feat: implement frontend-only mock for production lines and runs

- Add ProductionTemplatesPage component for managing production templates with a visual representation using React Flow. - Create LineHeaderNode and LineStageNode components for rendering production line nodes. - Introduce RunStageNode and RunHeaderNode components for displaying run stages and headers. - Implement StageProgressStrip for visualizing stage progress in runs. - Create mock data for production runs and templates to simulate backend functionality. - Define types for production templates and runs to structure mock data. - Document frontend Phase 2 specifications for manufacturing processes, including screens, dialogs, and validation posture.
feat: add dashboard overview stats endpoint and UI integration
2026-07-28 22:55:56 +05:30 · 2026-07-28 14:59:09 +05:30 · 2026-07-27 06:10:10 +00:00 · 2026-07-27 06:10:00 +00:00 · 2026-07-27 11:11:26 +05:30 · 2026-07-24 14:33:55 +05:30
319 changed files with 27459 additions and 1423 deletions
@@ -29,3 +29,10 @@ yarn-error.log*
 .DS_Store
 Thumbs.db
 .idea/
+
+# ── Migrations ─────────────────────────────────────────────────────────
+# New EF Core migrations are not committed. Note the 4 migrations already in
+# Backend/ERPCore/Infra/Persistence/Migrations/ stay tracked — .gitignore does
+# not apply to tracked files — so edits to those still get committed as normal.
+# Untracking them too takes `git rm --cached`.
+**/Migrations/
@@ -1,4 +1,5 @@
 using ERPCore.Dtos.Auth;
+using ERPCore.Dtos.Rbac;
 using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
 using ERPCore.System.Errors;
@@ -25,12 +26,27 @@ public sealed class AuthController : ControllerBase
    private readonly IAuthUserService _users;
    private readonly IAuthRecoveryService _recovery;
    private readonly IAuthAltService _alt;
+    private readonly IRoleService _roles;

-    public AuthController(IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt)
+    public AuthController(IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles)
    {
        _users = users;
        _recovery = recovery;
        _alt = alt;
+        _roles = roles;
+    }
+
+    /// <summary>
+    /// Authoritative current-session info for the frontend: role + the sidebar nav
+    /// codes it may see (docs/10 C.9 shadow-Role sync). Replaces the frontend's
+    /// previous reliance on a stale, untrusted `roleId` cached in localStorage.
+    /// </summary>
+    [HttpGet("me")]
+    [ProducesResponseType(typeof(MeResponseDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<MeResponseDto>> Me(CancellationToken ct)
+    {
+        var roleCode = User.FindFirst(AuthHexClaims.RoleCode)?.Value;
+        return Ok(await _roles.GetMeAsync(roleCode, ct));
    }

