active
+        description: 'Active status.'
+        required: false
+        example: false
+        type: boolean
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      name: 'John Doe'
+      role_id: 1
+      hourly_rate: '175.00'
+      active: false
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "John Doe",
+              "role": {
+                "id": 1,
+                "name": "Backend Developer"
+              },
+              "hourly_rate": "175.00",
+              "active": false,
+              "created_at": "2024-01-15T10:00:00.000000Z",
+              "updated_at": "2024-01-15T11:00:00.000000Z"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Team member not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"hourly_rate":["Hourly rate must be greater than 0"]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/team-members/{id}'
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Delete a team member'
+      description: 'Delete a team member. Cannot delete if member has allocations or actuals.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: '{"message":"Team member deleted successfully"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Team member not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Cannot delete team member with active allocations","suggestion":"Consider deactivating the team member instead"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Cannot delete team member with historical data","suggestion":"Consider deactivating the team member instead"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints.cache/03.yaml

@@ -0,0 +1,789 @@
+## Autogenerated by Scribe. DO NOT MODIFY.
+
+name: Projects
+description: |-
+
+  Endpoints for managing projects.
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/projects/types
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get all project types'
+      description: ''
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {"id": 1, "name": "Project"},
+              {"id": 2, "name": "Support"},
+              {"id": 3, "name": "Engagement"}
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/projects/statuses
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get all project statuses'
+      description: ''
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {"id": 1, "name": "Pre-sales", "order": 1},
+              {"id": 2, "name": "SOW Approval", "order": 2},
+              {"id": 3, "name": "Gathering Estimates", "order": 3}
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/projects
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List all projects'
+      description: 'Get a list of all projects with optional filtering by status and type.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters:
+      status_id:
+        custom: []
+        name: status_id
+        description: 'Filter by status ID.'
+        required: false
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      type_id:
+        custom: []
+        name: type_id
+        description: 'Filter by type ID.'
+        required: false
+        example: 2
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanQueryParameters:
+      status_id: 1
+      type_id: 2
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "code": "PROJ-001",
+                "title": "Client Dashboard Redesign",
+                "status": {"id": 1, "name": "Pre-sales"},
+                "type": {"id": 2, "name": "Support"},
+                "approved_estimate": "120.00",
+                "forecasted_effort": {"2024-02": 40, "2024-03": 60, "2024-04": 20},
+                "created_at": "2024-01-15T10:00:00.000000Z",
+                "updated_at": "2024-01-15T10:00:00.000000Z"
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/projects
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Create a new project'
+      description: 'Create a new project with code, title, and type.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      code:
+        custom: []
+        name: code
+        description: 'Project code (must be unique).'
+        required: true
+        example: PROJ-001
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      title:
+        custom: []
+        name: title
+        description: 'Project title.'
+        required: true
+        example: 'Client Dashboard Redesign'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      type_id:
+        custom: []
+        name: type_id
+        description: 'Project type ID.'
+        required: true
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      code: PROJ-001
+      title: 'Client Dashboard Redesign'
+      type_id: 1
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "code": "PROJ-001",
+              "title": "Client Dashboard Redesign",
+              "status": {"id": 1, "name": "Pre-sales"},
+              "type": {"id": 1, "name": "Project"}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"code":["Project code must be unique"],"title":["The title field is required."]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: 'api/projects/{id}'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get a single project'
+      description: 'Get details of a specific project by ID.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "code": "PROJ-001",
+              "title": "Client Dashboard Redesign",
+              "status": {"id": 1, "name": "Pre-sales"},
+              "type": {"id": 1, "name": "Project"},
+              "approved_estimate": "120.00",
+              "forecasted_effort": {"2024-02": 40, "2024-03": 60}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+      - PATCH
+    uri: 'api/projects/{id}'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Update a project'
+      description: 'Update details of an existing project.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      code:
+        custom: []
+        name: code
+        description: 'Project code (must be unique).'
+        required: false
+        example: PROJ-002
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      title:
+        custom: []
+        name: title
+        description: 'Project title.'
+        required: false
+        example: 'Updated Title'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      type_id:
+        custom: []
+        name: type_id
+        description: 'Project type ID.'
+        required: false
+        example: 2
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      code: PROJ-002
+      title: 'Updated Title'
+      type_id: 2
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "code": "PROJ-002",
+              "title": "Updated Title",
+              "type": {"id": 2, "name": "Support"}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"type_id":["The selected type id is invalid."]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/projects/{id}'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Delete a project'
+      description: 'Delete a project. Cannot delete if project has allocations or actuals.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: '{"message":"Project deleted successfully"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Cannot delete project with allocations"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: 'api/projects/{project}/status'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Transition project status'
+      description: 'Transition project to a new status following the state machine rules.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      project:
+        custom: []
+        name: project
+        description: 'The project.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      project: architecto
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      status_id:
+        custom: []
+        name: status_id
+        description: 'Target status ID.'
+        required: true
+        example: 2
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      status_id: 2
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "status": {"id": 2, "name": "SOW Approval"}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Cannot transition from Pre-sales to Done"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: 'api/projects/{project}/estimate'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Set approved estimate'
+      description: 'Set the approved billable hours estimate for a project.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      project:
+        custom: []
+        name: project
+        description: 'The project.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      project: architecto
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      approved_estimate:
+        custom: []
+        name: approved_estimate
+        description: 'Approved estimate hours (must be > 0).'
+        required: true
+        example: 120.0
+        type: number
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      approved_estimate: 120.0
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "approved_estimate": "120.00"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Approved estimate must be greater than 0"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: 'api/projects/{project}/forecast'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Set forecasted effort'
+      description: 'Set the month-by-month forecasted effort breakdown.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      project:
+        custom: []
+        name: project
+        description: 'The project.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      project: architecto
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      forecasted_effort:
+        custom: []
+        name: forecasted_effort
+        description: 'Monthly effort breakdown.'
+        required: true
+        example:
+          2024-02: 40
+          2024-03: 60
+        type: object
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      forecasted_effort:
+        2024-02: 40
+        2024-03: 60
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "forecasted_effort": {"2024-02": 40, "2024-03": 60}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Forecasted effort exceeds approved estimate by more than 5%"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints.cache/04.yaml

@@ -0,0 +1,897 @@
+## Autogenerated by Scribe. DO NOT MODIFY.
+
+name: 'Capacity Planning'
+description: ''
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/capacity
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get Individual Capacity'
+      description: 'Calculate capacity for a specific team member in a given month.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      month:
+        custom: []
+        name: month
+        description: 'The month in YYYY-MM format.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      month: 2026-02
+      team_member_id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The <code>id</code> of an existing record in the team_members table.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+      team_member_id: architecto
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+              "month": "2026-02",
+              "working_days": 20,
+              "person_days": 18.5,
+              "hours": 148,
+              "details": [
+                {
+                  "date": "2026-02-02",
+                  "availability": 1,
+                  "is_pto": false
+                }
+              ]
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/capacity/team
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get Team Capacity'
+      description: 'Summarize the combined capacity for all active team members in a month.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      month:
+        custom: []
+        name: month
+        description: 'The month in YYYY-MM format.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      month: 2026-02
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "month": "2026-02",
+              "total_person_days": 180.5,
+              "total_hours": 1444,
+              "members": [
+                {
+                  "id": "550e8400-e29b-41d4-a716-446655440000",
+                  "name": "Ada Lovelace",
+                  "person_days": 18.5,
+                  "hours": 148
+                }
+              ]
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/capacity/revenue
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get Possible Revenue'
+      description: 'Estimate monthly revenue based on capacity hours and hourly rates.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      month:
+        custom: []
+        name: month
+        description: 'The month in YYYY-MM format.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      month: 2026-02
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "month": "2026-02",
+              "possible_revenue": 21500.25,
+              "member_revenues": [
+                {
+                  "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+                  "team_member_name": "Ada Lovelace",
+                  "hours": 148,
+                  "hourly_rate": 150.0,
+                  "revenue": 22200.0
+                }
+              ]
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/capacity/availability
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Save Team Member Availability'
+      description: 'Persist a daily availability override and refresh cached capacity totals.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The team member UUID.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      date:
+        custom: []
+        name: date
+        description: 'The date for the availability override (YYYY-MM-DD).'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      availability:
+        custom: []
+        name: availability
+        description: 'The availability value (0, 0.5, 1.0).'
+        required: true
+        example: architecto
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      team_member_id: architecto
+      date: architecto
+      availability: architecto
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+              "date": "2026-02-03",
+              "availability": 0.5
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/capacity/availability/batch
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Batch Update Team Member Availability'
+      description: 'Persist multiple daily availability overrides in a single batch operation.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'The month in YYYY-MM format.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      updates:
+        custom: []
+        name: updates
+        description: 'Array of availability updates.'
+        required: true
+        example:
+          - architecto
+        type: 'string[]'
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'updates[].team_member_id':
+        custom: []
+        name: 'updates[].team_member_id'
+        description: 'The team member UUID.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'updates[].date':
+        custom: []
+        name: 'updates[].date'
+        description: 'The date (YYYY-MM-DD).'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'updates[].availability':
+        custom: []
+        name: 'updates[].availability'
+        description: 'The availability value (0, 0.5, 1).'
+        required: true
+        example: architecto
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+      updates:
+        - architecto
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "saved": 12,
+              "month": "2026-02"
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/holidays
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List Holidays'
+      description: 'Retrieve holidays for a specific month or all holidays when no month is provided.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      month:
+        custom: []
+        name: month
+        description: 'nullable The month in YYYY-MM format.'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      month: 2026-02
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "date": "2026-02-14",
+                "name": "Company Holiday",
+                "description": "Office closed"
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/holidays
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Create Holiday'
+      description: 'Add a holiday and clear cached capacity data for the related month.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      date:
+        custom: []
+        name: date
+        description: 'Date of the holiday.'
+        required: true
+        example: '2026-02-14'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      name:
+        custom: []
+        name: name
+        description: 'Name of the holiday.'
+        required: true
+        example: "Presidents' Day"
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      description:
+        custom: []
+        name: description
+        description: 'nullable Optional description of the holiday.'
+        required: false
+        example: 'Eius et animi quos velit et.'
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      date: '2026-02-14'
+      name: "Presidents' Day"
+      description: 'Eius et animi quos velit et.'
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "date": "2026-02-14",
+              "name": "Presidents' Day",
+              "description": "Office closed"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"A holiday already exists for this date.","errors":{"date":["A holiday already exists for this date."]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/holidays/{id}'
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Delete Holiday'
+      description: 'Remove a holiday and clear affected capacity caches.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'The holiday UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "message": "Holiday deleted"
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/ptos
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List PTO Requests'
+      description: 'Fetch PTO requests for a team member, optionally constrained to a month.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      month:
+        custom: []
+        name: month
+        description: 'nullable The month in YYYY-MM format.'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      team_member_id: 550e8400-e29b-41d4-a716-446655440000
+      month: 2026-02
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The <code>id</code> of an existing record in the team_members table.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      team_member_id: architecto
+      month: 2026-02
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440001",
+                "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+                "start_date": "2026-02-10",
+                "end_date": "2026-02-12",
+                "status": "pending",
+                "reason": "Family travel"
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/ptos
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Request PTO'
+      description: 'Create a PTO request for a team member and approve it immediately.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      start_date:
+        custom: []
+        name: start_date
+        description: 'The first day of the PTO.'
+        required: true
+        example: '2026-02-10'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      end_date:
+        custom: []
+        name: end_date
+        description: 'The final day of the PTO.'
+        required: true
+        example: '2026-02-12'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      reason:
+        custom: []
+        name: reason
+        description: 'nullable Optional reason for the PTO.'
+        required: false
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      team_member_id: 550e8400-e29b-41d4-a716-446655440000
+      start_date: '2026-02-10'
+      end_date: '2026-02-12'
+      reason: architecto
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440001",
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+              "start_date": "2026-02-10",
+              "end_date": "2026-02-12",
+              "status": "approved",
+              "reason": "Family travel"
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: 'api/ptos/{id}/approve'
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Approve PTO'
+      description: 'Approve a pending PTO request and refresh the affected capacity caches.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'The PTO UUID that needs approval.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440001
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440001
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440001",
+              "status": "approved"
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints.cache/05.yaml

@@ -0,0 +1,495 @@
+## Autogenerated by Scribe. DO NOT MODIFY.
+
+name: 'Resource Allocation'
+description: |-
+
+  Endpoints for managing resource allocations.
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/allocations
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List allocations / Get allocation matrix'
+      description: 'Get all allocations, optionally filtered by month.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Filter by month (YYYY-MM format).'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanQueryParameters:
+      month: 2026-02
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "project_id": "550e8400-e29b-41d4-a716-446655440001",
+                "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+                "month": "2026-02",
+                "allocated_hours": 40.00
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/allocations
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Create a new allocation'
+      description: 'Allocate hours for a team member to a project for a specific month.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      project_id:
+        custom: []
+        name: project_id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440001
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'Team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440002
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: true
+        deprecated: false
+      month:
+        custom: []
+        name: month
+        description: 'Month (YYYY-MM format).'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      allocated_hours:
+        custom: []
+        name: allocated_hours
+        description: 'Hours to allocate (must be >= 0).'
+        required: true
+        example: '40'
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      project_id: 550e8400-e29b-41d4-a716-446655440001
+      team_member_id: 550e8400-e29b-41d4-a716-446655440002
+      month: 2026-02
+      allocated_hours: '40'
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "project_id": "550e8400-e29b-41d4-a716-446655440001",
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+              "month": "2026-02",
+              "allocated_hours": 40.00
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"allocated_hours":["Allocated hours must be greater than or equal to 0"]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: 'api/allocations/{id}'
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get a single allocation'
+      description: 'Get details of a specific allocation by ID.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Allocation UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "project_id": "550e8400-e29b-41d4-a716-446655440001",
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+              "month": "2026-02",
+              "allocated_hours": 40.00
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message": "Allocation not found"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+      - PATCH
+    uri: 'api/allocations/{id}'
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Update an allocation'
+      description: "Update an existing allocation's hours."
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Allocation UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      allocated_hours:
+        custom: []
+        name: allocated_hours
+        description: 'Hours to allocate (must be >= 0).'
+        required: true
+        example: '60'
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      allocated_hours: '60'
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "project_id": "550e8400-e29b-41d4-a716-446655440001",
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+              "month": "2026-02",
+              "allocated_hours": 60.00
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message": "Allocation not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"allocated_hours":["Allocated hours must be greater than or equal to 0"]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/allocations/{id}'
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Delete an allocation'
+      description: 'Remove an allocation.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Allocation UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: '{"message": "Allocation deleted successfully"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message": "Allocation not found"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/allocations/bulk
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Bulk create allocations'
+      description: 'Create or update multiple allocations in a single request.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      allocations:
+        custom: []
+        name: allocations
+        description: 'Array of allocations.'
+        required: true
+        example:
+          -
+            project_id: ...
+            team_member_id: ...
+            month: 2026-02
+            allocated_hours: 40
+        type: 'string[]'
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      'allocations[].project_id':
+        custom: []
+        name: 'allocations[].project_id'
+        description: 'Must be a valid UUID. The <code>id</code> of an existing record in the projects table.'
+        required: true
+        example: 6ff8f7f6-1eb3-3525-be4a-3932c805afed
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'allocations[].team_member_id':
+        custom: []
+        name: 'allocations[].team_member_id'
+        description: 'Must be a valid UUID. The <code>id</code> of an existing record in the team_members table.'
+        required: true
+        example: 6b72fe4a-5b40-307c-bc24-f79acf9a1bb9
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'allocations[].month':
+        custom: []
+        name: 'allocations[].month'
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'allocations[].allocated_hours':
+        custom: []
+        name: 'allocations[].allocated_hours'
+        description: 'Must be at least 0.'
+        required: true
+        example: 77
+        type: number
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      allocations:
+        -
+          project_id: ...
+          team_member_id: ...
+          month: 2026-02
+          allocated_hours: 40
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "project_id": "550e8400-e29b-41d4-a716-446655440001",
+                "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+                "month": "2026-02",
+                "allocated_hours": 40.00
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints/00.yaml

@@ -0,0 +1,224 @@
+name: Authentication
+description: |-
+
+  Endpoints for JWT authentication and session lifecycle.
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/auth/login
+    metadata:
+      custom: []
+      groupName: Authentication
+      groupDescription: |-
+
+        Endpoints for JWT authentication and session lifecycle.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Login and get tokens'
+      description: 'Authenticate with email and password to receive an access token and refresh token.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      email:
+        custom: []
+        name: email
+        description: 'User email address.'
+        required: true
+        example: user@example.com
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      password:
+        custom: []
+        name: password
+        description: 'User password.'
+        required: true
+        example: secret123
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      email: user@example.com
+      password: secret123
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "Alice Johnson",
+              "email": "user@example.com",
+              "role": "manager",
+              "active": true,
+              "created_at": "2026-01-01T00:00:00Z",
+              "updated_at": "2026-01-01T00:00:00Z"
+            },
+            "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
+            "refresh_token": "abc123def456",
+            "token_type": "bearer",
+            "expires_in": 3600
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 401
+        content: '{"message":"Invalid credentials"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 403
+        content: '{"message":"Account is inactive"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"errors":{"email":["The email field is required."],"password":["The password field is required."]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/auth/refresh
+    metadata:
+      custom: []
+      groupName: Authentication
+      groupDescription: |-
+
+        Endpoints for JWT authentication and session lifecycle.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Refresh access token'
+      description: 'Exchange a valid refresh token for a new access token and refresh token pair.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      refresh_token:
+        custom: []
+        name: refresh_token
+        description: 'Refresh token returned by login.'
+        required: true
+        example: abc123def456
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      refresh_token: abc123def456
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "Alice Johnson",
+              "email": "user@example.com",
+              "role": "manager",
+              "active": true,
+              "created_at": "2026-01-01T00:00:00Z",
+              "updated_at": "2026-01-01T00:00:00Z"
+            },
+            "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
+            "refresh_token": "newtoken123",
+            "token_type": "bearer",
+            "expires_in": 3600
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 401
+        content: '{"message":"Invalid or expired refresh token"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/auth/logout
+    metadata:
+      custom: []
+      groupName: Authentication
+      groupDescription: |-
+
+        Endpoints for JWT authentication and session lifecycle.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Logout current session'
+      description: 'Invalidate a refresh token and end the active authenticated session.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      refresh_token:
+        custom: []
+        name: refresh_token
+        description: 'Optional refresh token to invalidate immediately.'
+        required: false
+        example: abc123def456
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      refresh_token: abc123def456
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: '{"message":"Logged out successfully"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints/01.yaml

@@ -0,0 +1,223 @@
+name: Endpoints
+description: ''
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/user
+    metadata:
+      custom: []
+      groupName: Endpoints
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: ''
+      description: ''
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 401
+        content: '{"message":"Authentication required"}'
+        headers:
+          cache-control: 'no-cache, private'
+          content-type: application/json
+          access-control-allow-origin: '*'
+        description: null
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/project-month-plans
+    metadata:
+      custom: []
+      groupName: Endpoints
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: |-
+        GET /api/project-month-plans?year=2026
+        Returns month-plan grid payload by project/month for the year.
+      description: ''
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 401
+        content: '{"message":"Authentication required"}'
+        headers:
+          cache-control: 'no-cache, private'
+          content-type: application/json
+          access-control-allow-origin: '*'
+        description: null
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: api/project-month-plans/bulk
+    metadata:
+      custom: []
+      groupName: Endpoints
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: |-
+        PUT /api/project-month-plans/bulk
+        Bulk upsert month plan cells.
+      description: ''
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      year:
+        custom: []
+        name: year
+        description: 'Must be at least 2020. Must not be greater than 2100.'
+        required: true
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      items:
+        custom: []
+        name: items
+        description: ''
+        required: true
+        example:
+          - []
+        type: 'object[]'
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'items[].project_id':
+        custom: []
+        name: 'items[].project_id'
+        description: 'Must be a valid UUID. The <code>id</code> of an existing record in the projects table.'
+        required: true
+        example: 6ff8f7f6-1eb3-3525-be4a-3932c805afed
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'items[].month':
+        custom: []
+        name: 'items[].month'
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'items[].planned_hours':
+        custom: []
+        name: 'items[].planned_hours'
+        description: 'Must be at least 0.'
+        required: false
+        example: 84
+        type: number
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      year: 1
+      items:
+        -
+          project_id: 6ff8f7f6-1eb3-3525-be4a-3932c805afed
+          month: 2026-02
+          planned_hours: 84
+    fileParameters: []
+    responses: []
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/ptos/{id}'
+    metadata:
+      custom: []
+      groupName: Endpoints
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: ''
+      description: ''
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'The ID of the pto.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: architecto
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses: []
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints/02.yaml

@@ -0,0 +1,445 @@
+name: 'Team Members'
+description: |-
+
+  Endpoints for managing team members.
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/team-members
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List all team members'
+      description: 'Get a list of all team members with optional filtering by active status.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters:
+      active:
+        custom: []
+        name: active
+        description: 'Filter by active status.'
+        required: false
+        example: true
+        type: boolean
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanQueryParameters:
+      active: true
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "name": "John Doe",
+                "role": {
+                  "id": 1,
+                  "name": "Backend Developer"
+                },
+                "hourly_rate": "150.00",
+                "active": true,
+                "created_at": "2024-01-15T10:00:00.000000Z",
+                "updated_at": "2024-01-15T10:00:00.000000Z"
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/team-members
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Create a new team member'
+      description: 'Create a new team member with name, role, and hourly rate.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      name:
+        custom: []
+        name: name
+        description: 'Team member name.'
+        required: true
+        example: 'John Doe'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      role_id:
+        custom: []
+        name: role_id
+        description: 'Role ID.'
+        required: true
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      hourly_rate:
+        custom: []
+        name: hourly_rate
+        description: 'Hourly rate (must be > 0).'
+        required: true
+        example: '150.00'
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      active:
+        custom: []
+        name: active
+        description: 'Active status (defaults to true).'
+        required: false
+        example: true
+        type: boolean
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      name: 'John Doe'
+      role_id: 1
+      hourly_rate: '150.00'
+      active: true
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "John Doe",
+              "role": {
+                "id": 1,
+                "name": "Backend Developer"
+              },
+              "hourly_rate": "150.00",
+              "active": true,
+              "created_at": "2024-01-15T10:00:00.000000Z",
+              "updated_at": "2024-01-15T10:00:00.000000Z"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"name":["The name field is required."],"hourly_rate":["Hourly rate must be greater than 0"]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: 'api/team-members/{id}'
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get a single team member'
+      description: 'Get details of a specific team member by ID.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "John Doe",
+              "role": {
+                "id": 1,
+                "name": "Backend Developer"
+              },
+              "hourly_rate": "150.00",
+              "active": true,
+              "created_at": "2024-01-15T10:00:00.000000Z",
+              "updated_at": "2024-01-15T10:00:00.000000Z"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Team member not found"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+      - PATCH
+    uri: 'api/team-members/{id}'
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Update a team member'
+      description: 'Update details of an existing team member.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      name:
+        custom: []
+        name: name
+        description: 'Team member name.'
+        required: false
+        example: 'John Doe'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      role_id:
+        custom: []
+        name: role_id
+        description: 'Role ID.'
+        required: false
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      hourly_rate:
+        custom: []
+        name: hourly_rate
+        description: 'Hourly rate (must be > 0).'
+        required: false
+        example: '175.00'
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      active:
+        custom: []
+        name: active
+        description: 'Active status.'
+        required: false
+        example: false
+        type: boolean
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      name: 'John Doe'
+      role_id: 1
+      hourly_rate: '175.00'
+      active: false
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "name": "John Doe",
+              "role": {
+                "id": 1,
+                "name": "Backend Developer"
+              },
+              "hourly_rate": "175.00",
+              "active": false,
+              "created_at": "2024-01-15T10:00:00.000000Z",
+              "updated_at": "2024-01-15T11:00:00.000000Z"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Team member not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"hourly_rate":["Hourly rate must be greater than 0"]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/team-members/{id}'
+    metadata:
+      custom: []
+      groupName: 'Team Members'
+      groupDescription: |-
+
+        Endpoints for managing team members.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Delete a team member'
+      description: 'Delete a team member. Cannot delete if member has allocations or actuals.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: '{"message":"Team member deleted successfully"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Team member not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Cannot delete team member with active allocations","suggestion":"Consider deactivating the team member instead"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Cannot delete team member with historical data","suggestion":"Consider deactivating the team member instead"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints/03.yaml

