@open-mercato/core 0.10.1-develop.7716.1.cefe7975df → 0.10.1-develop.7721.1.b5c4a00a68

package/dist/modules/staff/api/timesheets/tasks/[id]/comments/route.js

@@ -17,7 +17,7 @@ import { User } from "@open-mercato/core/modules/auth/data/entities";
 import { StaffTimeTaskComment } from "../../../../../data/entities.js";
 import {
   staffTimeTaskCommentCreateSchema,
-  staffTimeTaskCommentUpdateSchema
+  staffTimeTaskCommentUpdateRequestSchema
 } from "../../../../../data/validators.js";
 import { staffTimeTaskCommentCommandIds } from "../../../../../commands/timesheets-task-comments.js";
 import { STAFF_TIME_TRACKING_RESOURCE_KINDS } from "../../../../guards.js";
@@ -46,6 +46,8 @@ const commentItemSchema = z.object({
   authorUserId: z.string().uuid().nullable(),
   authorName: z.string().nullable(),
   authorEmail: z.string().nullable(),
+  visibility: z.enum(["internal", "customer"]),
+  authorKind: z.enum(["staff", "customer"]),
   createdAt: z.string().nullable(),
   updatedAt: z.string().nullable()
 });
@@ -62,8 +64,16 @@ const createResponseSchema = z.object({
   authorUserId: z.string().uuid().nullable()
 });
 const okResponseSchema = z.object({ ok: z.boolean() });
-const createBodySchema = z.object({ body: z.string().trim().min(1).max(5e3) });
-const updateBodySchema = z.object({ id: z.string().uuid(), body: z.string().trim().min(1).max(5e3) });
+const visibilitySchema = z.enum(["internal", "customer"]);
+const createBodySchema = z.object({
+  body: z.string().trim().min(1).max(5e3),
+  visibility: visibilitySchema.optional()
+});
+const updateBodySchema = z.object({
+  id: z.string().uuid(),
+  body: z.string().trim().min(1).max(5e3).optional(),
+  visibility: visibilitySchema.optional()
+});
 function extractTaskId(req) {
   try {
     const match = new URL(req.url).pathname.match(/\/tasks\/([^/]+)\/comments/);
@@ -150,13 +160,17 @@ async function resolveAuthorMeta(route, authorUserIds) {
 function serializeComment(comment, authors) {
   const authorUserId = comment.authorUserId ?? null;
   const meta = authorUserId ? authors.get(authorUserId) ?? null : null;
+  const authorKind = comment.authorKind === "customer" ? "customer" : "staff";
+  const customerName = comment.authorDisplaySnapshot?.displayName ?? null;
   return {
     id: comment.id,
     taskId: comment.taskId,
     body: comment.body,
     authorUserId,
-    authorName: meta?.name ?? null,
-    authorEmail: meta?.email ?? null,
+    authorName: authorKind === "customer" ? customerName : meta?.name ?? null,
+    authorEmail: authorKind === "customer" ? null : meta?.email ?? null,
+    visibility: comment.visibility === "customer" ? "customer" : "internal",
+    authorKind,
     createdAt: comment.createdAt ? comment.createdAt.toISOString() : null,
     updatedAt: comment.updatedAt ? comment.updatedAt.toISOString() : null
   };
@@ -256,7 +270,7 @@ async function POST(req) {
     const parsedBody = createBodySchema.parse(raw ?? {});
     const input = parseScopedCommandInput(
       staffTimeTaskCommentCreateSchema,
-      { taskId: route.taskId, body: parsedBody.body },
+      { taskId: route.taskId, body: parsedBody.body, visibility: parsedBody.visibility ?? "internal" },
       route.ctx,
       route.translate
     );
@@ -289,7 +303,11 @@ async function PUT(req) {
     const raw = await readJsonSafe(req, {});
     const parsedBody = updateBodySchema.parse(raw ?? {});
     await requireCommentOnTask(route, parsedBody.id);
-    const input = staffTimeTaskCommentUpdateSchema.parse({ id: parsedBody.id, body: parsedBody.body });
+    const input = staffTimeTaskCommentUpdateRequestSchema.parse({
+      id: parsedBody.id,
+      body: parsedBody.body,
+      visibility: parsedBody.visibility
+    });
     const guardResult = await runGuards(route, "update", input.id, input);
     if (!guardResult.ok) return guardResult.response;
     const commandBus = route.ctx.container.resolve("commandBus");

package/dist/modules/staff/api/timesheets/tasks/[id]/comments/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/staff/api/timesheets/tasks/%5Bid%5D/comments/route.ts"],