    // ---- Session-issuing (UserManager) ------------------------------------
@@ -0,0 +1,20 @@
+using ERPCore.Dtos.Dashboard;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Dashboard overview stats — cross-domain counts, not a stored entity.</summary>
+[Route("api/v1/dashboard")]
+public sealed class DashboardController : ApiControllerBase
+{
+    private readonly IDashboardService _dashboard;
+
+    public DashboardController(IDashboardService dashboard) => _dashboard = dashboard;
+
+    /// <summary>Aggregate counts for stock, GRN, and procurement.</summary>
+    [HttpGet("stats")]
+    [ProducesResponseType(typeof(DashboardStatsDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<DashboardStatsDto>> GetStats(CancellationToken ct)
+        => Ok(await _dashboard.GetStatsAsync(ct));
+}
@@ -0,0 +1,99 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Attendance upload batch endpoints (docs/13-BACKEND-HRM-API.md §4).</summary>
+[Route("api/v1/attendance-batches")]
+public sealed class AttendanceBatchesController : ApiControllerBase
+{
+    private readonly IAttendanceUploadService _attendance;
+    private readonly ICurrentUser _currentUser;
+
+    public AttendanceBatchesController(IAttendanceUploadService attendance, ICurrentUser currentUser)
+    {
+        _attendance = attendance;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet("template.xlsx")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public IActionResult DownloadTemplate([FromQuery] string? format)
+    {
+        var (content, contentType, fileName) = _attendance.GenerateTemplate(string.Equals(format, "csv", StringComparison.OrdinalIgnoreCase));
+        return File(content, contentType, fileName);
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<AttendanceUploadBatchDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<AttendanceUploadBatchDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] AttendanceBatchStatus? status,
+        [FromQuery] int? periodYear, [FromQuery] int? periodMonth, CancellationToken ct)
+        => Ok(await _attendance.ListBatchesAsync(query, status, periodYear, periodMonth, ct));
+
+    [HttpGet("{batchId:int}")]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> GetById(int batchId, CancellationToken ct)
+    {
+        var result = await _attendance.GetBatchAsync(batchId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost]
+    [RequestSizeLimit(20 * 1024 * 1024)]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> Upload(
+        [FromForm] UploadAttendanceBatchMetadata metadata, IFormFile file, CancellationToken ct)
+    {
+        await using var stream = file.OpenReadStream();
+        var result = await _attendance.UploadAsync(stream, file.FileName, metadata.PeriodStart, metadata.PeriodEnd, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/attendance-batches/{result.AttendanceUploadBatchId}", result);
+    }
+
+    [HttpGet("{batchId:int}/records")]
+    [ProducesResponseType(typeof(List<AttendanceRecordDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<AttendanceRecordDto>>> ListRecords(
+        int batchId, [FromQuery] RowValidationStatus? status, CancellationToken ct)
+        => Ok(await _attendance.ListRecordsAsync(batchId, status, ct));
+
+    [HttpPut("{batchId:int}/records/{recordId:int}")]
+    [ProducesResponseType(typeof(AttendanceRecordDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AttendanceRecordDto>> UpdateRecord(
+        int batchId, int recordId, [FromBody] UpdateAttendanceRecordRequest request, CancellationToken ct)
+        => Ok(await _attendance.UpdateRecordAsync(batchId, recordId, request, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{batchId:int}/resolve-duplicate")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> ResolveDuplicate(int batchId, [FromBody] ResolveDuplicateRequest request, CancellationToken ct)
+    {
+        await _attendance.ResolveDuplicateAsync(batchId, request, ct);
+        return NoContent();
+    }
+
+    [HttpPost("{batchId:int}/validate")]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> Validate(int batchId, CancellationToken ct)
+        => Ok(await _attendance.ValidateAsync(batchId, ct));
+
+    [HttpPost("{batchId:int}/confirm")]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> Confirm(int batchId, CancellationToken ct)
+        => Ok(await _attendance.ConfirmAsync(batchId, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{batchId:int}/unlock")]
+    [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AttendanceUploadBatchDto>> Unlock(int batchId, [FromBody] UnlockAttendanceBatchRequest request, CancellationToken ct)
+        => Ok(await _attendance.UnlockAsync(batchId, request.Reason, _currentUser.AuditUserId, ct));
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Branch master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/branches")]
+public sealed class BranchesController : ApiControllerBase
+{
+    private readonly IBranchService _branches;
+
+    public BranchesController(IBranchService branches) => _branches = branches;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<BranchDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<BranchDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _branches.ListAsync(query, status, ct));
+
+    [HttpGet("{branchId:int}")]
+    [ProducesResponseType(typeof(BranchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<BranchDto>> GetById(int branchId, CancellationToken ct)
+    {
+        var result = await _branches.GetAsync(branchId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(BranchDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<BranchDto>> Create([FromBody] CreateBranchRequest request, CancellationToken ct)
+    {
+        var result = await _branches.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/branches/{result.Value.BranchId}", result.Value);
+    }
+
+    [HttpPut("{branchId:int}")]
+    [ProducesResponseType(typeof(BranchDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<BranchDto>> Update(int branchId, [FromBody] UpdateBranchRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _branches.UpdateAsync(branchId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{branchId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int branchId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _branches.SetStatusAsync(branchId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,65 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Department master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/departments")]
+public sealed class DepartmentsController : ApiControllerBase
+{
+    private readonly IDepartmentService _departments;
+
+    public DepartmentsController(IDepartmentService departments) => _departments = departments;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<DepartmentDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<DepartmentDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _departments.ListAsync(query, status, ct));
+
+    [HttpGet("{departmentId:int}")]
+    [ProducesResponseType(typeof(DepartmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<DepartmentDto>> GetById(int departmentId, CancellationToken ct)
+    {
+        var result = await _departments.GetAsync(departmentId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(DepartmentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<DepartmentDto>> Create([FromBody] CreateDepartmentRequest request, CancellationToken ct)
+    {
+        var result = await _departments.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/departments/{result.Value.DepartmentId}", result.Value);
+    }
+
+    [HttpPut("{departmentId:int}")]
+    [ProducesResponseType(typeof(DepartmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<DepartmentDto>> Update(int departmentId, [FromBody] UpdateDepartmentRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _departments.UpdateAsync(departmentId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{departmentId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int departmentId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _departments.SetStatusAsync(departmentId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Designation (job title) master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/designations")]
+public sealed class DesignationsController : ApiControllerBase
+{
+    private readonly IDesignationService _designations;
+
+    public DesignationsController(IDesignationService designations) => _designations = designations;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<DesignationDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<DesignationDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _designations.ListAsync(query, status, ct));
+
+    [HttpGet("{designationId:int}")]
+    [ProducesResponseType(typeof(DesignationDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<DesignationDto>> GetById(int designationId, CancellationToken ct)
+    {
+        var result = await _designations.GetAsync(designationId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(DesignationDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<DesignationDto>> Create([FromBody] CreateDesignationRequest request, CancellationToken ct)
+    {
+        var result = await _designations.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/designations/{result.Value.DesignationId}", result.Value);
+    }
+
+    [HttpPut("{designationId:int}")]
+    [ProducesResponseType(typeof(DesignationDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<DesignationDto>> Update(int designationId, [FromBody] UpdateDesignationRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _designations.UpdateAsync(designationId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{designationId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int designationId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _designations.SetStatusAsync(designationId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,217 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>
+/// Employee (staff) endpoints, incl. the Employee&lt;-&gt;User cross-link and staff
+/// document sub-resources (docs/13-BACKEND-HRM-API.md §3).
+/// </summary>
+[Route("api/v1/employees")]
+public sealed class EmployeesController : ApiControllerBase
+{
+    private readonly IEmployeeService _employees;
+    private readonly IEmployeeUserLinkService _links;
+    private readonly IEmployeeDocumentService _documents;
+    private readonly ILeaveBalanceService _leaveBalances;
+    private readonly IEmployeeSalaryStructureService _salaryStructures;
+    private readonly IEmployeeLoanService _loans;
+    private readonly ICurrentUser _currentUser;
+
+    public EmployeesController(
+        IEmployeeService employees, IEmployeeUserLinkService links, IEmployeeDocumentService documents,
+        ILeaveBalanceService leaveBalances, IEmployeeSalaryStructureService salaryStructures,
+        IEmployeeLoanService loans, ICurrentUser currentUser)
+    {
+        _employees = employees;
+        _links = links;
+        _documents = documents;
+        _leaveBalances = leaveBalances;
+        _salaryStructures = salaryStructures;
+        _loans = loans;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<EmployeeListItemDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<EmployeeListItemDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EmployeeStatus? status,
+        [FromQuery] int? departmentId, [FromQuery] int? designationId, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _employees.ListAsync(query, status, departmentId, designationId, branchId, ct));
+
+    /// <summary>Advisory reverse-direction lookup: does a System User already exist with this email? (docs/12-BACKEND-HRM.md A.5)</summary>
+    [HttpGet("email-lookup")]
+    [ProducesResponseType(typeof(UserMatchResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<UserMatchResponse>> EmailLookup([FromQuery] string email, CancellationToken ct)
+        => Ok(new UserMatchResponse(await _links.FindUserCandidateByEmailAsync(email, ct)));
+
+    [HttpGet("{employeeId:int}")]
+    [ProducesResponseType(typeof(EmployeeDetailDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<EmployeeDetailDto>> GetById(int employeeId, CancellationToken ct)
+    {
+        var result = await _employees.GetAsync(employeeId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(EmployeeDetailDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<EmployeeDetailDto>> Create([FromBody] CreateEmployeeRequest request, CancellationToken ct)
+    {
+        var result = await _employees.CreateAsync(request, _currentUser.AuditUserId, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/employees/{result.Value.EmployeeId}", result.Value);
+    }
+
+    [HttpPut("{employeeId:int}")]
+    [ProducesResponseType(typeof(EmployeeDetailDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<EmployeeDetailDto>> Update(int employeeId, [FromBody] UpdateEmployeeRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _employees.UpdateAsync(employeeId, request, expected, _currentUser.AuditUserId, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Never a hard delete — Employee is retained forever (docs/12-BACKEND-HRM.md C.2).</summary>
+    [HttpPatch("{employeeId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int employeeId, [FromBody] UpdateEmployeeStatusRequest request, CancellationToken ct)
+    {
+        await _employees.SetStatusAsync(employeeId, request.Status, ct);
+        return NoContent();
+    }
+
+    [HttpPost("{employeeId:int}/link-user")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> LinkUser(int employeeId, [FromBody] LinkUserRequest request, CancellationToken ct)
+    {
+        await _links.LinkAsync(employeeId, request.UserId, ct);
+        return NoContent();
+    }
+
+    [HttpDelete("{employeeId:int}/link-user")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> UnlinkUser(int employeeId, CancellationToken ct)
+    {
+        await _links.UnlinkAsync(employeeId, ct);
+        return NoContent();
+    }
+
+    [HttpGet("{employeeId:int}/bank-details")]
+    [ProducesResponseType(typeof(List<EmployeeBankDetailDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<EmployeeBankDetailDto>>> ListBankDetails(int employeeId, CancellationToken ct)
+        => Ok(await _employees.ListBankDetailsAsync(employeeId, ct));
+
+    [HttpPut("{employeeId:int}/bank-details")]
+    [ProducesResponseType(typeof(List<EmployeeBankDetailDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<List<EmployeeBankDetailDto>>> ReplaceBankDetails(
+        int employeeId, [FromBody] ReplaceEmployeeBankDetailsRequest request, CancellationToken ct)
+        => Ok(await _employees.ReplaceBankDetailsAsync(employeeId, request, ct));
+
+    [HttpGet("{employeeId:int}/leave-balances")]
+    [ProducesResponseType(typeof(List<LeaveBalanceDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<LeaveBalanceDto>>> ListLeaveBalances(int employeeId, [FromQuery] int? year, CancellationToken ct)
+        => Ok(await _leaveBalances.ListAsync(employeeId, year, ct));
+
+    [HttpPut("{employeeId:int}/leave-balances")]
+    [ProducesResponseType(typeof(List<LeaveBalanceDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<List<LeaveBalanceDto>>> UpdateLeaveBalances(
+        int employeeId, [FromBody] UpdateLeaveBalancesRequest request, CancellationToken ct)
+        => Ok(await _leaveBalances.ApplyAdjustmentsAsync(employeeId, request, ct));
+
+    [HttpGet("{employeeId:int}/salary-structure")]
+    [ProducesResponseType(typeof(List<EmployeeSalaryStructureDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<EmployeeSalaryStructureDto>>> GetSalaryStructureHistory(int employeeId, CancellationToken ct)
+        => Ok(await _salaryStructures.ListHistoryAsync(employeeId, ct));
+
+    [HttpPost("{employeeId:int}/salary-structure")]
+    [ProducesResponseType(typeof(EmployeeSalaryStructureDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<EmployeeSalaryStructureDto>> CreateSalaryStructure(
+        int employeeId, [FromBody] CreateSalaryStructureRequest request, CancellationToken ct)
+    {
+        var result = await _salaryStructures.CreateAsync(employeeId, request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/employees/{employeeId}/salary-structure", result);
+    }
+
+    [HttpGet("{employeeId:int}/loans")]
+    [ProducesResponseType(typeof(List<EmployeeLoanDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<EmployeeLoanDto>>> ListLoans(int employeeId, CancellationToken ct)
+        => Ok(await _loans.ListAsync(employeeId, ct));
+
+    [HttpGet("{employeeId:int}/loans/{loanId:int}")]
+    [ProducesResponseType(typeof(EmployeeLoanDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<EmployeeLoanDto>> GetLoan(int employeeId, int loanId, CancellationToken ct)
+    {
+        var result = await _loans.GetAsync(employeeId, loanId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost("{employeeId:int}/loans")]
+    [ProducesResponseType(typeof(EmployeeLoanDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<EmployeeLoanDto>> CreateLoan(int employeeId, [FromBody] CreateEmployeeLoanRequest request, CancellationToken ct)
+    {
+        var result = await _loans.CreateAsync(employeeId, request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/employees/{employeeId}/loans/{result.EmployeeLoanId}", result);
+    }
+
+    [HttpGet("{employeeId:int}/documents")]
+    [ProducesResponseType(typeof(List<EmployeeDocumentDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<EmployeeDocumentDto>>> ListDocuments(int employeeId, CancellationToken ct)
+        => Ok(await _documents.ListAsync(employeeId, ct));
+
+    [HttpPost("{employeeId:int}/documents")]
+    [RequestSizeLimit(20 * 1024 * 1024)]
+    [ProducesResponseType(typeof(EmployeeDocumentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status413PayloadTooLarge)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<EmployeeDocumentDto>> UploadDocument(
+        int employeeId, [FromForm] UploadEmployeeDocumentRequest request, IFormFile file, CancellationToken ct)
+    {
+        await using var stream = file.OpenReadStream();
+        var result = await _documents.UploadAsync(
+            employeeId, request, stream, file.FileName, file.ContentType, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/employees/{employeeId}/documents/{result.EmployeeDocumentId}", result);
+    }
+
+    [HttpGet("{employeeId:int}/documents/{documentId:int}/download")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> DownloadDocument(int employeeId, int documentId, CancellationToken ct)
+    {
+        var (content, fileName, contentType) = await _documents.DownloadAsync(employeeId, documentId, ct);
+        return File(content, contentType, fileName);
+    }
+
+    [HttpPatch("{employeeId:int}/documents/{documentId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetDocumentStatus(
+        int employeeId, int documentId, [FromBody] UpdateEmployeeDocumentStatusRequest request, CancellationToken ct)
+    {
+        await _documents.SetStatusAsync(employeeId, documentId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>EmploymentType master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/employment-types")]
+public sealed class EmploymentTypesController : ApiControllerBase
+{
+    private readonly IEmploymentTypeService _employmentTypes;
+
+    public EmploymentTypesController(IEmploymentTypeService employmentTypes) => _employmentTypes = employmentTypes;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<EmploymentTypeDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<EmploymentTypeDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _employmentTypes.ListAsync(query, status, ct));
+
+    [HttpGet("{employmentTypeId:int}")]
+    [ProducesResponseType(typeof(EmploymentTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<EmploymentTypeDto>> GetById(int employmentTypeId, CancellationToken ct)
+    {
+        var result = await _employmentTypes.GetAsync(employmentTypeId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(EmploymentTypeDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<EmploymentTypeDto>> Create([FromBody] CreateEmploymentTypeRequest request, CancellationToken ct)
+    {
+        var result = await _employmentTypes.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/employment-types/{result.Value.EmploymentTypeId}", result.Value);
+    }
+
+    [HttpPut("{employmentTypeId:int}")]
+    [ProducesResponseType(typeof(EmploymentTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<EmploymentTypeDto>> Update(int employmentTypeId, [FromBody] UpdateEmploymentTypeRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _employmentTypes.UpdateAsync(employmentTypeId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{employmentTypeId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int employmentTypeId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _employmentTypes.SetStatusAsync(employmentTypeId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Staff document-type catalog ("DocType") endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/hr-document-types")]
+public sealed class HrDocumentTypesController : ApiControllerBase
+{
+    private readonly IHrDocumentTypeService _types;
+
+    public HrDocumentTypesController(IHrDocumentTypeService types) => _types = types;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<HrDocumentTypeDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<HrDocumentTypeDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _types.ListAsync(query, status, ct));
+
+    [HttpGet("{hrDocumentTypeId:int}")]
+    [ProducesResponseType(typeof(HrDocumentTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<HrDocumentTypeDto>> GetById(int hrDocumentTypeId, CancellationToken ct)
+    {
+        var result = await _types.GetAsync(hrDocumentTypeId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(HrDocumentTypeDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<HrDocumentTypeDto>> Create([FromBody] CreateHrDocumentTypeRequest request, CancellationToken ct)
+    {
+        var result = await _types.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/hr-document-types/{result.Value.HrDocumentTypeId}", result.Value);
+    }
+
+    [HttpPut("{hrDocumentTypeId:int}")]
+    [ProducesResponseType(typeof(HrDocumentTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<HrDocumentTypeDto>> Update(int hrDocumentTypeId, [FromBody] UpdateHrDocumentTypeRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _types.UpdateAsync(hrDocumentTypeId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{hrDocumentTypeId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int hrDocumentTypeId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _types.SetStatusAsync(hrDocumentTypeId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,52 @@
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Read-only HRM reports (FR-HR-RPT, docs/13-BACKEND-HRM-API.md §6). No new entities — aggregation over existing tables.</summary>
+[Route("api/v1/reports/hrm")]
+public sealed class HrReportsController : ApiControllerBase
+{
+    private readonly IHrReportService _reports;
+
+    public HrReportsController(IHrReportService reports) => _reports = reports;
+
+    [HttpGet("attendance-summary")]
+    [ProducesResponseType(typeof(List<AttendanceSummaryRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<AttendanceSummaryRowDto>>> AttendanceSummary(
+        [FromQuery] int periodYear, [FromQuery] int periodMonth, [FromQuery] int? departmentId, CancellationToken ct)
+        => Ok(await _reports.AttendanceSummaryAsync(periodYear, periodMonth, departmentId, ct));
+
+    [HttpGet("overtime")]
+    [ProducesResponseType(typeof(List<OvertimeReportRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<OvertimeReportRowDto>>> Overtime(
+        [FromQuery] int periodYear, [FromQuery] int periodMonth, CancellationToken ct)
+        => Ok(await _reports.OvertimeReportAsync(periodYear, periodMonth, ct));
+
+    [HttpGet("late-arrivals")]
+    [ProducesResponseType(typeof(List<LateArrivalReportRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<LateArrivalReportRowDto>>> LateArrivals(
+        [FromQuery] int periodYear, [FromQuery] int periodMonth, CancellationToken ct)
+        => Ok(await _reports.LateArrivalReportAsync(periodYear, periodMonth, ct));
+
+    [HttpGet("payroll-register")]
+    [ProducesResponseType(typeof(List<PayrollRegisterRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<PayrollRegisterRowDto>>> PayrollRegister([FromQuery] int payrollRunId, CancellationToken ct)
+        => Ok(await _reports.PayrollRegisterAsync(payrollRunId, ct));
+
+    [HttpGet("salary-history")]
+    [ProducesResponseType(typeof(List<SalaryHistoryRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<SalaryHistoryRowDto>>> SalaryHistory([FromQuery] int employeeId, CancellationToken ct)
+        => Ok(await _reports.SalaryHistoryAsync(employeeId, ct));
+
+    [HttpGet("leave-balances")]
+    [ProducesResponseType(typeof(List<LeaveBalanceReportRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<LeaveBalanceReportRowDto>>> LeaveBalances([FromQuery] int year, CancellationToken ct)
+        => Ok(await _reports.LeaveBalanceReportAsync(year, ct));
+
+    [HttpGet("document-expiry")]
+    [ProducesResponseType(typeof(List<DocumentExpiryReportRowDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<DocumentExpiryReportRowDto>>> DocumentExpiry([FromQuery] int withinDays, CancellationToken ct)
+        => Ok(await _reports.DocumentExpiryReportAsync(withinDays, ct));
+}
@@ -0,0 +1,71 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Leave request endpoints (docs/13-BACKEND-HRM-API.md §5).</summary>
+[Route("api/v1/leave-requests")]
+public sealed class LeaveRequestsController : ApiControllerBase
+{
+    private readonly ILeaveRequestService _requests;
+    private readonly ICurrentUser _currentUser;
+
+    public LeaveRequestsController(ILeaveRequestService requests, ICurrentUser currentUser)
+    {
+        _requests = requests;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<LeaveRequestDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<LeaveRequestDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] int? employeeId, [FromQuery] LeaveRequestStatus? status, CancellationToken ct)
+        => Ok(await _requests.ListAsync(query, employeeId, status, ct));
+
+    [HttpGet("{leaveRequestId:int}")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<LeaveRequestDto>> GetById(int leaveRequestId, CancellationToken ct)
+    {
+        var result = await _requests.GetAsync(leaveRequestId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<LeaveRequestDto>> Create([FromBody] CreateLeaveRequestRequest request, CancellationToken ct)
+    {
+        var result = await _requests.CreateAsync(request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/leave-requests/{result.LeaveRequestId}", result);
+    }
+
+    [HttpPost("{leaveRequestId:int}/submit")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveRequestDto>> Submit(int leaveRequestId, CancellationToken ct)
+        => Ok(await _requests.SubmitAsync(leaveRequestId, ct));
+
+    [HttpPost("{leaveRequestId:int}/approve")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveRequestDto>> Approve(int leaveRequestId, CancellationToken ct)
+        => Ok(await _requests.ApproveAsync(leaveRequestId, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{leaveRequestId:int}/reject")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveRequestDto>> Reject(int leaveRequestId, [FromBody] RejectLeaveRequestRequest request, CancellationToken ct)
+        => Ok(await _requests.RejectAsync(leaveRequestId, request.Reason, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{leaveRequestId:int}/cancel")]
+    [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveRequestDto>> Cancel(int leaveRequestId, CancellationToken ct)
+        => Ok(await _requests.CancelAsync(leaveRequestId, ct));
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Leave type master endpoints (docs/13-BACKEND-HRM-API.md §5).</summary>
+[Route("api/v1/leave-types")]
+public sealed class LeaveTypesController : ApiControllerBase
+{
+    private readonly ILeaveTypeService _leaveTypes;
+
+    public LeaveTypesController(ILeaveTypeService leaveTypes) => _leaveTypes = leaveTypes;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<LeaveTypeDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<LeaveTypeDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _leaveTypes.ListAsync(query, status, ct));
+
+    [HttpGet("{leaveTypeId:int}")]
+    [ProducesResponseType(typeof(LeaveTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<LeaveTypeDto>> GetById(int leaveTypeId, CancellationToken ct)
+    {
+        var result = await _leaveTypes.GetAsync(leaveTypeId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(LeaveTypeDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<LeaveTypeDto>> Create([FromBody] CreateLeaveTypeRequest request, CancellationToken ct)
+    {
+        var result = await _leaveTypes.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/leave-types/{result.Value.LeaveTypeId}", result.Value);
+    }
+
+    [HttpPut("{leaveTypeId:int}")]
+    [ProducesResponseType(typeof(LeaveTypeDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<LeaveTypeDto>> Update(int leaveTypeId, [FromBody] UpdateLeaveTypeRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _leaveTypes.UpdateAsync(leaveTypeId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{leaveTypeId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int leaveTypeId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _leaveTypes.SetStatusAsync(leaveTypeId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,85 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Payroll run endpoints (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/payroll-runs")]
+public sealed class PayrollRunsController : ApiControllerBase
+{
+    private readonly IPayrollRunService _payrollRuns;
+    private readonly ICurrentUser _currentUser;
+
+    public PayrollRunsController(IPayrollRunService payrollRuns, ICurrentUser currentUser)
+    {
+        _payrollRuns = payrollRuns;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<PayrollRunDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<PayrollRunDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] int? periodYear, [FromQuery] int? periodMonth,
+        [FromQuery] PayrollRunStatus? status, CancellationToken ct)
+        => Ok(await _payrollRuns.ListAsync(query, periodYear, periodMonth, status, ct));
+
+    [HttpGet("{payrollRunId:int}")]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PayrollRunDto>> GetById(int payrollRunId, CancellationToken ct)
+    {
+        var result = await _payrollRuns.GetAsync(payrollRunId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpGet("{payrollRunId:int}/lines")]
+    [ProducesResponseType(typeof(List<PayrollLineDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<PayrollLineDto>>> ListLines(int payrollRunId, CancellationToken ct)
+        => Ok(await _payrollRuns.ListLinesAsync(payrollRunId, ct));
+
+    [HttpGet("{payrollRunId:int}/lines/{lineId:int}")]
+    [ProducesResponseType(typeof(PayrollLineDetailDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PayrollLineDetailDto>> GetLine(int payrollRunId, int lineId, CancellationToken ct)
+    {
+        var result = await _payrollRuns.GetLineAsync(payrollRunId, lineId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<PayrollRunDto>> Generate([FromBody] GeneratePayrollRunRequest request, CancellationToken ct)
+    {
+        var result = await _payrollRuns.GenerateAsync(request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/payroll-runs/{result.PayrollRunId}", result);
+    }
+
+    [HttpPost("{payrollRunId:int}/approve")]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PayrollRunDto>> Approve(int payrollRunId, CancellationToken ct)
+        => Ok(await _payrollRuns.ApproveAsync(payrollRunId, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{payrollRunId:int}/lock")]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PayrollRunDto>> Lock(int payrollRunId, CancellationToken ct)
+        => Ok(await _payrollRuns.LockAsync(payrollRunId, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{payrollRunId:int}/unlock")]
+    [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PayrollRunDto>> Unlock(int payrollRunId, [FromBody] UnlockPayrollRunRequest request, CancellationToken ct)
+        => Ok(await _payrollRuns.UnlockAsync(payrollRunId, request.Reason, _currentUser.AuditUserId, ct));
+
+    [HttpPost("{payrollRunId:int}/generate-payslips")]
+    [ProducesResponseType(typeof(List<PayslipDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<List<PayslipDto>>> GeneratePayslips(int payrollRunId, CancellationToken ct)
+        => Ok(await _payrollRuns.GeneratePayslipsAsync(payrollRunId, ct));
+}
@@ -0,0 +1,33 @@
+using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Effective-dated EPF/ETF settings (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/payroll-statutory-settings")]
+public sealed class PayrollStatutorySettingsController : ApiControllerBase
+{
+    private readonly IPayrollStatutorySettingService _settings;
+    private readonly ICurrentUser _currentUser;
+
+    public PayrollStatutorySettingsController(IPayrollStatutorySettingService settings, ICurrentUser currentUser)
+    {
+        _settings = settings;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(List<PayrollStatutorySettingDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<PayrollStatutorySettingDto>>> List(CancellationToken ct)
+        => Ok(await _settings.ListAsync(ct));
+
+    [HttpPost]
+    [ProducesResponseType(typeof(PayrollStatutorySettingDto), StatusCodes.Status201Created)]
+    public async Task<ActionResult<PayrollStatutorySettingDto>> Create([FromBody] UpsertPayrollStatutorySettingRequest request, CancellationToken ct)
+    {
+        var result = await _settings.CreateAsync(request, _currentUser.AuditUserId, ct);
+        return Created($"/api/v1/payroll-statutory-settings/{result.PayrollStatutorySettingId}", result);
+    }
+}
@@ -0,0 +1,32 @@
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Payslip retrieval + HTML print view (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/payslips")]
+public sealed class PayslipsController : ApiControllerBase
+{
+    private readonly IPayslipService _payslips;
+
+    public PayslipsController(IPayslipService payslips) => _payslips = payslips;
+
+    [HttpGet("{payslipId:int}")]
+    [ProducesResponseType(typeof(PayslipDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PayslipDto>> GetById(int payslipId, CancellationToken ct)
+    {
+        var result = await _payslips.GetAsync(payslipId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpGet("{payslipId:int}/view")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> View(int payslipId, CancellationToken ct)
+    {
+        var html = await _payslips.RenderHtmlAsync(payslipId, ct);
+        return html is null ? NotFound() : Content(html, "text/html");
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>SalaryComponent master endpoints (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/salary-components")]
+public sealed class SalaryComponentsController : ApiControllerBase
+{
+    private readonly ISalaryComponentService _components;
+
+    public SalaryComponentsController(ISalaryComponentService components) => _components = components;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<SalaryComponentDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<SalaryComponentDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _components.ListAsync(query, status, ct));
+
+    [HttpGet("{salaryComponentId:int}")]
+    [ProducesResponseType(typeof(SalaryComponentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SalaryComponentDto>> GetById(int salaryComponentId, CancellationToken ct)
+    {
+        var result = await _components.GetAsync(salaryComponentId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(SalaryComponentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<SalaryComponentDto>> Create([FromBody] CreateSalaryComponentRequest request, CancellationToken ct)
+    {
+        var result = await _components.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/salary-components/{result.Value.SalaryComponentId}", result.Value);
+    }
+
+    [HttpPut("{salaryComponentId:int}")]
+    [ProducesResponseType(typeof(SalaryComponentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SalaryComponentDto>> Update(int salaryComponentId, [FromBody] UpdateSalaryComponentRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _components.UpdateAsync(salaryComponentId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{salaryComponentId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int salaryComponentId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _components.SetStatusAsync(salaryComponentId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,28 @@
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>Configurable APIT-style tax slabs (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Route("api/v1/tax-slabs")]
+public sealed class TaxSlabsController : ApiControllerBase
+{
+    private readonly ITaxSlabService _taxSlabs;
+
+    public TaxSlabsController(ITaxSlabService taxSlabs) => _taxSlabs = taxSlabs;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(List<TaxSlabDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<TaxSlabDto>>> List(CancellationToken ct)
+        => Ok(await _taxSlabs.ListAsync(ct));
+
+    [HttpPost]
+    [ProducesResponseType(typeof(TaxSlabDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<TaxSlabDto>> Create([FromBody] CreateTaxSlabRequest request, CancellationToken ct)
+    {
+        var result = await _taxSlabs.CreateAsync(request, ct);
+        return Created($"/api/v1/tax-slabs/{result.TaxSlabId}", result);
+    }
+}
@@ -0,0 +1,64 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers.Hrm;
+
+/// <summary>WorkShift master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Route("api/v1/work-shifts")]
+public sealed class WorkShiftsController : ApiControllerBase
+{
+    private readonly IWorkShiftService _shifts;
+
+    public WorkShiftsController(IWorkShiftService shifts) => _shifts = shifts;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<WorkShiftDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<WorkShiftDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _shifts.ListAsync(query, status, ct));
+
+    [HttpGet("{workShiftId:int}")]
+    [ProducesResponseType(typeof(WorkShiftDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<WorkShiftDto>> GetById(int workShiftId, CancellationToken ct)
+    {
+        var result = await _shifts.GetAsync(workShiftId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(WorkShiftDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<WorkShiftDto>> Create([FromBody] CreateWorkShiftRequest request, CancellationToken ct)
+    {
+        var result = await _shifts.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/work-shifts/{result.Value.WorkShiftId}", result.Value);
+    }
+
+    [HttpPut("{workShiftId:int}")]
+    [ProducesResponseType(typeof(WorkShiftDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<WorkShiftDto>> Update(int workShiftId, [FromBody] UpdateWorkShiftRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _shifts.UpdateAsync(workShiftId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{workShiftId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int workShiftId, [FromBody] UpdateHrMasterStatusRequest request, CancellationToken ct)
+    {
+        await _shifts.SetStatusAsync(workShiftId, request.Status, ct);
+        return NoContent();
+    }
+}
@@ -0,0 +1,39 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Dtos.Rbac;
+using ERPCore.Repositories.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Read-only sidebar nav tree, used by the Role permission-assignment checkbox
+/// UI and by `GET /auth/me` (see AuthController) to resolve a role's visible codes.
+/// NavItem/SubNavItem rows are seeded (NavItemConfiguration/SubNavItemConfiguration)
+/// to match the frontend's hardcoded sidebar — not admin-editable in this phase.
+/// </summary>
+[Route("api/v1/nav")]
+public sealed class NavController : ApiControllerBase
+{
+    private readonly IRepository<NavItem> _navItems;
+
+    public NavController(IRepository<NavItem> navItems) => _navItems = navItems;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(List<NavItemDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<NavItemDto>>> GetTree(CancellationToken ct)
+    {
+        var items = await _navItems.Query().AsNoTracking()
+            .Include(n => n.Children)
+            .OrderBy(n => n.SortOrder)
+            .ToListAsync(ct);
+
+        var dto = items.Select(n => new NavItemDto(
+            n.NavItemId, n.Code, n.Label, n.Icon, n.Href, n.SortOrder,
+            n.Children.OrderBy(c => c.SortOrder)
+                .Select(c => new SubNavItemDto(c.SubNavItemId, c.Code, c.Label, c.Icon, c.Href, c.SortOrder))
+                .ToList())).ToList();
+
+        return Ok(dto);
+    }
+}
@@ -57,6 +57,25 @@ public sealed class PurchaseOrdersController : ApiControllerBase
        return Ok(result.Value);
    }