@@ -0,0 +1,787 @@
+name: Projects
+description: |-
+
+  Endpoints for managing projects.
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/projects/types
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get all project types'
+      description: ''
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {"id": 1, "name": "Project"},
+              {"id": 2, "name": "Support"},
+              {"id": 3, "name": "Engagement"}
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/projects/statuses
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get all project statuses'
+      description: ''
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {"id": 1, "name": "Pre-sales", "order": 1},
+              {"id": 2, "name": "SOW Approval", "order": 2},
+              {"id": 3, "name": "Gathering Estimates", "order": 3}
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/projects
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List all projects'
+      description: 'Get a list of all projects with optional filtering by status and type.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters:
+      status_id:
+        custom: []
+        name: status_id
+        description: 'Filter by status ID.'
+        required: false
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      type_id:
+        custom: []
+        name: type_id
+        description: 'Filter by type ID.'
+        required: false
+        example: 2
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanQueryParameters:
+      status_id: 1
+      type_id: 2
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "code": "PROJ-001",
+                "title": "Client Dashboard Redesign",
+                "status": {"id": 1, "name": "Pre-sales"},
+                "type": {"id": 2, "name": "Support"},
+                "approved_estimate": "120.00",
+                "forecasted_effort": {"2024-02": 40, "2024-03": 60, "2024-04": 20},
+                "created_at": "2024-01-15T10:00:00.000000Z",
+                "updated_at": "2024-01-15T10:00:00.000000Z"
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/projects
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Create a new project'
+      description: 'Create a new project with code, title, and type.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      code:
+        custom: []
+        name: code
+        description: 'Project code (must be unique).'
+        required: true
+        example: PROJ-001
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      title:
+        custom: []
+        name: title
+        description: 'Project title.'
+        required: true
+        example: 'Client Dashboard Redesign'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      type_id:
+        custom: []
+        name: type_id
+        description: 'Project type ID.'
+        required: true
+        example: 1
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      code: PROJ-001
+      title: 'Client Dashboard Redesign'
+      type_id: 1
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "code": "PROJ-001",
+              "title": "Client Dashboard Redesign",
+              "status": {"id": 1, "name": "Pre-sales"},
+              "type": {"id": 1, "name": "Project"}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"code":["Project code must be unique"],"title":["The title field is required."]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: 'api/projects/{id}'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get a single project'
+      description: 'Get details of a specific project by ID.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "code": "PROJ-001",
+              "title": "Client Dashboard Redesign",
+              "status": {"id": 1, "name": "Pre-sales"},
+              "type": {"id": 1, "name": "Project"},
+              "approved_estimate": "120.00",
+              "forecasted_effort": {"2024-02": 40, "2024-03": 60}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+      - PATCH
+    uri: 'api/projects/{id}'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Update a project'
+      description: 'Update details of an existing project.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      code:
+        custom: []
+        name: code
+        description: 'Project code (must be unique).'
+        required: false
+        example: PROJ-002
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      title:
+        custom: []
+        name: title
+        description: 'Project title.'
+        required: false
+        example: 'Updated Title'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      type_id:
+        custom: []
+        name: type_id
+        description: 'Project type ID.'
+        required: false
+        example: 2
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      code: PROJ-002
+      title: 'Updated Title'
+      type_id: 2
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "code": "PROJ-002",
+              "title": "Updated Title",
+              "type": {"id": 2, "name": "Support"}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"type_id":["The selected type id is invalid."]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/projects/{id}'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Delete a project'
+      description: 'Delete a project. Cannot delete if project has allocations or actuals.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: '{"message":"Project deleted successfully"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Cannot delete project with allocations"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: 'api/projects/{project}/status'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Transition project status'
+      description: 'Transition project to a new status following the state machine rules.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      project:
+        custom: []
+        name: project
+        description: 'The project.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      project: architecto
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      status_id:
+        custom: []
+        name: status_id
+        description: 'Target status ID.'
+        required: true
+        example: 2
+        type: integer
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      status_id: 2
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "status": {"id": 2, "name": "SOW Approval"}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Cannot transition from Pre-sales to Done"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: 'api/projects/{project}/estimate'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Set approved estimate'
+      description: 'Set the approved billable hours estimate for a project.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      project:
+        custom: []
+        name: project
+        description: 'The project.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      project: architecto
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      approved_estimate:
+        custom: []
+        name: approved_estimate
+        description: 'Approved estimate hours (must be > 0).'
+        required: true
+        example: 120.0
+        type: number
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      approved_estimate: 120.0
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "approved_estimate": "120.00"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Approved estimate must be greater than 0"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: 'api/projects/{project}/forecast'
+    metadata:
+      custom: []
+      groupName: Projects
+      groupDescription: |-
+
+        Endpoints for managing projects.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Set forecasted effort'
+      description: 'Set the month-by-month forecasted effort breakdown.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      project:
+        custom: []
+        name: project
+        description: 'The project.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      id:
+        custom: []
+        name: id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      project: architecto
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      forecasted_effort:
+        custom: []
+        name: forecasted_effort
+        description: 'Monthly effort breakdown.'
+        required: true
+        example:
+          2024-02: 40
+          2024-03: 60
+        type: object
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      forecasted_effort:
+        2024-02: 40
+        2024-03: 60
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "forecasted_effort": {"2024-02": 40, "2024-03": 60}
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message":"Project not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Forecasted effort exceeds approved estimate by more than 5%"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints/04.yaml

@@ -0,0 +1,895 @@
+name: 'Capacity Planning'
+description: ''
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/capacity
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get Individual Capacity'
+      description: 'Calculate capacity for a specific team member in a given month.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      month:
+        custom: []
+        name: month
+        description: 'The month in YYYY-MM format.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      month: 2026-02
+      team_member_id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The <code>id</code> of an existing record in the team_members table.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+      team_member_id: architecto
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+              "month": "2026-02",
+              "working_days": 20,
+              "person_days": 18.5,
+              "hours": 148,
+              "details": [
+                {
+                  "date": "2026-02-02",
+                  "availability": 1,
+                  "is_pto": false
+                }
+              ]
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/capacity/team
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get Team Capacity'
+      description: 'Summarize the combined capacity for all active team members in a month.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      month:
+        custom: []
+        name: month
+        description: 'The month in YYYY-MM format.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      month: 2026-02
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "month": "2026-02",
+              "total_person_days": 180.5,
+              "total_hours": 1444,
+              "members": [
+                {
+                  "id": "550e8400-e29b-41d4-a716-446655440000",
+                  "name": "Ada Lovelace",
+                  "person_days": 18.5,
+                  "hours": 148
+                }
+              ]
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/capacity/revenue
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get Possible Revenue'
+      description: 'Estimate monthly revenue based on capacity hours and hourly rates.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      month:
+        custom: []
+        name: month
+        description: 'The month in YYYY-MM format.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      month: 2026-02
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "month": "2026-02",
+              "possible_revenue": 21500.25,
+              "member_revenues": [
+                {
+                  "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+                  "team_member_name": "Ada Lovelace",
+                  "hours": 148,
+                  "hourly_rate": 150.0,
+                  "revenue": 22200.0
+                }
+              ]
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/capacity/availability
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Save Team Member Availability'
+      description: 'Persist a daily availability override and refresh cached capacity totals.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The team member UUID.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      date:
+        custom: []
+        name: date
+        description: 'The date for the availability override (YYYY-MM-DD).'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      availability:
+        custom: []
+        name: availability
+        description: 'The availability value (0, 0.5, 1.0).'
+        required: true
+        example: architecto
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      team_member_id: architecto
+      date: architecto
+      availability: architecto
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+              "date": "2026-02-03",
+              "availability": 0.5
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/capacity/availability/batch
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Batch Update Team Member Availability'
+      description: 'Persist multiple daily availability overrides in a single batch operation.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'The month in YYYY-MM format.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      updates:
+        custom: []
+        name: updates
+        description: 'Array of availability updates.'
+        required: true
+        example:
+          - architecto
+        type: 'string[]'
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'updates[].team_member_id':
+        custom: []
+        name: 'updates[].team_member_id'
+        description: 'The team member UUID.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'updates[].date':
+        custom: []
+        name: 'updates[].date'
+        description: 'The date (YYYY-MM-DD).'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'updates[].availability':
+        custom: []
+        name: 'updates[].availability'
+        description: 'The availability value (0, 0.5, 1).'
+        required: true
+        example: architecto
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+      updates:
+        - architecto
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "saved": 12,
+              "month": "2026-02"
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/holidays
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List Holidays'
+      description: 'Retrieve holidays for a specific month or all holidays when no month is provided.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      month:
+        custom: []
+        name: month
+        description: 'nullable The month in YYYY-MM format.'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      month: 2026-02
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      month: 2026-02
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "date": "2026-02-14",
+                "name": "Company Holiday",
+                "description": "Office closed"
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/holidays
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Create Holiday'
+      description: 'Add a holiday and clear cached capacity data for the related month.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      date:
+        custom: []
+        name: date
+        description: 'Date of the holiday.'
+        required: true
+        example: '2026-02-14'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      name:
+        custom: []
+        name: name
+        description: 'Name of the holiday.'
+        required: true
+        example: "Presidents' Day"
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      description:
+        custom: []
+        name: description
+        description: 'nullable Optional description of the holiday.'
+        required: false
+        example: 'Eius et animi quos velit et.'
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      date: '2026-02-14'
+      name: "Presidents' Day"
+      description: 'Eius et animi quos velit et.'
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "date": "2026-02-14",
+              "name": "Presidents' Day",
+              "description": "Office closed"
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"A holiday already exists for this date.","errors":{"date":["A holiday already exists for this date."]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/holidays/{id}'
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Delete Holiday'
+      description: 'Remove a holiday and clear affected capacity caches.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'The holiday UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "message": "Holiday deleted"
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/ptos
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List PTO Requests'
+      description: 'Fetch PTO requests for a team member, optionally constrained to a month.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      month:
+        custom: []
+        name: month
+        description: 'nullable The month in YYYY-MM format.'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      team_member_id: 550e8400-e29b-41d4-a716-446655440000
+      month: 2026-02
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The <code>id</code> of an existing record in the team_members table.'
+        required: true
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      month:
+        custom: []
+        name: month
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      team_member_id: architecto
+      month: 2026-02
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440001",
+                "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+                "start_date": "2026-02-10",
+                "end_date": "2026-02-12",
+                "status": "pending",
+                "reason": "Family travel"
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/ptos
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Request PTO'
+      description: 'Create a PTO request for a team member and approve it immediately.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'The team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      start_date:
+        custom: []
+        name: start_date
+        description: 'The first day of the PTO.'
+        required: true
+        example: '2026-02-10'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      end_date:
+        custom: []
+        name: end_date
+        description: 'The final day of the PTO.'
+        required: true
+        example: '2026-02-12'
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      reason:
+        custom: []
+        name: reason
+        description: 'nullable Optional reason for the PTO.'
+        required: false
+        example: architecto
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: true
+        deprecated: false
+    cleanBodyParameters:
+      team_member_id: 550e8400-e29b-41d4-a716-446655440000
+      start_date: '2026-02-10'
+      end_date: '2026-02-12'
+      reason: architecto
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440001",
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+              "start_date": "2026-02-10",
+              "end_date": "2026-02-12",
+              "status": "approved",
+              "reason": "Family travel"
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+    uri: 'api/ptos/{id}/approve'
+    metadata:
+      custom: []
+      groupName: 'Capacity Planning'
+      groupDescription: ''
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Approve PTO'
+      description: 'Approve a pending PTO request and refresh the affected capacity caches.'
+      authenticated: false
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'The PTO UUID that needs approval.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440001
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440001
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440001",
+              "status": "approved"
+            }
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints/05.yaml

@@ -0,0 +1,493 @@
+name: 'Resource Allocation'
+description: |-
+
+  Endpoints for managing resource allocations.
+endpoints:
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: api/allocations
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'List allocations / Get allocation matrix'
+      description: 'Get all allocations, optionally filtered by month.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters:
+      month:
+        custom: []
+        name: month
+        description: 'Filter by month (YYYY-MM format).'
+        required: false
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanQueryParameters:
+      month: 2026-02
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "project_id": "550e8400-e29b-41d4-a716-446655440001",
+                "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+                "month": "2026-02",
+                "allocated_hours": 40.00
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/allocations
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Create a new allocation'
+      description: 'Allocate hours for a team member to a project for a specific month.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      project_id:
+        custom: []
+        name: project_id
+        description: 'Project UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440001
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      team_member_id:
+        custom: []
+        name: team_member_id
+        description: 'Team member UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440002
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: true
+        deprecated: false
+      month:
+        custom: []
+        name: month
+        description: 'Month (YYYY-MM format).'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      allocated_hours:
+        custom: []
+        name: allocated_hours
+        description: 'Hours to allocate (must be >= 0).'
+        required: true
+        example: '40'
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      project_id: 550e8400-e29b-41d4-a716-446655440001
+      team_member_id: 550e8400-e29b-41d4-a716-446655440002
+      month: 2026-02
+      allocated_hours: '40'
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "project_id": "550e8400-e29b-41d4-a716-446655440001",
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+              "month": "2026-02",
+              "allocated_hours": 40.00
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"allocated_hours":["Allocated hours must be greater than or equal to 0"]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - GET
+    uri: 'api/allocations/{id}'
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Get a single allocation'
+      description: 'Get details of a specific allocation by ID.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Allocation UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "project_id": "550e8400-e29b-41d4-a716-446655440001",
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+              "month": "2026-02",
+              "allocated_hours": 40.00
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message": "Allocation not found"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - PUT
+      - PATCH
+    uri: 'api/allocations/{id}'
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Update an allocation'
+      description: "Update an existing allocation's hours."
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Allocation UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      allocated_hours:
+        custom: []
+        name: allocated_hours
+        description: 'Hours to allocate (must be >= 0).'
+        required: true
+        example: '60'
+        type: numeric
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      allocated_hours: '60'
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: |-
+          {
+            "data": {
+              "id": "550e8400-e29b-41d4-a716-446655440000",
+              "project_id": "550e8400-e29b-41d4-a716-446655440001",
+              "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+              "month": "2026-02",
+              "allocated_hours": 60.00
+            }
+          }
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message": "Allocation not found"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 422
+        content: '{"message":"Validation failed","errors":{"allocated_hours":["Allocated hours must be greater than or equal to 0"]}}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - DELETE
+    uri: 'api/allocations/{id}'
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Delete an allocation'
+      description: 'Remove an allocation.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters:
+      id:
+        custom: []
+        name: id
+        description: 'Allocation UUID.'
+        required: true
+        example: 550e8400-e29b-41d4-a716-446655440000
+        type: string
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+    cleanUrlParameters:
+      id: 550e8400-e29b-41d4-a716-446655440000
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters: []
+    cleanBodyParameters: []
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 200
+        content: '{"message": "Allocation deleted successfully"}'
+        headers: []
+        description: ''
+      -
+        custom: []
+        status: 404
+        content: '{"message": "Allocation not found"}'
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null
+  -
+    custom: []
+    httpMethods:
+      - POST
+    uri: api/allocations/bulk
+    metadata:
+      custom: []
+      groupName: 'Resource Allocation'
+      groupDescription: |-
+
+        Endpoints for managing resource allocations.
+      subgroup: ''
+      subgroupDescription: ''
+      title: 'Bulk create allocations'
+      description: 'Create or update multiple allocations in a single request.'
+      authenticated: true
+      deprecated: false
+    headers:
+      Content-Type: application/json
+      Accept: application/json
+    urlParameters: []
+    cleanUrlParameters: []
+    queryParameters: []
+    cleanQueryParameters: []
+    bodyParameters:
+      allocations:
+        custom: []
+        name: allocations
+        description: 'Array of allocations.'
+        required: true
+        example:
+          -
+            project_id: ...
+            team_member_id: ...
+            month: 2026-02
+            allocated_hours: 40
+        type: 'string[]'
+        enumValues: []
+        exampleWasSpecified: true
+        nullable: false
+        deprecated: false
+      'allocations[].project_id':
+        custom: []
+        name: 'allocations[].project_id'
+        description: 'Must be a valid UUID. The <code>id</code> of an existing record in the projects table.'
+        required: true
+        example: 6ff8f7f6-1eb3-3525-be4a-3932c805afed
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'allocations[].team_member_id':
+        custom: []
+        name: 'allocations[].team_member_id'
+        description: 'Must be a valid UUID. The <code>id</code> of an existing record in the team_members table.'
+        required: true
+        example: 6b72fe4a-5b40-307c-bc24-f79acf9a1bb9
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'allocations[].month':
+        custom: []
+        name: 'allocations[].month'
+        description: 'Must be a valid date in the format <code>Y-m</code>.'
+        required: true
+        example: 2026-02
+        type: string
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+      'allocations[].allocated_hours':
+        custom: []
+        name: 'allocations[].allocated_hours'
+        description: 'Must be at least 0.'
+        required: true
+        example: 77
+        type: number
+        enumValues: []
+        exampleWasSpecified: false
+        nullable: false
+        deprecated: false
+    cleanBodyParameters:
+      allocations:
+        -
+          project_id: ...
+          team_member_id: ...
+          month: 2026-02
+          allocated_hours: 40
+    fileParameters: []
+    responses:
+      -
+        custom: []
+        status: 201
+        content: |-
+          {
+            "data": [
+              {
+                "id": "550e8400-e29b-41d4-a716-446655440000",
+                "project_id": "550e8400-e29b-41d4-a716-446655440001",
+                "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+                "month": "2026-02",
+                "allocated_hours": 40.00
+              }
+            ]
+          }
+        headers: []
+        description: ''
+    responseFields: []
+    auth: []
+    controller: null
+    method: null
+    route: null

backend/.scribe/endpoints/custom.0.yaml

@@ -0,0 +1,53 @@
+# To include an endpoint that isn't a part of your Laravel app (or belongs to a vendor package),
+# you can define it in a custom.*.yaml file, like this one.
+# Each custom file should contain an array of endpoints. Here's an example:
+# See https://scribe.knuckles.wtf/laravel/documenting/custom-endpoints#extra-sorting-groups-in-custom-endpoint-files for more options
+
+#- httpMethods:
+#    - POST
+#  uri: api/doSomething/{param}
+#  metadata:
+#    groupName: The group the endpoint belongs to. Can be a new group or an existing group.
+#    groupDescription: A description for the group. You don't need to set this for every endpoint; once is enough.
+#    subgroup: You can add a subgroup, too.
+#    title: Do something
+#    description: 'This endpoint allows you to do something.'
+#    authenticated: false
+#  headers:
+#    Content-Type: application/json
+#    Accept: application/json
+#  urlParameters:
+#    param:
+#      name: param
+#      description: A URL param for no reason.
+#      required: true
+#      example: 2
+#      type: integer
+#  queryParameters:
+#    speed:
+#      name: speed
+#      description: How fast the thing should be done. Can be `slow` or `fast`.
+#      required: false
+#      example: fast
+#      type: string
+#  bodyParameters:
+#    something:
+#      name: something
+#      description: The things we should do.
+#      required: true
+#      example:
+#        - string 1
+#        - string 2
+#      type: 'string[]'
+#  responses:
+#    - status: 200
+#      description: 'When the thing was done smoothly.'
+#      content: # Your response content can be an object, an array, a string or empty.
+#         {
+#           "hey": "ho ho ho"
+#         }
+#  responseFields:
+#    hey:
+#      name: hey
+#      description: Who knows?
+#      type: string # This is optional

backend/.scribe/intro.md

@@ -0,0 +1,13 @@
+# Introduction
+
+
+
+<aside>
+    <strong>Base URL</strong>: <code>http://localhost</code>
+</aside>
+
+    This documentation aims to provide all the information you need to work with our API.
+
+    <aside>As you scroll, you'll see code examples for working with the API in different programming languages in the dark area to the right (or as part of the content on mobile).
+    You can switch the language used with the tabs at the top right (or from the nav menu at the top left on mobile).</aside>
+

backend/AGENTS.md

@@ -0,0 +1,234 @@
+<laravel-boost-guidelines>
+=== foundation rules ===
+
+# Laravel Boost Guidelines
+
+The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.
+
+## Foundational Context
+
+This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
+
+- php - 8.5.2
+- laravel/framework (LARAVEL) - v12
+- laravel/prompts (PROMPTS) - v0
+- laravel/mcp (MCP) - v0
+- laravel/pint (PINT) - v1
+- laravel/sail (SAIL) - v1
+- pestphp/pest (PEST) - v3
+- phpunit/phpunit (PHPUNIT) - v11
+
+## Skills Activation
+
+This project has domain-specific skills available. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
+
+- `pest-testing` — Tests applications using the Pest 3 PHP framework. Activates when writing tests, creating unit or feature tests, adding assertions, testing Livewire components, architecture testing, debugging test failures, working with datasets or mocking; or when the user mentions test, spec, TDD, expects, assertion, coverage, or needs to verify functionality works.
+
+## Conventions
+
+- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
+- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
+- Check for existing components to reuse before writing a new one.
+
+## Verification Scripts
+
+- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.
+
+## Application Structure & Architecture
+
+- Stick to existing directory structure; don't create new base folders without approval.
+- Do not change the application's dependencies without approval.
+
+## Frontend Bundling
+
+- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
+
+## Documentation Files
+
+- You must only create documentation files if explicitly requested by the user.
+
+## Replies
+
+- Be concise in your explanations - focus on what's important rather than explaining obvious details.
+
+=== boost rules ===
+
+# Laravel Boost
+
+- Laravel Boost is an MCP server that comes with powerful tools designed specifically for this application. Use them.
+
+## Artisan
+
+- Use the `list-artisan-commands` tool when you need to call an Artisan command to double-check the available parameters.
+
+## URLs
+
+- Whenever you share a project URL with the user, you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain/IP, and port.
+
+## Tinker / Debugging
+
+- You should use the `tinker` tool when you need to execute PHP to debug code or query Eloquent models directly.
+- Use the `database-query` tool when you only need to read from the database.
+- Use the `database-schema` tool to inspect table structure before writing migrations or models.
+
+## Reading Browser Logs With the `browser-logs` Tool
+
+- You can read browser logs, errors, and exceptions using the `browser-logs` tool from Boost.
+- Only recent browser logs will be useful - ignore old logs.
+
+## Searching Documentation (Critically Important)
+
+- Boost comes with a powerful `search-docs` tool you should use before trying other approaches when working with Laravel or Laravel ecosystem packages. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
+- Search the documentation before making code changes to ensure we are taking the correct approach.
+- Use multiple, broad, simple, topic-based queries at once. For example: `['rate limiting', 'routing rate limiting', 'routing']`. The most relevant results will be returned first.
+- Do not add package names to queries; package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
+
+### Available Search Syntax
+
+1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'.
+2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit".
+3. Quoted Phrases (Exact Position) - query="infinite scroll" - words must be adjacent and in that order.
+4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit".
+5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms.
+
+=== php rules ===
+
+# PHP
+
+- Always use curly braces for control structures, even for single-line bodies.
+
+## Constructors
+
+- Use PHP 8 constructor property promotion in `__construct()`.
+    - `public function __construct(public GitHub $github) { }`
+- Do not allow empty `__construct()` methods with zero parameters unless the constructor is private.
+
+## Type Declarations
+
+- Always use explicit return type declarations for methods and functions.
+- Use appropriate PHP type hints for method parameters.
+
+<!-- Explicit Return Types and Method Params -->
+```php
+protected function isAccessible(User $user, ?string $path = null): bool
+{
+    ...
+}
+```
+
+## Enums
+
+- Typically, keys in an Enum should be TitleCase. For example: `FavoritePerson`, `BestLake`, `Monthly`.
+
+## Comments
+
+- Prefer PHPDoc blocks over inline comments. Never use comments within the code itself unless the logic is exceptionally complex.
+
+## PHPDoc Blocks
+
+- Add useful array shape type definitions when appropriate.
+
+=== tests rules ===
+
+# Test Enforcement
+
+- Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
+- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test --compact` with a specific filename or filter.
+
+=== laravel/core rules ===
+
+# Do Things the Laravel Way
+
+- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using the `list-artisan-commands` tool.
+- If you're creating a generic PHP class, use `php artisan make:class`.
+- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
+
+## Database
+
+- Always use proper Eloquent relationship methods with return type hints. Prefer relationship methods over raw queries or manual joins.
+- Use Eloquent models and relationships before suggesting raw database queries.
+- Avoid `DB::`; prefer `Model::query()`. Generate code that leverages Laravel's ORM capabilities rather than bypassing them.
+- Generate code that prevents N+1 query problems by using eager loading.
+- Use Laravel's query builder for very complex database operations.
+
+### Model Creation
+
+- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `list-artisan-commands` to check the available options to `php artisan make:model`.
+
+### APIs & Eloquent Resources
+
+- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
+
+## Controllers & Validation
+
+- Always create Form Request classes for validation rather than inline validation in controllers. Include both validation rules and custom error messages.
+- Check sibling Form Requests to see if the application uses array or string based validation rules.
+
+## Authentication & Authorization
+
+- Use Laravel's built-in authentication and authorization features (gates, policies, Sanctum, etc.).
+
+## URL Generation
+
+- When generating links to other pages, prefer named routes and the `route()` function.
+
+## Queues
+
+- Use queued jobs for time-consuming operations with the `ShouldQueue` interface.
+
+## Configuration
+
+- Use environment variables only in configuration files - never use the `env()` function directly outside of config files. Always use `config('app.name')`, not `env('APP_NAME')`.
+
+## Testing
+
+- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
+- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
+- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
+
+## Vite Error
+
+- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
+
+=== laravel/v12 rules ===
+
+# Laravel 12
+
+- CRITICAL: ALWAYS use `search-docs` tool for version-specific Laravel documentation and updated code examples.
+- Since Laravel 11, Laravel has a new streamlined file structure which this project uses.
+
+## Laravel 12 Structure
+
+- In Laravel 12, middleware are no longer registered in `app/Http/Kernel.php`.
+- Middleware are configured declaratively in `bootstrap/app.php` using `Application::configure()->withMiddleware()`.
+- `bootstrap/app.php` is the file to register middleware, exceptions, and routing files.
+- `bootstrap/providers.php` contains application specific service providers.
+- The `app\Console\Kernel.php` file no longer exists; use `bootstrap/app.php` or `routes/console.php` for console configuration.
+- Console commands in `app/Console/Commands/` are automatically available and do not require manual registration.
+
+## Database
+
+- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
+- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
+
+### Models
+
+- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
+
+=== pint/core rules ===
+
+# Laravel Pint Code Formatter
+
+- You must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
+- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.
+
+=== pest/core rules ===
+
+## Pest
+
+- This project uses Pest for testing. Create tests: `php artisan make:test --pest {name}`.
+- Run tests: `php artisan test --compact` or filter: `php artisan test --compact --filter=testName`.
+- Do NOT delete tests without approval.
+- CRITICAL: ALWAYS use `search-docs` tool for version-specific Pest documentation and updated code examples.
+- IMPORTANT: Activate `pest-testing` every time you're working with a Pest or testing-related task.
+</laravel-boost-guidelines>

backend/Dockerfile

@@ -0,0 +1,43 @@
+FROM php:8.4-cli
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y \
+    git \
+    curl \
+    libpng-dev \
+    libonig-dev \
+    libxml2-dev \
+    zip \
+    unzip \
+    libpq-dev \
+    libzip-dev \
+    && docker-php-ext-install pdo pdo_pgsql mbstring exif pcntl bcmath gd zip
+
+# Install Redis extension
+RUN pecl install redis && docker-php-ext-enable redis
+
+# Install Composer
+COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
+
+# Set working directory
+WORKDIR /var/www/html
+
+# Copy existing application directory contents
+COPY . .
+
+# Install PHP dependencies
+RUN composer install --no-interaction --optimize-autoloader
+
+# Install Laravel Boost
+#RUN php artisan boost:install
+#RUN php artisan vendor:publish --provider="Laravel\Boost\BoostServiceProvider"
+RUN php artisan config:clear
+RUN composer dump-autoload
+
+# Set permissions
+RUN chmod -R 755 /var/www/html/storage
+
+EXPOSE 3000
+
+# Run Laravel development server
+CMD ["php", "artisan", "serve", "--host=0.0.0.0", "--port=3000"]

backend/README.md

@@ -0,0 +1,59 @@
+<p align="center"><a href="https://laravel.com" target="_blank"><img src="https://raw.githubusercontent.com/laravel/art/master/logo-lockup/5%20SVG/2%20CMYK/1%20Full%20Color/laravel-logolockup-cmyk-red.svg" width="400" alt="Laravel Logo"></a></p>
+
+<p align="center">
+<a href="https://github.com/laravel/framework/actions"><img src="https://github.com/laravel/framework/workflows/tests/badge.svg" alt="Build Status"></a>
+<a href="https://packagist.org/packages/laravel/framework"><img src="https://img.shields.io/packagist/dt/laravel/framework" alt="Total Downloads"></a>
+<a href="https://packagist.org/packages/laravel/framework"><img src="https://img.shields.io/packagist/v/laravel/framework" alt="Latest Stable Version"></a>
+<a href="https://packagist.org/packages/laravel/framework"><img src="https://img.shields.io/packagist/l/laravel/framework" alt="License"></a>
+</p>
+
+## About Laravel
+
+Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable and creative experience to be truly fulfilling. Laravel takes the pain out of development by easing common tasks used in many web projects, such as:
+
+- [Simple, fast routing engine](https://laravel.com/docs/routing).
+- [Powerful dependency injection container](https://laravel.com/docs/container).
+- Multiple back-ends for [session](https://laravel.com/docs/session) and [cache](https://laravel.com/docs/cache) storage.
+- Expressive, intuitive [database ORM](https://laravel.com/docs/eloquent).
+- Database agnostic [schema migrations](https://laravel.com/docs/migrations).
+- [Robust background job processing](https://laravel.com/docs/queues).
+- [Real-time event broadcasting](https://laravel.com/docs/broadcasting).
+
+Laravel is accessible, powerful, and provides tools required for large, robust applications.
+
+## Learning Laravel
+
+Laravel has the most extensive and thorough [documentation](https://laravel.com/docs) and video tutorial library of all modern web application frameworks, making it a breeze to get started with the framework. You can also check out [Laravel Learn](https://laravel.com/learn), where you will be guided through building a modern Laravel application.
+
+If you don't feel like reading, [Laracasts](https://laracasts.com) can help. Laracasts contains thousands of video tutorials on a range of topics including Laravel, modern PHP, unit testing, and JavaScript. Boost your skills by digging into our comprehensive video library.
+
+## Laravel Sponsors
+
+We would like to extend our thanks to the following sponsors for funding Laravel development. If you are interested in becoming a sponsor, please visit the [Laravel Partners program](https://partners.laravel.com).
+
+### Premium Partners
+
+- **[Vehikl](https://vehikl.com)**
+- **[Tighten Co.](https://tighten.co)**
+- **[Kirschbaum Development Group](https://kirschbaumdevelopment.com)**
+- **[64 Robots](https://64robots.com)**
+- **[Curotec](https://www.curotec.com/services/technologies/laravel)**
+- **[DevSquad](https://devsquad.com/hire-laravel-developers)**
+- **[Redberry](https://redberry.international/laravel-development)**
+- **[Active Logic](https://activelogic.com)**
+
+## Contributing
+
+Thank you for considering contributing to the Laravel framework! The contribution guide can be found in the [Laravel documentation](https://laravel.com/docs/contributions).
+
+## Code of Conduct
+
+In order to ensure that the Laravel community is welcoming to all, please review and abide by the [Code of Conduct](https://laravel.com/docs/contributions#code-of-conduct).
+
+## Security Vulnerabilities
+
+If you discover a security vulnerability within Laravel, please send an e-mail to Taylor Otwell via [taylor@laravel.com](mailto:taylor@laravel.com). All security vulnerabilities will be promptly addressed.
+
+## License
+
+The Laravel framework is open-sourced software licensed under the [MIT license](https://opensource.org/licenses/MIT).