-  "sourcesContent": ["/**\n * Task comments (T3.4b) \u2014 the \"Komentarze (2)\" thread in the task drawer of\n * screen 7: avatar, author name, timestamp, body, and a composer that posts on\n * \u2318\u21B5.\n *\n * Hand-written rather than `makeCrudRoute`, for one reason that decides\n * everything else: **a caller who cannot see the task's project must not be able\n * to tell that the task exists.** A CRUD list would answer such a request with\n * an empty page \u2014 which is a different response from \"no such task\" and\n * therefore an existence oracle for every task id in the tenant. Here every\n * method funnels through the same `requireAccessibleTask` call before it touches\n * a comment, so \"not yours\" and \"does not exist\" produce one and the same 404\n * body, byte for byte.\n *\n * Because the route is hand-written it wires `runRouteMutationGuards` itself\n * (`packages/core/AGENTS.md` \u00A7 API Routes) \u2014 the same guard set every\n * `makeCrudRoute` write runs \u2014 and the writes go through the task-comment\n * commands so audit, undo, events and indexing stay consistent.\n *\n * Two more things the thread depends on:\n *\n *  - **Oldest first.** Screen 7 reads as a conversation, so the list sorts by\n *    `created_at ASC` with an id tiebreak, not the newest-first default a grid\n *    would want.\n *  - **The author's display name is resolved for rendering**, reusing the same\n *    `User` lookup `api/comments.ts` uses for the team-member timeline rather\n *    than inventing a cross-module join. A name that cannot be resolved degrades\n *    to `null` and the thread still renders \u2014 the comment is the record, the\n *    name is decoration.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { StaffTimeTaskComment } from '../../../../../data/entities'\nimport {\n  staffTimeTaskCommentCreateSchema,\n  staffTimeTaskCommentUpdateSchema,\n} from '../../../../../data/validators'\nimport { staffTimeTaskCommentCommandIds } from '../../../../../commands/timesheets-task-comments'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport {\n  loadTagProjectAccess as loadTaskProjectAccess,\n  requireAccessibleTask,\n  type TagAssignmentScope as TaskAccessScope,\n} from '../../../tags/access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/comments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTaskComment\n\nconst VIEW_FEATURE = 'staff.timesheets.tasks.view'\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  DELETE: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n})\n\nconst commentItemSchema = z.object({\n  id: z.string().uuid(),\n  taskId: z.string().uuid(),\n  body: z.string(),\n  authorUserId: z.string().uuid().nullable(),\n  authorName: z.string().nullable(),\n  authorEmail: z.string().nullable(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst listResponseSchema = z.object({\n  items: z.array(commentItemSchema),\n  total: z.number().int(),\n  page: z.number().int(),\n  pageSize: z.number().int(),\n  totalPages: z.number().int(),\n})\n\nconst createResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n  taskId: z.string().uuid(),\n  authorUserId: z.string().uuid().nullable(),\n})\n\nconst okResponseSchema = z.object({ ok: z.boolean() })\n\nconst createBodySchema = z.object({ body: z.string().trim().min(1).max(5000) })\nconst updateBodySchema = z.object({ id: z.string().uuid(), body: z.string().trim().min(1).max(5000) })\n\ntype RouteContext = {\n  ctx: CommandRuntimeContext\n  scope: TaskAccessScope\n  translate: (key: string, fallback?: string) => string\n  taskId: string\n}\n\n/**\n * The task id comes from the path segment. Read from the URL rather than the\n * handler's `params` argument so the route behaves identically under the app's\n * catch-all dispatcher and under a direct call in tests.\n */\nfunction extractTaskId(req: Request): string | null {\n  try {\n    const match = new URL(req.url).pathname.match(/\\/tasks\\/([^/]+)\\/comments/)\n    const id = match?.[1] ? decodeURIComponent(match[1]) : null\n    return id && id.length > 0 ? id : null\n  } catch {\n    return null\n  }\n}\n\nasync function buildRouteContext(req: Request): Promise<RouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? auth.orgId ?? null\n  const userId = auth.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const taskId = extractTaskId(req)\n  if (!taskId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.taskComments.errors.taskIdRequired', 'Task id is required.'),\n    })\n  }\n\n  return { ctx, scope: { tenantId, organizationId, userId }, translate, taskId }\n}\n\n/**\n * The single gate every method passes through. Resolving project access before\n * the task is loaded \u2014 and answering both misses with one body \u2014 is what keeps\n * the endpoint from confirming that a task the caller may not see exists.\n */\nasync function requireTaskAccess(route: RouteContext): Promise<void> {\n  const access = await loadTaskProjectAccess(route.ctx.container, route.scope)\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, route.taskId, route.scope, access, route.translate)\n}\n\nfunction commentNotFoundError(translate: (key: string, fallback?: string) => string): CrudHttpError {\n  return new CrudHttpError(404, {\n    error: translate('staff.time_tracking.taskComments.errors.notFound', 'Comment not found or not accessible.'),\n  })\n}\n\n/**\n * A comment addressed through another task's URL is refused exactly like a\n * comment that does not exist, so the path segment cannot be swapped to reach a\n * thread the caller has no route to.