+    /// <summary>Submit a Draft PO (Draft → Approved). 409 PO_NOT_EDITABLE if not Draft.</summary>
+    [HttpPost("{poId:int}/submit")]
+    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseOrderDto>> Submit(int poId, CancellationToken ct)
+        => Ok(await _pos.SubmitAsync(poId, ct));
+
+    /// <summary>Delete a PO — permitted only while Draft (409 PO_NOT_EDITABLE otherwise).</summary>
+    [HttpDelete("{poId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int poId, CancellationToken ct)
+    {
+        await _pos.DeleteAsync(poId, ct);
+        return NoContent();
+    }
+
    /// <summary>Approve — no-op in Phase 1 (POs auto-approve); transitions PendingApproval→Approved when enabled.</summary>
    [HttpPost("{poId:int}/approve")]
    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
@@ -0,0 +1,88 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Rbac;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Role CRUD + permission assignment (mirrors AuthHex's Role; see docs/10 C.9).</summary>
+[Route("api/v1/roles")]
+public sealed class RolesController : ApiControllerBase
+{
+    private readonly IRoleService _roles;
+
+    public RolesController(IRoleService roles) => _roles = roles;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<RoleDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<RoleDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _roles.ListAsync(query, status, ct));
+
+    [HttpGet("{roleId:int}")]
+    [ProducesResponseType(typeof(RoleDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<RoleDto>> GetById(int roleId, CancellationToken ct)
+    {
+        var result = await _roles.GetAsync(roleId, ct);
+        if (result is null) return NotFound();
+
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(RoleDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<RoleDto>> Create([FromBody] CreateRoleRequest request, CancellationToken ct)
+    {
+        var result = await _roles.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/roles/{result.Value.RoleId}", result.Value);
+    }
+
+    [HttpPut("{roleId:int}")]
+    [ProducesResponseType(typeof(RoleDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<RoleDto>> Update(int roleId, [FromBody] UpdateRoleRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _roles.UpdateAsync(roleId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPatch("{roleId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int roleId, [FromBody] UpdateRoleStatusRequest request, CancellationToken ct)
+    {
+        await _roles.SetStatusAsync(roleId, request.Status, ct);
+        return NoContent();
+    }
+
+    [HttpDelete("{roleId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int roleId, CancellationToken ct)
+    {
+        await _roles.DeleteAsync(roleId, ct);
+        return NoContent();
+    }
+
+    [HttpGet("{roleId:int}/permissions")]
+    [ProducesResponseType(typeof(RolePermissionsDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<RolePermissionsDto>> GetPermissions(int roleId, CancellationToken ct)
+        => Ok(await _roles.GetPermissionsAsync(roleId, ct));
+
+    [HttpPut("{roleId:int}/permissions")]
+    [ProducesResponseType(typeof(RolePermissionsDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<RolePermissionsDto>> AssignPermissions(
+        int roleId, [FromBody] AssignRolePermissionsRequest request, CancellationToken ct)
+        => Ok(await _roles.AssignPermissionsAsync(roleId, request, ct));
+}
@@ -0,0 +1,65 @@
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Hrm;
+using ERPCore.Dtos.Users;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// User management: local shadow `User` list/detail + role assignment, and
+/// account creation orchestrated against AuthHex (see <see cref="IUserManagementService.CreateAsync"/>).
+/// </summary>
+[Route("api/v1/users")]
+public sealed class UsersController : ApiControllerBase
+{
+    private readonly IUserManagementService _users;
+    private readonly IEmployeeUserLinkService _links;
+
+    public UsersController(IUserManagementService users, IEmployeeUserLinkService links)
+    {
+        _users = users;
+        _links = links;
+    }
+
+    /// <summary>Advisory forward-direction lookup: does a Staff record already exist with this email? (docs/12-BACKEND-HRM.md A.5)</summary>
+    [HttpGet("email-lookup")]
+    [ProducesResponseType(typeof(EmployeeMatchResponse), StatusCodes.Status200OK)]
+    public async Task<ActionResult<EmployeeMatchResponse>> EmailLookup([FromQuery] string email, CancellationToken ct)
+        => Ok(new EmployeeMatchResponse(await _links.FindStaffCandidateByEmailAsync(email, ct)));
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<ManagedUserDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<ManagedUserDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _users.ListAsync(query, ct));
+
+    /// <summary>AuthHex UserType options for the create-user form's select.</summary>
+    [HttpGet("user-types")]
+    [ProducesResponseType(typeof(List<UserTypeOptionDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<List<UserTypeOptionDto>>> ListUserTypes(CancellationToken ct)
+        => Ok(await _users.ListUserTypesAsync(ct));
+
+    [HttpGet("{userId:int}")]
+    [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ManagedUserDto>> GetById(int userId, CancellationToken ct)
+    {
+        var result = await _users.GetAsync(userId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ManagedUserDto>> Create([FromBody] CreateUserRequest request, CancellationToken ct)
+    {
+        var result = await _users.CreateAsync(request, ct);
+        return Created($"/api/v1/users/{result.UserId}", result);
+    }
+
+    [HttpPut("{userId:int}/role")]
+    [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ManagedUserDto>> UpdateRole(int userId, [FromBody] UpdateUserRoleRequest request, CancellationToken ct)
+        => Ok(await _users.UpdateRoleAsync(userId, request, ct));
+}
@@ -0,0 +1,40 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Per employee/day attendance row (FR-HR-ATT). <see cref="WorkShiftId"/> is
+/// snapshotted from the employee's shift at ingestion time (docs/12-BACKEND-HRM.md
+/// A.3) so a later shift reassignment never retroactively changes historical
+/// Late/OT figures. Model: docs/12-BACKEND-HRM.md Part C.4.
+/// </summary>
+public class AttendanceRecord
+{
+    public int AttendanceRecordId { get; set; }
+    public int? AttendanceUploadBatchId { get; set; }
+    public AttendanceUploadBatch? AttendanceUploadBatch { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+
+    public DateTime AttendanceDate { get; set; }
+    public TimeSpan? CheckIn { get; set; }
+    public TimeSpan? CheckOut { get; set; }
+    public int WorkShiftId { get; set; }
+    public WorkShift? WorkShift { get; set; }
+
+    public int WorkingMinutes { get; set; }
+    public int LateMinutes { get; set; }
+    public int EarlyLeaveMinutes { get; set; }
+    public int OvertimeMinutes { get; set; }
+
+    public AttendanceStatus AttendanceStatus { get; set; }
+    public RowValidationStatus RowValidationStatus { get; set; } = RowValidationStatus.Valid;
+    public int? DuplicateOfAttendanceRecordId { get; set; }
+
+    public string? Notes { get; set; }
+    public bool IsManualOverride { get; set; }
+    public int? EditedBy { get; set; }
+    public DateTime? EditedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,31 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Attendance upload batch (FR-HR-ATT) — the transactional document driving the
+/// exact status flow Draft→Validated→Confirmed→UsedInPayroll. Scoped to exactly
+/// one payroll period, numbered via <see cref="NumberSequence"/> (docType "ATT").
+/// Model: docs/12-BACKEND-HRM.md Part C.4.
+/// </summary>
+public class AttendanceUploadBatch
+{
+    public int AttendanceUploadBatchId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public DateTime PeriodStart { get; set; }
+    public DateTime PeriodEnd { get; set; }
+    public AttendanceSourceType SourceType { get; set; }
+    public string? OriginalFileName { get; set; }
+
+    public int UploadedBy { get; set; }
+    public DateTime UploadedAt { get; set; }
+    public AttendanceBatchStatus Status { get; set; } = AttendanceBatchStatus.Draft;
+    public int? ConfirmedBy { get; set; }
+    public DateTime? ConfirmedAt { get; set; }
+
+    public int RowCountTotal { get; set; }
+    public int RowCountDuplicate { get; set; }
+    public int RowCountError { get; set; }
+
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,23 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Branch/location master (FR-HR-MD-01) — multi-branch readiness. Referenced
+/// optionally by <see cref="Employee.BranchId"/> and <see cref="PayrollRun.BranchId"/>.
+/// Deactivated, not deleted, when referenced. Model: docs/12-BACKEND-HRM.md Part C.1.
+/// </summary>
+public class Branch
+{
+    public int BranchId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public string? Address { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,26 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Department master (FR-HR-MD-01) — unlimited self-nesting for a real org chart
+/// (unlike the two-level-capped <see cref="Category"/>); cycle prevention is a
+/// service-level check on write, not a DB constraint. Model: docs/12-BACKEND-HRM.md Part C.1.
+/// </summary>
+public class Department
+{
+    public int DepartmentId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public int? ParentDepartmentId { get; set; }
+    public Department? ParentDepartment { get; set; }
+    public int? HeadEmployeeId { get; set; }
+    public Employee? HeadEmployee { get; set; }
+    public int? BranchId { get; set; }
+    public Branch? Branch { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,19 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Job title master (FR-HR-MD-01), standalone — not FK'd to Department, since a
+/// title like "Accountant" can exist in multiple departments. Model: docs/12-BACKEND-HRM.md Part C.1.
+/// </summary>
+public class Designation
+{
+    public int DesignationId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,76 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Staff record (FR-HR-MD-02) — distinct from <see cref="User"/> (the system login
+/// account): not every employee has a login, and not every login belongs to an
+/// employee. <see cref="UserId"/> is the optional, explicit, human-confirmed link
+/// between the two (docs/12-BACKEND-HRM.md A.5/C.2, Part B.3.2). Never hard-deleted —
+/// separation is recorded via <see cref="Status"/> + <see cref="LastWorkingDate"/>.
+/// <see cref="EmployeeCode"/> is user-entered (not <see cref="NumberSequence"/>-issued):
+/// HR departments keep their own legacy numbering scheme, and NumberSequence's
+/// year-scoping is the wrong shape for an identifier that must never look "reset".
+/// </summary>
+public class Employee
+{
+    public int EmployeeId { get; set; }
+    public string EmployeeCode { get; set; } = string.Empty;
+
+    // Identity
+    public string FullName { get; set; } = string.Empty;
+    public string? Nic { get; set; }
+    public DateTime? DateOfBirth { get; set; }
+    public Gender? Gender { get; set; }
+    public string? Nationality { get; set; }
+    public string? ProfilePhotoPath { get; set; }
+
+    // Contact
+    /// <summary>The field used for the bidirectional Employee&lt;-&gt;User email cross-check.</summary>
+    public string? Email { get; set; }
+    public string? PersonalMobile { get; set; }
+    public string? AddressLine1 { get; set; }
+    public string? AddressLine2 { get; set; }
+    public string? City { get; set; }
+    public string? PostalCode { get; set; }
+    public string? Country { get; set; }
+
+    // Emergency contact
+    public string? EmergencyContactName { get; set; }
+    public string? EmergencyContactRelationship { get; set; }
+    public string? EmergencyContactPhone { get; set; }
+
+    // Employment
+    public DateTime HireDate { get; set; }
+    public DateTime? ConfirmationDate { get; set; }
+    public DateTime? LastWorkingDate { get; set; }
+    public int DepartmentId { get; set; }
+    public Department? Department { get; set; }
+    public int DesignationId { get; set; }
+    public Designation? Designation { get; set; }
+    public int EmploymentTypeId { get; set; }
+    public EmploymentType? EmploymentType { get; set; }
+    public int? BranchId { get; set; }
+    public Branch? Branch { get; set; }
+    public int WorkShiftId { get; set; }
+    public WorkShift? WorkShift { get; set; }
+    public int? ReportingManagerId { get; set; }
+    public Employee? ReportingManager { get; set; }
+
+    // Statutory (Sri Lanka)
+    public string? EpfNumber { get; set; }
+    public string? EtfNumber { get; set; }
+    public string? TaxIdentificationNumber { get; set; }
+
+    /// <summary>Optional login account link (unique — one User backs at most one Employee).</summary>
+    public int? UserId { get; set; }
+    public User? User { get; set; }
+
+    public EmployeeStatus Status { get; set; } = EmployeeStatus.Active;
+
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public int? UpdatedBy { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,28 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Employee bank account (FR-HR-MD-03), one-to-many — a future split-payment
+/// improvement is possible since this isn't a 1:1 scalar set. Exactly one row per
+/// employee is <see cref="IsPrimary"/>; payroll disbursement targets it.
+/// Model: docs/12-BACKEND-HRM.md Part C.2.
+/// </summary>
+public class EmployeeBankDetail
+{
+    public int EmployeeBankDetailId { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+
+    public string BankName { get; set; } = string.Empty;
+    public string BranchName { get; set; } = string.Empty;
+    public string AccountNumber { get; set; } = string.Empty;
+    public string AccountHolderName { get; set; } = string.Empty;
+    public string? SwiftCode { get; set; }
+    public bool IsPrimary { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,36 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Uploaded staff document (FR-HR-DOC-02..04) — the user's "Doc". <see cref="StoredFileName"/>/
+/// <see cref="RelativePath"/> are server-generated (never the client's filename), so the
+/// file is only ever reachable through <see cref="Services.Interfaces.IFileStorageService"/>,
+/// never a guessable static path. Archived, not deleted, so the audit trail of what was
+/// once on file is retained. Model: docs/12-BACKEND-HRM.md Part C.3.
+/// </summary>
+public class EmployeeDocument
+{
+    public int EmployeeDocumentId { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+    public int HrDocumentTypeId { get; set; }
+    public HrDocumentType? HrDocumentType { get; set; }
+
+    public string OriginalFileName { get; set; } = string.Empty;
+    public string StoredFileName { get; set; } = string.Empty;
+    public string RelativePath { get; set; } = string.Empty;
+    public string ContentType { get; set; } = string.Empty;
+    public long SizeBytes { get; set; }
+    public DateTime? IssueDate { get; set; }
+    public DateTime? ExpiryDate { get; set; }
+    public string? Notes { get; set; }
+
+    public int UploadedBy { get; set; }
+    public DateTime UploadedAt { get; set; }
+    public int? VerifiedBy { get; set; }
+    public DateTime? VerifiedAt { get; set; }
+
+    public EmployeeDocumentStatus Status { get; set; } = EmployeeDocumentStatus.Active;
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,35 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Loan/Advance (FR-HR-PAY-03) — <see cref="LoanKind"/> discriminates, structurally
+/// identical otherwise. <see cref="OutstandingBalance"/> is denormalized (parallel to
+/// <c>StockLayer.QtyRemaining</c>). Numbered via <see cref="NumberSequence"/> (docType "LOAN").
+/// Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class EmployeeLoan
+{
+    public int EmployeeLoanId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+    public LoanKind LoanKind { get; set; }
+
+    public decimal PrincipalAmount { get; set; }
+    public decimal InterestRate { get; set; }
+    public decimal InstallmentAmount { get; set; }
+    public int NumberOfInstallments { get; set; }
+    public int StartYear { get; set; }
+    public int StartMonth { get; set; }
+    public decimal OutstandingBalance { get; set; }
+    public LoanStatus Status { get; set; } = LoanStatus.Active;
+
+    public int ApprovedBy { get; set; }
+    public DateTime ApprovedAt { get; set; }
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public List<LoanInstallment> Installments { get; set; } = new();
+}
@@ -0,0 +1,30 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Effective-dated salary structure header (FR-HR-PAY-02) — the audit trail a
+/// salary revision needs (docs/12-BACKEND-HRM.md §13): exactly one row with
+/// <see cref="EffectiveTo"/> null (the current one) per employee at a time.
+/// Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class EmployeeSalaryStructure
+{
+    public int EmployeeSalaryStructureId { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+
+    public DateTime EffectiveFrom { get; set; }
+    public DateTime? EffectiveTo { get; set; }
+    public decimal BasicSalary { get; set; }
+    public string Currency { get; set; } = "LKR";
+    public SalaryStructureStatus Status { get; set; } = SalaryStructureStatus.Active;
+
+    public int ApprovedBy { get; set; }
+    public DateTime ApprovedAt { get; set; }
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public List<EmployeeSalaryStructureLine> Lines { get; set; } = new();
+}
@@ -0,0 +1,12 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>Allowance/other-deduction line on a salary structure. Model: docs/12-BACKEND-HRM.md Part C.6.</summary>
+public class EmployeeSalaryStructureLine
+{
+    public int EmployeeSalaryStructureLineId { get; set; }
+    public int EmployeeSalaryStructureId { get; set; }
+    public EmployeeSalaryStructure? EmployeeSalaryStructure { get; set; }
+    public int SalaryComponentId { get; set; }
+    public SalaryComponent? SalaryComponent { get; set; }
+    public decimal Amount { get; set; }
+}
@@ -0,0 +1,20 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Labor category master (FR-HR-MD-01) — a master, not an enum, mirroring
+/// <see cref="Brand"/>: employment categories change with company/labor-law
+/// policy without wanting a code deploy. Model: docs/12-BACKEND-HRM.md Part C.1.
+/// </summary>
+public class EmploymentType
+{
+    public int EmploymentTypeId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -3,9 +3,13 @@ using ERPCore.Domain.Enums;
 namespace ERPCore.Domain.Entities;