backend/app/Http/Controllers/Api/AllocationController.php

@@ -0,0 +1,408 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Resources\AllocationResource;
+use App\Models\Allocation;
+use App\Services\AllocationMatrixService;
+use App\Services\AllocationValidationService;
+use App\Services\CapacityService;
+use App\Services\VarianceCalculator;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
+
+/**
+ * @group Resource Allocation
+ *
+ * Endpoints for managing resource allocations.
+ */
+class AllocationController extends Controller
+{
+    protected AllocationValidationService $validationService;
+
+    public function __construct(
+        AllocationValidationService $validationService,
+        protected VarianceCalculator $varianceCalculator,
+        protected CapacityService $capacityService,
+        protected AllocationMatrixService $allocationMatrixService
+    ) {
+        $this->validationService = $validationService;
+    }
+
+    /**
+     * List allocations / Get allocation matrix
+     *
+     * Get all allocations, optionally filtered by month.
+     *
+     * @authenticated
+     *
+     * @queryParam month string Filter by month (YYYY-MM format). Example: 2026-02
+     *
+     * @response 200 {
+     *   "data": [
+     *     {
+     *       "id": "550e8400-e29b-41d4-a716-446655440000",
+     *       "project_id": "550e8400-e29b-41d4-a716-446655440001",
+     *       "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+     *       "month": "2026-02",
+     *       "allocated_hours": 40.00,
+     *       "is_untracked": false,
+     *       "row_variance": { "allocated_total": 80, "planned_month": 100, "variance": -20, "status": "UNDER" },
+     *       "column_variance": { "allocated": 80, "capacity": 160, "variance": -80, "status": "UNDER" }
+     *     }
+     *   ]
+     * }
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $month = $request->query('month');
+
+        $query = Allocation::with(['project', 'teamMember']);
+
+        if ($month) {
+            // Convert YYYY-MM to YYYY-MM-01 for date comparison
+            $monthDate = $month.'-01';
+            $query->where('month', $monthDate);
+        }
+
+        $allocations = $query->get();
+
+        // Compute variance indicators for each allocation if month is specified
+        if ($month) {
+            $allocations->each(function ($allocation) use ($month) {
+                // Add untracked flag
+                $allocation->is_untracked = $allocation->team_member_id === null;
+
+                // Add row variance (project level)
+                $rowVariance = $this->varianceCalculator->calculateRowVariance(
+                    $allocation->project_id,
+                    $month
+                );
+                $allocation->row_variance = $rowVariance;
+
+                // Add column variance only for tracked allocations
+                if ($allocation->team_member_id !== null) {
+                    $columnVariance = $this->varianceCalculator->calculateColumnVariance(
+                        $allocation->team_member_id,
+                        $month,
+                        $this->capacityService
+                    );
+                    $allocation->column_variance = $columnVariance;
+                } else {
+                    $allocation->column_variance = null;
+                }
+            });
+        }
+
+        return $this->wrapResource(AllocationResource::collection($allocations));
+    }
+
+    /**
+     * Create a new allocation
+     *
+     * Allocate hours for a team member to a project for a specific month.
+     *
+     * @authenticated
+     *
+     * @bodyParam project_id string required Project UUID. Example: 550e8400-e29b-41d4-a716-446655440001
+     * @bodyParam team_member_id string optional Team member UUID (null for untracked). Example: 550e8400-e29b-41d4-a716-446655440002
+     * @bodyParam month string required Month (YYYY-MM format). Example: 2026-02
+     * @bodyParam allocated_hours numeric required Hours to allocate (must be >= 0). Example: 40
+     *
+     * @response 201 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "project_id": "550e8400-e29b-41d4-a716-446655440001",
+     *     "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+     *     "month": "2026-02",
+     *     "allocated_hours": 40.00
+     *   }
+     * }
+     * @response 422 {"message":"Validation failed","errors":{"allocated_hours":["Allocated hours must be greater than or equal to 0"]}}
+     */
+    public function store(Request $request): JsonResponse
+    {
+        $validator = Validator::make($request->all(), [
+            'project_id' => 'required|uuid|exists:projects,id',
+            'team_member_id' => 'nullable|uuid|exists:team_members,id',
+            'month' => 'required|date_format:Y-m',
+            'allocated_hours' => 'required|numeric|min:0',
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        // Validate against capacity and approved estimate (skip for untracked)
+        $teamMemberId = $request->input('team_member_id');
+        $capacityValidation = ['valid' => true, 'warning' => null, 'utilization' => 0];
+
+        if ($teamMemberId) {
+            $capacityValidation = $this->validationService->validateCapacity(
+                $teamMemberId,
+                $request->input('month'),
+                (float) $request->input('allocated_hours')
+            );
+        }
+
+        $estimateValidation = $this->validationService->validateApprovedEstimate(
+            $request->input('project_id'),
+            $request->input('month'),
+            (float) $request->input('allocated_hours')
+        );
+
+        // Convert YYYY-MM to YYYY-MM-01 for database storage
+        $data = $request->all();
+        $data['month'] = $data['month'].'-01';
+
+        $allocation = Allocation::create($data);
+        $allocation->load(['project', 'teamMember']);
+
+        $response = new AllocationResource($allocation);
+        $responseData = $response->toArray($request);
+
+        // Add variance data
+        $month = $request->input('month');
+        $responseData['is_untracked'] = $teamMemberId === null;
+
+        // Row variance (project level)
+        $rowVariance = $this->varianceCalculator->calculateRowVariance(
+            $allocation->project_id,
+            $month
+        );
+        $responseData['row_variance'] = $rowVariance;
+
+        // Column variance (member level) - only for tracked allocations
+        if ($teamMemberId) {
+            $columnVariance = $this->varianceCalculator->calculateColumnVariance(
+                $teamMemberId,
+                $month,
+                $this->capacityService
+            );
+            $responseData['column_variance'] = $columnVariance;
+            $responseData['utilization'] = $capacityValidation['utilization'];
+        } else {
+            $responseData['column_variance'] = null;
+        }
+
+        // Add validation warnings/info to response
+        $responseData['warnings'] = [];
+        if ($capacityValidation['warning']) {
+            $responseData['warnings'][] = $capacityValidation['warning'];
+        }
+        if ($estimateValidation['message']) {
+            $responseData['warnings'][] = $estimateValidation['message'];
+        }
+
+        return response()->json(['data' => $responseData], 201);
+    }
+
+    /**
+     * Get a single allocation
+     *
+     * Get details of a specific allocation by ID.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Allocation UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "project_id": "550e8400-e29b-41d4-a716-446655440001",
+     *     "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+     *     "month": "2026-02",
+     *     "allocated_hours": 40.00
+     *   }
+     * }
+     * @response 404 {"message": "Allocation not found"}
+     */
+    public function show(string $id): JsonResponse
+    {
+        $allocation = Allocation::with(['project', 'teamMember'])->find($id);
+
+        if (! $allocation) {
+            return response()->json([
+                'message' => 'Allocation not found',
+            ], 404);
+        }
+
+        return $this->wrapResource(new AllocationResource($allocation));
+    }
+
+    /**
+     * Update an allocation
+     *
+     * Update an existing allocation's hours.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Allocation UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @bodyParam allocated_hours numeric required Hours to allocate (must be >= 0). Example: 60
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "project_id": "550e8400-e29b-41d4-a716-446655440001",
+     *     "team_member_id": "550e8400-e29b-41d4-a716-446655440002",
+     *     "month": "2026-02",
+     *     "allocated_hours": 60.00
+     *   }
+     * }
+     * @response 404 {"message": "Allocation not found"}
+     * @response 422 {"message":"Validation failed","errors":{"allocated_hours":["Allocated hours must be greater than or equal to 0"]}}
+     */
+    public function update(Request $request, string $id): JsonResponse
+    {
+        $allocation = Allocation::find($id);
+
+        if (! $allocation) {
+            return response()->json([
+                'message' => 'Allocation not found',
+            ], 404);
+        }
+
+        $validator = Validator::make($request->all(), [
+            'allocated_hours' => 'required|numeric|min:0',
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        $allocation->update($request->all());
+        $allocation->load(['project', 'teamMember']);
+
+        return $this->wrapResource(new AllocationResource($allocation));
+    }
+
+    /**
+     * Delete an allocation
+     *
+     * Remove an allocation.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Allocation UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @response 200 {"message": "Allocation deleted successfully"}
+     * @response 404 {"message": "Allocation not found"}
+     */
+    public function destroy(string $id): JsonResponse
+    {
+        $allocation = Allocation::find($id);
+
+        if (! $allocation) {
+            return response()->json([
+                'message' => 'Allocation not found',
+            ], 404);
+        }
+
+        $allocation->delete();
+
+        return response()->json([
+            'message' => 'Allocation deleted successfully',
+        ]);
+    }
+
+    /**
+     * Bulk create allocations
+     *
+     * Create multiple allocations in a single request.
+     * Supports partial success - valid items are created, invalid items are reported.
+     *
+     * @authenticated
+     *
+     * @bodyParam allocations array required Array of allocations. Example: [{"project_id": "...", "team_member_id": "...", "month": "2026-02", "allocated_hours": 40}]
+     *
+     * @response 201 {
+     *   "data": [
+     *     { "index": 0, "id": "...", "status": "created" }
+     *   ],
+     *   "failed": [
+     *     { "index": 1, "errors": { "allocated_hours": ["..."] } }
+     *   ],
+     *   "summary": { "created": 1, "failed": 1 }
+     * }
+     */
+    public function bulkStore(Request $request): JsonResponse
+    {
+        // Basic validation only - individual item validation happens in the loop
+        // This allows partial success even if some items have invalid data
+        $validator = Validator::make($request->all(), [
+            'allocations' => 'required|array|min:1',
+            'allocations.*.project_id' => 'required',
+            'allocations.*.month' => 'required',
+            'allocations.*.allocated_hours' => 'required|numeric',
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        $data = [];
+        $failed = [];
+        $created = 0;
+        $failedCount = 0;
+
+        foreach ($request->input('allocations') as $index => $allocationData) {
+            // Convert YYYY-MM to YYYY-MM-01 for database storage
+            $allocationData['month'] = $allocationData['month'].'-01';
+
+            // Validate each item individually (for partial bulk success)
+            $itemValidator = Validator::make($allocationData, [
+                'project_id' => 'required|uuid|exists:projects,id',
+                'team_member_id' => 'nullable|uuid|exists:team_members,id',
+                'month' => 'required|date',
+                'allocated_hours' => 'required|numeric|min:0',
+            ]);
+
+            if ($itemValidator->fails()) {
+                $failed[] = [
+                    'index' => $index,
+                    'errors' => $itemValidator->errors()->toArray(),
+                ];
+                $failedCount++;
+
+                continue;
+            }
+
+            try {
+                $allocation = Allocation::create($allocationData);
+                $data[] = [
+                    'index' => $index,
+                    'id' => $allocation->id,
+                    'status' => 'created',
+                ];
+                $created++;
+            } catch (\Exception $e) {
+                $failed[] = [
+                    'index' => $index,
+                    'errors' => ['allocation' => ['Failed to create allocation: '.$e->getMessage()]],
+                ];
+                $failedCount++;
+            }
+        }
+
+        return response()->json([
+            'data' => $data,
+            'failed' => $failed,
+            'summary' => [
+                'created' => $created,
+                'failed' => $failedCount,
+            ],
+        ], 201);
+    }
+}

backend/app/Http/Controllers/Api/AuthController.php

@@ -0,0 +1,189 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Resources\UserResource;
+use App\Models\User;
+use App\Services\JwtService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Validator;
+
+/**
+ * @group Authentication
+ *
+ * Endpoints for JWT authentication and session lifecycle.
+ */
+class AuthController extends Controller
+{
+    /**
+     * JWT Service instance
+     */
+    protected JwtService $jwtService;
+
+    /**
+     * Constructor
+     */
+    public function __construct(JwtService $jwtService)
+    {
+        $this->jwtService = $jwtService;
+    }
+
+    /**
+     * Login and get tokens
+     *
+     * Authenticate with email and password to receive an access token and refresh token.
+     *
+     * @bodyParam email string required User email address. Example: user@example.com
+     * @bodyParam password string required User password. Example: secret123
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "name": "Alice Johnson",
+     *     "email": "user@example.com",
+     *     "role": "manager",
+     *     "active": true,
+     *     "created_at": "2026-01-01T00:00:00Z",
+     *     "updated_at": "2026-01-01T00:00:00Z"
+     *   },
+     *   "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
+     *   "refresh_token": "abc123def456",
+     *   "token_type": "bearer",
+     *   "expires_in": 3600
+     * }
+     * @response 401 {"message":"Invalid credentials"}
+     * @response 403 {"message":"Account is inactive"}
+     * @response 422 {"errors":{"email":["The email field is required."],"password":["The password field is required."]}}
+     */
+    public function login(Request $request): JsonResponse
+    {
+        $validator = Validator::make($request->all(), [
+            'email' => 'required|string|email',
+            'password' => 'required|string',
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        $user = User::where('email', $request->email)->first();
+
+        if (! $user || ! Hash::check($request->password, $user->password)) {
+            return response()->json([
+                'message' => 'Invalid credentials',
+            ], 401);
+        }
+
+        if (! $user->active) {
+            return response()->json([
+                'message' => 'Account is inactive',
+            ], 403);
+        }
+
+        $accessToken = $this->jwtService->generateAccessToken($user);
+        $refreshToken = $this->jwtService->generateRefreshToken($user);
+
+        return (new UserResource($user))->additional([
+            'access_token' => $accessToken,
+            'refresh_token' => $refreshToken,
+            'token_type' => 'bearer',
+            'expires_in' => $this->jwtService->getAccessTokenTTL(),
+        ])->response();
+    }
+
+    /**
+     * Refresh access token
+     *
+     * Exchange a valid refresh token for a new access token and refresh token pair.
+     *
+     * @authenticated
+     *
+     * @bodyParam refresh_token string required Refresh token returned by login. Example: abc123def456
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "name": "Alice Johnson",
+     *     "email": "user@example.com",
+     *     "role": "manager",
+     *     "active": true,
+     *     "created_at": "2026-01-01T00:00:00Z",
+     *     "updated_at": "2026-01-01T00:00:00Z"
+     *   },
+     *   "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
+     *   "refresh_token": "newtoken123",
+     *   "token_type": "bearer",
+     *   "expires_in": 3600
+     * }
+     * @response 401 {"message":"Invalid or expired refresh token"}
+     */
+    public function refresh(Request $request): JsonResponse
+    {
+        $refreshToken = $request->input('refresh_token');
+
+        if (empty($refreshToken)) {
+            return response()->json([
+                'message' => 'Refresh token is required',
+            ], 422);
+        }
+
+        $userId = $this->jwtService->getUserIdFromRefreshToken($refreshToken);
+
+        if (! $userId) {
+            return response()->json([
+                'message' => 'Invalid or expired refresh token',
+            ], 401);
+        }
+
+        $user = User::find($userId);
+
+        if (! $user) {
+            return response()->json([
+                'message' => 'Invalid or expired refresh token',
+            ], 401);
+        }
+
+        $this->jwtService->invalidateRefreshToken($refreshToken, $userId);
+
+        $accessToken = $this->jwtService->generateAccessToken($user);
+        $newRefreshToken = $this->jwtService->generateRefreshToken($user);
+
+        return (new UserResource($user))->additional([
+            'access_token' => $accessToken,
+            'refresh_token' => $newRefreshToken,
+            'token_type' => 'bearer',
+            'expires_in' => $this->jwtService->getAccessTokenTTL(),
+        ])->response();
+    }
+
+    /**
+     * Logout current session
+     *
+     * Invalidate a refresh token and end the active authenticated session.
+     *
+     * @authenticated
+     *
+     * @bodyParam refresh_token string Optional refresh token to invalidate immediately. Example: abc123def456
+     *
+     * @response 200 {"message":"Logged out successfully"}
+     */
+    public function logout(Request $request): JsonResponse
+    {
+        $user = $request->user();
+        $refreshToken = $request->input('refresh_token');
+
+        if ($refreshToken) {
+            $this->jwtService->invalidateRefreshToken($refreshToken, $user?->id);
+        }
+
+        return response()->json([
+            'message' => 'Logged out successfully',
+        ]);
+    }
+}

backend/app/Http/Controllers/Api/CapacityController.php

@@ -0,0 +1,241 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Resources\CapacityResource;
+use App\Http\Resources\RevenueResource;
+use App\Http\Resources\TeamCapacityResource;
+use App\Http\Resources\TeamMemberAvailabilityResource;
+use App\Models\TeamMember;
+use App\Services\CapacityService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+
+class CapacityController extends Controller
+{
+    public function __construct(protected CapacityService $capacityService) {}
+
+    /**
+     * Get Individual Capacity
+     *
+     * Calculate capacity for a specific team member in a given month.
+     *
+     * @group Capacity Planning
+     *
+     * @urlParam month string required The month in YYYY-MM format. Example: 2026-02
+     * @urlParam team_member_id string required The team member UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @response {
+     *   "data": {
+     *     "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "month": "2026-02",
+     *     "working_days": 20,
+     *     "person_days": 18.5,
+     *     "hours": 148,
+     *     "details": [
+     *       {
+     *         "date": "2026-02-02",
+     *         "availability": 1,
+     *         "is_pto": false
+     *       }
+     *     ]
+     *   }
+     * }
+     */
+    public function individual(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'month' => 'required|date_format:Y-m',
+            'team_member_id' => 'required|exists:team_members,id',
+        ]);
+
+        $capacity = $this->capacityService->calculateIndividualCapacity($data['team_member_id'], $data['month']);
+        $workingDays = $this->capacityService->calculateWorkingDays($data['month']);
+
+        $payload = [
+            'team_member_id' => $data['team_member_id'],
+            'month' => $data['month'],
+            'working_days' => $workingDays,
+            'person_days' => $capacity['person_days'],
+            'hours' => $capacity['hours'],
+            'details' => $capacity['details'],
+        ];
+
+        return $this->wrapResource(new CapacityResource($payload));
+    }
+
+    /**
+     * Get Team Capacity
+     *
+     * Summarize the combined capacity for all active team members in a month.
+     *
+     * @group Capacity Planning
+     *
+     * @urlParam month string required The month in YYYY-MM format. Example: 2026-02
+     *
+     * @response {
+     *   "data": {
+     *     "month": "2026-02",
+     *     "total_person_days": 180.5,
+     *     "total_hours": 1444,
+     *     "members": [
+     *       {
+     *         "id": "550e8400-e29b-41d4-a716-446655440000",
+     *         "name": "Ada Lovelace",
+     *         "person_days": 18.5,
+     *         "hours": 148
+     *       }
+     *     ]
+     *   }
+     * }
+     */
+    public function team(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'month' => 'required|date_format:Y-m',
+        ]);
+
+        $payload = $this->capacityService->calculateTeamCapacity($data['month']);
+
+        return $this->wrapResource(new TeamCapacityResource($payload));
+    }
+
+    /**
+     * Get Possible Revenue
+     *
+     * Estimate monthly revenue based on capacity hours and hourly rates.
+     *
+     * @group Capacity Planning
+     *
+     * @urlParam month string required The month in YYYY-MM format. Example: 2026-02
+     *
+     * @response {
+     *   "data": {
+     *     "month": "2026-02",
+     *     "possible_revenue": 21500.25,
+     *     "member_revenues": [
+     *       {
+     *         "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+     *         "team_member_name": "Ada Lovelace",
+     *         "hours": 148,
+     *         "hourly_rate": 150.0,
+     *         "revenue": 22200.0
+     *       }
+     *     ]
+     *   }
+     * }
+     */
+    public function revenue(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'month' => 'required|date_format:Y-m',
+        ]);
+
+        $revenue = $this->capacityService->calculatePossibleRevenue($data['month']);
+        $memberRevenues = [];
+
+        TeamMember::where('active', true)
+            ->get()
+            ->each(function (TeamMember $member) use ($data, &$memberRevenues): void {
+                $capacity = $this->capacityService->calculateIndividualCapacity($member->id, $data['month']);
+                $hours = $capacity['hours'];
+                $hourlyRate = $member->hourly_rate !== null ? (float) $member->hourly_rate : null;
+                $memberRevenue = $hourlyRate !== null ? round($hours * $hourlyRate, 2) : 0.0;
+
+                $memberRevenues[] = [
+                    'team_member_id' => $member->id,
+                    'team_member_name' => $member->name,
+                    'hours' => $hours,
+                    'hourly_rate' => $hourlyRate,
+                    'revenue' => $memberRevenue,
+                ];
+            });
+
+        return $this->wrapResource(new RevenueResource([
+            'month' => $data['month'],
+            'possible_revenue' => $revenue,
+            'member_revenues' => $memberRevenues,
+        ]));
+    }
+
+    /**
+     * Save Team Member Availability
+     *
+     * Persist a daily availability override and refresh cached capacity totals.
+     *
+     * @group Capacity Planning
+     *
+     * @bodyParam team_member_id string required The team member UUID.
+     * @bodyParam date string required The date for the availability override (YYYY-MM-DD).
+     * @bodyParam availability numeric required The availability value (0, 0.5, 1.0).
+     *
+     * @response 201 {
+     *   "data": {
+     *     "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "date": "2026-02-03",
+     *     "availability": 0.5
+     *   }
+     * }
+     */
+    public function saveAvailability(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'team_member_id' => 'required|exists:team_members,id',
+            'date' => 'required|date_format:Y-m-d',
+            'availability' => ['required', 'numeric', Rule::in([0, 0.5, 1])],
+        ]);
+
+        $entry = $this->capacityService->upsertTeamMemberAvailability(
+            $data['team_member_id'],
+            $data['date'],
+            (float) $data['availability']
+        );
+
+        return $this->wrapResource(new TeamMemberAvailabilityResource($entry), 201);
+    }
+
+    /**
+     * Batch Update Team Member Availability
+     *
+     * Persist multiple daily availability overrides in a single batch operation.
+     *
+     * @group Capacity Planning
+     *
+     * @bodyParam month string required The month in YYYY-MM format. Example: 2026-02
+     * @bodyParam updates array required Array of availability updates.
+     * @bodyParam updates[].team_member_id string required The team member UUID.
+     * @bodyParam updates[].date string required The date (YYYY-MM-DD).
+     * @bodyParam updates[].availability numeric required The availability value (0, 0.5, 1).
+     *
+     * @response {
+     *   "data": {
+     *     "saved": 12,
+     *     "month": "2026-02"
+     *   }
+     * }
+     */
+    public function batchUpdateAvailability(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'month' => 'required|date_format:Y-m',
+            'updates' => 'present|array',
+            'updates.*.team_member_id' => 'required_with:updates|exists:team_members,id',
+            'updates.*.date' => 'required_with:updates|date_format:Y-m-d',
+            'updates.*.availability' => ['required_with:updates', 'numeric', Rule::in([0, 0.5, 1])],
+        ]);
+
+        $saved = $this->capacityService->batchUpsertAvailability(
+            $data['updates'],
+            $data['month']
+        );
+
+        return response()->json([
+            'data' => [
+                'saved' => $saved,
+                'month' => $data['month'],
+            ],
+        ]);
+    }
+}