\n */\nasync function requireCommentOnTask(route: RouteContext, commentId: string): Promise<StaffTimeTaskComment> {\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  const comment = await em.findOne(StaffTimeTaskComment, {\n    id: commentId,\n    taskId: route.taskId,\n    tenantId: route.scope.tenantId,\n    organizationId: route.scope.organizationId,\n    deletedAt: null,\n  })\n  if (!comment) throw commentNotFoundError(route.translate)\n  return comment\n}\n\ntype AuthorMeta = { name: string | null; email: string | null }\n\nasync function resolveAuthorMeta(\n  route: RouteContext,\n  authorUserIds: string[],\n): Promise<Map<string, AuthorMeta>> {\n  const map = new Map<string, AuthorMeta>()\n  const unique = Array.from(new Set(authorUserIds))\n  if (unique.length === 0) return map\n  try {\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const users = await findWithDecryption(\n      em,\n      User,\n      { id: { $in: unique } },\n      undefined,\n      { tenantId: route.scope.tenantId, organizationId: route.scope.organizationId },\n    )\n    for (const user of users) {\n      const name = typeof user.name === 'string' && user.name.trim().length > 0 ? user.name.trim() : null\n      map.set(user.id, { name, email: user.email ?? null })\n    }\n  } catch (err) {\n    // A thread that renders without display names is still a usable thread.\n    logger.warn('staff.timesheets.task comments failed to resolve author metadata', { err })\n  }\n  return map\n}\n\nfunction serializeComment(comment: StaffTimeTaskComment, authors: Map<string, AuthorMeta>) {\n  const authorUserId = comment.authorUserId ?? null\n  const meta = authorUserId ? authors.get(authorUserId) ?? null : null\n  return {\n    id: comment.id,\n    taskId: comment.taskId,\n    body: comment.body,\n    authorUserId,\n    authorName: meta?.name ?? null,\n    authorEmail: meta?.email ?? null,\n    createdAt: comment.createdAt ? comment.createdAt.toISOString() : null,\n    updatedAt: comment.updatedAt ? comment.updatedAt.toISOString() : null,\n  }\n}\n\nasync function runGuards(\n  route: RouteContext,\n  operation: 'create' | 'update' | 'delete',\n  resourceId: string | null,\n  mutationPayload: Record<string, unknown> | null,\n) {\n  return runRouteMutationGuards({\n    container: route.ctx.container,\n    req: route.ctx.request as Request,\n    auth: {\n      userId: route.scope.userId,\n      tenantId: route.scope.tenantId,\n      organizationId: route.scope.organizationId,\n    },\n    input: {\n      resourceKind: RESOURCE_KIND,\n      resourceId,\n      operation,\n      mutationPayload,\n    },\n  })\n}\n\nfunction withOperationHeader(\n  response: NextResponse,\n  logEntry: {\n    id?: string\n    undoToken?: string | null\n    commandId?: string\n    actionLabel?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n    createdAt?: Date | string | null\n  } | null | undefined,\n  fallbackResourceId: string,\n): NextResponse {\n  if (!logEntry?.undoToken || !logEntry.id || !logEntry.commandId) return response\n  response.headers.set(\n    'x-om-operation',\n    serializeOperationMetadata({\n      id: logEntry.id,\n      undoToken: logEntry.undoToken,\n      commandId: logEntry.commandId,\n      actionLabel: logEntry.actionLabel ?? null,\n      resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n      resourceId: logEntry.resourceId ?? fallbackResourceId,\n      executedAt:\n        logEntry.createdAt instanceof Date\n          ? logEntry.createdAt.toISOString()\n          : typeof logEntry.createdAt === 'string'\n            ? logEntry.createdAt\n            : new Date().toISOString(),\n    }),\n  )\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function GET(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const query = listQuerySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n    })\n\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const [comments, total] = await em.findAndCount(\n      StaffTimeTaskComment,\n      {\n        taskId: route.taskId,\n        tenantId: route.scope.tenantId,\n        organizationId: route.scope.organizationId,\n        deletedAt: null,\n      },\n      {\n        // Oldest first \u2014 the drawer reads the thread top to bottom.