 /// <summary>
-/// GRN line (FR-GRN-04..08). <see cref="UnitCost"/> is the PO-derived cost for
-/// PO-based receipts (client cost ignored — 02-SECURITY C.3) or the entered cost
-/// for direct receipts. <see cref="ReceivedValue"/> = qty × unitCost.
+/// GRN line (FR-GRN-04..08). <see cref="UnitCost"/> is the gross cost received at:
+/// entered on the line, defaulting to the PO price when omitted (a per-receipt price
+/// override is now permitted — see docs/02-SECURITY C.3, revised). <see cref="PoUnitPrice"/>
+/// snapshots the PO price at receipt so the variance survives later PO edits.
+/// <see cref="NetUnitCost"/> = unitCost after trade discount — this is what the FIFO layer
+/// costs at (VAT never enters stock value; it is recoverable input tax).
+/// <see cref="ReceivedValue"/> = qty × netUnitCost (after discount, before VAT).
 /// <see cref="HoldStatus"/> gates issuability. Model: docs/10 Part C.3.
 /// </summary>
 public class GrnLine
@@ -31,7 +35,30 @@ public class GrnLine
    public Batch? Batch { get; set; }

    public decimal Qty { get; set; }
+
+    /// <summary>Gross unit cost received at (entered, or PO price when omitted).</summary>
    public decimal UnitCost { get; set; }
+
+    /// <summary>Snapshot of the PO line price at receipt; null for direct receipts.</summary>
+    public decimal? PoUnitPrice { get; set; }
+
+    /// <summary>Trade discount percentage (0–100), entered.</summary>
+    public decimal DiscountPct { get; set; }
+
+    /// <summary>UnitCost × (1 − DiscountPct/100) — the inventory (FIFO layer) cost.</summary>
+    public decimal NetUnitCost { get; set; }
+
+    /// <summary>VAT percentage (0–100), entered. Recoverable — does not affect stock value.</summary>
+    public decimal VatPct { get; set; }
+
+    /// <summary>Qty × NetUnitCost × VatPct/100.</summary>
+    public decimal VatAmount { get; set; }
+
+    /// <summary>Qty × NetUnitCost (after discount, before VAT).</summary>
    public decimal ReceivedValue { get; set; }
+
+    /// <summary>Qty × NetUnitCost + VatAmount — payable to the vendor.</summary>
+    public decimal LineTotal { get; set; }
+
    public HoldStatus HoldStatus { get; set; } = HoldStatus.Available;
 }
@@ -0,0 +1,24 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Staff document catalog (FR-HR-DOC-01) — the user's "DocType": a category of
+/// document (NIC, contract, certificate...), not the uploaded file itself (see
+/// <see cref="EmployeeDocument"/>, the "Doc"). Deactivated, not deleted, when
+/// referenced. Model: docs/12-BACKEND-HRM.md Part C.3.
+/// </summary>
+public class HrDocumentType
+{
+    public int HrDocumentTypeId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public HrDocumentCategory Category { get; set; }
+    public bool RequiredAtOnboarding { get; set; }
+    public bool ExpiryTracked { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -33,6 +33,14 @@ public class Item
    public StockNature StockNature { get; set; }
    public TrackingMode TrackingMode { get; set; }
    public string? TaxClass { get; set; }
+
+    /// <summary>
+    /// Optional fixed selling price used by Sales only. <c>null</c> means "use stock value"
+    /// (the item is sold at its FIFO stock cost at sale time); a value is the fixed sale price.
+    /// Never enters costing/GRN/FIFO (docs/10 Part C.1, C.9).
+    /// </summary>
+    public decimal? SalePrice { get; set; }
+
    public EntityStatus Status { get; set; } = EntityStatus.Active;

    public DateTime CreatedAt { get; set; }
@@ -0,0 +1,24 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Per employee/type/year leave entitlement (FR-HR-LV-03). Unique on
+/// (EmployeeId, LeaveTypeId, Year). RemainingDays is a computed projection, not
+/// stored. Model: docs/12-BACKEND-HRM.md Part C.5.
+/// </summary>
+public class LeaveBalance
+{
+    public int LeaveBalanceId { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+    public int LeaveTypeId { get; set; }
+    public LeaveType? LeaveType { get; set; }
+    public int Year { get; set; }
+
+    public decimal EntitledDays { get; set; }
+    public decimal TakenDays { get; set; }
+    public decimal CarriedForwardDays { get; set; }
+    public decimal AdjustmentDays { get; set; }
+
+    public uint RowVersion { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+}
@@ -0,0 +1,31 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Leave request (FR-HR-LV-02) — transactional document, numbered via
+/// <see cref="NumberSequence"/> (docType "LV"). Model: docs/12-BACKEND-HRM.md Part C.5.
+/// </summary>
+public class LeaveRequest
+{
+    public int LeaveRequestId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+    public int LeaveTypeId { get; set; }
+    public LeaveType? LeaveType { get; set; }
+
+    public DateTime StartDate { get; set; }
+    public DateTime EndDate { get; set; }
+    public decimal DaysCount { get; set; }
+    public string? Reason { get; set; }
+
+    public LeaveRequestStatus Status { get; set; } = LeaveRequestStatus.Draft;
+    public int? ApprovedBy { get; set; }
+    public DateTime? ApprovedAt { get; set; }
+    public string? RejectionReason { get; set; }
+
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,23 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>Leave type master (FR-HR-LV-01). Model: docs/12-BACKEND-HRM.md Part C.5.</summary>
+public class LeaveType
+{
+    public int LeaveTypeId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public bool IsPaid { get; set; } = true;
+    /// <summary>Feeds Payroll's No-Pay deduction when true (docs/12-BACKEND-HRM.md §6).</summary>
+    public bool CountsAsNoPay { get; set; }
+    public decimal AccrualPerYear { get; set; }
+    public bool CarryForwardAllowed { get; set; }
+    public int? MaxCarryForwardDays { get; set; }
+    public bool RequiresApproval { get; set; } = true;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,26 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Loan installment ledger row. <see cref="PayrollRunId"/> is stamped only when the
+/// consuming <see cref="PayrollRun"/> reaches Locked (docs/12-BACKEND-HRM.md A.4).
+/// Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class LoanInstallment
+{
+    public int LoanInstallmentId { get; set; }
+    public int EmployeeLoanId { get; set; }
+    public EmployeeLoan? EmployeeLoan { get; set; }
+
+    public int InstallmentNumber { get; set; }
+    public int DueYear { get; set; }
+    public int DueMonth { get; set; }
+    public decimal ScheduledAmount { get; set; }
+    public decimal? PaidAmount { get; set; }
+    public int? PayrollRunId { get; set; }
+    public PayrollRun? PayrollRun { get; set; }
+    public LoanInstallmentStatus Status { get; set; } = LoanInstallmentStatus.Pending;
+
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,22 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A top-level sidebar entry (mirrors the frontend's hardcoded nav list,
+/// components/Layouts/AppSidebar.tsx). Seeded to match the current app routes;
+/// per-role visibility is controlled via <see cref="Permission"/>/<see cref="RolePermission"/>,
+/// not by editing these rows through the UI.
+/// </summary>
+public class NavItem
+{
+    public int NavItemId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Label { get; set; } = string.Empty;
+    public string? Icon { get; set; }
+    public string? Href { get; set; }
+    public int SortOrder { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public ICollection<SubNavItem> Children { get; set; } = new List<SubNavItem>();
+}
@@ -0,0 +1,41 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Per-employee payroll summary row (FR-HR-PAY-05). EpfEmployerAmount/EtfEmployerAmount
+/// are informational/liability only, never subtracted from NetSalary
+/// (docs/12-BACKEND-HRM.md B.4). Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class PayrollLine
+{
+    public int PayrollLineId { get; set; }
+    public int PayrollRunId { get; set; }
+    public PayrollRun? PayrollRun { get; set; }
+    public int EmployeeId { get; set; }
+    public Employee? Employee { get; set; }
+
+    public decimal BasicSalary { get; set; }
+    public decimal TotalAllowances { get; set; }
+    public decimal OvertimeAmount { get; set; }
+    public decimal GrossSalary { get; set; }
+
+    public decimal LateDeductionAmount { get; set; }
+    public decimal NoPayAmount { get; set; }
+    public decimal LoanDeductionAmount { get; set; }
+    public decimal EpfEmployeeAmount { get; set; }
+    public decimal EpfEmployerAmount { get; set; }
+    public decimal EtfEmployerAmount { get; set; }
+    public decimal TaxAmount { get; set; }
+    public decimal OtherDeductionsAmount { get; set; }
+    public decimal NetSalary { get; set; }
+
+    public int WorkingDays { get; set; }
+    public int PresentDays { get; set; }
+    public int AbsentDays { get; set; }
+    public int LeaveDays { get; set; }
+    public int OtMinutesTotal { get; set; }
+    public int LateMinutesTotal { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public List<PayrollLineComponent> Components { get; set; } = new();
+}
@@ -0,0 +1,18 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>The detailed Basic/Transport/Meal/OT/Late/No-Pay/Loan/EPF/ETF/Tax breakdown. Model: docs/12-BACKEND-HRM.md Part C.6.</summary>
+public class PayrollLineComponent
+{
+    public int PayrollLineComponentId { get; set; }
+    public int PayrollLineId { get; set; }
+    public PayrollLine? PayrollLine { get; set; }
+    public PayrollLineComponentCategory ComponentCategory { get; set; }
+    /// <summary>Set only for structure-sourced Allowance/OtherDeduction lines; null for system-computed lines.</summary>
+    public int? SalaryComponentId { get; set; }
+    public SalaryComponent? SalaryComponent { get; set; }
+    public string Label { get; set; } = string.Empty;
+    public decimal Amount { get; set; }
+    public int SortOrder { get; set; }
+}
@@ -0,0 +1,33 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Payroll run (FR-HR-PAY-05/06) — the transactional document. Numbered via
+/// <see cref="NumberSequence"/> (docType "PAY"). Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class PayrollRun
+{
+    public int PayrollRunId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public int PeriodYear { get; set; }
+    public int PeriodMonth { get; set; }
+    /// <summary>Null = company-wide run.</summary>
+    public int? BranchId { get; set; }
+    public Branch? Branch { get; set; }
+    public PayrollRunStatus Status { get; set; } = PayrollRunStatus.Draft;
+
+    public int GeneratedBy { get; set; }
+    public DateTime GeneratedAt { get; set; }
+    public int? ApprovedBy { get; set; }
+    public DateTime? ApprovedAt { get; set; }
+    public int? LockedBy { get; set; }
+    public DateTime? LockedAt { get; set; }
+    public int? UnlockedBy { get; set; }
+    public DateTime? UnlockedAt { get; set; }
+    public string? UnlockReason { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public List<PayrollLine> Lines { get; set; } = new();
+}
@@ -0,0 +1,21 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Effective-dated EPF/ETF rates (FR-HR-PAY-04) — Sri Lanka defaults (EPF 8%
+/// employee / 12% employer, ETF 3% employer-only), configurable since government
+/// rates can change. Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class PayrollStatutorySetting
+{
+    public int PayrollStatutorySettingId { get; set; }
+    public decimal EpfEmployeeRate { get; set; } = 0.08m;
+    public decimal EpfEmployerRate { get; set; } = 0.12m;
+    public decimal EtfEmployerRate { get; set; } = 0.03m;
+    public decimal OtMultiplierDefault { get; set; } = 1.5m;
+    public DateTime EffectiveFrom { get; set; }
+    public DateTime? EffectiveTo { get; set; }
+
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,16 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Thin generation/release marker over a <see cref="PayrollLine"/> — ships as an
+/// HTML print view in this phase, per the confirmed decision (no PDF dependency).
+/// Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class Payslip
+{
+    public int PayslipId { get; set; }
+    public int PayrollLineId { get; set; }
+    public PayrollLine? PayrollLine { get; set; }
+    public DateTime GeneratedAt { get; set; }
+    public DateTime? ReleasedAt { get; set; }
+    public int? ReleasedBy { get; set; }
+}
@@ -0,0 +1,18 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A grantable sidebar-visibility unit — exactly one of <see cref="NavItemId"/> /
+/// <see cref="SubNavItemId"/> is set (enforced in <c>NavSeedService</c>/service layer,
+/// not by a DB constraint). One row is seeded per <see cref="NavItem"/>/<see cref="SubNavItem"/>;
+/// <see cref="RolePermission"/> grants it to a role.
+/// </summary>
+public class Permission
+{
+    public int PermissionId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public int? NavItemId { get; set; }
+    public int? SubNavItemId { get; set; }
+
+    public NavItem? NavItem { get; set; }
+    public SubNavItem? SubNavItem { get; set; }
+}
@@ -22,7 +22,7 @@ public class PoLine
    public Warehouse? Warehouse { get; set; }

    public decimal Qty { get; set; }
-    public decimal UnitPrice { get; set; }
+    public decimal UnitPrice { get; set; }//
    public decimal Tax { get; set; }
    public decimal QtyReceived { get; set; }
 }
@@ -0,0 +1,27 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Local shadow/projection of an AuthHex <c>Role</c> row, mirroring the same
+/// pattern <see cref="User"/> uses for AuthHex identities: <see cref="AuthRoleId"/>
+/// maps to AuthHex's Guid <c>RoleId</c>, while the local <see cref="RoleId"/> (int)
+/// is what <see cref="Permission"/>/<see cref="RolePermission"/>/<see cref="User.RoleId"/>
+/// FKs reference. AuthHex remains the source of truth; writes are forwarded there
+/// first (<c>IAuthHexClient</c>) and mirrored here on success.
+/// </summary>
+public class Role
+{
+    public int RoleId { get; set; }
+    public Guid AuthRoleId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public bool IsSystemRole { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,11 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>Join row granting a <see cref="Role"/> visibility of a <see cref="Permission"/> (nav node).</summary>
+public class RolePermission
+{
+    public int RoleId { get; set; }
+    public int PermissionId { get; set; }
+
+    public Role? Role { get; set; }
+    public Permission? Permission { get; set; }
+}
@@ -0,0 +1,19 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>Allowance/ad hoc deduction master (FR-HR-PAY-01). Model: docs/12-BACKEND-HRM.md Part C.6.</summary>
+public class SalaryComponent
+{
+    public int SalaryComponentId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public SalaryComponentType ComponentType { get; set; }
+    public bool IsTaxable { get; set; }
+    public bool IsEpfEtfApplicable { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,18 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>A child sidebar entry under a <see cref="NavItem"/> (e.g. Products' children).</summary>
+public class SubNavItem
+{
+    public int SubNavItemId { get; set; }
+    public int NavItemId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Label { get; set; } = string.Empty;
+    public string? Icon { get; set; }
+    public string? Href { get; set; }
+    public int SortOrder { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public NavItem? NavItem { get; set; }
+}
@@ -0,0 +1,19 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Configurable APIT-style marginal tax slab (FR-HR-PAY-04) — government slabs
+/// change with the yearly budget, so this is never hardcoded. <see cref="UpperBound"/>
+/// null means "and above". Model: docs/12-BACKEND-HRM.md Part C.6.
+/// </summary>
+public class TaxSlab
+{
+    public int TaxSlabId { get; set; }
+    public DateTime EffectiveFrom { get; set; }
+    public DateTime? EffectiveTo { get; set; }
+    public decimal LowerBound { get; set; }
+    public decimal? UpperBound { get; set; }
+    public decimal Rate { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -22,4 +22,16 @@ public class User