backend/app/Http/Controllers/Api/HolidayController.php

@@ -0,0 +1,121 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Resources\HolidayResource;
+use App\Models\Holiday;
+use App\Services\CapacityService;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class HolidayController extends Controller
+{
+    public function __construct(protected CapacityService $capacityService) {}
+
+    /**
+     * List Holidays
+     *
+     * Retrieve holidays for a specific month or all holidays when no month is provided.
+     *
+     * @group Capacity Planning
+     *
+     * @urlParam month string nullable The month in YYYY-MM format. Example: 2026-02
+     *
+     * @response {
+     *   "data": [
+     *     {
+     *       "id": "550e8400-e29b-41d4-a716-446655440000",
+     *       "date": "2026-02-14",
+     *       "name": "Company Holiday",
+     *       "description": "Office closed"
+     *     }
+     *   ]
+     * }
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'month' => 'nullable|date_format:Y-m',
+        ]);
+
+        $holidays = isset($data['month'])
+            ? $this->capacityService->getHolidaysForMonth($data['month'])
+            : Holiday::orderBy('date')->get();
+
+        return $this->wrapResource(HolidayResource::collection($holidays));
+    }
+
+    /**
+     * Create Holiday
+     *
+     * Add a holiday and clear cached capacity data for the related month.
+     *
+     * @group Capacity Planning
+     *
+     * @bodyParam date string required Date of the holiday. Example: 2026-02-14
+     * @bodyParam name string required Name of the holiday. Example: Presidents' Day
+     * @bodyParam description string nullable Optional description of the holiday.
+     *
+     * @response 201 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "date": "2026-02-14",
+     *     "name": "Presidents' Day",
+     *     "description": "Office closed"
+     *   }
+     * }
+     * @response 422 {"message":"A holiday already exists for this date.","errors":{"date":["A holiday already exists for this date."]}}
+     */
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'date' => 'required|date',
+            'name' => 'required|string',
+            'description' => 'nullable|string',
+        ]);
+
+        try {
+            $holiday = Holiday::create($data);
+            $this->capacityService->forgetCapacityCacheForMonth($holiday->date->format('Y-m'));
+
+            return $this->wrapResource(new HolidayResource($holiday), 201);
+        } catch (UniqueConstraintViolationException $e) {
+            return response()->json([
+                'message' => 'A holiday already exists for this date.',
+                'errors' => [
+                    'date' => ['A holiday already exists for this date.'],
+                ],
+            ], 422);
+        }
+    }
+
+    /**
+     * Delete Holiday
+     *
+     * Remove a holiday and clear affected capacity caches.
+     *
+     * @group Capacity Planning
+     *
+     * @urlParam id string required The holiday UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @response {
+     *   "message": "Holiday deleted"
+     * }
+     */
+    public function destroy(string $id): JsonResponse
+    {
+        $holiday = Holiday::find($id);
+
+        if (! $holiday) {
+            return response()->json(['message' => 'Holiday not found'], 404);
+        }
+
+        $month = $holiday->date->format('Y-m');
+        $holiday->delete();
+        $this->capacityService->forgetCapacityCacheForMonth($month);
+
+        return response()->json(['message' => 'Holiday deleted']);
+    }
+}

backend/app/Http/Controllers/Api/ProjectController.php

@@ -0,0 +1,413 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Resources\ProjectResource;
+use App\Http\Resources\ProjectStatusResource;
+use App\Http\Resources\ProjectTypeResource;
+use App\Models\Project;
+use App\Models\ProjectStatus;
+use App\Models\ProjectType;
+use App\Services\ProjectService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\ValidationException;
+
+/**
+ * @group Projects
+ *
+ * Endpoints for managing projects.
+ */
+class ProjectController extends Controller
+{
+    /**
+     * Project Service instance
+     */
+    protected ProjectService $projectService;
+
+    /**
+     * Constructor
+     */
+    public function __construct(ProjectService $projectService)
+    {
+        $this->projectService = $projectService;
+    }
+
+    /**
+     * List all projects
+     *
+     * Get a list of all projects with optional filtering by status and type.
+     *
+     * @authenticated
+     *
+     * @queryParam status_id integer Filter by status ID. Example: 1
+     * @queryParam type_id integer Filter by type ID. Example: 2
+     *
+     * @response 200 {
+     *   "data": [
+     *     {
+     *       "id": "550e8400-e29b-41d4-a716-446655440000",
+     *       "code": "PROJ-001",
+     *       "title": "Client Dashboard Redesign",
+     *       "status": {"id": 1, "name": "Pre-sales"},
+     *       "type": {"id": 2, "name": "Support"},
+     *       "approved_estimate": "120.00",
+     *       "forecasted_effort": {"2024-02": 40, "2024-03": 60, "2024-04": 20},
+     *       "created_at": "2024-01-15T10:00:00.000000Z",
+     *       "updated_at": "2024-01-15T10:00:00.000000Z"
+     *     }
+     *   ]
+     * }
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $statusId = $request->query('status_id') ? (int) $request->query('status_id') : null;
+        $typeId = $request->query('type_id') ? (int) $request->query('type_id') : null;
+
+        $projects = $this->projectService->getAll($statusId, $typeId);
+
+        return $this->wrapResource(ProjectResource::collection($projects));
+    }
+
+    /**
+     * Create a new project
+     *
+     * Create a new project with code, title, and type.
+     *
+     * @authenticated
+     *
+     * @bodyParam code string required Project code (must be unique). Example: PROJ-001
+     * @bodyParam title string required Project title. Example: Client Dashboard Redesign
+     * @bodyParam type_id integer required Project type ID. Example: 1
+     *
+     * @response 201 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "code": "PROJ-001",
+     *     "title": "Client Dashboard Redesign",
+     *     "status": {"id": 1, "name": "Pre-sales"},
+     *     "type": {"id": 1, "name": "Project"}
+     *   }
+     * }
+     * @response 422 {"message":"Validation failed","errors":{"code":["Project code must be unique"],"title":["The title field is required."]}}
+     */
+    public function store(Request $request): JsonResponse
+    {
+        try {
+            $project = $this->projectService->create($request->all());
+
+            return $this->wrapResource(new ProjectResource($project), 201);
+        } catch (ValidationException $e) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $e->validator->errors(),
+            ], 422);
+        }
+    }
+
+    /**
+     * Get a single project
+     *
+     * Get details of a specific project by ID.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Project UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "code": "PROJ-001",
+     *     "title": "Client Dashboard Redesign",
+     *     "status": {"id": 1, "name": "Pre-sales"},
+     *     "type": {"id": 1, "name": "Project"},
+     *     "approved_estimate": "120.00",
+     *     "forecasted_effort": {"2024-02": 40, "2024-03": 60}
+     *   }
+     * }
+     * @response 404 {"message":"Project not found"}
+     */
+    public function show(string $id): JsonResponse
+    {
+        $project = $this->projectService->findById($id);
+
+        if (! $project) {
+            return response()->json([
+                'message' => 'Project not found',
+            ], 404);
+        }
+
+        return $this->wrapResource(new ProjectResource($project));
+    }
+
+    /**
+     * Update a project
+     *
+     * Update details of an existing project.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Project UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @bodyParam code string Project code (must be unique). Example: PROJ-002
+     * @bodyParam title string Project title. Example: Updated Title
+     * @bodyParam type_id integer Project type ID. Example: 2
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "code": "PROJ-002",
+     *     "title": "Updated Title",
+     *     "type": {"id": 2, "name": "Support"}
+     *   }
+     * }
+     * @response 404 {"message":"Project not found"}
+     * @response 422 {"message":"Validation failed","errors":{"type_id":["The selected type id is invalid."]}}
+     */
+    public function update(Request $request, string $id): JsonResponse
+    {
+        $project = Project::find($id);
+
+        if (! $project) {
+            return response()->json([
+                'message' => 'Project not found',
+            ], 404);
+        }
+
+        try {
+            $project = $this->projectService->update($project, $request->only([
+                'code', 'title', 'type_id', 'status_id', 'approved_estimate',
+            ]));
+
+            return $this->wrapResource(new ProjectResource($project));
+        } catch (ValidationException $e) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $e->validator->errors(),
+            ], 422);
+        }
+    }
+
+    /**
+     * Transition project status
+     *
+     * Transition project to a new status following the state machine rules.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Project UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @bodyParam status_id integer required Target status ID. Example: 2
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "status": {"id": 2, "name": "SOW Approval"}
+     *   }
+     * }
+     * @response 404 {"message":"Project not found"}
+     * @response 422 {"message":"Cannot transition from Pre-sales to Done"}
+     */
+    public function updateStatus(Request $request, string $id): JsonResponse
+    {
+        $project = Project::with('status')->find($id);
+
+        if (! $project) {
+            return response()->json([
+                'message' => 'Project not found',
+            ], 404);
+        }
+
+        $request->validate([
+            'status_id' => 'required|integer|exists:project_statuses,id',
+        ]);
+
+        try {
+            $project = $this->projectService->transitionStatus(
+                $project,
+                (int) $request->input('status_id')
+            );
+
+            return $this->wrapResource(new ProjectResource($project));
+        } catch (\RuntimeException $e) {
+            return response()->json([
+                'message' => $e->getMessage(),
+            ], 422);
+        }
+    }
+
+    /**
+     * Set approved estimate
+     *
+     * Set the approved billable hours estimate for a project.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Project UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @bodyParam approved_estimate number required Approved estimate hours (must be > 0). Example: 120
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "approved_estimate": "120.00"
+     *   }
+     * }
+     * @response 404 {"message":"Project not found"}
+     * @response 422 {"message":"Approved estimate must be greater than 0"}
+     */
+    public function setEstimate(Request $request, string $id): JsonResponse
+    {
+        $project = Project::find($id);
+
+        if (! $project) {
+            return response()->json([
+                'message' => 'Project not found',
+            ], 404);
+        }
+
+        $request->validate([
+            'approved_estimate' => 'required|numeric',
+        ]);
+
+        try {
+            $project = $this->projectService->setApprovedEstimate(
+                $project,
+                (float) $request->input('approved_estimate')
+            );
+
+            return $this->wrapResource(new ProjectResource($project));
+        } catch (\RuntimeException $e) {
+            return response()->json([
+                'message' => $e->getMessage(),
+            ], 422);
+        }
+    }
+
+    /**
+     * Set forecasted effort
+     *
+     * Set the month-by-month forecasted effort breakdown.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Project UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @bodyParam forecasted_effort object required Monthly effort breakdown. Example: {"2024-02": 40, "2024-03": 60}
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "forecasted_effort": {"2024-02": 40, "2024-03": 60}
+     *   }
+     * }
+     * @response 404 {"message":"Project not found"}
+     * @response 422 {"message":"Forecasted effort exceeds approved estimate by more than 5%"}
+     */
+    public function setForecast(Request $request, string $id): JsonResponse
+    {
+        $project = Project::find($id);
+
+        if (! $project) {
+            return response()->json([
+                'message' => 'Project not found',
+            ], 404);
+        }
+
+        $request->validate([
+            'forecasted_effort' => 'required|array',
+        ]);
+
+        try {
+            $project = $this->projectService->setForecastedEffort(
+                $project,
+                $request->input('forecasted_effort')
+            );
+
+            return $this->wrapResource(new ProjectResource($project));
+        } catch (\RuntimeException $e) {
+            return response()->json([
+                'message' => $e->getMessage(),
+            ], 422);
+        }
+    }
+
+    /**
+     * Get all project types
+     *
+     * @authenticated
+     *
+     * @response 200 {
+     *   "data": [
+     *     {"id": 1, "name": "Project"},
+     *     {"id": 2, "name": "Support"},
+     *     {"id": 3, "name": "Engagement"}
+     *   ]
+     * }
+     */
+    public function types(): JsonResponse
+    {
+        $types = ProjectType::orderBy('name')->get(['id', 'name']);
+
+        return $this->wrapResource(ProjectTypeResource::collection($types));
+    }
+
+    /**
+     * Get all project statuses
+     *
+     * @authenticated
+     *
+     * @response 200 {
+     *   "data": [
+     *     {"id": 1, "name": "Pre-sales", "order": 1},
+     *     {"id": 2, "name": "SOW Approval", "order": 2},
+     *     {"id": 3, "name": "Gathering Estimates", "order": 3}
+     *   ]
+     * }
+     */
+    public function statuses(): JsonResponse
+    {
+        $statuses = ProjectStatus::orderBy('order')->get(['id', 'name', 'order']);
+
+        return $this->wrapResource(ProjectStatusResource::collection($statuses));
+    }
+
+    /**
+     * Delete a project
+     *
+     * Delete a project. Cannot delete if project has allocations or actuals.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Project UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @response 200 {"message":"Project deleted successfully"}
+     * @response 404 {"message":"Project not found"}
+     * @response 422 {"message":"Cannot delete project with allocations"}
+     */
+    public function destroy(string $id): JsonResponse
+    {
+        $project = Project::find($id);
+
+        if (! $project) {
+            return response()->json([
+                'message' => 'Project not found',
+            ], 404);
+        }
+
+        $canDelete = $this->projectService->canDelete($project);
+
+        if (! $canDelete['canDelete']) {
+            return response()->json([
+                'message' => "Cannot delete project with {$canDelete['reason']}",
+            ], 422);
+        }
+
+        $project->delete();
+
+        return response()->json([
+            'message' => 'Project deleted successfully',
+        ]);
+    }
+}

backend/app/Http/Controllers/Api/ProjectMonthPlanController.php

@@ -0,0 +1,154 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\ProjectMonthPlan;
+use App\Services\ReconciliationCalculator;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
+
+class ProjectMonthPlanController extends Controller
+{
+    public function __construct(
+        private ReconciliationCalculator $reconciliationCalculator
+    ) {}
+
+    /**
+     * GET /api/project-month-plans?year=2026
+     * Returns month-plan grid payload by project/month for the year.
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $year = $request->query('year', date('Y'));
+
+        $startDate = "{$year}-01-01";
+        $endDate = "{$year}-12-01";
+
+        $plans = ProjectMonthPlan::whereBetween('month', [$startDate, $endDate])
+            ->with('project')
+            ->get()
+            ->groupBy('project_id');
+
+        // Get all projects for the year with status relationship
+        $projects = \App\Models\Project::with('status')->get();
+
+        // Build grid payload
+        $data = $projects->map(function ($project) use ($plans, $year) {
+            $projectPlans = $plans->get($project->id, collect());
+            $planByMonth = $projectPlans->mapWithKeys(function ($plan) {
+                $monthKey = $plan->month?->format('Y-m-01');
+
+                if ($monthKey === null) {
+                    return [];
+                }
+
+                return [$monthKey => $plan];
+            });
+
+            $months = [];
+            for ($month = 1; $month <= 12; $month++) {
+                $monthDate = sprintf('%04d-%02d-01', $year, $month);
+                $plan = $planByMonth->get($monthDate);
+
+                $months[$monthDate] = $plan
+                    ? [
+                        'id' => $plan->id,
+                        'planned_hours' => $plan->planned_hours,
+                        'is_blank' => $plan->planned_hours === null,
+                    ]
+                    : null;
+            }
+
+            return [
+                'project_id' => $project->id,
+                'project_code' => $project->code,
+                'project_name' => $project->title,
+                'project_status' => $project->status?->name,
+                'approved_estimate' => $project->approved_estimate,
+                'months' => $months,
+            ];
+        });
+
+        // Calculate reconciliation status for each project using the service
+        $reconciliationResults = $this->reconciliationCalculator->calculateForProjects($projects, (int) $year);
+
+        $data = $data->map(function ($project) use ($reconciliationResults) {
+            $project['plan_sum'] = $reconciliationResults[$project['project_id']]['plan_sum'] ?? 0;
+            $project['reconciliation_status'] = $reconciliationResults[$project['project_id']]['status'] ?? 'UNDER';
+
+            return $project;
+        });
+
+        return response()->json([
+            'data' => $data,
+            'meta' => [
+                'year' => (int) $year,
+            ],
+        ]);
+    }
+
+    /**
+     * PUT /api/project-month-plans/bulk
+     * Bulk upsert month plan cells.
+     */
+    public function bulkUpdate(Request $request): JsonResponse
+    {
+        $validator = Validator::make($request->all(), [
+            'year' => 'required|integer|min:2020|max:2100',
+            'items' => 'required|array',
+            'items.*.project_id' => 'required|uuid|exists:projects,id',
+            'items.*.month' => 'required|date_format:Y-m',
+            'items.*.planned_hours' => 'nullable|numeric|min:0',
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        $year = $request->input('year');
+        $items = $request->input('items');
+        $created = 0;
+        $updated = 0;
+        $cleared = 0;
+
+        foreach ($items as $item) {
+            $projectId = $item['project_id'];
+            $month = $item['month'].'-01'; // Convert YYYY-MM to YYYY-MM-01
+            $plannedHours = $item['planned_hours']; // Can be null to clear
+
+            $plan = ProjectMonthPlan::firstOrNew([
+                'project_id' => $projectId,
+                'month' => $month,
+            ]);
+
+            if ($plannedHours === null && $plan->exists) {
+                // Clear semantics: delete the row to represent blank
+                $plan->delete();
+                $cleared++;
+            } elseif ($plannedHours !== null) {
+                $plan->planned_hours = $plannedHours;
+                $plan->save();
+
+                if (! $plan->wasRecentlyCreated) {
+                    $updated++;
+                } else {
+                    $created++;
+                }
+            }
+        }
+
+        return response()->json([
+            'message' => 'Bulk update complete',
+            'summary' => [
+                'created' => $created,
+                'updated' => $updated,
+                'cleared' => $cleared,
+            ],
+        ]);
+    }
+}

backend/app/Http/Controllers/Api/PtoController.php

@@ -0,0 +1,193 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Resources\PtoResource;
+use App\Models\Pto;
+use App\Services\CapacityService;
+use Carbon\Carbon;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class PtoController extends Controller
+{
+    public function __construct(protected CapacityService $capacityService) {}
+
+    /**
+     * List PTO Requests
+     *
+     * Fetch PTO requests for a team member, optionally constrained to a month.
+     *
+     * @group Capacity Planning
+     *
+     * @urlParam team_member_id string required The team member UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     * @urlParam month string nullable The month in YYYY-MM format. Example: 2026-02
+     *
+     * @response {
+     *   "data": [
+     *     {
+     *       "id": "550e8400-e29b-41d4-a716-446655440001",
+     *       "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+     *       "start_date": "2026-02-10",
+     *       "end_date": "2026-02-12",
+     *       "status": "pending",
+     *       "reason": "Family travel"
+     *     }
+     *   ]
+     * }
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'team_member_id' => 'required|exists:team_members,id',
+            'month' => 'nullable|date_format:Y-m',
+        ]);
+
+        $query = Pto::with('teamMember')->where('team_member_id', $data['team_member_id']);
+
+        if (! empty($data['month'])) {
+            $start = Carbon::createFromFormat('Y-m', $data['month'])->startOfMonth();
+            $end = $start->copy()->endOfMonth();
+
+            $query->where(function ($statement) use ($start, $end): void {
+                $statement->whereBetween('start_date', [$start, $end])
+                    ->orWhereBetween('end_date', [$start, $end])
+                    ->orWhere(function ($nested) use ($start, $end): void {
+                        $nested->where('start_date', '<=', $start)
+                            ->where('end_date', '>=', $end);
+                    });
+            });
+        }
+
+        $ptos = $query->orderBy('start_date')->get();
+
+        return $this->wrapResource(PtoResource::collection($ptos));
+    }
+
+    /**
+     * Request PTO
+     *
+     * Create a PTO request for a team member and approve it immediately.
+     *
+     * @group Capacity Planning
+     *
+     * @bodyParam team_member_id string required The team member UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     * @bodyParam start_date string required The first day of the PTO. Example: 2026-02-10
+     * @bodyParam end_date string required The final day of the PTO. Example: 2026-02-12
+     * @bodyParam reason string nullable Optional reason for the PTO.
+     *
+     * @response 201 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440001",
+     *     "team_member_id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "start_date": "2026-02-10",
+     *     "end_date": "2026-02-12",
+     *     "status": "approved",
+     *     "reason": "Family travel"
+     *   }
+     * }
+     */
+    public function store(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'team_member_id' => 'required|exists:team_members,id',
+            'start_date' => 'required|date',
+            'end_date' => 'required|date|after_or_equal:start_date',
+            'reason' => 'nullable|string',
+        ]);
+
+        try {
+            $pto = Pto::create(array_merge($data, ['status' => 'approved']));
+            $months = $this->monthsBetween($pto->start_date, $pto->end_date);
+            $this->capacityService->forgetCapacityCacheForTeamMember($pto->team_member_id, $months);
+
+            foreach ($months as $month) {
+                $this->capacityService->forgetCapacityCacheForMonth($month);
+            }
+
+            $pto->load('teamMember');
+
+            return $this->wrapResource(new PtoResource($pto), 201);
+        } catch (UniqueConstraintViolationException $e) {
+            return response()->json([
+                'message' => 'A PTO request with these details already exists.',
+                'errors' => [
+                    'general' => ['A PTO request with these details already exists.'],
+                ],
+            ], 422);
+        }
+    }
+
+    /**
+     * Approve PTO
+     *
+     * Approve a pending PTO request and refresh the affected capacity caches.
+     *
+     * @group Capacity Planning
+     *
+     * @urlParam id string required The PTO UUID that needs approval. Example: 550e8400-e29b-41d4-a716-446655440001
+     *
+     * @response {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440001",
+     *     "status": "approved"
+     *   }
+     * }
+     */
+    public function approve(string $id): JsonResponse
+    {
+        $pto = Pto::with('teamMember')->findOrFail($id);
+
+        if ($pto->status !== 'approved') {
+            $pto->status = 'approved';
+            $pto->save();
+            $months = $this->monthsBetween($pto->start_date, $pto->end_date);
+            $this->capacityService->forgetCapacityCacheForTeamMember($pto->team_member_id, $months);
+
+            foreach ($months as $month) {
+                $this->capacityService->forgetCapacityCacheForMonth($month);
+            }
+        }
+
+        $pto->load('teamMember');
+
+        return $this->wrapResource(new PtoResource($pto));
+    }
+
+    public function destroy(string $id): JsonResponse
+    {
+        $pto = Pto::find($id);
+
+        if (! $pto) {
+            return response()->json(['message' => 'PTO not found'], 404);
+        }
+
+        $months = $this->monthsBetween($pto->start_date, $pto->end_date);
+        $teamMemberId = $pto->team_member_id;
+        $pto->delete();
+
+        $this->capacityService->forgetCapacityCacheForTeamMember($teamMemberId, $months);
+
+        foreach ($months as $month) {
+            $this->capacityService->forgetCapacityCacheForMonth($month);
+        }
+
+        return response()->json(['message' => 'PTO deleted']);
+    }
+
+    private function monthsBetween(Carbon|string $start, Carbon|string $end): array
+    {
+        $startMonth = Carbon::create($start)->copy()->startOfMonth();
+        $endMonth = Carbon::create($end)->copy()->startOfMonth();
+        $months = [];
+
+        while ($startMonth <= $endMonth) {
+            $months[] = $startMonth->format('Y-m');
+            $startMonth->addMonth();
+        }
+
+        return $months;
+    }
+}

backend/app/Http/Controllers/Api/ReportController.php

@@ -0,0 +1,361 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Allocation;
+use App\Models\Project;
+use App\Models\ProjectMonthPlan;
+use App\Models\TeamMember;
+use App\Services\ReconciliationCalculator;
+use App\Services\VarianceCalculator;
+use Carbon\Carbon;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
+
+/**
+ * @group Reports
+ *
+ * Endpoints for generating management reports with did/is/will views.
+ */
+class ReportController extends Controller
+{
+    public function __construct(
+        protected ReconciliationCalculator $reconciliationCalculator,
+        protected VarianceCalculator $varianceCalculator
+    ) {
+    }
+
+    /**
+     * Get allocation report
+     *
+     * Returns aggregated allocation data with lifecycle totals, month plans,
+     * execution hours, and variances. View type (did/is/will) is inferred
+     * from the date range relative to current month.
+     *
+     * @authenticated
+     *
+     * @queryParam start_date string required Start date (YYYY-MM-DD). Example: 2026-01-01
+     * @queryParam end_date string required End date (YYYY-MM-DD). Example: 2026-03-31
+     * @queryParam project_ids array optional Filter by project IDs. Example: ["uuid1", "uuid2"]
+     * @queryParam member_ids array optional Filter by team member IDs. Example: ["uuid1", "uuid2"]
+     *
+     * @response 200 {
+     *   "period": { "start": "2026-01-01", "end": "2026-03-31" },
+     *   "view_type": "is",
+     *   "projects": [...],
+     *   "members": [...],
+     *   "aggregates": {
+     *     "total_planned": 7200,
+     *     "total_allocated": 7100,
+     *     "total_variance": -100,
+     *     "status": "MATCH"
+     *   }
+     * }
+     */
+    public function allocations(Request $request): JsonResponse
+    {
+        $validator = Validator::make($request->all(), [
+            'start_date' => 'required|date_format:Y-m-d',
+            'end_date' => 'required|date_format:Y-m-d|after_or_equal:start_date',
+            'project_ids' => 'nullable|array',
+            'project_ids.*' => 'uuid|exists:projects,id',
+            'member_ids' => 'nullable|array',
+            'member_ids.*' => 'uuid|exists:team_members,id',
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        $startDate = Carbon::parse($request->input('start_date'));
+        $endDate = Carbon::parse($request->input('end_date'));
+        $viewType = $this->determineViewType($startDate, $endDate);
+
+        // Get projects with optional filtering
+        $projectsQuery = Project::query();
+        if ($request->has('project_ids')) {
+            $projectsQuery->whereIn('id', $request->input('project_ids'));
+        }
+        $projects = $projectsQuery->get();
+
+        // Get team members with optional filtering
+        $membersQuery = TeamMember::query();
+        if ($request->has('member_ids')) {
+            $membersQuery->whereIn('id', $request->input('member_ids'));
+        }
+        $members = $membersQuery->get();
+
+        // Get all plans for the period
+        $plans = ProjectMonthPlan::whereBetween('month', [$startDate->format('Y-m-d'), $endDate->format('Y-m-d')])
+            ->when($request->has('project_ids'), fn ($q) => $q->whereIn('project_id', $request->input('project_ids')))
+            ->get()
+            ->groupBy('project_id');
+
+        // Get all allocations for the period
+        $allocations = Allocation::whereBetween('month', [$startDate->format('Y-m-d'), $endDate->format('Y-m-d')])
+            ->when($request->has('project_ids'), fn ($q) => $q->whereIn('project_id', $request->input('project_ids')))
+            ->when($request->has('member_ids'), fn ($q) => $q->whereIn('team_member_id', $request->input('member_ids')))
+            ->get();
+
+        // Build project report data
+        $projectData = $this->buildProjectData($projects, $plans, $allocations, $startDate, $endDate);
+
+        // Build member report data
+        $memberData = $this->buildMemberData($members, $allocations, $startDate, $endDate);
+
+        // Calculate aggregates
+        $aggregates = $this->calculateAggregates($projectData);
+
+        return response()->json([
+            'period' => [
+                'start' => $startDate->format('Y-m-d'),
+                'end' => $endDate->format('Y-m-d'),
+            ],
+            'view_type' => $viewType,
+            'projects' => $projectData,
+            'members' => $memberData,
+            'aggregates' => $aggregates,
+        ]);
+    }
+
+    /**
+     * Determine view type based on date range relative to current month.
+     */
+    private function determineViewType(Carbon $startDate, Carbon $endDate): string
+    {
+        $now = Carbon::now();
+        $currentMonthStart = $now->copy()->startOfMonth();
+        $currentMonthEnd = $now->copy()->endOfMonth();
+
+        $rangeStart = $startDate->copy()->startOfMonth();
+        $rangeEnd = $endDate->copy()->endOfMonth();
+
+        // All dates are in the past -> 'did'
+        if ($rangeEnd->lt($currentMonthStart)) {
+            return 'did';
+        }
+
+        // All dates are in the future -> 'will'
+        if ($rangeStart->gt($currentMonthEnd)) {
+            return 'will';
+        }
+
+        // Includes current month -> 'is'
+        return 'is';
+    }
+
+    /**
+     * Build project report data with lifecycle totals and period execution.
+     *
+     * @return array<int, array{
+     *   id: string,
+     *   code: string,
+     *   title: string,
+     *   approved_estimate: float,
+     *   lifecycle_status: string,
+     *   plan_sum: float,
+     *   period_planned: float,
+     *   period_allocated: float,
+     *   period_variance: float,
+     *   period_status: string,
+     *   months: array
+     * }>
+     */
+    private function buildProjectData($projects, $plans, $allocations, Carbon $startDate, Carbon $endDate): array
+    {
+        $projectData = [];
+
+        foreach ($projects as $project) {
+            $projectPlans = $plans->get($project->id, collect());
+
+            // Calculate lifecycle reconciliation (all plans for this project)
+            $allProjectPlans = ProjectMonthPlan::where('project_id', $project->id)->get();
+            $lifecycleStatus = $this->reconciliationCalculator->calculateStatus($project, $allProjectPlans);
+            $planSum = $this->reconciliationCalculator->calculatePlanSum($project, $allProjectPlans);
+
+            // Calculate period metrics (only within date range)
+            $periodPlans = $projectPlans->filter(fn ($p) =>
+                Carbon::parse($p->month)->between($startDate, $endDate)
+            );
+
+            $periodPlanned = $periodPlans->sum('planned_hours');
+
+            // Get allocations for this project in the period
+            $projectAllocations = $allocations->where('project_id', $project->id);
+            $periodAllocated = $projectAllocations->sum('allocated_hours');
+
+            $periodVariance = $periodAllocated - $periodPlanned;
+            $periodStatus = $this->varianceCalculator->determineStatus($periodVariance);
+
+            // Build monthly breakdown
+            $months = $this->buildProjectMonthBreakdown($projectPlans, $projectAllocations, $startDate, $endDate);
+
+            $projectData[] = [
+                'id' => $project->id,
+                'code' => $project->code,
+                'title' => $project->title,
+                'approved_estimate' => (float) $project->approved_estimate,
+                'lifecycle_status' => $lifecycleStatus,
+                'plan_sum' => $planSum,
+                'period_planned' => $periodPlanned,
+                'period_allocated' => $periodAllocated,
+                'period_variance' => $periodVariance,
+                'period_status' => $periodStatus,
+                'months' => $months,
+            ];
+        }
+
+        return $projectData;
+    }
+
+    /**
+     * Build monthly breakdown for a project.
+     *
+     * @return array<int, array{
+     *   month: string,
+     *   planned_hours: float|null,
+     *   is_blank: bool,
+     *   allocated_hours: float,
+     *   variance: float,
+     *   status: string
+     * }>
+     */
+    private function buildProjectMonthBreakdown($projectPlans, $projectAllocations, Carbon $startDate, Carbon $endDate): array
+    {
+        $months = [];
+        $current = $startDate->copy()->startOfMonth();
+
+        while ($current->lte($endDate)) {
+            $monthKey = $current->format('Y-m');
+
+            // Get plan for this month
+            $plan = $projectPlans->first(fn ($p) =>
+                Carbon::parse($p->month)->format('Y-m') === $monthKey
+            );
+
+            $plannedHours = $plan?->planned_hours;
+            $isBlank = $plannedHours === null;
+
+            // Get allocations for this month
+            $monthAllocations = $projectAllocations->filter(fn ($a) =>
+                Carbon::parse($a->month)->format('Y-m') === $monthKey
+            );
+
+            $allocatedHours = $monthAllocations->sum('allocated_hours');
+            $variance = $allocatedHours - ($plannedHours ?? 0);
+            $status = $this->varianceCalculator->determineStatus($variance);
+
+            $months[] = [
+                'month' => $monthKey,
+                'planned_hours' => $isBlank ? null : (float) $plannedHours,
+                'is_blank' => $isBlank,
+                'allocated_hours' => $allocatedHours,
+                'variance' => $variance,
+                'status' => $status,
+            ];
+
+            $current->addMonth();
+        }
+
+        return $months;
+    }
+
+    /**
+     * Build member report data with capacity and utilization.
+     *
+     * @return array<int, array{
+     *   id: string,
+     *   name: string,
+     *   period_allocated: float,
+     *   period_untracked: float,
+     *   total_hours: float,
+     *   projects: array
+     * }>
+     */
+    private function buildMemberData($members, $allocations, Carbon $startDate, Carbon $endDate): array
+    {
+        $memberData = [];
+
+        foreach ($members as $member) {
+            // Get allocations for this member in the period (excluding untracked)
+            $memberAllocations = $allocations->filter(fn ($a) =>
+                $a->team_member_id === $member->id
+            );
+
+            $periodAllocated = $memberAllocations->sum('allocated_hours');
+
+            // Group by project
+            $projects = $memberAllocations
+                ->groupBy('project_id')
+                ->map(fn ($allocs, $projectId) => [
+                    'project_id' => $projectId,
+                    'project_code' => $allocs->first()->project->code ?? null,
+                    'project_title' => $allocs->first()->project->title ?? null,
+                    'total_hours' => $allocs->sum('allocated_hours'),
+                ])
+                ->values()
+                ->toArray();
+
+            $memberData[] = [
+                'id' => $member->id,
+                'name' => $member->name,
+                'period_allocated' => $periodAllocated,
+                'projects' => $projects,
+            ];
+        }
+
+        // Add untracked row
+        $untrackedAllocations = $allocations->whereNull('team_member_id');
+        if ($untrackedAllocations->isNotEmpty()) {
+            $untrackedProjects = $untrackedAllocations
+                ->groupBy('project_id')
+                ->map(fn ($allocs, $projectId) => [
+                    'project_id' => $projectId,
+                    'project_code' => $allocs->first()->project->code ?? null,
+                    'project_title' => $allocs->first()->project->title ?? null,
+                    'total_hours' => $allocs->sum('allocated_hours'),
+                ])
+                ->values()
+                ->toArray();
+
+            $memberData[] = [
+                'id' => null,
+                'name' => 'Untracked',
+                'period_allocated' => $untrackedAllocations->sum('allocated_hours'),
+                'projects' => $untrackedProjects,
+            ];
+        }
+
+        return $memberData;
+    }
+
+    /**
+     * Calculate aggregate metrics across all projects.
+     *
+     * @return array{
+     *   total_planned: float,
+     *   total_allocated: float,
+     *   total_variance: float,
+     *   status: string
+     * }
+     */
+    private function calculateAggregates(array $projectData): array
+    {
+        $totalPlanned = array_sum(array_column($projectData, 'period_planned'));
+        $totalAllocated = array_sum(array_column($projectData, 'period_allocated'));
+        $totalVariance = $totalAllocated - $totalPlanned;
+        $status = $this->varianceCalculator->determineStatus($totalVariance);
+
+        return [
+            'total_planned' => $totalPlanned,
+            'total_allocated' => $totalAllocated,
+            'total_variance' => $totalVariance,
+            'status' => $status,
+        ];
+    }
+}

backend/app/Http/Controllers/Api/RolesController.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Resources\RoleResource;
+use App\Models\Role;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * @group Roles
+ *
+ * Endpoints for managing roles.
+ */
+class RolesController extends Controller
+{
+    /**
+     * List all roles
+     *
+     * Get a list of all available roles for team members.
+     *
+     * @authenticated
+     *
+     * @response 200 {
+     *   "data": [
+     *     {
+     *       "id": 1,
+     *       "name": "Frontend Dev",
+     *       "description": "Frontend Developer - specializes in UI/UX and client-side development"
+     *     }
+     *   ]
+     * }
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $roles = Role::orderBy('name')->get(['id', 'name', 'description']);
+
+        return $this->wrapResource(RoleResource::collection($roles));
+    }
+}

backend/app/Http/Controllers/Api/TeamMemberController.php

@@ -0,0 +1,242 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Resources\TeamMemberResource;
+use App\Models\TeamMember;
+use App\Services\TeamMemberService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\ValidationException;
+
+/**
+ * @group Team Members
+ *
+ * Endpoints for managing team members.
+ */
+class TeamMemberController extends Controller
+{
+    /**
+     * Team Member Service instance
+     */
+    protected TeamMemberService $teamMemberService;
+
+    /**
+     * Constructor
+     */
+    public function __construct(TeamMemberService $teamMemberService)
+    {
+        $this->teamMemberService = $teamMemberService;
+    }
+
+    /**
+     * List all team members
+     *
+     * Get a list of all team members with optional filtering by active status.
+     *
+     * @authenticated
+     *
+     * @queryParam active boolean Filter by active status. Example: true
+     *
+     * @response 200 {
+     *   "data": [
+     *     {
+     *       "id": "550e8400-e29b-41d4-a716-446655440000",
+     *       "name": "John Doe",
+     *       "role": {
+     *         "id": 1,
+     *         "name": "Backend Developer"
+     *       },
+     *       "hourly_rate": "150.00",
+     *       "active": true,
+     *       "created_at": "2024-01-15T10:00:00.000000Z",
+     *       "updated_at": "2024-01-15T10:00:00.000000Z"
+     *     }
+     *   ]
+     * }
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $active = $request->has('active')
+            ? filter_var($request->query('active'), FILTER_VALIDATE_BOOLEAN)
+            : null;
+
+        $teamMembers = $this->teamMemberService->getAll($active);
+
+        return $this->wrapResource(TeamMemberResource::collection($teamMembers));
+    }
+
+    /**
+     * Create a new team member
+     *
+     * Create a new team member with name, role, and hourly rate.
+     *
+     * @authenticated
+     *
+     * @bodyParam name string required Team member name. Example: John Doe
+     * @bodyParam role_id integer required Role ID. Example: 1
+     * @bodyParam hourly_rate numeric required Hourly rate (must be > 0). Example: 150.00
+     * @bodyParam active boolean Active status (defaults to true). Example: true
+     *
+     * @response 201 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "name": "John Doe",
+     *     "role": {
+     *       "id": 1,
+     *       "name": "Backend Developer"
+     *     },
+     *     "hourly_rate": "150.00",
+     *     "active": true,
+     *     "created_at": "2024-01-15T10:00:00.000000Z",
+     *     "updated_at": "2024-01-15T10:00:00.000000Z"
+     *   }
+     * }
+     * @response 422 {"message":"Validation failed","errors":{"name":["The name field is required."],"hourly_rate":["Hourly rate must be greater than 0"]}}
+     */
+    public function store(Request $request): JsonResponse
+    {
+        try {
+            $teamMember = $this->teamMemberService->create($request->all());
+
+            return $this->wrapResource(new TeamMemberResource($teamMember), 201);
+        } catch (ValidationException $e) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $e->validator->errors(),
+            ], 422);
+        }
+    }
+
+    /**
+     * Get a single team member
+     *
+     * Get details of a specific team member by ID.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Team member UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "name": "John Doe",
+     *     "role": {
+     *       "id": 1,
+     *       "name": "Backend Developer"
+     *     },
+     *     "hourly_rate": "150.00",
+     *     "active": true,
+     *     "created_at": "2024-01-15T10:00:00.000000Z",
+     *     "updated_at": "2024-01-15T10:00:00.000000Z"
+     *   }
+     * }
+     * @response 404 {"message":"Team member not found"}
+     */
+    public function show(string $id): JsonResponse
+    {
+        $teamMember = $this->teamMemberService->findById($id);
+
+        if (! $teamMember) {
+            return response()->json([
+                'message' => 'Team member not found',
+            ], 404);
+        }
+
+        return $this->wrapResource(new TeamMemberResource($teamMember));
+    }
+
+    /**
+     * Update a team member
+     *
+     * Update details of an existing team member.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Team member UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @bodyParam name string Team member name. Example: John Doe
+     * @bodyParam role_id integer Role ID. Example: 1
+     * @bodyParam hourly_rate numeric Hourly rate (must be > 0). Example: 175.00
+     * @bodyParam active boolean Active status. Example: false
+     *
+     * @response 200 {
+     *   "data": {
+     *     "id": "550e8400-e29b-41d4-a716-446655440000",
+     *     "name": "John Doe",
+     *     "role": {
+     *       "id": 1,
+     *       "name": "Backend Developer"
+     *     },
+     *     "hourly_rate": "175.00",
+     *     "active": false,
+     *     "created_at": "2024-01-15T10:00:00.000000Z",
+     *     "updated_at": "2024-01-15T11:00:00.000000Z"
+     *   }
+     * }
+     * @response 404 {"message":"Team member not found"}
+     * @response 422 {"message":"Validation failed","errors":{"hourly_rate":["Hourly rate must be greater than 0"]}}
+     */
+    public function update(Request $request, string $id): JsonResponse
+    {
+        $teamMember = TeamMember::find($id);
+
+        if (! $teamMember) {
+            return response()->json([
+                'message' => 'Team member not found',
+            ], 404);
+        }
+
+        try {
+            $teamMember = $this->teamMemberService->update($teamMember, $request->only([
+                'name', 'role_id', 'hourly_rate', 'active',
+            ]));
+
+            return $this->wrapResource(new TeamMemberResource($teamMember));
+        } catch (ValidationException $e) {
+            return response()->json([
+                'message' => 'Validation failed',
+                'errors' => $e->validator->errors(),
+            ], 422);
+        }
+    }
+
+    /**
+     * Delete a team member
+     *
+     * Delete a team member. Cannot delete if member has allocations or actuals.
+     *
+     * @authenticated
+     *
+     * @urlParam id string required Team member UUID. Example: 550e8400-e29b-41d4-a716-446655440000
+     *
+     * @response 200 {"message":"Team member deleted successfully"}
+     * @response 404 {"message":"Team member not found"}
+     * @response 422 {"message":"Cannot delete team member with active allocations","suggestion":"Consider deactivating the team member instead"}
+     * @response 422 {"message":"Cannot delete team member with historical data","suggestion":"Consider deactivating the team member instead"}
+     */
+    public function destroy(string $id): JsonResponse
+    {
+        $teamMember = TeamMember::find($id);
+
+        if (! $teamMember) {
+            return response()->json([
+                'message' => 'Team member not found',
+            ], 404);
+        }
+
+        try {
+            $this->teamMemberService->delete($teamMember);
+
+            return response()->json([
+                'message' => 'Team member deleted successfully',
+            ]);
+        } catch (\RuntimeException $e) {
+            return response()->json([
+                'message' => $e->getMessage(),
+                'suggestion' => 'Consider deactivating the team member instead',
+            ], 422);
+        }
+    }
+}

backend/app/Http/Controllers/Controller.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Resources\Json\JsonResource;
+use Illuminate\Routing\Controller as BaseController;
+
+class Controller extends BaseController
+{
+    protected function wrapResource(JsonResource $resource, int $status = 200): JsonResponse
+    {
+        return response()->json([
+            'data' => $resource->resolve(request()),
+        ], $status);
+    }
+}

backend/app/Http/Middleware/JwtAuth.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class JwtAuth
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $token = $this->extractToken($request);
+
+        if (! $token) {
+            return response()->json([
+                'message' => 'Authentication required',
+            ], 401);
+        }
+
+        $payload = $this->decodeJWT($token);
+
+        if (! $payload) {
+            return response()->json([
+                'message' => 'Invalid token',
+            ], 401);
+        }
+
+        if ($payload->exp < time()) {
+            return response()->json([
+                'message' => 'Token expired',
+            ], 401);
+        }
+
+        $user = \App\Models\User::find($payload->sub);
+
+        if (! $user) {
+            return response()->json([
+                'message' => 'User not found',
+            ], 401);
+        }
+
+        auth()->setUser($user);
+        $request->setUserResolver(fn () => $user);
+
+        return $next($request);
+    }
+
+    protected function extractToken(Request $request): ?string
+    {
+        $header = $request->header('Authorization');
+
+        if (! $header || ! str_starts_with($header, 'Bearer ')) {
+            return null;
+        }
+
+        return substr($header, 7);
+    }
+
+    protected function decodeJWT(string $token): ?object
+    {
+        $parts = explode('.', $token);
+
+        if (count($parts) !== 3) {
+            return null;
+        }
+
+        list($header, $payload, $signature) = $parts;
+
+        $expectedSignature = hash_hmac('sha256', $header . '.' . $payload, config('app.key'), true);
+        $expectedSignature = base64_encode($expectedSignature);
+        $expectedSignature = str_replace(['+', '/', '='], ['-', '_', ''], $expectedSignature);
+
+        if (! hash_equals($expectedSignature, $signature)) {
+            return null;
+        }
+
+        $payload = base64_decode(str_replace(['-', '_'], ['+', '/'], $payload));
+
+        return json_decode($payload);
+    }
+}

backend/app/Http/Resources/AllocationResource.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Request;
+
+class AllocationResource extends BaseResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'project_id' => $this->project_id,
+            'team_member_id' => $this->team_member_id,
+            'month' => $this->month?->format('Y-m'),
+            'allocated_hours' => $this->formatDecimal($this->allocated_hours),
+            'allocation_indicator' => $this->allocation_indicator ?? 'gray',
+            'created_at' => $this->formatDate($this->created_at),
+            'updated_at' => $this->formatDate($this->updated_at),
+            'project' => $this->whenLoaded('project', fn () => new ProjectResource($this->project)),
+            'team_member' => $this->whenLoaded('teamMember', fn () => new TeamMemberResource($this->teamMember)),
+        ];
+    }
+}

backend/app/Http/Resources/BaseResource.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+abstract class BaseResource extends JsonResource
+{
+    protected function formatDate($date): ?string
+    {
+        return $date?->toIso8601String();
+    }
+
+    protected function formatDecimal($value, int $decimals = 2): ?float
+    {
+        return $value !== null ? round((float) $value, $decimals) : null;
+    }
+}

backend/app/Http/Resources/CapacityResource.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Resources;
+
+class CapacityResource extends BaseResource
+{
+    public function toArray($request): array
+    {
+        return [
+            'team_member_id' => $this->resource['team_member_id'] ?? null,
+            'month' => $this->resource['month'] ?? null,
+            'working_days' => $this->resource['working_days'] ?? null,
+            'person_days' => $this->resource['person_days'] ?? null,
+            'hours' => $this->resource['hours'] ?? null,
+            'details' => $this->resource['details'] ?? [],
+        ];
+    }
+}

backend/app/Http/Resources/HolidayResource.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Http\Resources;
+
+class HolidayResource extends BaseResource
+{
+    public function toArray($request): array
+    {
+        return [
+            'id' => $this->id,
+            'date' => $this->date?->toDateString(),
+            'name' => $this->name,
+            'description' => $this->description,
+        ];
+    }
+}

backend/app/Http/Resources/ProjectMonthPlanResource.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Request;
+
+class ProjectMonthPlanResource extends BaseResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'project_id' => $this->project_id,
+            'month' => $this->month?->format('Y-m'),
+            'planned_hours' => $this->formatDecimal($this->planned_hours),
+            'is_blank' => $this->planned_hours === null,
+            'created_at' => $this->formatDate($this->created_at),
+            'updated_at' => $this->formatDate($this->updated_at),
+        ];
+    }
+}

backend/app/Http/Resources/ProjectResource.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Resources;
+
+class ProjectResource extends BaseResource
+{
+    public function toArray($request): array
+    {
+        return [
+            'id' => $this->id,
+            'code' => $this->code,
+            'title' => $this->title,
+            'status_id' => $this->status_id,
+            'type_id' => $this->type_id,
+            'status' => $this->whenLoaded('status', fn () => new ProjectStatusResource($this->status)),
+            'type' => $this->whenLoaded('type', fn () => new ProjectTypeResource($this->type)),
+            'approved_estimate' => $this->formatEstimate($this->approved_estimate),
+            'forecasted_effort' => $this->forecasted_effort,
+            'start_date' => $this->formatDate($this->start_date),
+            'end_date' => $this->formatDate($this->end_date),
+            'created_at' => $this->formatDate($this->created_at),
+            'updated_at' => $this->formatDate($this->updated_at),
+        ];
+    }
+
+    private function formatEstimate(?float $value): ?string
+    {
+        return $value !== null ? number_format((float) $value, 2, '.', '') : null;
+    }
+}

backend/app/Http/Resources/ProjectStatusResource.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Resources;
+
+class ProjectStatusResource extends BaseResource
+{
+    public function toArray($request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'order' => $this->order,
+            'is_active' => $this->is_active,
+            'is_billable' => $this->is_billable,
+        ];
+    }
+}

backend/app/Http/Resources/ProjectTypeResource.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Http\Resources;
+
+class ProjectTypeResource extends BaseResource
+{
+    public function toArray($request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'description' => $this->description,
+        ];
+    }
+}

backend/app/Http/Resources/PtoResource.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Resources;
+
+class PtoResource extends BaseResource
+{
+    public function toArray($request): array
+    {
+        return [
+            'id' => $this->id,
+            'team_member_id' => $this->team_member_id,
+            'team_member' => $this->whenLoaded('teamMember', fn () => new TeamMemberResource($this->teamMember)),
+            'start_date' => $this->start_date?->toDateString(),
+            'end_date' => $this->end_date?->toDateString(),
+            'reason' => $this->reason,
+            'status' => $this->status,
+            'created_at' => $this->formatDate($this->created_at),
+        ];
+    }
+}

backend/app/Http/Resources/RevenueResource.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Http\Resources;
+
+class RevenueResource extends BaseResource
+{
+    public function toArray($request): array
+    {
+        return [
+            'month' => $this->resource['month'] ?? null,
+            'possible_revenue' => $this->resource['possible_revenue'] ?? null,
+            'member_revenues' => $this->resource['member_revenues'] ?? [],
+        ];
+    }
+}

backend/app/Http/Resources/RoleResource.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Resources;
+
+class RoleResource extends BaseResource
+{
+    /**
+     * Transform the resource into an array.
+     */
+    public function toArray($request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'description' => $this->description,
+        ];
+    }
+}

backend/app/Http/Resources/TeamCapacityResource.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Http\Resources;
+
+class TeamCapacityResource extends BaseResource
+{
+    public function toArray($request): array
+    {
+        return [
+            'month' => $this->resource['month'] ?? null,
+            'person_days' => $this->resource['person_days'] ?? null,
+            'hours' => $this->resource['hours'] ?? null,
+            'members' => $this->resource['members'] ?? [],
+        ];
+    }
+}

backend/app/Http/Resources/TeamMemberAvailabilityResource.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\TeamMemberAvailability;
+
+class TeamMemberAvailabilityResource extends BaseResource
+{
+    public function toArray($request): array
+    {
+        /** @var TeamMemberAvailability $availability */
+        $availability = $this->resource;
+
+        return [
+            'team_member_id' => $availability->team_member_id,
+            'date' => $availability->date?->toDateString(),
+            'availability' => (float) $availability->availability,
+        ];
+    }
+}

backend/app/Http/Resources/TeamMemberResource.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Resources;
+
+class TeamMemberResource extends BaseResource
+{
+    /**
+     * Transform the resource into an array.
+     */
+    public function toArray($request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'role_id' => $this->role_id,
+            'role' => $this->whenLoaded('role', fn () => new RoleResource($this->role)),
+            'hourly_rate' => $this->formatDecimal($this->hourly_rate),
+            'active' => $this->active,
+            'created_at' => $this->formatDate($this->created_at),
+            'updated_at' => $this->formatDate($this->updated_at),
+        ];
+    }
+}

backend/app/Http/Resources/UserResource.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Resources;
+
+class UserResource extends BaseResource
+{
+    /**
+     * Transform the resource into an array.
+     */
+    public function toArray($request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'email' => $this->email,
+            'role' => $this->role,
+            'active' => $this->active,
+            'created_at' => $this->formatDate($this->created_at),
+            'updated_at' => $this->formatDate($this->updated_at),
+        ];
+    }
+}

backend/app/Models/Actual.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+
+class Actual extends Model
+{
+    use HasFactory, HasUuids;
+
+    protected $primaryKey = 'id';
+    public $incrementing = false;
+    protected $keyType = 'string';
+
+    protected $table = 'actuals';
+
+    protected $fillable = [
+        'project_id',
+        'team_member_id',
+        'month',
+        'hours_logged',
+    ];
+
+    protected $casts = [
+        'month' => 'date',
+        'hours_logged' => 'decimal:2',
+    ];
+
+    /**
+     * Get the project that owns the actual.
+     */
+    public function project()
+    {
+        return $this->belongsTo(Project::class);
+    }
+
+    /**
+     * Get the team member that owns the actual.
+     */
+    public function teamMember()
+    {
+        return $this->belongsTo(TeamMember::class);
+    }
+}

backend/app/Models/Allocation.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+
+class Allocation extends Model
+{
+    use HasFactory, HasUuids;
+
+    protected $primaryKey = 'id';
+    public $incrementing = false;
+    protected $keyType = 'string';
+
+    protected $fillable = [
+        'project_id',
+        'team_member_id',
+        'month',
+        'allocated_hours',
+    ];
+
+    protected $casts = [
+        'month' => 'date',
+        'allocated_hours' => 'decimal:2',
+    ];
+
+    /**
+     * Get the project that owns the allocation.
+     */
+    public function project()
+    {
+        return $this->belongsTo(Project::class);
+    }
+
+    /**
+     * Get the team member that owns the allocation.
+     */
+    public function teamMember()
+    {
+        return $this->belongsTo(TeamMember::class);
+    }
+}