    /// <summary>AuthHex identity (token <c>UserId</c> GUID); null for the seeded system user.</summary>
    public Guid? AuthUserId { get; set; }
+
+    /// <summary>
+    /// Mirrors the AuthHex identity's email (backfilled at create time by
+    /// <c>UsersController.Create</c>, best-effort by JIT provisioning otherwise).
+    /// Used only for the Employee&lt;-&gt;User cross-link soft match (docs/12-BACKEND-HRM.md
+    /// A.5) — never for authentication, which stays AuthHex's responsibility.
+    /// </summary>
+    public string? Email { get; set; }
+
+    /// <summary>Local shadow <see cref="Role"/> assignment; null until an admin assigns one.</summary>
+    public int? RoleId { get; set; }
+    public Role? Role { get; set; }
 }
@@ -0,0 +1,32 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Attendance baseline (FR-HR-MD-01) — the shift definition Late/Early/OT figures
+/// are computed against (docs/12-BACKEND-HRM.md A.3, C.1). <see cref="IsOvernight"/>
+/// is explicit rather than inferred from End&lt;Start, since that comparison alone
+/// is ambiguous for a shift that starts and ends the same clock time next day.
+/// </summary>
+public class WorkShift
+{
+    public int WorkShiftId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public TimeSpan StartTime { get; set; }
+    public TimeSpan EndTime { get; set; }
+    public bool IsOvernight { get; set; }
+    public int GraceMinutes { get; set; } = 15;
+    public int BreakMinutes { get; set; } = 60;
+    public int StandardWorkingMinutes { get; set; } = 480;
+    public decimal OtMultiplier { get; set; } = 1.5m;
+
+    /// <summary>Bitmask, bit 0 = Monday .. bit 6 = Sunday.</summary>
+    public int WorkingDaysMask { get; set; } = 0b0111111;
+
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}
@@ -0,0 +1,15 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>
+/// Attendance upload batch lifecycle (FR-HR-ATT, docs/12-BACKEND-HRM.md C.4) —
+/// exactly the flow specified by the business: once <see cref="Confirmed"/> it
+/// becomes payroll's source of truth; once <see cref="UsedInPayroll"/> it is
+/// immutable even to Unlock (a payroll run must be unlocked/regenerated first).
+/// </summary>
+public enum AttendanceBatchStatus
+{
+    Draft,
+    Validated,
+    Confirmed,
+    UsedInPayroll
+}
@@ -0,0 +1,13 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>
+/// Origin of an attendance batch (docs/12-BACKEND-HRM.md C.4). <see cref="BiometricDevice"/>
+/// is a reserved future integration seam (docs §B.7) — no device feed exists yet.
+/// </summary>
+public enum AttendanceSourceType
+{
+    Excel,
+    Csv,
+    Manual,
+    BiometricDevice
+}
@@ -0,0 +1,17 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>
+/// Per-day attendance classification (docs/12-BACKEND-HRM.md C.4). Lateness/OT are
+/// derived facts (LateMinutes/OvertimeMinutes &gt; 0) on an otherwise Present record,
+/// not separate statuses. <see cref="OnLeave"/> is derived from an overlapping
+/// Approved LeaveRequest with no uploaded punch (§6).
+/// </summary>
+public enum AttendanceStatus
+{
+    Present,
+    Absent,
+    HalfDay,
+    OnLeave,
+    Holiday,
+    WeekOff
+}
@@ -0,0 +1,11 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>
+/// Uploaded staff document status (docs/12-BACKEND-HRM.md C.3). Never hard-deleted —
+/// archived instead, mirroring the deactivate-not-delete master convention (FR-MD-08).
+/// </summary>
+public enum EmployeeDocumentStatus
+{
+    Active,
+    Archived
+}
@@ -0,0 +1,16 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>
+/// Employee lifecycle status (docs/12-BACKEND-HRM.md C.2). An Employee is never
+/// hard-deleted; separation is recorded here instead (with <c>LastWorkingDate</c>
+/// set), matching the deactivate-not-delete convention for masters (FR-MD-08)
+/// taken one step further since the record must be retained for audit/payroll history.
+/// </summary>
+public enum EmployeeStatus
+{
+    Active,
+    Suspended,
+    Resigned,
+    Terminated,
+    Retired
+}
@@ -0,0 +1,9 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>Employee gender (docs/12-BACKEND-HRM.md C.2). Optional field, stored as a string.</summary>
+public enum Gender
+{
+    Male,
+    Female,
+    Other
+}
@@ -0,0 +1,12 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>Staff document catalog category (docs/12-BACKEND-HRM.md C.3). Stored as a string.</summary>
+public enum HrDocumentCategory
+{
+    Identity,
+    Educational,
+    Contract,
+    Certification,
+    Statutory,
+    Other
+}
@@ -0,0 +1,11 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>Leave request approval lifecycle (FR-HR-LV-02, docs/12-BACKEND-HRM.md C.5).</summary>
+public enum LeaveRequestStatus
+{
+    Draft,
+    Submitted,
+    Approved,
+    Rejected,
+    Cancelled
+}
@@ -0,0 +1,13 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>
+/// An installment flips Pending→Deducted only when its PayrollRun reaches Locked
+/// (docs/12-BACKEND-HRM.md A.4) — never at Generate/Draft, so a discarded/regenerated
+/// draft never prematurely consumes it.
+/// </summary>
+public enum LoanInstallmentStatus
+{
+    Pending,
+    Deducted,
+    Skipped
+}
@@ -0,0 +1,8 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>Loan vs Advance discriminator (docs/12-BACKEND-HRM.md C.6) — structurally identical, differ only in intent/labeling.</summary>
+public enum LoanKind
+{
+    Loan,
+    Advance
+}
@@ -0,0 +1,8 @@
+namespace ERPCore.Domain.Enums;
+
+public enum LoanStatus
+{
+    Active,
+    Closed,
+    Cancelled
+}
@@ -0,0 +1,12 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>
+/// EmployerContribution lines (EPF-employer, ETF) are informational/liability only —
+/// never subtracted from Net Salary (docs/12-BACKEND-HRM.md B.4).
+/// </summary>
+public enum PayrollLineComponentCategory
+{
+    Earning,
+    Deduction,
+    EmployerContribution
+}
@@ -0,0 +1,15 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>
+/// PayrollRun approval workflow (FR-HR-PAY-06, docs/12-BACKEND-HRM.md C.6). Maps the
+/// business's 5-step flow to 3 stored states: Generate→Draft, Review is a human
+/// action (not stored), Approve→Approved, Lock→Locked (the point loan installments
+/// and attendance batches are stamped consumed — see A.4), Generate Payslips is an
+/// action gated on Locked, not a state.
+/// </summary>
+public enum PayrollRunStatus
+{
+    Draft,
+    Approved,
+    Locked
+}
@@ -0,0 +1,12 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>Per-record outcome of the attendance upload validation pipeline (docs/12-BACKEND-HRM.md §B.3.4).</summary>
+public enum RowValidationStatus
+{
+    Valid,
+    DuplicateWithinBatch,
+    DuplicateConfirmed,
+    EmployeeNotFound,
+    InvalidDateTime,
+    Error
+}
@@ -0,0 +1,12 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>
+/// SalaryComponent master category (docs/12-BACKEND-HRM.md C.6) — for Allowances and
+/// ad hoc Other Deductions only. OT/Late/No-Pay/Loan/EPF/ETF/Tax are system-computed,
+/// not user-defined components, to avoid a generic formula engine nobody asked for.
+/// </summary>
+public enum SalaryComponentType
+{
+    Earning,
+    Deduction
+}
@@ -0,0 +1,8 @@
+namespace ERPCore.Domain.Enums;
+
+/// <summary>Effective-dated salary structure status (docs/12-BACKEND-HRM.md C.6) — exactly one Active (open-ended) row per employee at a time.</summary>
+public enum SalaryStructureStatus
+{
+    Active,
+    Superseded
+}
@@ -0,0 +1,28 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace ERPCore.Dtos.Auth;
+
+/// <summary>AuthHex's Role projection (ERP_Auth_Service/API_DOCUMENTATION.md, RoleManager section).</summary>
+public sealed class AuthHexRoleDto
+{
+    public Guid RoleId { get; set; }
+    public string? Code { get; set; }
+    public string? Name { get; set; }
+    public bool? IsSystemRole { get; set; }
+    public DateTime CreatedAt { get; set; }
+}
+
+public sealed class CreateAuthHexRoleRequest
+{
+    [Required] public string Code { get; set; } = string.Empty;
+    public string? Name { get; set; }
+    public bool? IsSystemRole { get; set; }
+}
+
+public sealed class UpdateAuthHexRoleRequest
+{
+    [Required] public Guid RoleId { get; set; }
+    public string? Code { get; set; }
+    public string? Name { get; set; }
+    public bool? IsSystemRole { get; set; }
+}
@@ -82,6 +82,14 @@ public sealed class GetUserDetailsResponse
    public JsonElement? UserType { get; set; }
 }

+/// <summary>AuthHex's UserType lookup (ERP_Auth_Service/API_DOCUMENTATION.md, listUserTypes).</summary>
+public sealed class UserTypeDto
+{
+    public Guid UserTypeId { get; set; }
+    public string? Code { get; set; }
+    public string? Description { get; set; }
+}
+
 public sealed class SessionDto
 {
    public string? SessionId { get; set; }
@@ -0,0 +1,24 @@
+namespace ERPCore.Dtos.Dashboard;
+
+/// <summary>
+/// Aggregate counts for the dashboard overview — mirrors the widget set in
+/// docs/dashboard-implementation.pdf: reorder alerts, on-hand summary, stock valuation,
+/// pending-approval POs, pending GRNs, open requisitions, open counts awaiting posting,
+/// and open RFQs. Recent movements isn't here — it's just GET /stock/ledger with a small
+/// pageSize, no aggregation needed. A single computed-on-read object, not a stored
+/// entity — same as reorder alerts (docs/11 §5.7).
+/// </summary>
+public sealed record DashboardStatsDto(
+    int LowStockAlerts,
+    decimal OnHandTotal,
+    int OnHandWarehouses,
+    decimal StockValuationTotal,
+    IReadOnlyList<WarehouseValuationDto> StockValuationByWarehouse,
+    int PendingApprovalPurchaseOrders,
+    int PendingGrns,
+    int OpenRequisitions,
+    int PendingCounts,
+    int OpenRfqs);
+
+/// <summary>One bar in the Stock Valuation chart — total FIFO layer value for a warehouse.</summary>
+public sealed record WarehouseValuationDto(int WarehouseId, decimal Total);
@@ -7,7 +7,10 @@ namespace ERPCore.Dtos.Grn;

 public sealed record GrnLineDto(
    int GrnLineId, int? PoLineId, int ItemId, int UomId, int? BinId,
-    decimal Qty, decimal UnitCost, decimal ReceivedValue, HoldStatus HoldStatus, int? BatchId);
+    decimal Qty, decimal UnitCost, decimal? PoUnitPrice,
+    decimal DiscountPct, decimal NetUnitCost, decimal VatPct, decimal VatAmount,
+    decimal ReceivedValue, decimal LineTotal, decimal PriceVariance,
+    HoldStatus HoldStatus, int? BatchId);