backend/app/Models/Holiday.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+
+class Holiday extends Model
+{
+    use HasFactory, HasUuids;
+
+    protected $primaryKey = 'id';
+    public $incrementing = false;
+    protected $keyType = 'string';
+
+    protected $fillable = [
+        'date',
+        'name',
+        'description',
+    ];
+
+    protected $casts = [
+        'date' => 'date',
+    ];
+}

backend/app/Models/Project.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+
+class Project extends Model
+{
+    use HasFactory, HasUuids;
+
+    protected $primaryKey = 'id';
+    public $incrementing = false;
+    protected $keyType = 'string';
+
+    protected $fillable = [
+        'code',
+        'title',
+        'status_id',
+        'type_id',
+        'approved_estimate',
+        'forecasted_effort',
+    ];
+
+    protected $casts = [
+        'approved_estimate' => 'decimal:2',
+        'forecasted_effort' => 'array',
+    ];
+
+    /**
+     * Get the status that owns the project.
+     */
+    public function status()
+    {
+        return $this->belongsTo(ProjectStatus::class, 'status_id');
+    }
+
+    /**
+     * Get the type that owns the project.
+     */
+    public function type()
+    {
+        return $this->belongsTo(ProjectType::class, 'type_id');
+    }
+
+    /**
+     * Get the allocations for the project.
+     */
+    public function allocations(): HasMany
+    {
+        return $this->hasMany(Allocation::class);
+    }
+
+    /**
+     * Get the actuals for the project.
+     */
+    public function actuals(): HasMany
+    {
+        return $this->hasMany(Actual::class);
+    }
+}

backend/app/Models/ProjectMonthPlan.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class ProjectMonthPlan extends Model
+{
+    use HasUuids;
+
+    protected $table = 'project_month_plans';
+
+    protected $fillable = [
+        'project_id',
+        'month',
+        'planned_hours',
+    ];
+
+    protected $casts = [
+        'month' => 'date:Y-m-01',
+        'planned_hours' => 'decimal:2',
+    ];
+
+    /**
+     * Get the project this plan belongs to.
+     */
+    public function project(): BelongsTo
+    {
+        return $this->belongsTo(Project::class);
+    }
+
+    /**
+     * Check if this plan cell is blank (unset).
+     */
+    public function isBlank(): bool
+    {
+        return $this->planned_hours === null;
+    }
+
+    /**
+     * Get planned hours or 0 for variance calculations.
+     * Blank plan is treated as 0 for allocation variance.
+     */
+    public function getPlannedHoursForVariance(): float
+    {
+        return (float) ($this->planned_hours ?? 0);
+    }
+}

backend/app/Models/ProjectStatus.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class ProjectStatus extends Model
+{
+    use HasFactory;
+
+    protected $fillable = [
+        'name',
+        'order',
+        'is_active',
+        'is_billable',
+    ];
+
+    protected $casts = [
+        'order' => 'integer',
+        'is_active' => 'boolean',
+        'is_billable' => 'boolean',
+    ];
+
+    /**
+     * Get the projects for the status.
+     */
+    public function projects(): HasMany
+    {
+        return $this->hasMany(Project::class, 'status_id');
+    }
+}

backend/app/Models/ProjectType.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class ProjectType extends Model
+{
+    use HasFactory;
+
+    protected $fillable = [
+        'name',
+        'description',
+    ];
+
+    /**
+     * Get the projects for the type.
+     */
+    public function projects(): HasMany
+    {
+        return $this->hasMany(Project::class, 'type_id');
+    }
+}

backend/app/Models/Pto.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+
+class Pto extends Model
+{
+    use HasFactory, HasUuids;
+
+    protected $primaryKey = 'id';
+    public $incrementing = false;
+    protected $keyType = 'string';
+
+    protected $table = 'ptos';
+
+    protected $fillable = [
+        'team_member_id',
+        'start_date',
+        'end_date',
+        'reason',
+        'status',
+    ];
+
+    protected $casts = [
+        'start_date' => 'date',
+        'end_date' => 'date',
+    ];
+
+    /**
+     * Get the team member that owns the PTO.
+     */
+    public function teamMember()
+    {
+        return $this->belongsTo(TeamMember::class);
+    }
+}

backend/app/Models/Role.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class Role extends Model
+{
+    use HasFactory;
+
+    protected $fillable = [
+        'name',
+        'description',
+    ];
+
+    /**
+     * Get the team members for the role.
+     */
+    public function teamMembers(): HasMany
+    {
+        return $this->hasMany(TeamMember::class);
+    }
+}

backend/app/Models/TeamMember.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+
+class TeamMember extends Model
+{
+    use HasFactory, HasUuids;
+
+    protected $primaryKey = 'id';
+    public $incrementing = false;
+    protected $keyType = 'string';
+
+    protected $fillable = [
+        'name',
+        'role_id',
+        'hourly_rate',
+        'active',
+    ];
+
+    protected $casts = [
+        'hourly_rate' => 'decimal:2',
+        'active' => 'boolean',
+    ];
+
+    /**
+     * Get the role that owns the team member.
+     */
+    public function role()
+    {
+        return $this->belongsTo(Role::class);
+    }
+
+    /**
+     * Get the allocations for the team member.
+     */
+    public function allocations(): HasMany
+    {
+        return $this->hasMany(Allocation::class);
+    }
+
+    /**
+     * Get the actuals for the team member.
+     */
+    public function actuals(): HasMany
+    {
+        return $this->hasMany(Actual::class);
+    }
+
+    /**
+     * Get the PTOs for the team member.
+     */
+    public function ptos(): HasMany
+    {
+        return $this->hasMany(Pto::class);
+    }
+}

backend/app/Models/TeamMemberAvailability.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class TeamMemberAvailability extends Model
+{
+    use HasFactory, HasUuids;
+
+    protected $table = 'team_member_daily_availabilities';
+
+    protected $primaryKey = 'id';
+
+    public $incrementing = false;
+
+    protected $keyType = 'string';
+
+    protected $fillable = [
+        'team_member_id',
+        'date',
+        'availability',
+    ];
+
+    protected $casts = [
+        'date' => 'date',
+        'availability' => 'float',
+    ];
+
+    public function teamMember(): BelongsTo
+    {
+        return $this->belongsTo(TeamMember::class);
+    }
+}

backend/app/Models/User.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Models;
+
+// use Illuminate\Contracts\Auth\MustVerifyEmail;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Foundation\Auth\User as Authenticatable;
+use Illuminate\Notifications\Notifiable;
+use Illuminate\Database\Eloquent\Concerns\HasUuids;
+use Tymon\JWTAuth\Contracts\JWTSubject;
+
+class User extends Authenticatable implements JWTSubject
+{
+    /** @use HasFactory<\Database\Factories\UserFactory> */
+    use HasFactory, Notifiable, HasUuids;
+
+    protected $primaryKey = 'id';
+    public $incrementing = false;
+    protected $keyType = 'string';
+
+    /**
+     * The attributes that are mass assignable.
+     *
+     * @var list<string>
+     */
+    protected $fillable = [
+        'name',
+        'email',
+        'password',
+        'role',
+    ];
+
+    /**
+     * The attributes that should be hidden for serialization.
+     *
+     * @var list<string>
+     */
+    protected $hidden = [
+        'password',
+        'remember_token',
+    ];
+
+    /**
+     * Get the attributes that should be cast.
+     *
+     * @return array<string, string>
+     */
+    protected function casts(): array
+    {
+        return [
+            'email_verified_at' => 'datetime',
+            'password' => 'hashed',
+        ];
+    }
+
+    /**
+     * Get the identifier that will be stored in the subject claim of the JWT.
+     *
+     * @return mixed
+     */
+    public function getJWTIdentifier()
+    {
+        return $this->getKey();
+    }
+
+    /**
+     * Return a key value array, containing any custom claims to be added to the JWT.
+     *
+     * @return array
+     */
+    public function getJWTCustomClaims()
+    {
+        return [
+            'role' => $this->role,
+            'email' => $this->email,
+        ];
+    }
+}

backend/app/Policies/AllocationPolicy.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Allocation;
+use App\Models\User;
+
+class AllocationPolicy
+{
+    /**
+     * Determine whether the user can view any allocations.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view a specific allocation.
+     */
+    public function view(User $user, Allocation $allocation): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create allocations.
+     */
+    public function create(User $user): bool
+    {
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can update allocations.
+     */
+    public function update(User $user, Allocation $allocation): bool
+    {
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can delete allocations.
+     */
+    public function delete(User $user, Allocation $allocation): bool
+    {
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+}

backend/app/Policies/ProjectPolicy.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Project;
+use App\Models\User;
+
+class ProjectPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        // All authenticated users can view projects
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, Project $project): bool
+    {
+        // All authenticated users can view individual projects
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        // Only superusers and managers can create projects
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, Project $project): bool
+    {
+        // Only superusers and managers can update projects
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, Project $project): bool
+    {
+        // Only superusers and managers can delete projects
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can transition project status.
+     */
+    public function updateStatus(User $user, Project $project): bool
+    {
+        // Only superusers and managers can transition status
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can set approved estimate.
+     */
+    public function setEstimate(User $user, Project $project): bool
+    {
+        // Only superusers and managers can set estimates
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can set forecasted effort.
+     */
+    public function setForecast(User $user, Project $project): bool
+    {
+        // Only superusers and managers can set forecasts
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, Project $project): bool
+    {
+        // Only superusers and managers can restore projects
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, Project $project): bool
+    {
+        // Only superusers can force delete projects
+        return $user->role === 'superuser';
+    }
+}

backend/app/Policies/TeamMemberPolicy.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\TeamMember;
+use App\Models\User;
+
+class TeamMemberPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        // All authenticated users can view team members
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, TeamMember $teamMember): bool
+    {
+        // All authenticated users can view individual team members
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        // Only superusers and managers can create team members
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, TeamMember $teamMember): bool
+    {
+        // Only superusers and managers can update team members
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, TeamMember $teamMember): bool
+    {
+        // Only superusers and managers can delete team members
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, TeamMember $teamMember): bool
+    {
+        // Only superusers and managers can restore team members
+        return in_array($user->role, ['superuser', 'manager']);
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, TeamMember $teamMember): bool
+    {
+        // Only superusers can force delete team members
+        return $user->role === 'superuser';
+    }
+}

backend/app/Providers/AppServiceProvider.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Providers;
+
+use Illuminate\Support\ServiceProvider;
+
+class AppServiceProvider extends ServiceProvider
+{
+    /**
+     * Register any application services.
+     */
+    public function register(): void
+    {
+        //
+    }
+
+    /**
+     * Bootstrap any application services.
+     */
+    public function boot(): void
+    {
+        //
+    }
+}

backend/app/Services/AllocationMatrixService.php

@@ -0,0 +1,134 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Allocation;
+use App\Models\Project;
+use Illuminate\Support\Collection;
+
+class AllocationMatrixService
+{
+    public function __construct(
+        private VarianceCalculator $varianceCalculator
+    ) {}
+
+    /**
+     * Get the allocation matrix with totals.
+     *
+     * @return array{
+     *   allocations: \Illuminate\Support\Collection,
+     *   projectTotals: array<string, float>,
+     *   teamMemberTotals: array<string, float>,
+     *   grandTotal: float
+     * }
+     */
+    public function getMatrix(string $month): array
+    {
+        $allocations = Allocation::with(['project', 'teamMember'])
+            ->where('month', $month)
+            ->get();
+
+        // Calculate project totals (including untracked)
+        $projectTotals = $allocations->groupBy('project_id')
+            ->map(fn (Collection $group) => $group->sum('allocated_hours'))
+            ->toArray();
+
+        // Calculate team member totals (excluding untracked/null)
+        $teamMemberTotals = $allocations
+            ->filter(fn ($a) => $a->team_member_id !== null)
+            ->groupBy('team_member_id')
+            ->map(fn (Collection $group) => $group->sum('allocated_hours'))
+            ->toArray();
+
+        // Calculate grand total (including untracked)
+        $grandTotal = $allocations->sum('allocated_hours');
+
+        return [
+            'allocations' => $allocations,
+            'projectTotals' => $projectTotals,
+            'teamMemberTotals' => $teamMemberTotals,
+            'grandTotal' => $grandTotal,
+        ];
+    }
+
+    /**
+     * Get matrix with utilization data for each team member.
+     */
+    public function getMatrixWithUtilization(string $month, CapacityService $capacityService): array
+    {
+        $matrix = $this->getMatrix($month);
+
+        // Add utilization for each team member (excluding untracked)
+        $teamMemberUtilization = [];
+        foreach ($matrix['teamMemberTotals'] as $teamMemberId => $totalHours) {
+            $capacityData = $capacityService->calculateIndividualCapacity($teamMemberId, $month);
+            $capacity = $capacityData['hours'] ?? 0;
+            $teamMemberUtilization[$teamMemberId] = [
+                'capacity' => $capacity,
+                'allocated' => $totalHours,
+                'utilization' => $capacity > 0 ? round(($totalHours / $capacity) * 100, 1) : 0,
+            ];
+        }
+
+        $matrix['teamMemberUtilization'] = $teamMemberUtilization;
+
+        return $matrix;
+    }
+
+    /**
+     * Get matrix with variance data against explicit month plans.
+     *
+     * @return array{
+     *   allocations: \Illuminate\Support\Collection,
+     *   projectTotals: array<string, float>,
+     *   teamMemberTotals: array<string, float>,
+     *   grandTotal: float,
+     *   projectVariances: array<string, array>,
+     *   teamMemberVariances: array<string, array>
+     * }
+     */
+    public function getMatrixWithVariance(string $month, CapacityService $capacityService): array
+    {
+        $matrix = $this->getMatrix($month);
+
+        // Calculate variances
+        $variances = $this->varianceCalculator->calculateMatrixVariances($month, $capacityService);
+
+        $matrix['projectVariances'] = $variances['project_variances'];
+        $matrix['teamMemberVariances'] = $variances['team_member_variances'];
+
+        return $matrix;
+    }
+
+    /**
+     * Check if allocation includes untracked (null team_member_id).
+     */
+    public function hasUntracked(Allocation $allocation): bool
+    {
+        return $allocation->team_member_id === null;
+    }
+
+    /**
+     * Get total allocated hours for a project/month including untracked.
+     */
+    public function getProjectTotalWithUntracked(string $projectId, string $month): float
+    {
+        $monthDate = strlen($month) === 7 ? $month.'-01' : $month;
+
+        return Allocation::where('project_id', $projectId)
+            ->where('month', $monthDate)
+            ->sum('allocated_hours');
+    }
+
+    /**
+     * Get total allocated hours for a team member/month (excludes untracked).
+     */
+    public function getTeamMemberTotal(string $teamMemberId, string $month): float
+    {
+        $monthDate = strlen($month) === 7 ? $month.'-01' : $month;
+
+        return Allocation::where('team_member_id', $teamMemberId)
+            ->where('month', $monthDate)
+            ->sum('allocated_hours');
+    }
+}

backend/app/Services/AllocationValidationService.php

@@ -0,0 +1,163 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Allocation;
+use App\Models\Project;
+use App\Models\TeamMember;
+
+class AllocationValidationService
+{
+    /**
+     * Validate an allocation against team member capacity.
+     *
+     * @return array{valid: bool, warning: ?string, utilization: float}
+     */
+    public function validateCapacity(
+        string $teamMemberId,
+        string $month,
+        float $newHours,
+        ?string $excludeAllocationId = null
+    ): array {
+        $teamMember = TeamMember::with('role')->find($teamMemberId);
+
+        if (! $teamMember) {
+            return ['valid' => true, 'warning' => null, 'utilization' => 0];
+        }
+
+        // Get capacity for the month
+        $capacityService = app(CapacityService::class);
+        $capacityData = $capacityService->calculateIndividualCapacity($teamMemberId, $month);
+        $capacity = $capacityData['hours'] ?? 0;
+
+        if ($capacity <= 0) {
+            return ['valid' => true, 'warning' => null, 'utilization' => 0];
+        }
+
+        // Convert YYYY-MM to YYYY-MM-01 for database query
+        $monthDate = $month . '-01';
+
+        // Get existing allocations for this team member in this month
+        $existingHours = Allocation::where('team_member_id', $teamMemberId)
+            ->where('month', $monthDate)
+            ->when($excludeAllocationId, fn ($query) => $query->where('id', '!=', $excludeAllocationId))
+            ->sum('allocated_hours');
+
+        $totalHours = $existingHours + $newHours;
+        $utilization = ($totalHours / $capacity) * 100;
+
+        // Over-allocated: warn but allow
+        if ($utilization > 100) {
+            $overBy = $totalHours - $capacity;
+
+            return [
+                'valid' => true,
+                'warning' => "Team member over-allocated by {$overBy} hours ({$utilization}% utilization)",
+                'utilization' => round($utilization, 1),
+            ];
+        }
+
+        return [
+            'valid' => true,
+            'warning' => null,
+            'utilization' => round($utilization, 1),
+        ];
+    }
+
+    /**
+     * Validate an allocation against project approved estimate.
+     *
+     * @return array{valid: bool, indicator: string, message: ?string}
+     */
+    public function validateApprovedEstimate(
+        string $projectId,
+        string $month,
+        float $newHours,
+        ?string $excludeAllocationId = null
+    ): array {
+        $project = Project::find($projectId);
+
+        if (! $project || ! $project->approved_estimate) {
+            return ['valid' => true, 'indicator' => 'gray', 'message' => null];
+        }
+
+        // Convert YYYY-MM to YYYY-MM-01 for database query
+        $monthDate = $month . '-01';
+
+        // Get existing allocations for this project in this month
+        $existingHours = Allocation::where('project_id', $projectId)
+            ->where('month', $monthDate)
+            ->when($excludeAllocationId, fn ($query) => $query->where('id', '!=', $excludeAllocationId))
+            ->sum('allocated_hours');
+
+        $totalHours = $existingHours + $newHours;
+        $approved = (float) $project->approved_estimate;
+
+        if ($approved <= 0) {
+            return ['valid' => true, 'indicator' => 'gray', 'message' => null];
+        }
+
+        $percentage = ($totalHours / $approved) * 100;
+
+        // Over-allocated: RED indicator
+        if ($percentage > 100) {
+            $overBy = $totalHours - $approved;
+
+            return [
+                'valid' => true,
+                'indicator' => 'red',
+                'message' => "{$percentage}% allocated (over by {$overBy} hours). Project will be over-charged.",
+            ];
+        }
+
+        // Exactly at estimate: GREEN indicator
+        if ($percentage >= 100) {
+            return [
+                'valid' => true,
+                'indicator' => 'green',
+                'message' => '100% allocated',
+            ];
+        }
+
+        // Under-allocated: YELLOW indicator
+        $underBy = $approved - $totalHours;
+
+        return [
+            'valid' => true,
+            'indicator' => 'yellow',
+            'message' => "{$percentage}% allocated (under by {$underBy} hours)",
+        ];
+    }
+
+    /**
+     * Get validation results for all allocations in a month.
+     */
+    public function getAllocationValidation(
+        string $teamMemberId,
+        string $month
+    ): array {
+        $capacityValidation = $this->validateCapacity($teamMemberId, $month, 0);
+
+        // Convert YYYY-MM to YYYY-MM-01 for database query
+        $monthDate = $month . '-01';
+
+        $allocations = Allocation::where('team_member_id', $teamMemberId)
+            ->where('month', $monthDate)
+            ->with('project')
+            ->get();
+
+        $projectValidations = $allocations->map(function ($allocation) use ($month) {
+            return $this->validateApprovedEstimate(
+                $allocation->project_id,
+                $month,
+                (float) $allocation->allocated_hours,
+                $allocation->id
+            );
+        });
+
+        return [
+            'capacity' => $capacityValidation,
+            'projects' => $projectValidations,
+        ];
+    }
+}

backend/app/Services/CapacityService.php

@@ -0,0 +1,393 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Holiday;
+use App\Models\Pto;
+use App\Models\TeamMember;
+use App\Models\TeamMemberAvailability;
+use App\Utilities\WorkingDaysCalculator;
+use Carbon\Carbon;
+use Carbon\CarbonPeriod;
+use DateTimeInterface;
+use Illuminate\Cache\Repository as CacheRepository;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+use Throwable;
+
+class CapacityService
+{
+    private int $hoursPerDay = 8;
+
+    private ?bool $redisAvailable = null;
+
+    /**
+     * Calculate how many working days exist for the supplied month (weekends and holidays excluded).
+     */
+    public function calculateWorkingDays(string $month): int
+    {
+        $holidayDates = $this->getHolidaysForMonth($month)
+            ->pluck('date')
+            ->map(fn (Carbon $date): string => $date->toDateString())
+            ->all();
+
+        return WorkingDaysCalculator::calculate($month, $holidayDates);
+    }
+
+    /**
+     * Calculate capacity for a single team member for the requested month.
+     */
+    public function calculateIndividualCapacity(string $teamMemberId, string $month): array
+    {
+        $cacheKey = $this->buildCacheKey($month, $teamMemberId);
+        $tags = $this->getCapacityCacheTags($month, "team_member:{$teamMemberId}");
+
+        $resolver = function () use ($teamMemberId, $month): array {
+            $period = $this->createMonthPeriod($month);
+            $holidayDates = $this->getHolidaysForMonth($month)
+                ->pluck('date')
+                ->map(fn (Carbon $date): string => $date->toDateString())
+                ->all();
+            $holidayLookup = array_flip($holidayDates);
+            $ptoDates = $this->buildPtoDates($this->getPtoForTeamMember($teamMemberId, $month), $month);
+            $availabilities = $this->getAvailabilityEntries($teamMemberId, $month);
+            $personDays = 0.0;
+            $details = [];
+
+            foreach ($period as $day) {
+                $date = $day->toDateString();
+
+                if (! WorkingDaysCalculator::isWorkingDay($date, $holidayLookup)) {
+                    continue;
+                }
+
+                $isPto = in_array($date, $ptoDates, true);
+                $hasAvailabilityOverride = $availabilities->has($date);
+                $availability = $hasAvailabilityOverride
+                    ? (float) $availabilities->get($date)
+                    : ($isPto ? 0.0 : 1.0);
+
+                $details[] = [
+                    'date' => $date,
+                    'availability' => (float) $availability,
+                    'is_pto' => $isPto,
+                ];
+
+                $personDays += $availability;
+            }
+
+            $hours = (int) round($personDays * $this->hoursPerDay);
+
+            return [
+                'person_days' => round($personDays, 2),
+                'hours' => $hours,
+                'details' => $details,
+            ];
+        };
+
+        /** @var array $capacity */
+        /** @var array $capacity */
+        $capacity = $this->rememberCapacity($cacheKey, now()->addHour(), $resolver, $tags);
+
+        return $capacity;
+    }
+
+    /**
+     * Calculate the combined capacity for all active team members.
+     */
+    public function calculateTeamCapacity(string $month): array
+    {
+        $cacheKey = $this->buildCacheKey($month, 'team');
+        $tags = $this->getCapacityCacheTags($month, 'team');
+
+        /** @var array $payload */
+        $payload = $this->rememberCapacity($cacheKey, now()->addHour(), function () use ($month): array {
+            $activeMembers = TeamMember::where('active', true)->get();
+            $totalDays = 0.0;
+            $totalHours = 0;
+            $members = [];
+
+            foreach ($activeMembers as $member) {
+                $capacity = $this->calculateIndividualCapacity($member->id, $month);
+
+                $totalDays += $capacity['person_days'];
+                $totalHours += $capacity['hours'];
+
+                $members[] = [
+                    'id' => $member->id,
+                    'name' => $member->name,
+                    'person_days' => $capacity['person_days'],
+                    'hours' => $capacity['hours'],
+                ];
+            }
+
+            return [
+                'month' => $month,
+                'person_days' => round($totalDays, 2),
+                'hours' => $totalHours,
+                'members' => $members,
+            ];
+        }, $tags);
+
+        return $payload;
+    }
+
+    /**
+     * Estimate revenue by multiplying capacity hours with hourly rates.
+     */
+    public function calculatePossibleRevenue(string $month): float
+    {
+        $cacheKey = $this->buildCacheKey($month, 'revenue');
+        $tags = $this->getCapacityCacheTags($month, 'revenue');
+
+        /** @var float $revenue */
+        $revenue = $this->rememberCapacity($cacheKey, now()->addHour(), function () use ($month): float {
+            $activeMembers = TeamMember::where('active', true)->get();
+            $revenue = 0.0;
+
+            foreach ($activeMembers as $member) {
+                $capacity = $this->calculateIndividualCapacity($member->id, $month);
+                $revenue += $capacity['hours'] * (float) $member->hourly_rate;
+            }
+
+            return round($revenue, 2);
+        }, $tags);
+
+        return $revenue;
+    }
+
+    /**
+     * Return all holidays in the requested month.
+     */
+    public function getHolidaysForMonth(string $month): Collection
+    {
+        $period = $this->createMonthPeriod($month);
+
+        return Holiday::whereBetween('date', [$period->getStartDate(), $period->getEndDate()])
+            ->orderBy('date')
+            ->get();
+    }
+
+    /**
+     * Return approved PTO records for a team member inside the requested month.
+     */
+    public function getPtoForTeamMember(string $teamMemberId, string $month): Collection
+    {
+        $period = $this->createMonthPeriod($month);
+
+        return Pto::where('team_member_id', $teamMemberId)
+            ->where('status', 'approved')
+            ->where(function ($query) use ($period): void {
+                $query->whereBetween('start_date', [$period->getStartDate(), $period->getEndDate()])
+                    ->orWhereBetween('end_date', [$period->getStartDate(), $period->getEndDate()])
+                    ->orWhere(function ($nested) use ($period): void {
+                        $nested->where('start_date', '<=', $period->getStartDate())
+                            ->where('end_date', '>=', $period->getEndDate());
+                    });
+            })
+            ->get();
+    }
+
+    /**
+     * Clear redis cache for a specific month and team member.
+     */
+    public function forgetCapacityCacheForTeamMember(string $teamMemberId, array $months): void
+    {
+        $useRedis = $this->redisAvailable();
+
+        foreach ($months as $month) {
+            $tags = $this->getCapacityCacheTags($month, "team_member:{$teamMemberId}");
+            $key = $this->buildCacheKey($month, $teamMemberId);
+
+            // Always forget from array store (used in tests and as fallback)
+            Cache::store('array')->forget($key);
+
+            if ($useRedis) {
+                $this->flushCapacityTags($tags);
+            }
+        }
+    }
+
+    /**
+     * Clear redis cache for a month across all team members.
+     */
+    public function forgetCapacityCacheForMonth(string $month): void
+    {
+        // Always forget from array store (used in tests and as fallback)
+        foreach (TeamMember::pluck('id') as $teamMemberId) {
+            Cache::store('array')->forget($this->buildCacheKey($month, $teamMemberId));
+        }
+        Cache::store('array')->forget($this->buildCacheKey($month, 'team'));
+        Cache::store('array')->forget($this->buildCacheKey($month, 'revenue'));
+
+        if ($this->redisAvailable()) {
+            $this->flushCapacityTags($this->getCapacityCacheTags($month));
+        }
+    }
+
+    /**
+     * Build the cache key used for storing individual capacity data.
+     */
+    private function buildCacheKey(string $month, string $teamMemberId): string
+    {
+        return "capacity:{$month}:{$teamMemberId}";
+    }
+
+    private function getCapacityCacheTags(string $month, ?string $context = null): array
+    {
+        $tags = ['capacity', "capacity:month:{$month}"];
+
+        if ($context) {
+            $tags[] = "capacity:{$context}";
+        }
+
+        return $tags;
+    }
+
+    private function flushCapacityTags(array $tags): void
+    {
+        if (! $this->redisAvailable()) {
+            return;
+        }
+
+        try {
+            /** @var CacheRepository $store */
+            $store = Cache::store('redis');
+            $store->tags($tags)->flush();
+        } catch (Throwable) {
+            // Ignore cache failures when Redis is unavailable.
+        }
+    }
+
+    /**
+     * Load availability entries for the team member within the month, keyed by date.
+     */
+    private function getAvailabilityEntries(string $teamMemberId, string $month): Collection
+    {
+        $period = $this->createMonthPeriod($month);
+
+        return TeamMemberAvailability::where('team_member_id', $teamMemberId)
+            ->whereBetween('date', [$period->getStartDate(), $period->getEndDate()])
+            ->get()
+            ->mapWithKeys(fn (TeamMemberAvailability $entry) => [$entry->date->toDateString() => (float) $entry->availability]);
+    }
+
+    public function upsertTeamMemberAvailability(string $teamMemberId, string $date, float $availability): TeamMemberAvailability
+    {
+        $entry = TeamMemberAvailability::updateOrCreate(
+            ['team_member_id' => $teamMemberId, 'date' => $date],
+            ['availability' => $availability]
+        );
+
+        $month = Carbon::createFromFormat('Y-m-d', $date)->format('Y-m');
+
+        $this->forgetCapacityCacheForTeamMember($teamMemberId, [$month]);
+        $this->forgetCapacityCacheForMonth($month);
+
+        return $entry;
+    }
+
+    public function batchUpsertAvailability(array $updates, string $month): int
+    {
+        $count = 0;
+
+        foreach ($updates as $update) {
+            TeamMemberAvailability::updateOrCreate(
+                ['team_member_id' => $update['team_member_id'], 'date' => $update['date']],
+                ['availability' => $update['availability']]
+            );
+            $count++;
+        }
+
+        $this->forgetCapacityCacheForMonth($month);
+
+        return $count;
+    }
+
+    /**
+     * Create a CarbonPeriod for the given month.
+     */
+    private function createMonthPeriod(string $month): CarbonPeriod
+    {
+        $start = Carbon::createFromFormat('Y-m', $month)->startOfMonth();
+        $end = $start->copy()->endOfMonth();
+
+        return CarbonPeriod::create($start, $end);
+    }
+
+    /**
+     * Expand PTO records into a unique list of dates inside the requested month.
+     */
+    private function buildPtoDates(Collection $ptos, string $month): array
+    {
+        $period = $this->createMonthPeriod($month);
+        $dates = [];
+
+        foreach ($ptos as $pto) {
+            $ptoStart = Carbon::create($pto->start_date)->max($period->getStartDate());
+            $ptoEnd = Carbon::create($pto->end_date)->min($period->getEndDate());
+
+            if ($ptoStart->greaterThan($ptoEnd)) {
+                continue;
+            }
+
+            foreach (CarbonPeriod::create($ptoStart, $ptoEnd) as $day) {
+                $dates[] = $day->toDateString();
+            }
+        }
+
+        return array_unique($dates);
+    }
+
+    private function rememberCapacity(string $key, DateTimeInterface|int $ttl, callable $callback, array $tags = []): mixed
+    {
+        if (! $this->redisAvailable()) {
+            return Cache::store('array')->remember($key, $ttl, $callback);
+        }
+
+        try {
+            /** @var CacheRepository $store */
+            $store = Cache::store('redis');
+
+            if (! empty($tags)) {
+                $store = $store->tags($tags);
+            }
+
+            return $store->remember($key, $ttl, $callback);
+        } catch (Throwable) {
+            return Cache::store('array')->remember($key, $ttl, $callback);
+        }
+    }
+
+    private function forgetCapacity(string $key): void
+    {
+        if (! $this->redisAvailable()) {
+            return;
+        }
+
+        try {
+            Cache::store('redis')->forget($key);
+        } catch (Throwable) {
+            // Ignore cache failures when Redis is unavailable.
+        }
+    }
+
+    private function redisAvailable(): bool
+    {
+        if ($this->redisAvailable !== null) {
+            return $this->redisAvailable;
+        }
+
+        if (! config('cache.stores.redis')) {
+            return $this->redisAvailable = false;
+        }
+
+        $client = config('database.redis.client', 'phpredis');
+
+        if ($client === 'predis') {
+            return $this->redisAvailable = class_exists('\Predis\Client');
+        }
+
+        return $this->redisAvailable = extension_loaded('redis');
+    }
+}

backend/app/Services/JwtService.php

@@ -0,0 +1,283 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\User;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * JWT Service
+ * 
+ * Handles JWT token generation, validation, and refresh token management.
+ */
+class JwtService
+{
+    /**
+     * Access token TTL in seconds (60 minutes)
+     */
+    private const ACCESS_TOKEN_TTL = 3600;
+
+    /**
+     * Refresh token TTL in seconds (7 days)
+     */
+    private const REFRESH_TOKEN_TTL = 604800;
+
+    /**
+     * Generate a new access token for a user
+     *
+     * @param User $user
+     * @return string
+     */
+    public function generateAccessToken(User $user): string
+    {
+        $payload = [
+            'iss' => config('app.url', 'headroom'),
+            'sub' => $user->id,
+            'iat' => time(),
+            'exp' => time() + self::ACCESS_TOKEN_TTL,
+            'role' => $user->role,
+            'permissions' => $this->getPermissions($user->role),
+            'jti' => $this->generateTokenId(),
+        ];
+
+        return $this->encodeJWT($payload);
+    }
+
+    /**
+     * Generate a new refresh token for a user
+     *
+     * @param User $user
+     * @return string
+     */
+    public function generateRefreshToken(User $user): string
+    {
+        $token = $this->generateSecureToken();
+        $key = $this->getRefreshTokenKey($token);
+        
+        Cache::put($key, $user->id, self::REFRESH_TOKEN_TTL);
+
+        return $token;
+    }
+
+    /**
+     * Get user ID from a refresh token
+     *
+     * @param string $token
+     * @return string|null
+     */
+    public function getUserIdFromRefreshToken(string $token): ?string
+    {
+        return Cache::get($this->getRefreshTokenKey($token));
+    }
+
+    /**
+     * Invalidate a refresh token
+     *
+     * @param string $token
+     * @param string|null $userId
+     * @return void
+     */
+    public function invalidateRefreshToken(string $token, ?string $userId = null): void
+    {
+        Cache::forget($this->getRefreshTokenKey($token));
+    }
+
+    /**
+     * Validate and decode a JWT token
+     *
+     * @param string $token
+     * @return array|null Returns payload array or null if invalid
+     */
+    public function validateToken(string $token): ?array
+    {
+        $parts = explode('.', $token);
+        
+        if (count($parts) !== 3) {
+            return null;
+        }
+
+        [$header, $payload, $signature] = $parts;
+
+        // Verify signature
+        $expectedSignature = $this->createSignature($header, $payload);
+        
+        if (! hash_equals($expectedSignature, $signature)) {
+            return null;
+        }
+
+        // Decode payload
+        $payloadData = $this->base64UrlDecode($payload);
+        $payloadArray = json_decode($payloadData, true);
+
+        if (! is_array($payloadArray)) {
+            return null;
+        }
+
+        // Check expiration
+        if (isset($payloadArray['exp']) && $payloadArray['exp'] < time()) {
+            return null;
+        }
+
+        return $payloadArray;
+    }
+
+    /**
+     * Extract claims from a JWT token
+     *
+     * @param string $token
+     * @return array|null
+     */
+    public function extractClaims(string $token): ?array
+    {
+        return $this->validateToken($token);
+    }
+
+    /**
+     * Get token expiration time
+     *
+     * @return int
+     */
+    public function getAccessTokenTTL(): int
+    {
+        return self::ACCESS_TOKEN_TTL;
+    }
+
+    /**
+     * Get refresh token expiration time
+     *
+     * @return int
+     */
+    public function getRefreshTokenTTL(): int
+    {
+        return self::REFRESH_TOKEN_TTL;
+    }
+
+    /**
+     * Get permissions for a role
+     *
+     * @param string $role
+     * @return array
+     */
+    public function getPermissions(string $role): array
+    {
+        return match ($role) {
+            'superuser' => [
+                'manage_users',
+                'manage_team_members',
+                'manage_projects',
+                'manage_allocations',
+                'manage_actuals',
+                'view_reports',
+                'configure_system',
+                'view_audit_logs',
+            ],
+            'manager' => [
+                'manage_projects',
+                'manage_allocations',
+                'manage_actuals',
+                'view_reports',
+                'manage_team_members',
+            ],
+            'developer' => [
+                'manage_actuals',
+                'view_own_allocations',
+                'view_own_actuals',
+                'log_hours',
+            ],
+            'top_brass' => [
+                'view_reports',
+                'view_allocations',
+                'view_actuals',
+                'view_capacity',
+            ],
+            default => [],
+        };
+    }
+
+    /**
+     * Encode a JWT token
+     *
+     * @param array $payload
+     * @return string
+     */
+    private function encodeJWT(array $payload): string
+    {
+        $header = $this->base64UrlEncode(json_encode(['typ' => 'JWT', 'alg' => 'HS256']));
+        $payload = $this->base64UrlEncode(json_encode($payload));
+        $signature = $this->createSignature($header, $payload);
+
+        return $header . '.' . $payload . '.' . $signature;
+    }
+
+    /**
+     * Create a signature for JWT
+     *
+     * @param string $header
+     * @param string $payload
+     * @return string
+     */
+    private function createSignature(string $header, string $payload): string
+    {
+        $signature = hash_hmac('sha256', $header . '.' . $payload, config('app.key'), true);
+        
+        return $this->base64UrlEncode($signature);
+    }
+
+    /**
+     * Generate a cryptographically secure random token
+     *
+     * @return string
+     */
+    private function generateSecureToken(): string
+    {
+        return bin2hex(random_bytes(32));
+    }
+
+    /**
+     * Generate a unique token ID
+     *
+     * @return string
+     */
+    private function generateTokenId(): string
+    {
+        return uniqid('token_', true);
+    }
+
+    /**
+     * Get cache key for refresh token
+     *
+     * @param string $token
+     * @return string
+     */
+    private function getRefreshTokenKey(string $token): string
+    {
+        return "refresh_token:{$token}";
+    }
+
+    /**
+     * Base64URL encode
+     *
+     * @param string $data
+     * @return string
+     */
+    private function base64UrlEncode(string $data): string
+    {
+        return str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($data));
+    }
+
+    /**
+     * Base64URL decode
+     *
+     * @param string $data
+     * @return string
+     */
+    private function base64UrlDecode(string $data): string
+    {
+        $padding = 4 - (strlen($data) % 4);
+        if ($padding !== 4) {
+            $data .= str_repeat('=', $padding);
+        }
+        
+        return base64_decode(str_replace(['-', '_'], ['+', '/'], $data));
+    }
+}

backend/app/Services/ProjectService.php

@@ -0,0 +1,238 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Project;
+use App\Models\ProjectStatus;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+
+/**
+ * Project Service
+ *
+ * Handles business logic for project operations.
+ */
+class ProjectService
+{
+    public function __construct(protected ProjectStatusService $statusService) {}
+
+    /**
+     * Get all projects with optional filtering.
+     *
+     * @param  int|null  $statusId  Filter by status ID
+     * @param  int|null  $typeId  Filter by type ID
+     * @return Collection<Project>
+     */
+    public function getAll(?int $statusId = null, ?int $typeId = null): Collection
+    {
+        $query = Project::with([
+            'status:id,name,order',
+            'type:id,name',
+        ])
+            ->select('projects.*')
+            ->leftJoin('project_statuses', 'projects.status_id', '=', 'project_statuses.id');
+
+        if ($statusId !== null) {
+            $query->where('projects.status_id', $statusId);
+        }
+
+        if ($typeId !== null) {
+            $query->where('projects.type_id', $typeId);
+        }
+
+        return $query->get();
+    }
+
+    /**
+     * Find a project by ID.
+     */
+    public function findById(string $id): ?Project
+    {
+        return Project::with(['status', 'type', 'allocations', 'actuals'])->find($id);
+    }
+
+    /**
+     * Create a new project.
+     *
+     * @throws ValidationException
+     */
+    public function create(array $data): Project
+    {
+        $validator = Validator::make($data, [
+            'code' => 'required|string|max:50|unique:projects,code',
+            'title' => 'required|string|max:255',
+            'type_id' => 'required|integer|exists:project_types,id',
+            'status_id' => 'sometimes|integer|exists:project_statuses,id',
+        ], [
+            'code.unique' => 'Project code must be unique',
+        ]);
+
+        if ($validator->fails()) {
+            throw new ValidationException($validator);
+        }
+
+        // Default to first status (Pre-sales) if not provided
+        if (! isset($data['status_id'])) {
+            $initialStatus = ProjectStatus::orderBy('order')->first();
+            $data['status_id'] = $initialStatus?->id;
+        }
+
+        $project = Project::create($data);
+        $project->load(['status', 'type']);
+
+        return $project;
+    }
+
+    /**
+     * Update an existing project.
+     *
+     * @throws ValidationException
+     */
+    public function update(Project $project, array $data): Project
+    {
+        $validator = Validator::make($data, [
+            'code' => 'sometimes|string|max:50|unique:projects,code,'.$project->id,
+            'title' => 'sometimes|string|max:255',
+            'type_id' => 'sometimes|integer|exists:project_types,id',
+            'status_id' => 'sometimes|integer|exists:project_statuses,id',
+            'approved_estimate' => 'sometimes|numeric|min:0',
+        ], [
+            'code.unique' => 'Project code must be unique',
+        ]);
+
+        if ($validator->fails()) {
+            throw new ValidationException($validator);
+        }
+
+        $project->update($data);
+        $project->load(['status', 'type']);
+
+        return $project;
+    }
+
+    /**
+     * Transition project to a new status.
+     *
+     * @throws \RuntimeException
+     */
+    public function transitionStatus(Project $project, int $newStatusId): Project
+    {
+        $newStatus = ProjectStatus::find($newStatusId);
+
+        if (! $newStatus) {
+            throw new \RuntimeException('Invalid status', 422);
+        }
+
+        $currentStatusName = $project->status->name;
+        $newStatusName = $newStatus->name;
+
+        // Check if transition is valid
+        if (! $this->statusService->canTransition($currentStatusName, $newStatusName)) {
+            throw new \RuntimeException(
+                "Cannot transition from {$currentStatusName} to {$newStatusName}",
+                422
+            );
+        }
+
+        // Special validation: Estimate Approved requires approved_estimate > 0
+        if ($this->statusService->requiresEstimate($newStatusName)) {
+            if (! $project->approved_estimate || $project->approved_estimate <= 0) {
+                throw new \RuntimeException(
+                    'Cannot transition to Estimate Approved without an approved estimate',
+                    422
+                );
+            }
+        }
+
+        $project->update(['status_id' => $newStatusId]);
+        $project->load(['status', 'type']);
+
+        return $project;
+    }
+
+    /**
+     * Set the approved estimate for a project.
+     *
+     * @throws \RuntimeException
+     */
+    public function setApprovedEstimate(Project $project, float $estimate): Project
+    {
+        if ($estimate <= 0) {
+            throw new \RuntimeException('Approved estimate must be greater than 0', 422);
+        }
+
+        $project->update(['approved_estimate' => $estimate]);
+        $project->load(['status', 'type']);
+
+        return $project;
+    }
+
+    /**
+     * Set the forecasted effort for a project.
+     *
+     * @param  array  $forecastedEffort  ['2024-01' => 40, '2024-02' => 60, ...]
+     *
+     * @throws \RuntimeException
+     */
+    public function setForecastedEffort(Project $project, array $forecastedEffort): Project
+    {
+        // Calculate total forecasted hours
+        $totalForecasted = array_sum($forecastedEffort);
+
+        // If project has approved estimate, validate within tolerance
+        if ($project->approved_estimate && $project->approved_estimate > 0) {
+            $approved = (float) $project->approved_estimate;
+            $difference = $totalForecasted - $approved;
+            $percentageDiff = ($difference / $approved) * 100;
+            $tolerancePercent = 5;
+
+            if (abs($percentageDiff) > $tolerancePercent) {
+                $lowerBound = max(0, round($approved * (1 - $tolerancePercent / 100), 2));
+                $upperBound = round($approved * (1 + $tolerancePercent / 100), 2);
+                $message = sprintf(
+                    'Forecasted effort (%s h) %s approved estimate (%s h) by %s hours (%s%%). Forecasted effort must be between %s and %s hours for a %s hour estimate.',
+                    number_format($totalForecasted, 2, '.', ''),
+                    $difference > 0 ? 'exceeds' : 'is below',
+                    number_format($approved, 2, '.', ''),
+                    number_format(abs($difference), 2, '.', ''),
+                    number_format(abs($percentageDiff), 2, '.', ''),
+                    number_format($lowerBound, 2, '.', ''),
+                    number_format($upperBound, 2, '.', ''),
+                    number_format($approved, 2, '.', '')
+                );
+
+                throw new \RuntimeException($message, 422);
+            }
+        }
+
+        $project->update(['forecasted_effort' => $forecastedEffort]);
+        $project->load(['status', 'type']);
+
+        return $project;
+    }
+
+    /**
+     * Check if a project can be deleted.
+     *
+     * @return array{canDelete: bool, reason?: string}
+     */
+    public function canDelete(Project $project): array
+    {
+        if ($project->allocations()->exists()) {
+            return [
+                'canDelete' => false,
+                'reason' => 'Project has allocations',
+            ];
+        }
+
+        if ($project->actuals()->exists()) {
+            return [
+                'canDelete' => false,
+                'reason' => 'Project has actuals',
+            ];
+        }
+
+        return ['canDelete' => true];
+    }
+}

backend/app/Services/ProjectStatusService.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Services;
+
+/**
+ * Encapsulates the project lifecycle state machine.
+ */
+class ProjectStatusService
+{
+    /**
+     * Valid status transitions for the project state machine.
+     * Key = from status, Value = array of valid target statuses
+     */
+    protected array $statusTransitions = [
+        'Pre-sales' => ['SOW Approval'],
+        'SOW Approval' => ['Estimation', 'Pre-sales'],
+        'Estimation' => ['Estimate Approved', 'SOW Approval'],
+        'Estimate Approved' => ['Resource Allocation', 'Estimate Rework'],
+        'Resource Allocation' => ['Sprint 0', 'Estimate Approved'],
+        'Sprint 0' => ['In Progress', 'Resource Allocation'],
+        'In Progress' => ['UAT', 'Sprint 0', 'On Hold'],
+        'UAT' => ['Handover / Sign-off', 'In Progress', 'On Hold'],
+        'Handover / Sign-off' => ['Closed', 'UAT'],
+        'Estimate Rework' => ['Estimation'],
+        'On Hold' => ['In Progress', 'Cancelled'],
+        'Cancelled' => [],
+        'Closed' => [],
+    ];
+
+    /**
+     * Return the valid target statuses for the provided current status.
+     */
+    public function getValidTransitions(string $currentStatus): array
+    {
+        return $this->statusTransitions[$currentStatus] ?? [];
+    }
+
+    /**
+     * Determine if a transition from the current status to the target is allowed.
+     */
+    public function canTransition(string $currentStatus, string $targetStatus): bool
+    {
+        return in_array($targetStatus, $this->getValidTransitions($currentStatus), true);
+    }
+
+    /**
+     * Return statuses that do not allow further transitions.
+     */
+    public function getTerminalStatuses(): array
+    {
+        return array_keys(array_filter($this->statusTransitions, static fn (array $targets): bool => $targets === []));
+    }
+
+    /**
+     * Determine if a status requires an approved estimate before entering.
+     */
+    public function requiresEstimate(string $statusName): bool
+    {
+        return $statusName === 'Estimate Approved';
+    }
+}

backend/app/Services/ReconciliationCalculator.php

@@ -0,0 +1,103 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Project;
+use App\Models\ProjectMonthPlan;
+use Illuminate\Support\Collection;
+
+class ReconciliationCalculator
+{
+    /**
+     * Calculate reconciliation status for a single project.
+     * Returns OVER, UNDER, or MATCH based on plan_sum vs approved_estimate.
+     */
+    public function calculateStatus(Project $project, ?Collection $plans = null): string
+    {
+        $approved = (float) $project->approved_estimate;
+
+        // If no approved estimate, consider it UNDER
+        if ($approved <= 0) {
+            return 'UNDER';
+        }
+
+        $planSum = $this->calculatePlanSum($project, $plans);
+
+        // Use decimal-safe comparison
+        if ($this->isGreaterThan($planSum, $approved)) {
+            return 'OVER';
+        }
+
+        if ($this->isLessThan($planSum, $approved)) {
+            return 'UNDER';
+        }
+
+        return 'MATCH';
+    }
+
+    /**
+     * Calculate the sum of planned hours for a project.
+     * Only sums non-null planned_hours values.
+     */
+    public function calculatePlanSum(Project $project, ?Collection $plans = null): float
+    {
+        if ($plans === null) {
+            $plans = ProjectMonthPlan::where('project_id', $project->id)->get();
+        }
+
+        return $plans
+            ->filter(fn ($plan) => $plan->planned_hours !== null)
+            ->sum('planned_hours');
+    }
+
+    /**
+     * Calculate plan sum and status for multiple projects.
+     * Returns array with project_id => ['plan_sum' => float, 'status' => string].
+     */
+    public function calculateForProjects(Collection $projects, int $year): array
+    {
+        $startDate = "{$year}-01-01";
+        $endDate = "{$year}-12-01";
+
+        // Get all plans for the year, grouped by project_id
+        $allPlans = ProjectMonthPlan::whereBetween('month', [$startDate, $endDate])
+            ->get()
+            ->groupBy('project_id');
+
+        $results = [];
+
+        foreach ($projects as $project) {
+            $projectPlans = $allPlans->get($project->id, collect());
+            $planSum = $this->calculatePlanSum($project, $projectPlans);
+            $status = $this->calculateStatus($project, $projectPlans);
+
+            $results[$project->id] = [
+                'plan_sum' => $planSum,
+                'status' => $status,
+                'approved_estimate' => $project->approved_estimate,
+            ];
+        }
+
+        return $results;
+    }
+
+    /**
+     * Compare two floats using epsilon for decimal-safe comparison.
+     */
+    private function isGreaterThan(float $a, float $b): bool
+    {
+        $epsilon = 0.0001;
+
+        return ($a - $b) > $epsilon;
+    }
+
+    /**
+     * Compare two floats using epsilon for decimal-safe comparison.
+     */
+    private function isLessThan(float $a, float $b): bool
+    {
+        $epsilon = 0.0001;
+
+        return ($b - $a) > $epsilon;
+    }
+}