 public sealed record GrnDto(
    int GrnId, string DocNo, int? PoId, int VendorId, int WarehouseId, GrnStatus Status,
@@ -44,8 +47,16 @@ public sealed class CreateGrnLineInput
    [Required] public int UomId { get; set; }
    public int? BinId { get; set; }
    [Range(0.0001, double.MaxValue)] public decimal Qty { get; set; }
-    /// <summary>Used only for direct (no-PO) receipts; ignored when <see cref="PoLineId"/> is set.</summary>
+    /// <summary>
+    /// Gross unit cost. Required for direct (no-PO) receipts. For a PO line it is an optional
+    /// per-receipt price override — when 0/omitted the PO line price is used; when supplied it
+    /// wins and a variance is recorded against the PO snapshot (docs/02-SECURITY C.3, revised).
+    /// </summary>
    [Range(0, double.MaxValue)] public decimal UnitCost { get; set; }
+    /// <summary>Trade discount percentage (0–100). Reduces the inventory cost.</summary>
+    [Range(0, 100)] public decimal DiscountPct { get; set; }
+    /// <summary>VAT percentage (0–100). Recoverable — does not affect stock value.</summary>
+    [Range(0, 100)] public decimal VatPct { get; set; }
    [EnumDataType(typeof(HoldStatus))] public HoldStatus HoldStatus { get; set; } = HoldStatus.Available;
    public BatchInput? Batch { get; set; }
 }
@@ -0,0 +1,44 @@
+using System.ComponentModel.DataAnnotations;
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Dtos.Hrm;
+
+public sealed record AttendanceUploadBatchDto(
+    int AttendanceUploadBatchId, string DocNo, DateTime PeriodStart, DateTime PeriodEnd,
+    AttendanceSourceType SourceType, string? OriginalFileName, int UploadedBy, DateTime UploadedAt,
+    AttendanceBatchStatus Status, int? ConfirmedBy, DateTime? ConfirmedAt,
+    int RowCountTotal, int RowCountDuplicate, int RowCountError);
+
+public sealed class UploadAttendanceBatchMetadata
+{
+    [Required] public DateTime PeriodStart { get; set; }
+    [Required] public DateTime PeriodEnd { get; set; }
+}
+
+public sealed record AttendanceRecordDto(
+    int AttendanceRecordId, int? AttendanceUploadBatchId, int EmployeeId, string? EmployeeCode, string? EmployeeName,
+    DateTime AttendanceDate, TimeSpan? CheckIn, TimeSpan? CheckOut,
+    int WorkingMinutes, int LateMinutes, int EarlyLeaveMinutes, int OvertimeMinutes,
+    AttendanceStatus AttendanceStatus, RowValidationStatus RowValidationStatus,
+    int? DuplicateOfAttendanceRecordId, string? Notes);
+
+public sealed class UpdateAttendanceRecordRequest
+{
+    public TimeSpan? CheckIn { get; set; }
+    public TimeSpan? CheckOut { get; set; }
+    public AttendanceStatus? AttendanceStatus { get; set; }
+    [StringLength(1000)] public string? Notes { get; set; }
+}
+
+public sealed class ResolveDuplicateRequest
+{
+    [Required] public int RecordId { get; set; }
+    /// <summary>"keep" discards the other duplicate row(s); "discard" removes this row; "supersede" (cross-batch-confirmed only) replaces the prior confirmed record.</summary>
+    [Required, RegularExpression("^(keep|discard|supersede)$")]
+    public string Action { get; set; } = string.Empty;
+}
+
+public sealed class UnlockAttendanceBatchRequest
+{
+    [Required, StringLength(500)] public string Reason { get; set; } = string.Empty;
+}
@@ -0,0 +1,46 @@
+using System.ComponentModel.DataAnnotations;
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Dtos.Hrm;
+
+public sealed record HrDocumentTypeDto(
+    int HrDocumentTypeId, string Code, string Name, HrDocumentCategory Category,
+    bool RequiredAtOnboarding, bool ExpiryTracked, EntityStatus Status,
+    DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateHrDocumentTypeRequest
+{
+    [Required, StringLength(20)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    [Required, EnumDataType(typeof(HrDocumentCategory))] public HrDocumentCategory Category { get; set; }
+    public bool RequiredAtOnboarding { get; set; }
+    public bool ExpiryTracked { get; set; }
+}
+
+public sealed class UpdateHrDocumentTypeRequest
+{
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    [Required, EnumDataType(typeof(HrDocumentCategory))] public HrDocumentCategory Category { get; set; }
+    public bool RequiredAtOnboarding { get; set; }
+    public bool ExpiryTracked { get; set; }
+}
+
+public sealed record EmployeeDocumentDto(
+    int EmployeeDocumentId, int EmployeeId, int HrDocumentTypeId, string? HrDocumentTypeName,
+    string OriginalFileName, string ContentType, long SizeBytes,
+    DateTime? IssueDate, DateTime? ExpiryDate, string? Notes,
+    int UploadedBy, DateTime UploadedAt, EmployeeDocumentStatus Status);
+
+/// <summary>Metadata accompanying a multipart file upload (the file itself is bound separately).</summary>
+public sealed class UploadEmployeeDocumentRequest
+{
+    [Required] public int HrDocumentTypeId { get; set; }
+    public DateTime? IssueDate { get; set; }
+    public DateTime? ExpiryDate { get; set; }
+    [StringLength(1000)] public string? Notes { get; set; }
+}
+
+public sealed class UpdateEmployeeDocumentStatusRequest
+{
+    [Required, EnumDataType(typeof(EmployeeDocumentStatus))] public EmployeeDocumentStatus Status { get; set; }
+}
@@ -0,0 +1,117 @@
+using System.ComponentModel.DataAnnotations;
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Dtos.Hrm;
+
+public sealed record EmployeeListItemDto(
+    int EmployeeId, string EmployeeCode, string FullName, string? Email,
+    int DepartmentId, string? DepartmentName, int DesignationId, string? DesignationName,
+    int EmploymentTypeId, string? EmploymentTypeName, int? BranchId, string? BranchName,
+    EmployeeStatus Status, bool HasUserLink, DateTime HireDate);
+
+public sealed record EmployeeDetailDto(
+    int EmployeeId, string EmployeeCode, string FullName, string? Nic, DateTime? DateOfBirth,
+    Gender? Gender, string? Nationality, string? ProfilePhotoPath,
+    string? Email, string? PersonalMobile, string? AddressLine1, string? AddressLine2,
+    string? City, string? PostalCode, string? Country,
+    string? EmergencyContactName, string? EmergencyContactRelationship, string? EmergencyContactPhone,
+    DateTime HireDate, DateTime? ConfirmationDate, DateTime? LastWorkingDate,
+    int DepartmentId, int DesignationId, int EmploymentTypeId, int? BranchId, int WorkShiftId,
+    int? ReportingManagerId, string? EpfNumber, string? EtfNumber, string? TaxIdentificationNumber,
+    int? UserId, EmployeeStatus Status, DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateEmployeeRequest
+{
+    [Required, StringLength(30)] public string EmployeeCode { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string FullName { get; set; } = string.Empty;
+    [StringLength(30)] public string? Nic { get; set; }
+    public DateTime? DateOfBirth { get; set; }
+    public Gender? Gender { get; set; }
+    [StringLength(100)] public string? Nationality { get; set; }
+
+    [EmailAddress, StringLength(320)] public string? Email { get; set; }
+    [StringLength(30)] public string? PersonalMobile { get; set; }
+    [StringLength(200)] public string? AddressLine1 { get; set; }
+    [StringLength(200)] public string? AddressLine2 { get; set; }
+    [StringLength(100)] public string? City { get; set; }
+    [StringLength(20)] public string? PostalCode { get; set; }
+    [StringLength(100)] public string? Country { get; set; }
+
+    [StringLength(200)] public string? EmergencyContactName { get; set; }
+    [StringLength(100)] public string? EmergencyContactRelationship { get; set; }
+    [StringLength(30)] public string? EmergencyContactPhone { get; set; }
+
+    [Required] public DateTime HireDate { get; set; }
+    [Required] public int DepartmentId { get; set; }
+    [Required] public int DesignationId { get; set; }
+    [Required] public int EmploymentTypeId { get; set; }
+    public int? BranchId { get; set; }
+    [Required] public int WorkShiftId { get; set; }
+    public int? ReportingManagerId { get; set; }
+
+    [StringLength(30)] public string? EpfNumber { get; set; }
+    [StringLength(30)] public string? EtfNumber { get; set; }
+    [StringLength(30)] public string? TaxIdentificationNumber { get; set; }
+
+    /// <summary>Explicit, human-confirmed link to an existing User found via email-lookup — never automatic.</summary>
+    public int? LinkUserId { get; set; }
+}
+
+public sealed class UpdateEmployeeRequest
+{
+    [Required, StringLength(200)] public string FullName { get; set; } = string.Empty;
+    [StringLength(30)] public string? Nic { get; set; }
+    public DateTime? DateOfBirth { get; set; }
+    public Gender? Gender { get; set; }
+    [StringLength(100)] public string? Nationality { get; set; }
+
+    [EmailAddress, StringLength(320)] public string? Email { get; set; }
+    [StringLength(30)] public string? PersonalMobile { get; set; }
+    [StringLength(200)] public string? AddressLine1 { get; set; }
+    [StringLength(200)] public string? AddressLine2 { get; set; }
+    [StringLength(100)] public string? City { get; set; }
+    [StringLength(20)] public string? PostalCode { get; set; }
+    [StringLength(100)] public string? Country { get; set; }
+
+    [StringLength(200)] public string? EmergencyContactName { get; set; }
+    [StringLength(100)] public string? EmergencyContactRelationship { get; set; }
+    [StringLength(30)] public string? EmergencyContactPhone { get; set; }
+
+    public DateTime? ConfirmationDate { get; set; }
+    public DateTime? LastWorkingDate { get; set; }
+    [Required] public int DepartmentId { get; set; }
+    [Required] public int DesignationId { get; set; }
+    [Required] public int EmploymentTypeId { get; set; }
+    public int? BranchId { get; set; }
+    [Required] public int WorkShiftId { get; set; }
+    public int? ReportingManagerId { get; set; }
+
+    [StringLength(30)] public string? EpfNumber { get; set; }
+    [StringLength(30)] public string? EtfNumber { get; set; }
+    [StringLength(30)] public string? TaxIdentificationNumber { get; set; }
+}
+
+public sealed class UpdateEmployeeStatusRequest
+{
+    [Required, EnumDataType(typeof(EmployeeStatus))] public EmployeeStatus Status { get; set; }
+}
+
+public sealed record EmployeeBankDetailDto(
+    int EmployeeBankDetailId, string BankName, string BranchName, string AccountNumber,
+    string AccountHolderName, string? SwiftCode, bool IsPrimary, EntityStatus Status);
+
+public sealed class UpsertEmployeeBankDetailRequest
+{
+    public int? EmployeeBankDetailId { get; set; }
+    [Required, StringLength(200)] public string BankName { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string BranchName { get; set; } = string.Empty;
+    [Required, StringLength(50)] public string AccountNumber { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string AccountHolderName { get; set; } = string.Empty;
+    [StringLength(20)] public string? SwiftCode { get; set; }
+    public bool IsPrimary { get; set; }
+}
+
+public sealed class ReplaceEmployeeBankDetailsRequest
+{
+    [Required] public List<UpsertEmployeeBankDetailRequest> Items { get; set; } = new();
+}
@@ -0,0 +1,17 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace ERPCore.Dtos.Hrm;
+
+/// <summary>Advisory match surfaced by the reverse-direction email-lookup (docs/12-BACKEND-HRM.md A.5).</summary>
+public sealed record EmployeeMatchDto(int EmployeeId, string EmployeeCode, string FullName, string Email);
+
+public sealed record UserMatchDto(int UserId, string Username, string DisplayName, string Email);
+
+public sealed record EmployeeMatchResponse(EmployeeMatchDto? Match);
+
+public sealed record UserMatchResponse(UserMatchDto? Match);
+
+public sealed class LinkUserRequest
+{
+    [Required] public int UserId { get; set; }
+}
@@ -0,0 +1,67 @@
+using System.ComponentModel.DataAnnotations;
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Dtos.Hrm;
+
+public sealed record LeaveTypeDto(
+    int LeaveTypeId, string Code, string Name, bool IsPaid, bool CountsAsNoPay, decimal AccrualPerYear,
+    bool CarryForwardAllowed, int? MaxCarryForwardDays, bool RequiresApproval, EntityStatus Status,
+    DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateLeaveTypeRequest
+{
+    [Required, StringLength(20)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    public bool IsPaid { get; set; } = true;
+    public bool CountsAsNoPay { get; set; }
+    [Range(0, 365)] public decimal AccrualPerYear { get; set; }
+    public bool CarryForwardAllowed { get; set; }
+    public int? MaxCarryForwardDays { get; set; }
+    public bool RequiresApproval { get; set; } = true;
+}
+
+public sealed class UpdateLeaveTypeRequest
+{
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    public bool IsPaid { get; set; }
+    public bool CountsAsNoPay { get; set; }
+    [Range(0, 365)] public decimal AccrualPerYear { get; set; }
+    public bool CarryForwardAllowed { get; set; }
+    public int? MaxCarryForwardDays { get; set; }
+    public bool RequiresApproval { get; set; }
+}
+
+public sealed record LeaveRequestDto(
+    int LeaveRequestId, string DocNo, int EmployeeId, string? EmployeeName, int LeaveTypeId, string? LeaveTypeName,
+    DateTime StartDate, DateTime EndDate, decimal DaysCount, string? Reason,
+    LeaveRequestStatus Status, int? ApprovedBy, DateTime? ApprovedAt, string? RejectionReason, DateTime CreatedAt);
+
+public sealed class CreateLeaveRequestRequest
+{
+    [Required] public int EmployeeId { get; set; }
+    [Required] public int LeaveTypeId { get; set; }
+    [Required] public DateTime StartDate { get; set; }
+    [Required] public DateTime EndDate { get; set; }
+    [StringLength(1000)] public string? Reason { get; set; }
+}
+
+public sealed class RejectLeaveRequestRequest
+{
+    [Required, StringLength(1000)] public string Reason { get; set; } = string.Empty;
+}
+
+public sealed record LeaveBalanceDto(
+    int LeaveBalanceId, int EmployeeId, int LeaveTypeId, string? LeaveTypeName, int Year,
+    decimal EntitledDays, decimal TakenDays, decimal CarriedForwardDays, decimal AdjustmentDays, decimal RemainingDays);
+
+public sealed class LeaveBalanceAdjustmentItem
+{
+    [Required] public int LeaveTypeId { get; set; }
+    public decimal AdjustmentDays { get; set; }
+}
+
+public sealed class UpdateLeaveBalancesRequest
+{
+    [Required] public int Year { get; set; }
+    [Required] public List<LeaveBalanceAdjustmentItem> Items { get; set; } = new();
+}
@@ -0,0 +1,111 @@
+using System.ComponentModel.DataAnnotations;
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Dtos.Hrm;
+
+// Narrow DTOs for the five HRM org masters — server-controlled fields (status,
+// ids, timestamps) excluded from create/update requests (02-SECURITY B.6/C.1).
+
+public sealed record BranchDto(
+    int BranchId, string Code, string Name, string? Address, EntityStatus Status,
+    DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateBranchRequest
+{
+    [Required, StringLength(20)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    [StringLength(500)] public string? Address { get; set; }
+}
+
+public sealed class UpdateBranchRequest
+{
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    [StringLength(500)] public string? Address { get; set; }
+}
+
+public sealed record DepartmentDto(
+    int DepartmentId, string Code, string Name, int? ParentDepartmentId, int? HeadEmployeeId,
+    int? BranchId, EntityStatus Status, DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateDepartmentRequest
+{
+    [Required, StringLength(20)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    public int? ParentDepartmentId { get; set; }
+    public int? HeadEmployeeId { get; set; }
+    public int? BranchId { get; set; }
+}
+
+public sealed class UpdateDepartmentRequest
+{
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    public int? ParentDepartmentId { get; set; }
+    public int? HeadEmployeeId { get; set; }
+    public int? BranchId { get; set; }
+}
+
+public sealed record DesignationDto(
+    int DesignationId, string Code, string Name, EntityStatus Status, DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateDesignationRequest
+{
+    [Required, StringLength(20)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+}
+
+public sealed class UpdateDesignationRequest
+{
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+}
+
+public sealed record EmploymentTypeDto(
+    int EmploymentTypeId, string Code, string Name, EntityStatus Status, DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateEmploymentTypeRequest
+{
+    [Required, StringLength(20)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+}
+
+public sealed class UpdateEmploymentTypeRequest
+{
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+}
+
+public sealed record WorkShiftDto(
+    int WorkShiftId, string Code, string Name, TimeSpan StartTime, TimeSpan EndTime, bool IsOvernight,
+    int GraceMinutes, int BreakMinutes, int StandardWorkingMinutes, decimal OtMultiplier, int WorkingDaysMask,
+    EntityStatus Status, DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateWorkShiftRequest
+{
+    [Required, StringLength(20)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    [Required] public TimeSpan StartTime { get; set; }
+    [Required] public TimeSpan EndTime { get; set; }
+    public bool IsOvernight { get; set; }
+    [Range(0, 240)] public int GraceMinutes { get; set; } = 15;
+    [Range(0, 240)] public int BreakMinutes { get; set; } = 60;
+    [Range(1, 1440)] public int StandardWorkingMinutes { get; set; } = 480;
+    [Range(1, 5)] public decimal OtMultiplier { get; set; } = 1.5m;
+    [Range(0, 127)] public int WorkingDaysMask { get; set; } = 0b0111111;
+}
+
+public sealed class UpdateWorkShiftRequest
+{
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    [Required] public TimeSpan StartTime { get; set; }
+    [Required] public TimeSpan EndTime { get; set; }
+    public bool IsOvernight { get; set; }
+    [Range(0, 240)] public int GraceMinutes { get; set; }
+    [Range(0, 240)] public int BreakMinutes { get; set; }
+    [Range(1, 1440)] public int StandardWorkingMinutes { get; set; }
+    [Range(1, 5)] public decimal OtMultiplier { get; set; }
+    [Range(0, 127)] public int WorkingDaysMask { get; set; }
+}
+
+/// <summary>Shared by all five masters' PATCH .../status endpoints.</summary>
+public sealed class UpdateHrMasterStatusRequest
+{
+    [Required, EnumDataType(typeof(EntityStatus))] public EntityStatus Status { get; set; }
+}
@@ -0,0 +1,130 @@
+using System.ComponentModel.DataAnnotations;
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Dtos.Hrm;
+
+// --- Salary components ---
+
+public sealed record SalaryComponentDto(
+    int SalaryComponentId, string Code, string Name, SalaryComponentType ComponentType,
+    bool IsTaxable, bool IsEpfEtfApplicable, EntityStatus Status, DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateSalaryComponentRequest
+{
+    [Required, StringLength(20)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    [Required, EnumDataType(typeof(SalaryComponentType))] public SalaryComponentType ComponentType { get; set; }
+    public bool IsTaxable { get; set; }
+    public bool IsEpfEtfApplicable { get; set; }
+}
+
+public sealed class UpdateSalaryComponentRequest
+{
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+    public bool IsTaxable { get; set; }
+    public bool IsEpfEtfApplicable { get; set; }
+}
+
+// --- Salary structure ---
+
+public sealed record EmployeeSalaryStructureLineDto(int SalaryComponentId, string? SalaryComponentName, decimal Amount);
+
+public sealed record EmployeeSalaryStructureDto(
+    int EmployeeSalaryStructureId, int EmployeeId, DateTime EffectiveFrom, DateTime? EffectiveTo,
+    decimal BasicSalary, string Currency, SalaryStructureStatus Status,
+    List<EmployeeSalaryStructureLineDto> Lines, DateTime CreatedAt);
+
+public sealed class SalaryStructureLineRequest
+{
+    [Required] public int SalaryComponentId { get; set; }
+    [Range(0, double.MaxValue)] public decimal Amount { get; set; }
+}
+
+public sealed class CreateSalaryStructureRequest
+{
+    [Required] public DateTime EffectiveFrom { get; set; }
+    [Range(0, double.MaxValue)] public decimal BasicSalary { get; set; }
+    public List<SalaryStructureLineRequest> Lines { get; set; } = new();
+}
+
+// --- Loans ---
+
+public sealed record LoanInstallmentDto(
+    int LoanInstallmentId, int InstallmentNumber, int DueYear, int DueMonth,
+    decimal ScheduledAmount, decimal? PaidAmount, int? PayrollRunId, LoanInstallmentStatus Status);
+
+public sealed record EmployeeLoanDto(
+    int EmployeeLoanId, string DocNo, int EmployeeId, LoanKind LoanKind, decimal PrincipalAmount,
+    decimal InterestRate, decimal InstallmentAmount, int NumberOfInstallments, int StartYear, int StartMonth,
+    decimal OutstandingBalance, LoanStatus Status, List<LoanInstallmentDto> Installments, DateTime CreatedAt);
+
+public sealed class CreateEmployeeLoanRequest
+{
+    [Required, EnumDataType(typeof(LoanKind))] public LoanKind LoanKind { get; set; }
+    [Range(0.01, double.MaxValue)] public decimal PrincipalAmount { get; set; }
+    [Range(0, 1)] public decimal InterestRate { get; set; }
+    [Range(0.01, double.MaxValue)] public decimal InstallmentAmount { get; set; }
+    [Range(1, 360)] public int NumberOfInstallments { get; set; }
+    [Range(2000, 2100)] public int StartYear { get; set; }
+    [Range(1, 12)] public int StartMonth { get; set; }
+}
+
+// --- Statutory settings ---
+
+public sealed record PayrollStatutorySettingDto(
+    int PayrollStatutorySettingId, decimal EpfEmployeeRate, decimal EpfEmployerRate, decimal EtfEmployerRate,
+    decimal OtMultiplierDefault, DateTime EffectiveFrom, DateTime? EffectiveTo);
+
+public sealed class UpsertPayrollStatutorySettingRequest
+{
+    [Range(0, 1)] public decimal EpfEmployeeRate { get; set; } = 0.08m;
+    [Range(0, 1)] public decimal EpfEmployerRate { get; set; } = 0.12m;
+    [Range(0, 1)] public decimal EtfEmployerRate { get; set; } = 0.03m;
+    [Range(1, 5)] public decimal OtMultiplierDefault { get; set; } = 1.5m;
+    [Required] public DateTime EffectiveFrom { get; set; }
+}
+
+public sealed record TaxSlabDto(int TaxSlabId, DateTime EffectiveFrom, DateTime? EffectiveTo, decimal LowerBound, decimal? UpperBound, decimal Rate);
+
+public sealed class CreateTaxSlabRequest
+{
+    [Required] public DateTime EffectiveFrom { get; set; }
+    [Range(0, double.MaxValue)] public decimal LowerBound { get; set; }
+    public decimal? UpperBound { get; set; }
+    [Range(0, 1)] public decimal Rate { get; set; }
+}
+
+// --- Payroll run ---
+
+public sealed record PayrollLineComponentDto(
+    PayrollLineComponentCategory ComponentCategory, int? SalaryComponentId, string Label, decimal Amount, int SortOrder);
+
+public sealed record PayrollLineDto(
+    int PayrollLineId, int PayrollRunId, int EmployeeId, string? EmployeeCode, string? EmployeeName,
+    decimal BasicSalary, decimal TotalAllowances, decimal OvertimeAmount, decimal GrossSalary,
+    decimal LateDeductionAmount, decimal NoPayAmount, decimal LoanDeductionAmount,
+    decimal EpfEmployeeAmount, decimal EpfEmployerAmount, decimal EtfEmployerAmount,
+    decimal TaxAmount, decimal OtherDeductionsAmount, decimal NetSalary,
+    int WorkingDays, int PresentDays, int AbsentDays, int LeaveDays, int OtMinutesTotal, int LateMinutesTotal);
+
+public sealed record PayrollLineDetailDto(PayrollLineDto Line, List<PayrollLineComponentDto> Components);
+
+public sealed record PayrollRunDto(
+    int PayrollRunId, string DocNo, int PeriodYear, int PeriodMonth, int? BranchId, PayrollRunStatus Status,
+    int GeneratedBy, DateTime GeneratedAt, int? ApprovedBy, DateTime? ApprovedAt,
+    int? LockedBy, DateTime? LockedAt, int? UnlockedBy, DateTime? UnlockedAt, string? UnlockReason,
+    decimal TotalGross, decimal TotalNet, int EmployeeCount);
+
+public sealed class GeneratePayrollRunRequest
+{
+    [Range(2000, 2100)] public int PeriodYear { get; set; }
+    [Range(1, 12)] public int PeriodMonth { get; set; }
+    public int? BranchId { get; set; }
+}
+
+public sealed class UnlockPayrollRunRequest
+{
+    [Required, StringLength(500)] public string Reason { get; set; } = string.Empty;
+}
+
+public sealed record PayslipDto(int PayslipId, int PayrollLineId, DateTime GeneratedAt, DateTime? ReleasedAt, int? ReleasedBy);
@@ -0,0 +1,26 @@
+namespace ERPCore.Dtos.Hrm;
+
+public sealed record AttendanceSummaryRowDto(
+    int EmployeeId, string EmployeeCode, string EmployeeName, string? DepartmentName,
+    int PresentDays, int AbsentDays, int LeaveDays, int HalfDays, int OtMinutesTotal, int LateMinutesTotal);
+
+public sealed record OvertimeReportRowDto(
+    int EmployeeId, string EmployeeCode, string EmployeeName, DateTime AttendanceDate, int OvertimeMinutes);
+
+public sealed record LateArrivalReportRowDto(
+    int EmployeeId, string EmployeeCode, string EmployeeName, DateTime AttendanceDate, int LateMinutes);
+
+public sealed record PayrollRegisterRowDto(
+    int PayrollLineId, int EmployeeId, string EmployeeCode, string EmployeeName,
+    decimal GrossSalary, decimal TotalDeductions, decimal NetSalary);
+
+public sealed record SalaryHistoryRowDto(
+    int EmployeeSalaryStructureId, DateTime EffectiveFrom, DateTime? EffectiveTo, decimal BasicSalary, string Status);
+
+public sealed record LeaveBalanceReportRowDto(
+    int EmployeeId, string EmployeeCode, string EmployeeName, string LeaveTypeName,
+    decimal EntitledDays, decimal TakenDays, decimal RemainingDays);
+
+public sealed record DocumentExpiryReportRowDto(
+    int EmployeeDocumentId, int EmployeeId, string EmployeeCode, string EmployeeName,
+    string DocumentTypeName, DateTime ExpiryDate, int DaysUntilExpiry);
@@ -9,7 +9,7 @@ namespace ERPCore.Dtos.Items;
 public sealed record ItemListItemDto(
    int ItemId, string Sku, string Name, int CategoryId, int? SubCategoryId, int? BrandId,
    int BaseUomId, int? DefaultVendorId, StockNature StockNature, TrackingMode TrackingMode,
-    string? TaxClass, EntityStatus Status);
+    string? TaxClass, decimal? SalePrice, EntityStatus Status);

 /// <summary>A single per-warehouse reorder policy row.</summary>
 public sealed record ItemReorderDto(int WarehouseId, decimal ReorderPoint, decimal ReorderQty);
@@ -27,7 +27,7 @@ public sealed record ItemDetailDto(
    int ItemId, string Sku, string Name, string? Description, int CategoryId,
    int? SubCategoryId, int? BrandId, int BaseUomId, int? DefaultVendorId,
    StockNature StockNature, TrackingMode TrackingMode,
-    string? TaxClass, EntityStatus Status, IReadOnlyList<ItemReorderDto> Reorder,
+    string? TaxClass, decimal? SalePrice, EntityStatus Status, IReadOnlyList<ItemReorderDto> Reorder,
    IReadOnlyList<UomConversionDto> Conversions,
    DateTime CreatedAt, DateTime? UpdatedAt);

@@ -62,6 +62,8 @@ public sealed class CreateItemRequest
    [Required, EnumDataType(typeof(StockNature))] public StockNature StockNature { get; set; }
    [EnumDataType(typeof(TrackingMode))] public TrackingMode TrackingMode { get; set; } = TrackingMode.None;
    [StringLength(20)] public string? TaxClass { get; set; }
+    /// <summary>Optional fixed sale price (Sales only). Null ⇒ sell at stock/FIFO value.</summary>
+    [Range(0, double.MaxValue)] public decimal? SalePrice { get; set; }
 }

 public sealed class UpdateItemRequest
@@ -79,6 +81,8 @@ public sealed class UpdateItemRequest
    [Required, EnumDataType(typeof(StockNature))] public StockNature StockNature { get; set; }
    [EnumDataType(typeof(TrackingMode))] public TrackingMode TrackingMode { get; set; } = TrackingMode.None;
    [StringLength(20)] public string? TaxClass { get; set; }
+    /// <summary>Optional fixed sale price (Sales only). Null ⇒ sell at stock/FIFO value.</summary>
+    [Range(0, double.MaxValue)] public decimal? SalePrice { get; set; }
 }

 public sealed class UpdateItemStatusRequest
@@ -37,6 +37,13 @@ public sealed class CreatePurchaseOrderRequest
    [Required] public int VendorId { get; set; }
    public int? RequisitionId { get; set; }
    [Required, MinLength(1)] public List<CreatePoLineInput> Lines { get; set; } = new();
+
+    /// <summary>
+    /// When true the PO is created in <c>Draft</c> (editable/deletable, not yet issued).
+    /// When false (default) it auto-approves on creation, preserving the Requisition→PO
+    /// and RFQ→PO flows unchanged (docs/11 §3.3).
+    /// </summary>
+    public bool SaveAsDraft { get; set; }
 }

 public sealed class UpdatePurchaseOrderRequest
@@ -0,0 +1,6 @@
+namespace ERPCore.Dtos.Rbac;
+
+/// <summary>Response for `GET /api/v1/auth/me` — the frontend's authoritative source
+/// for the current user's role and permitted sidebar nav codes (replaces trusting
+/// the stale, client-only `roleId` cached in localStorage).</summary>
+public sealed record MeResponseDto(string? RoleCode, string? RoleName, IReadOnlyList<string> NavCodes);
@@ -0,0 +1,7 @@
+namespace ERPCore.Dtos.Rbac;
+
+public sealed record SubNavItemDto(int SubNavItemId, string Code, string Label, string? Icon, string? Href, int SortOrder);
+
+public sealed record NavItemDto(
+    int NavItemId, string Code, string Label, string? Icon, string? Href, int SortOrder,
+    IReadOnlyList<SubNavItemDto> Children);
@@ -0,0 +1,34 @@
+using System.ComponentModel.DataAnnotations;
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Dtos.Rbac;
+
+public sealed record RoleDto(
+    int RoleId, string Code, string Name, bool IsSystemRole, EntityStatus Status,
+    DateTime CreatedAt, DateTime? UpdatedAt);
+
+public sealed class CreateRoleRequest
+{
+    [Required, StringLength(50)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+}
+
+public sealed class UpdateRoleRequest
+{
+    [Required, StringLength(50)] public string Code { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
+}
+
+public sealed class UpdateRoleStatusRequest
+{
+    [Required, EnumDataType(typeof(EntityStatus))] public EntityStatus Status { get; set; }
+}
+
+/// <summary>Replaces a role's full permission set (checkbox-tree save from the frontend).</summary>
+public sealed class AssignRolePermissionsRequest
+{
+    public List<int> NavItemIds { get; set; } = new();
+    public List<int> SubNavItemIds { get; set; } = new();
+}
+
+public sealed record RolePermissionsDto(int RoleId, List<int> NavItemIds, List<int> SubNavItemIds);
@@ -0,0 +1,41 @@
+using System.ComponentModel.DataAnnotations;
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Dtos.Users;
+
+public sealed record ManagedUserDto(
+    int UserId, string Username, string DisplayName, string? Email, EntityStatus Status,
+    int? RoleId, string? RoleCode, string? RoleName);
+
+/// <summary>
+/// Creates a user in both backends: forwards to AuthHex's `registerUser` (source
+/// of truth for credentials), then mirrors the account into ERPCore's local
+/// shadow `User` row immediately (rather than waiting for next-login JIT
+/// provisioning). AuthHex emails the generated/supplied password to `Email`.
+/// </summary>
+public sealed class CreateUserRequest
+{
+    [Required, StringLength(100)] public string Username { get; set; } = string.Empty;
+    [Required, StringLength(200)] public string FullName { get; set; } = string.Empty;
+    [Required] public int RoleId { get; set; }
+    [Required] public Guid UserTypeId { get; set; }
+    [Required, EmailAddress] public string Email { get; set; } = string.Empty;
+    public string? Nic { get; set; }
+    public string? MobileNumber { get; set; }
+    /// <summary>Left empty to auto-generate (AuthHex emails it to <see cref="Email"/>).</summary>
+    public string? Password { get; set; }
+
+    /// <summary>
+    /// Explicit, human-confirmed link to an existing unlinked Employee found via
+    /// email-lookup — never automatic, even on an exact email match (docs/12-BACKEND-HRM.md A.5).
+    /// </summary>
+    public int? LinkEmployeeId { get; set; }
+}
+
+public sealed class UpdateUserRoleRequest
+{
+    [Required] public int RoleId { get; set; }
+}
+
+/// <summary>AuthHex UserType lookup, for populating the create-user form's select (no local shadow — read-only passthrough).</summary>
+public sealed record UserTypeOptionDto(Guid UserTypeId, string? Code, string? Description);
@@ -7,6 +7,8 @@
  </PropertyGroup>

  <ItemGroup>
+    <PackageReference Include="ClosedXML" Version="0.105.0" />
+    <PackageReference Include="CsvHelper" Version="33.1.0" />
    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
      <PrivateAssets>all</PrivateAssets>
@@ -1,6 +1,7 @@
 using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using System.Text.Json;
+using System.Text.Json.Serialization;
 using ERPCore.Dtos.Auth;
 using ERPCore.System.Errors;

@@ -16,9 +17,14 @@ namespace ERPCore.Infra.Auth.AuthHex;
 /// </summary>
 public sealed class AuthHexClient : IAuthHexClient
 {
+    // WhenWritingNull: AuthHex's dispatcher reads payload fields as raw JsonElements and some
+    // (e.g. RoleManager's isSystemRole) call type-specific getters like GetBoolean() that throw
+    // on an explicit JSON null rather than treating it as "absent" — omit null properties instead
+    // of serializing them, so unset nullable request fields behave as ContainsKey == false upstream.
    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web)
    {
-        PropertyNameCaseInsensitive = true
+        PropertyNameCaseInsensitive = true,
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull
    };

    private readonly HttpClient _http;
@@ -42,6 +48,9 @@ public sealed class AuthHexClient : IAuthHexClient
    public Task<GetUserDetailsResponse> GetUserDetailsAsync(Guid userId, CancellationToken ct)
        => CallAsync<GetUserDetailsResponse>("user", "getUserDetails", new { userId }, null, ct);

+    public Task<List<UserTypeDto>> ListUserTypesAsync(CancellationToken ct)
+        => CallAsync<List<UserTypeDto>>("user", "listUserTypes", new { }, null, ct);
+
    public Task<List<SessionDto>> GetUserSessionsAsync(string bearerToken, CancellationToken ct)
        => CallAsync<List<SessionDto>>("user", "getUserSessions", new { }, bearerToken, ct);

@@ -103,6 +112,23 @@ public sealed class AuthHexClient : IAuthHexClient
    public Task<AuthHexSessionResult> VerifyAltOtpAsync(VerifyAltOtpRequest request, CancellationToken ct)
        => CallAsync<AuthHexSessionResult>("alt", "VerifyOTP", request, null, ct);