backend/app/Services/TeamMemberService.php

@@ -0,0 +1,240 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\TeamMember;
+use Closure;
+use DateTimeInterface;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+use Throwable;
+
+/**
+ * Team Member Service
+ *
+ * Handles business logic for team member operations.
+ */
+class TeamMemberService
+{
+    private ?bool $redisAvailable = null;
+
+    /**
+     * Get all team members with optional filtering.
+     *
+     * @param  bool|null  $active  Filter by active status
+     * @return Collection<TeamMember>
+     */
+    public function getAll(?bool $active = null): Collection
+    {
+        /** @var Collection<TeamMember> $teamMembers */
+        $teamMembers = $this->rememberTeamMembers(
+            $this->buildTeamMembersCacheKey($active),
+            now()->addHour(),
+            function () use ($active): Collection {
+                $query = TeamMember::with('role');
+
+                if ($active !== null) {
+                    $query->where('active', $active);
+                }
+
+                return $query->get();
+            }
+        );
+
+        return $teamMembers;
+    }
+
+    /**
+     * Find a team member by ID.
+     */
+    public function findById(string $id): ?TeamMember
+    {
+        return TeamMember::with('role')->find($id);
+    }
+
+    /**
+     * Create a new team member.
+     *
+     * @throws ValidationException
+     */
+    public function create(array $data): TeamMember
+    {
+        $validator = Validator::make($data, [
+            'name' => 'required|string|max:255',
+            'role_id' => 'required|integer|exists:roles,id',
+            'hourly_rate' => 'required|numeric|gt:0',
+            'active' => 'boolean',
+        ], [
+            'hourly_rate.gt' => 'Hourly rate must be greater than 0',
+        ]);
+
+        if ($validator->fails()) {
+            throw new ValidationException($validator);
+        }
+
+        $teamMember = TeamMember::create([
+            'name' => $data['name'],
+            'role_id' => $data['role_id'],
+            'hourly_rate' => $data['hourly_rate'],
+            'active' => $data['active'] ?? true,
+        ]);
+
+        $teamMember->load('role');
+        $this->forgetTeamMembersCache();
+
+        return $teamMember;
+    }
+
+    /**
+     * Update an existing team member.
+     *
+     * @throws ValidationException
+     */
+    public function update(TeamMember $teamMember, array $data): TeamMember
+    {
+        $validator = Validator::make($data, [
+            'name' => 'sometimes|string|max:255',
+            'role_id' => 'sometimes|integer|exists:roles,id',
+            'hourly_rate' => 'sometimes|numeric|gt:0',
+            'active' => 'sometimes|boolean',
+        ], [
+            'hourly_rate.gt' => 'Hourly rate must be greater than 0',
+        ]);
+
+        if ($validator->fails()) {
+            throw new ValidationException($validator);
+        }
+
+        $teamMember->update($data);
+        $teamMember->load('role');
+        $this->forgetTeamMembersCache();
+
+        return $teamMember;
+    }
+
+    /**
+     * Delete a team member.
+     *
+     * @throws \RuntimeException
+     */
+    public function delete(TeamMember $teamMember): void
+    {
+        // Check if team member has allocations
+        if ($teamMember->allocations()->exists()) {
+            throw new \RuntimeException(
+                'Cannot delete team member with active allocations',
+                422
+            );
+        }
+
+        // Check if team member has actuals
+        if ($teamMember->actuals()->exists()) {
+            throw new \RuntimeException(
+                'Cannot delete team member with historical data',
+                422
+            );
+        }
+
+        $teamMember->delete();
+        $this->forgetTeamMembersCache();
+    }
+
+    /**
+     * Check if a team member can be deleted.
+     *
+     * @return array{canDelete: bool, reason?: string}
+     */
+    public function canDelete(TeamMember $teamMember): array
+    {
+        if ($teamMember->allocations()->exists()) {
+            return [
+                'canDelete' => false,
+                'reason' => 'Team member has active allocations',
+            ];
+        }
+
+        if ($teamMember->actuals()->exists()) {
+            return [
+                'canDelete' => false,
+                'reason' => 'Team member has historical data',
+            ];
+        }
+
+        return ['canDelete' => true];
+    }
+
+    private function buildTeamMembersCacheKey(?bool $active): string
+    {
+        if ($active === null) {
+            return 'team-members:all';
+        }
+
+        return $active ? 'team-members:active' : 'team-members:inactive';
+    }
+
+    /**
+     * @param  Closure(): Collection<TeamMember>  $callback
+     * @return Collection<TeamMember>
+     */
+    private function rememberTeamMembers(string $key, DateTimeInterface|int $ttl, Closure $callback): Collection
+    {
+        if (! $this->redisAvailable()) {
+            /** @var Collection<TeamMember> $payload */
+            $payload = Cache::store('array')->remember($key, $ttl, $callback);
+
+            return $payload;
+        }
+
+        try {
+            /** @var Collection<TeamMember> $payload */
+            $payload = Cache::store('redis')->remember($key, $ttl, $callback);
+
+            return $payload;
+        } catch (Throwable) {
+            /** @var Collection<TeamMember> $payload */
+            $payload = Cache::store('array')->remember($key, $ttl, $callback);
+
+            return $payload;
+        }
+    }
+
+    private function forgetTeamMembersCache(): void
+    {
+        Cache::store('array')->forget($this->buildTeamMembersCacheKey(null));
+        Cache::store('array')->forget($this->buildTeamMembersCacheKey(true));
+        Cache::store('array')->forget($this->buildTeamMembersCacheKey(false));
+
+        if (! $this->redisAvailable()) {
+            return;
+        }
+
+        try {
+            Cache::store('redis')->forget($this->buildTeamMembersCacheKey(null));
+            Cache::store('redis')->forget($this->buildTeamMembersCacheKey(true));
+            Cache::store('redis')->forget($this->buildTeamMembersCacheKey(false));
+        } catch (Throwable) {
+            // Ignore cache failures when Redis is unavailable.
+        }
+    }
+
+    private function redisAvailable(): bool
+    {
+        if ($this->redisAvailable !== null) {
+            return $this->redisAvailable;
+        }
+
+        if (! config('cache.stores.redis')) {
+            return $this->redisAvailable = false;
+        }
+
+        $client = config('database.redis.client', 'phpredis');
+
+        if ($client === 'predis') {
+            return $this->redisAvailable = class_exists('Predis\\Client');
+        }
+
+        return $this->redisAvailable = extension_loaded('redis');
+    }
+}

backend/app/Services/VarianceCalculator.php

@@ -0,0 +1,164 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Allocation;
+use App\Models\ProjectMonthPlan;
+use Carbon\Carbon;
+
+class VarianceCalculator
+{
+    /**
+     * Calculate row variance for a project in a given month.
+     * Row variance = allocated_total - planned_month
+     *
+     * @return array{
+     *   allocated_total: float,
+     *   planned_month: float,
+     *   variance: float,
+     *   status: string
+     * }
+     */
+    public function calculateRowVariance(string $projectId, string $month): array
+    {
+        // Convert YYYY-MM to YYYY-MM-01 and then to a Carbon date for proper comparison
+        $monthDate = strlen($month) === 7 ? Carbon::createFromFormat('Y-m', $month)->startOfMonth() : Carbon::parse($month);
+
+        // Get total allocated hours for this project/month (including untracked)
+        $allocatedTotal = Allocation::where('project_id', $projectId)
+            ->whereMonth('month', $monthDate->month)
+            ->whereYear('month', $monthDate->year)
+            ->sum('allocated_hours');
+
+        // Get planned hours for this project/month (treat null as 0)
+        $plannedMonth = $this->getPlannedHoursForMonth($projectId, $month);
+
+        $variance = $allocatedTotal - $plannedMonth;
+
+        return [
+            'allocated_total' => $allocatedTotal,
+            'planned_month' => $plannedMonth,
+            'variance' => $variance,
+            'status' => $this->determineStatus($variance),
+        ];
+    }
+
+    /**
+     * Calculate column variance for a team member in a given month.
+     * Column variance = member_allocated - member_capacity
+     *
+     * @return array{
+     *   allocated: float,
+     *   capacity: float,
+     *   variance: float,
+     *   status: string
+     * }
+     */
+    public function calculateColumnVariance(string $teamMemberId, string $month, CapacityService $capacityService): array
+    {
+        // Convert YYYY-MM to Carbon date for proper comparison
+        $monthDate = strlen($month) === 7 ? Carbon::createFromFormat('Y-m', $month)->startOfMonth() : Carbon::parse($month);
+
+        // Get total allocated hours for this member/month (excluding untracked)
+        $allocated = Allocation::where('team_member_id', $teamMemberId)
+            ->whereMonth('month', $monthDate->month)
+            ->whereYear('month', $monthDate->year)
+            ->sum('allocated_hours');
+
+        // Get member capacity
+        $capacityData = $capacityService->calculateIndividualCapacity($teamMemberId, $month);
+        $capacity = $capacityData['hours'] ?? 0;
+
+        $variance = $allocated - $capacity;
+
+        return [
+            'allocated' => $allocated,
+            'capacity' => $capacity,
+            'variance' => $variance,
+            'status' => $this->determineStatus($variance),
+        ];
+    }
+
+    /**
+     * Get planned hours for a project/month.
+     * Returns 0 if no plan exists (blank month treated as 0).
+     */
+    public function getPlannedHoursForMonth(string $projectId, string $month): float
+    {
+        $monthDate = strlen($month) === 7 ? Carbon::createFromFormat('Y-m', $month)->startOfMonth() : Carbon::parse($month);
+
+        $plan = ProjectMonthPlan::where('project_id', $projectId)
+            ->whereMonth('month', $monthDate->month)
+            ->whereYear('month', $monthDate->year)
+            ->first();
+
+        // Blank plan is treated as 0 for allocation variance
+        return (float) ($plan?->planned_hours ?? 0);
+    }
+
+    /**
+     * Determine status based on variance value.
+     *
+     * - Positive variance (> 0): OVER (red)
+     * - Negative variance (< 0): UNDER (amber)
+     * - Zero variance: MATCH (neutral)
+     */
+    public function determineStatus(float $variance): string
+    {
+        $epsilon = 0.0001;
+
+        if ($variance > $epsilon) {
+            return 'OVER';
+        }
+
+        if ($variance < -$epsilon) {
+            return 'UNDER';
+        }
+
+        return 'MATCH';
+    }
+
+    /**
+     * Calculate both row and column variances for a complete matrix view.
+     *
+     * @return array{
+     *   project_variances: array<string, array>,
+     *   team_member_variances: array<string, array>
+     * }
+     */
+    public function calculateMatrixVariances(string $month, CapacityService $capacityService): array
+    {
+        // Convert YYYY-MM to Carbon date for proper comparison
+        $monthDate = strlen($month) === 7 ? Carbon::createFromFormat('Y-m', $month)->startOfMonth() : Carbon::parse($month);
+
+        // Get all allocations for the month using whereMonth/whereYear
+        $allocations = Allocation::whereMonth('month', $monthDate->month)
+            ->whereYear('month', $monthDate->year)
+            ->get();
+
+        // Calculate row variances per project
+        $projectIds = $allocations->pluck('project_id')->unique()->toArray();
+        $projectVariances = [];
+
+        foreach ($projectIds as $projectId) {
+            $projectVariances[$projectId] = $this->calculateRowVariance($projectId, $month);
+        }
+
+        // Calculate column variances per team member (excluding null/untracked)
+        $teamMemberIds = $allocations->pluck('team_member_id')
+            ->filter(fn ($id) => $id !== null)
+            ->unique()
+            ->toArray();
+
+        $teamMemberVariances = [];
+
+        foreach ($teamMemberIds as $teamMemberId) {
+            $teamMemberVariances[$teamMemberId] = $this->calculateColumnVariance($teamMemberId, $month, $capacityService);
+        }
+
+        return [
+            'project_variances' => $projectVariances,
+            'team_member_variances' => $teamMemberVariances,
+        ];
+    }
+}

backend/app/Utilities/WorkingDaysCalculator.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Utilities;
+
+use Carbon\Carbon;
+use Carbon\CarbonPeriod;
+
+class WorkingDaysCalculator
+{
+    public const TIMEZONE = 'America/New_York';
+
+    public static function calculate(string $month, array $holidays = []): int
+    {
+        $start = Carbon::createFromFormat('Y-m', $month, self::TIMEZONE)->startOfMonth();
+        $end = $start->copy()->endOfMonth();
+
+        return self::getWorkingDaysInRange($start->toDateString(), $end->toDateString(), $holidays);
+    }
+
+    public static function getWorkingDaysInRange(string $start, string $end, array $holidays = []): int
+    {
+        $period = CarbonPeriod::create(
+            Carbon::create($start, self::TIMEZONE),
+            Carbon::create($end, self::TIMEZONE)
+        );
+        $holidayLookup = array_flip($holidays);
+        $workingDays = 0;
+
+        foreach ($period as $day) {
+            $date = $day->toDateString();
+
+            if (self::isWorkingDay($date, $holidayLookup)) {
+                $workingDays++;
+            }
+        }
+
+        return $workingDays;
+    }
+
+    public static function isWorkingDay(string $date, array $holidays = []): bool
+    {
+        $carbonDate = Carbon::create($date, self::TIMEZONE);
+
+        if ($carbonDate->isWeekend()) {
+            return false;
+        }
+
+        if (isset($holidays[$carbonDate->toDateString()])) {
+            return false;
+        }
+
+        return true;
+    }
+
+    public static function isWeekend(string $date): bool
+    {
+        return Carbon::create($date, self::TIMEZONE)->isWeekend();
+    }
+}

backend/artisan

@@ -0,0 +1,18 @@
+#!/usr/bin/env php
+<?php
+
+use Illuminate\Foundation\Application;
+use Symfony\Component\Console\Input\ArgvInput;
+
+define('LARAVEL_START', microtime(true));
+
+// Register the Composer autoloader...
+require __DIR__.'/vendor/autoload.php';
+
+// Bootstrap Laravel and handle the command...
+/** @var Application $app */
+$app = require_once __DIR__.'/bootstrap/app.php';
+
+$status = $app->handleCommand(new ArgvInput);
+
+exit($status);

backend/boost.json

@@ -0,0 +1,14 @@
+{
+    "agents": [
+        "opencode",
+        "junie",
+        "codex"
+    ],
+    "guidelines": true,
+    "herd_mcp": false,
+    "mcp": true,
+    "sail": false,
+    "skills": [
+        "pest-testing"
+    ]
+}

backend/bootstrap/app.php

@@ -0,0 +1,19 @@
+<?php
+
+use Illuminate\Foundation\Application;
+use Illuminate\Foundation\Configuration\Exceptions;
+use Illuminate\Foundation\Configuration\Middleware;
+
+return Application::configure(basePath: dirname(__DIR__))
+    ->withRouting(
+        web: __DIR__.'/../routes/web.php',
+        api: __DIR__.'/../routes/api.php',
+        commands: __DIR__.'/../routes/console.php',
+        health: '/up',
+    )
+    ->withMiddleware(function (Middleware $middleware): void {
+        //
+    })
+    ->withExceptions(function (Exceptions $exceptions): void {
+        //
+    })->create();

backend/bootstrap/cache/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore

backend/bootstrap/providers.php

@@ -0,0 +1,5 @@
+<?php
+
+return [
+    App\Providers\AppServiceProvider::class,
+];

backend/composer.json

@@ -0,0 +1,95 @@
+{
+    "$schema": "https://getcomposer.org/schema.json",
+    "name": "laravel/laravel",
+    "type": "project",
+    "description": "The skeleton application for the Laravel framework.",
+    "keywords": [
+        "laravel",
+        "framework"
+    ],
+    "license": "MIT",
+    "require": {
+        "php": "^8.2",
+        "knuckleswtf/scribe": "^5.7",
+        "laravel/framework": "^12.0",
+        "laravel/tinker": "^2.10.1",
+        "parsedown/parsedown": "1.7.4",
+        "predis/predis": "^2.0",
+        "tymon/jwt-auth": "^2.0"
+    },
+    "require-dev": {
+        "fakerphp/faker": "^1.23",
+        "laravel/pail": "^1.2.2",
+        "laravel/pint": "^1.24",
+        "laravel/sail": "^1.41",
+        "mockery/mockery": "^1.6",
+        "nunomaduro/collision": "^8.6",
+        "pestphp/pest": "^3.8",
+        "pestphp/pest-plugin-laravel": "^3.0",
+        "phpunit/phpunit": "^11.5.3"
+    },
+    "autoload": {
+        "psr-4": {
+            "App\\": "app/",
+            "Database\\Factories\\": "database/factories/",
+            "Database\\Seeders\\": "database/seeders/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "Tests\\": "tests/"
+        }
+    },
+    "scripts": {
+        "setup": [
+            "composer install",
+            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\"",
+            "@php artisan key:generate",
+            "@php artisan migrate --force",
+            "npm install",
+            "npm run build"
+        ],
+        "dev": [
+            "Composer\\Config::disableProcessTimeout",
+            "npx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan serve\" \"php artisan queue:listen --tries=1 --timeout=0\" \"php artisan pail --timeout=0\" \"npm run dev\" --names=server,queue,logs,vite --kill-others"
+        ],
+        "test": [
+            "@php artisan config:clear --ansi",
+            "@php artisan test"
+        ],
+        "post-autoload-dump": [
+            "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
+            "@php artisan package:discover --ansi"
+        ],
+        "post-update-cmd": [
+            "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
+        ],
+        "post-root-package-install": [
+            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
+        ],
+        "post-create-project-cmd": [
+            "@php artisan key:generate --ansi",
+            "@php -r \"file_exists('database/database.sqlite') || touch('database/database.sqlite');\"",
+            "@php artisan migrate --graceful --ansi"
+        ],
+        "pre-package-uninstall": [
+            "Illuminate\\Foundation\\ComposerScripts::prePackageUninstall"
+        ]
+    },
+    "extra": {
+        "laravel": {
+            "dont-discover": []
+        }
+    },
+    "config": {
+        "optimize-autoloader": true,
+        "preferred-install": "dist",
+        "sort-packages": true,
+        "allow-plugins": {
+            "pestphp/pest-plugin": true,
+            "php-http/discovery": true
+        }
+    },
+    "minimum-stability": "stable",
+    "prefer-stable": true
+}

backend/config/app.php

@@ -0,0 +1,126 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Name
+    |--------------------------------------------------------------------------
+    |
+    | This value is the name of your application, which will be used when the
+    | framework needs to place the application's name in a notification or
+    | other UI elements where an application name needs to be displayed.
+    |
+    */
+
+    'name' => env('APP_NAME', 'Laravel'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Environment
+    |--------------------------------------------------------------------------
+    |
+    | This value determines the "environment" your application is currently
+    | running in. This may determine how you prefer to configure various
+    | services the application utilizes. Set this in your ".env" file.
+    |
+    */
+
+    'env' => env('APP_ENV', 'production'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Debug Mode
+    |--------------------------------------------------------------------------
+    |
+    | When your application is in debug mode, detailed error messages with
+    | stack traces will be shown on every error that occurs within your
+    | application. If disabled, a simple generic error page is shown.
+    |
+    */
+
+    'debug' => (bool) env('APP_DEBUG', false),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application URL
+    |--------------------------------------------------------------------------
+    |
+    | This URL is used by the console to properly generate URLs when using
+    | the Artisan command line tool. You should set this to the root of
+    | the application so that it's available within Artisan commands.
+    |
+    */
+
+    'url' => env('APP_URL', 'http://localhost'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Timezone
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify the default timezone for your application, which
+    | will be used by the PHP date and date-time functions. The timezone
+    | is set to "UTC" by default as it is suitable for most use cases.
+    |
+    */
+
+    'timezone' => 'UTC',
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Locale Configuration
+    |--------------------------------------------------------------------------
+    |
+    | The application locale determines the default locale that will be used
+    | by Laravel's translation / localization methods. This option can be
+    | set to any locale for which you plan to have translation strings.
+    |
+    */
+
+    'locale' => env('APP_LOCALE', 'en'),
+
+    'fallback_locale' => env('APP_FALLBACK_LOCALE', 'en'),
+
+    'faker_locale' => env('APP_FAKER_LOCALE', 'en_US'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Encryption Key
+    |--------------------------------------------------------------------------
+    |
+    | This key is utilized by Laravel's encryption services and should be set
+    | to a random, 32 character string to ensure that all encrypted values
+    | are secure. You should do this prior to deploying the application.
+    |
+    */
+
+    'cipher' => 'AES-256-CBC',
+
+    'key' => env('APP_KEY'),
+
+    'previous_keys' => [
+        ...array_filter(
+            explode(',', (string) env('APP_PREVIOUS_KEYS', ''))
+        ),
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Maintenance Mode Driver
+    |--------------------------------------------------------------------------
+    |
+    | These configuration options determine the driver used to determine and
+    | manage Laravel's "maintenance mode" status. The "cache" driver will
+    | allow maintenance mode to be controlled across multiple machines.
+    |
+    | Supported drivers: "file", "cache"
+    |
+    */
+
+    'maintenance' => [
+        'driver' => env('APP_MAINTENANCE_DRIVER', 'file'),
+        'store' => env('APP_MAINTENANCE_STORE', 'database'),
+    ],
+
+];

backend/config/auth.php

@@ -0,0 +1,115 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Authentication Defaults
+    |--------------------------------------------------------------------------
+    |
+    | This option defines the default authentication "guard" and password
+    | reset "broker" for your application. You may change these values
+    | as required, but they're a perfect start for most applications.
+    |
+    */
+
+    'defaults' => [
+        'guard' => env('AUTH_GUARD', 'web'),
+        'passwords' => env('AUTH_PASSWORD_BROKER', 'users'),
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Authentication Guards
+    |--------------------------------------------------------------------------
+    |
+    | Next, you may define every authentication guard for your application.
+    | Of course, a great default configuration has been defined for you
+    | which utilizes session storage plus the Eloquent user provider.
+    |
+    | All authentication guards have a user provider, which defines how the
+    | users are actually retrieved out of your database or other storage
+    | system used by the application. Typically, Eloquent is utilized.
+    |
+    | Supported: "session"
+    |
+    */
+
+    'guards' => [
+        'web' => [
+            'driver' => 'session',
+            'provider' => 'users',
+        ],
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | User Providers
+    |--------------------------------------------------------------------------
+    |
+    | All authentication guards have a user provider, which defines how the
+    | users are actually retrieved out of your database or other storage
+    | system used by the application. Typically, Eloquent is utilized.
+    |
+    | If you have multiple user tables or models you may configure multiple
+    | providers to represent the model / table. These providers may then
+    | be assigned to any extra authentication guards you have defined.
+    |
+    | Supported: "database", "eloquent"
+    |
+    */
+
+    'providers' => [
+        'users' => [
+            'driver' => 'eloquent',
+            'model' => env('AUTH_MODEL', App\Models\User::class),
+        ],
+
+        // 'users' => [
+        //     'driver' => 'database',
+        //     'table' => 'users',
+        // ],
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Resetting Passwords
+    |--------------------------------------------------------------------------
+    |
+    | These configuration options specify the behavior of Laravel's password
+    | reset functionality, including the table utilized for token storage
+    | and the user provider that is invoked to actually retrieve users.
+    |
+    | The expiry time is the number of minutes that each reset token will be
+    | considered valid. This security feature keeps tokens short-lived so
+    | they have less time to be guessed. You may change this as needed.
+    |
+    | The throttle setting is the number of seconds a user must wait before
+    | generating more password reset tokens. This prevents the user from
+    | quickly generating a very large amount of password reset tokens.
+    |
+    */
+
+    'passwords' => [
+        'users' => [
+            'provider' => 'users',
+            'table' => env('AUTH_PASSWORD_RESET_TOKEN_TABLE', 'password_reset_tokens'),
+            'expire' => 60,
+            'throttle' => 60,
+        ],
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Password Confirmation Timeout
+    |--------------------------------------------------------------------------
+    |
+    | Here you may define the number of seconds before a password confirmation
+    | window expires and users are asked to re-enter their password via the
+    | confirmation screen. By default, the timeout lasts for three hours.
+    |
+    */
+
+    'password_timeout' => env('AUTH_PASSWORD_TIMEOUT', 10800),
+
+];

backend/config/boost.php

@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Boost Master Switch
+    |--------------------------------------------------------------------------
+    |
+    | This option may be used to disable all Boost functionality - which
+    | will prevent Boost's routes from being registered and will also
+    | disable Boost's browser logging functionality from operating.
+    |
+    */
+
+    'enabled' => env('BOOST_ENABLED', true),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Boost Browser Logs Watcher
+    |--------------------------------------------------------------------------
+    |
+    | The following option may be used to enable or disable the browser logs
+    | watcher feature within Laravel Boost. The log watcher will read any
+    | errors within the browser's console to give Boost better context.
+    |
+    */
+
+    'browser_logs_watcher' => env('BOOST_BROWSER_LOGS_WATCHER', true),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Boost Executables Paths
+    |--------------------------------------------------------------------------
+    |
+    | These options allow you to specify custom paths for the executables that
+    | Boost uses. When configured, they take precedence over the automatic
+    | discovery mechanism. Leave empty to use defaults from your $PATH.
+    |
+    */
+
+    'executable_paths' => [
+        'php' => env('BOOST_PHP_EXECUTABLE_PATH'),
+        'composer' => env('BOOST_COMPOSER_EXECUTABLE_PATH'),
+        'npm' => env('BOOST_NPM_EXECUTABLE_PATH'),
+        'vendor_bin' => env('BOOST_VENDOR_BIN_EXECUTABLE_PATH'),
+    ],
+
+];

backend/config/cache.php

@@ -0,0 +1,117 @@
+<?php
+
+use Illuminate\Support\Str;
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Default Cache Store
+    |--------------------------------------------------------------------------
+    |
+    | This option controls the default cache store that will be used by the
+    | framework. This connection is utilized if another isn't explicitly
+    | specified when running a cache operation inside the application.
+    |
+    */
+
+    'default' => env('CACHE_STORE', 'database'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Cache Stores
+    |--------------------------------------------------------------------------
+    |
+    | Here you may define all of the cache "stores" for your application as
+    | well as their drivers. You may even define multiple stores for the
+    | same cache driver to group types of items stored in your caches.
+    |
+    | Supported drivers: "array", "database", "file", "memcached",
+    |                    "redis", "dynamodb", "octane",
+    |                    "failover", "null"
+    |
+    */
+
+    'stores' => [
+
+        'array' => [
+            'driver' => 'array',
+            'serialize' => false,
+        ],
+
+        'database' => [
+            'driver' => 'database',
+            'connection' => env('DB_CACHE_CONNECTION'),
+            'table' => env('DB_CACHE_TABLE', 'cache'),
+            'lock_connection' => env('DB_CACHE_LOCK_CONNECTION'),
+            'lock_table' => env('DB_CACHE_LOCK_TABLE'),
+        ],
+
+        'file' => [
+            'driver' => 'file',
+            'path' => storage_path('framework/cache/data'),
+            'lock_path' => storage_path('framework/cache/data'),
+        ],
+
+        'memcached' => [
+            'driver' => 'memcached',
+            'persistent_id' => env('MEMCACHED_PERSISTENT_ID'),
+            'sasl' => [
+                env('MEMCACHED_USERNAME'),
+                env('MEMCACHED_PASSWORD'),
+            ],
+            'options' => [
+                // Memcached::OPT_CONNECT_TIMEOUT => 2000,
+            ],
+            'servers' => [
+                [
+                    'host' => env('MEMCACHED_HOST', '127.0.0.1'),
+                    'port' => env('MEMCACHED_PORT', 11211),
+                    'weight' => 100,
+                ],
+            ],
+        ],
+
+        'redis' => [
+            'driver' => 'redis',
+            'connection' => env('REDIS_CACHE_CONNECTION', 'cache'),
+            'lock_connection' => env('REDIS_CACHE_LOCK_CONNECTION', 'default'),
+        ],
+
+        'dynamodb' => [
+            'driver' => 'dynamodb',
+            'key' => env('AWS_ACCESS_KEY_ID'),
+            'secret' => env('AWS_SECRET_ACCESS_KEY'),
+            'region' => env('AWS_DEFAULT_REGION', 'us-east-1'),
+            'table' => env('DYNAMODB_CACHE_TABLE', 'cache'),
+            'endpoint' => env('DYNAMODB_ENDPOINT'),
+        ],
+
+        'octane' => [
+            'driver' => 'octane',
+        ],
+
+        'failover' => [
+            'driver' => 'failover',
+            'stores' => [
+                'database',
+                'array',
+            ],
+        ],
+
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Cache Key Prefix
+    |--------------------------------------------------------------------------
+    |
+    | When utilizing the APC, database, memcached, Redis, and DynamoDB cache
+    | stores, there might be other applications using the same cache. For
+    | that reason, you may prefix every cache key to avoid collisions.
+    |
+    */
+
+    'prefix' => env('CACHE_PREFIX', Str::slug((string) env('APP_NAME', 'laravel')).'-cache-'),
+
+];

backend/config/cors.php

@@ -0,0 +1,24 @@
+<?php
+
+return [
+    'paths' => [
+        'api/*',
+        'api/documentation',
+        'api/documentation/*',
+        'sanctum/csrf-cookie',
+    ],
+
+    'allowed_methods' => ['*'],
+
+    'allowed_origins' => ['*'],
+
+    'allowed_origins_patterns' => [],
+
+    'allowed_headers' => ['*'],
+
+    'exposed_headers' => [],
+
+    'max_age' => 0,
+
+    'supports_credentials' => false,
+];