+    // ---- RoleManager --------------------------------------------------
+
+    public Task<AuthHexRoleDto> CreateRoleAsync(CreateAuthHexRoleRequest request, CancellationToken ct)
+        => CallAsync<AuthHexRoleDto>("role", "createRole", request, null, ct);
+
+    public Task<List<AuthHexRoleDto>> ListRolesAsync(CancellationToken ct)
+        => CallAsync<List<AuthHexRoleDto>>("role", "listRoles", new { }, null, ct);
+
+    public Task<AuthHexRoleDto> GetRoleAsync(Guid roleId, CancellationToken ct)
+        => CallAsync<AuthHexRoleDto>("role", "getRole", new { roleId }, null, ct);
+
+    public Task<AuthHexRoleDto> UpdateRoleAsync(UpdateAuthHexRoleRequest request, CancellationToken ct)
+        => CallAsync<AuthHexRoleDto>("role", "updateRole", request, null, ct);
+
+    public Task DeleteRoleAsync(Guid roleId, CancellationToken ct)
+        => CallVoidAsync("role", "deleteRole", new { roleId }, null, ct);
+
    // ---- Transport --------------------------------------------------------

    private async Task CallVoidAsync(string routeGroup, string functionName, object payload, string? bearerToken, CancellationToken ct)
@@ -16,6 +16,7 @@ public interface IAuthHexClient
    Task<AuthHexSessionResult> VerifyOtpForLoginAsync(VerifyOtpForLoginRequest request, CancellationToken ct);
    Task<AuthHexSessionResult> RefreshTokenAsync(string refreshToken, string? deviceName, CancellationToken ct);
    Task<GetUserDetailsResponse> GetUserDetailsAsync(Guid userId, CancellationToken ct);
+    Task<List<UserTypeDto>> ListUserTypesAsync(CancellationToken ct);
    Task<List<SessionDto>> GetUserSessionsAsync(string bearerToken, CancellationToken ct);
    Task ChangeUserStatusAsync(bool isActive, string bearerToken, CancellationToken ct);
    Task LockUserAccountAsync(bool isLocked, string bearerToken, CancellationToken ct);
@@ -39,4 +40,12 @@ public interface IAuthHexClient
    Task<IsAvailableResponse> IsAvailableAsync(IsAvailableRequest request, CancellationToken ct);
    Task<SendOtpResponse> SendOtpAsync(SendOtpRequest request, CancellationToken ct);
    Task<AuthHexSessionResult> VerifyAltOtpAsync(VerifyAltOtpRequest request, CancellationToken ct);
+
+    // RoleManager (POST /api/role) — AuthHex is the source of truth for Role;
+    // ERPCore mirrors the result into a local shadow Role row (see RoleService).
+    Task<AuthHexRoleDto> CreateRoleAsync(CreateAuthHexRoleRequest request, CancellationToken ct);
+    Task<List<AuthHexRoleDto>> ListRolesAsync(CancellationToken ct);
+    Task<AuthHexRoleDto> GetRoleAsync(Guid roleId, CancellationToken ct);
+    Task<AuthHexRoleDto> UpdateRoleAsync(UpdateAuthHexRoleRequest request, CancellationToken ct);
+    Task DeleteRoleAsync(Guid roleId, CancellationToken ct);
 }
@@ -0,0 +1,30 @@
+using ERPCore.Domain.Entities;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ERPCore.Infra.Persistence.Configurations;
+
+public sealed class AttendanceRecordConfiguration : IEntityTypeConfiguration<AttendanceRecord>
+{
+    public void Configure(EntityTypeBuilder<AttendanceRecord> builder)
+    {
+        builder.ToTable("hr_attendance_records");
+        builder.HasKey(r => r.AttendanceRecordId);
+
+        builder.Property(r => r.Notes).HasMaxLength(1000);
+        builder.Property(r => r.AttendanceStatus).HasConversion<string>().HasMaxLength(20).IsRequired();
+        builder.Property(r => r.RowValidationStatus).HasConversion<string>().HasMaxLength(20).IsRequired();
+
+        builder.HasOne(r => r.AttendanceUploadBatch).WithMany()
+            .HasForeignKey(r => r.AttendanceUploadBatchId).OnDelete(DeleteBehavior.Cascade);
+        builder.HasOne(r => r.Employee).WithMany()
+            .HasForeignKey(r => r.EmployeeId).OnDelete(DeleteBehavior.Restrict);
+        builder.HasOne(r => r.WorkShift).WithMany()
+            .HasForeignKey(r => r.WorkShiftId).OnDelete(DeleteBehavior.Restrict);
+
+        builder.Property(r => r.RowVersion).IsRowVersion();
+
+        builder.HasIndex(r => new { r.EmployeeId, r.AttendanceDate });
+        builder.HasIndex(r => r.AttendanceUploadBatchId);
+    }
+}
@@ -0,0 +1,27 @@
+using ERPCore.Domain.Entities;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ERPCore.Infra.Persistence.Configurations;
+
+public sealed class AttendanceUploadBatchConfiguration : IEntityTypeConfiguration<AttendanceUploadBatch>
+{
+    public void Configure(EntityTypeBuilder<AttendanceUploadBatch> builder)
+    {
+        builder.ToTable("hr_attendance_upload_batches");
+        builder.HasKey(b => b.AttendanceUploadBatchId);
+
+        builder.Property(b => b.DocNo).IsRequired().HasMaxLength(30);
+        builder.HasIndex(b => b.DocNo).IsUnique();
+        builder.Property(b => b.OriginalFileName).HasMaxLength(260);
+
+        builder.Property(b => b.SourceType).HasConversion<string>().HasMaxLength(20).IsRequired();
+        builder.Property(b => b.Status).HasConversion<string>().HasMaxLength(20).IsRequired();
+
+        builder.Property(b => b.UploadedAt).IsRequired();
+        builder.Property(b => b.RowVersion).IsRowVersion();
+
+        builder.HasIndex(b => b.Status);
+        builder.HasIndex(b => new { b.PeriodStart, b.PeriodEnd });
+    }
+}
@@ -0,0 +1,29 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ERPCore.Infra.Persistence.Configurations;
+
+public sealed class BranchConfiguration : IEntityTypeConfiguration<Branch>
+{
+    public void Configure(EntityTypeBuilder<Branch> builder)
+    {
+        builder.ToTable("hr_branches");
+        builder.HasKey(b => b.BranchId);
+
+        builder.Property(b => b.Code).IsRequired().HasMaxLength(20);
+        builder.HasIndex(b => b.Code).IsUnique();
+        builder.Property(b => b.Name).IsRequired().HasMaxLength(200);
+        builder.Property(b => b.Address).HasMaxLength(500);
+
+        builder.Property(b => b.Status)
+            .HasConversion<string>().HasMaxLength(20).IsRequired()
+            .HasDefaultValue(EntityStatus.Active);
+
+        builder.Property(b => b.CreatedAt).IsRequired();
+        builder.Property(b => b.RowVersion).IsRowVersion();
+
+        builder.HasIndex(b => b.Status);
+    }
+}
@@ -0,0 +1,40 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ERPCore.Infra.Persistence.Configurations;
+
+public sealed class DepartmentConfiguration : IEntityTypeConfiguration<Department>
+{
+    public void Configure(EntityTypeBuilder<Department> builder)
+    {
+        builder.ToTable("hr_departments");
+        builder.HasKey(d => d.DepartmentId);
+
+        builder.Property(d => d.Code).IsRequired().HasMaxLength(20);
+        builder.HasIndex(d => d.Code).IsUnique();
+        builder.Property(d => d.Name).IsRequired().HasMaxLength(200);
+
+        builder.Property(d => d.Status)
+            .HasConversion<string>().HasMaxLength(20).IsRequired()
+            .HasDefaultValue(EntityStatus.Active);
+
+        // Self-nesting (unlimited depth, unlike Category) — cycle prevention is
+        // service-level, not a DB constraint (docs/12-BACKEND-HRM.md A.1/C.1).
+        builder.HasOne(d => d.ParentDepartment).WithMany()
+            .HasForeignKey(d => d.ParentDepartmentId).OnDelete(DeleteBehavior.Restrict);
+
+        builder.HasOne(d => d.HeadEmployee).WithMany()
+            .HasForeignKey(d => d.HeadEmployeeId).OnDelete(DeleteBehavior.Restrict);
+
+        builder.HasOne(d => d.Branch).WithMany()
+            .HasForeignKey(d => d.BranchId).OnDelete(DeleteBehavior.Restrict);
+
+        builder.Property(d => d.CreatedAt).IsRequired();
+        builder.Property(d => d.RowVersion).IsRowVersion();
+
+        builder.HasIndex(d => d.Status);
+        builder.HasIndex(d => d.ParentDepartmentId);
+    }
+}
@@ -0,0 +1,28 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ERPCore.Infra.Persistence.Configurations;
+
+public sealed class DesignationConfiguration : IEntityTypeConfiguration<Designation>
+{
+    public void Configure(EntityTypeBuilder<Designation> builder)
+    {
+        builder.ToTable("hr_designations");
+        builder.HasKey(d => d.DesignationId);
+
+        builder.Property(d => d.Code).IsRequired().HasMaxLength(20);
+        builder.HasIndex(d => d.Code).IsUnique();
+        builder.Property(d => d.Name).IsRequired().HasMaxLength(200);
+
+        builder.Property(d => d.Status)
+            .HasConversion<string>().HasMaxLength(20).IsRequired()
+            .HasDefaultValue(EntityStatus.Active);
+
+        builder.Property(d => d.CreatedAt).IsRequired();
+        builder.Property(d => d.RowVersion).IsRowVersion();
+
+        builder.HasIndex(d => d.Status);
+    }
+}
@@ -0,0 +1,33 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
+
+namespace ERPCore.Infra.Persistence.Configurations;
+
+public sealed class EmployeeBankDetailConfiguration : IEntityTypeConfiguration<EmployeeBankDetail>
+{
+    public void Configure(EntityTypeBuilder<EmployeeBankDetail> builder)
+    {
+        builder.ToTable("hr_employee_bank_details");
+        builder.HasKey(b => b.EmployeeBankDetailId);
+
+        builder.Property(b => b.BankName).IsRequired().HasMaxLength(200);
+        builder.Property(b => b.BranchName).IsRequired().HasMaxLength(200);
+        builder.Property(b => b.AccountNumber).IsRequired().HasMaxLength(50);
+        builder.Property(b => b.AccountHolderName).IsRequired().HasMaxLength(200);
+        builder.Property(b => b.SwiftCode).HasMaxLength(20);
+
+        builder.Property(b => b.Status)
+            .HasConversion<string>().HasMaxLength(20).IsRequired()
+            .HasDefaultValue(EntityStatus.Active);
+
+        builder.HasOne(b => b.Employee).WithMany()
+            .HasForeignKey(b => b.EmployeeId).OnDelete(DeleteBehavior.Cascade);
+
+        builder.Property(b => b.CreatedAt).IsRequired();
+        builder.Property(b => b.RowVersion).IsRowVersion();
+
+        builder.HasIndex(b => b.EmployeeId);
+    }
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Sasanka	4561ef7ba8	feat: implement frontend-only mock for production lines and runs - Add ProductionTemplatesPage component for managing production templates with a visual representation using React Flow. - Create LineHeaderNode and LineStageNode components for rendering production line nodes. - Introduce RunStageNode and RunHeaderNode components for displaying run stages and headers. - Implement StageProgressStrip for visualizing stage progress in runs. - Create mock data for production runs and templates to simulate backend functionality. - Define types for production templates and runs to structure mock data. - Document frontend Phase 2 specifications for manufacturing processes, including screens, dialogs, and validation posture.	2026-07-28 22:55:56 +05:30
Sasanka	b12adebaa0	feat: add dashboard overview stats endpoint and UI integration - Implemented `GET /dashboard/stats` in `DashboardController` to provide aggregate counts for stock, GRN, and procurement. - Created `DashboardStatsDto` and `WarehouseValuationDto` to structure the response data. - Developed `DashboardService` to fetch and compute necessary statistics from the database. - Added `IDashboardService` interface for service abstraction. - Introduced API client methods in `dashboard.ts` for frontend consumption of the new endpoint. - Defined TypeScript types for dashboard data in `dashboard.ts` to ensure type safety in the frontend. - Updated UI components in the frontend to reflect changes in the dashboard, including styling adjustments and removal of unused icons.	2026-07-28 14:59:09 +05:30
ImanThiyanga	0b95d6f1cd	Merge pull request 'feat: enhance UI components and add vibrant theme support' (#17 ) from ui-fixers into Dev Reviewed-on: #17	2026-07-27 06:10:10 +00:00
ImanThiyanga	d35b076435	Merge branch 'Dev' into ui-fixers	2026-07-27 06:10:00 +00:00
Sasanka	c564916c60	feat: enhance UI components and add vibrant theme support - Updated layout and styling for various dashboard pages including stock adjustments, counts, transfers, wastage, and vendors to improve responsiveness and visual consistency. - Introduced a vibrant theme option in the theme toggle component, allowing users to switch between light, dark, and vibrant themes. - Refactored button styles across login and forgot password pages for better accessibility and visual feedback. - Improved sidebar navigation with expanded functionality for items without dedicated pages. - Enhanced data table styling for better readability and user interaction. - Added new background images to support the vibrant theme.	2026-07-27 11:11:26 +05:30
Dhananjaya99	86bb4d4908	Merge branch 'Dev' of https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core into Dev	2026-07-24 14:33:55 +05:30
Dhananjaya99	816ffbbfb6	setting not found issue	2026-07-24 14:33:49 +05:30
ashan_rusiru	ae20bc4e34	Merge pull request 'develop full initial module' (#16 ) from Feature_HRM into Dev Reviewed-on: #16	2026-07-24 05:25:13 +00:00
Dhananjaya99	755df494fe	develop full initial module	2026-07-23 19:54:56 +05:30
Dhananjaya99	eacc21afad	Merge branch 'fixers-7/23' into Dev	2026-07-23 13:02:24 +05:30
Sasanka	7366ca93c0	feat: implement theme toggle and enhance UI components	2026-07-23 12:53:26 +05:30
ImanThiyanga	5af77fbf0a	Merge pull request 'feat: Implement fixed sale price functionality for items' (#14 ) from fix/grn-varient into Dev Reviewed-on: #14	2026-07-23 06:48:46 +00:00
ImanThiyanga	a1b3985469	feat: Implement fixed sale price functionality for items - Added a toggle for fixed sale price vs stock value in the item creation form. - Introduced validation to ensure all variants have a price greater than 0 when fixed price mode is selected. - Updated the item model to include a nullable salePrice field, which is used for sales only and does not affect GRN/FIFO/ledger. - Enhanced the GRN page to allow off-PO items and included a refresh button to update the item list without reloading the page. - Updated documentation to reflect changes in item pricing and GRN handling.	2026-07-23 12:12:32 +05:30
ImanThiyanga	5cf9588728	role code error fixed	2026-07-22 16:14:49 +05:30
ImanThiyanga	9260b4de9b	Merge branch 'production' into Dev	2026-07-22 06:12:28 +00:00
ImanThiyanga	46e971ef25	Merge pull request 'Feat/po grn' (#12 ) from feat/po-GRN into Dev Reviewed-on: #12	2026-07-21 11:04:58 +00:00
ImanThiyanga	f8b9ee8f6c	Merge branch 'feat/po-GRN' of https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core into feat/po-GRN	2026-07-21 16:27:05 +05:30
ImanThiyanga	4108062416	ui fixes	2026-07-21 16:26:32 +05:30
ImanThiyanga	03bc85b788	feat(procurement): enhance purchase order and GRN functionalities - Updated purchase order descriptions for clarity on draft and submission processes. - Implemented submit and delete functionalities for draft purchase orders, allowing users to manage their orders more effectively. - Added discount and VAT fields to GRN lines, enabling better cost tracking and reporting. - Enhanced validation for GRN lines to ensure discount and VAT percentages are within acceptable ranges. - Updated API to support new functionalities, including submitting and deleting purchase orders. - Improved UI components for better user experience in managing purchase orders and GRNs. - Documented changes in security and backend phase documentation to reflect new processes and requirements.	2026-07-21 16:26:32 +05:30
ImanThiyanga	9158cd8c82	ui fixes	2026-07-21 11:55:40 +05:30
ImanThiyanga	951961b798	Merge pull request 'feat: enhance product management features' (#11 ) from products-fixers into Dev Reviewed-on: #11	2026-07-21 04:40:18 +00:00
ImanThiyanga	f02c89b3cb	feat(procurement): enhance purchase order and GRN functionalities - Updated purchase order descriptions for clarity on draft and submission processes. - Implemented submit and delete functionalities for draft purchase orders, allowing users to manage their orders more effectively. - Added discount and VAT fields to GRN lines, enabling better cost tracking and reporting. - Enhanced validation for GRN lines to ensure discount and VAT percentages are within acceptable ranges. - Updated API to support new functionalities, including submitting and deleting purchase orders. - Improved UI components for better user experience in managing purchase orders and GRNs. - Documented changes in security and backend phase documentation to reflect new processes and requirements.	2026-07-21 10:08:32 +05:30
Sasanka	295ec5799f	feat: enhance product management features - Implement sorting and filtering for categories in the dashboard. - Add status filtering and sorting capabilities for categories. - Introduce warehouse selection and base UOM configuration in the new item creation page. - Fetch and display brands and subcategories in the items page. - Update product settings to manage subcategories and brands. - Refactor sidebar navigation to include configuration options.	2026-07-20 17:11:13 +05:30
ImanThiyanga	fe9e8a780f	ui updated	2026-07-20 12:00:03 +05:30
Dhananjaya99	92c4b14a6c	add rbac	2026-07-18 23:42:58 +05:30
ashan_rusiru	80b130dffb	Merge pull request 'Feat/be inventory' (#10 ) from feat/be-inventory into Dev Reviewed-on: #10	2026-07-18 08:38:47 +00:00
ImanThiyanga	baaf51ba99	Merge pull request 'Dev' (#7 ) from Dev into production Reviewed-on: #7	2026-07-15 10:08:07 +00:00