\n        orderBy: { createdAt: 'asc', id: 'asc' },\n        limit: query.pageSize,\n        offset: (query.page - 1) * query.pageSize,\n      },\n    )\n\n    const authors = await resolveAuthorMeta(\n      route,\n      comments.map((comment) => comment.authorUserId).filter((id): id is string => typeof id === 'string'),\n    )\n\n    return NextResponse.json({\n      items: comments.map((comment) => serializeComment(comment, authors)),\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: query.pageSize > 0 ? Math.ceil(total / query.pageSize) : 0,\n    })\n  } catch (err) {\n    return errorResponse(err, 'staff.timesheets.tasks.comments.GET failed')\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = createBodySchema.parse(raw ?? {})\n    // `authorUserId` is never forwarded: whatever the client sent is dropped\n    // here and the command stamps the authenticated caller instead.\n    const input = parseScopedCommandInput(\n      staffTimeTaskCommentCreateSchema,\n      { taskId: route.taskId, body: parsedBody.body },\n      route.ctx,\n      route.translate,\n    )\n\n    const guardResult = await runGuards(route, 'create', route.taskId, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      typeof input,\n      { commentId: string; taskId: string; authorUserId: string | null }\n    >(staffTimeTaskCommentCommandIds.create, { input, ctx: route.ctx })\n\n    await guardResult.runAfterSuccess()\n\n    const response = NextResponse.json(\n      {\n        id: result?.commentId ?? null,\n        taskId: route.taskId,\n        authorUserId: result?.authorUserId ?? null,\n      },\n      { status: 201 },\n    )\n    return withOperationHeader(response, logEntry, result?.commentId ?? route.taskId)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.POST failed')\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = updateBodySchema.parse(raw ?? {})\n    await requireCommentOnTask(route, parsedBody.id)\n\n    const input = staffTimeTaskCommentUpdateSchema.parse({ id: parsedBody.id, body: parsedBody.body })\n\n    const guardResult = await runGuards(route, 'update', input.id, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<typeof input, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.update,\n      { input, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, input.id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.PUT failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const raw = await readJsonSafe(req, {})\n    const rawId = url.searchParams.get('id') ?? (raw as { id?: unknown } | null)?.id\n    const id = z.string().uuid().parse(typeof rawId === 'string' ? rawId : undefined)\n    await requireCommentOnTask(route, id)\n\n    const guardResult = await runGuards(route, 'delete', id, { id })\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<{ id: string }, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.delete,\n      { input: { id }, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task comments',\n  methods: {\n    GET: {\n      summary: 'List task comments',\n      description:\n        'Returns the task comment thread oldest-first, with the author display name resolved for rendering. Answers 404 \u2014 identical to a task that does not exist \u2014 when the task belongs to a project the caller cannot see.',\n      query: listQuerySchema,\n      responses: [{ status: 200, description: 'Comment thread', schema: listResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.view' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    POST: {\n      summary: 'Post a task comment',\n      description:\n        'Adds a comment to the task. The author is stamped from the authenticated caller \u2014 an authorUserId supplied by the client is ignored.',\n      requestBody: { contentType: 'application/json', schema: createBodySchema },\n      responses: [{ status: 201, description: 'Comment created', schema: createResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    PUT: {\n      summary: 'Edit a task comment',\n      description:\n        'Updates a comment body. Only the comment author may edit, unless the caller holds staff.timesheets.manage_all. Honours the optimistic-lock header.',\n      requestBody: { contentType: 'application/json', schema: updateBodySchema },\n      responses: [{ status: 200, description: 'Comment updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete a task comment',\n      description:\n        'Soft-deletes a comment so its audit trail survives. Only the comment author may delete, unless the caller holds staff.timesheets.manage_all.',\n      requestBody: { contentType: 'application/json', schema: z.object({ id: z.string().uuid() }) },\n      responses: [{ status: 200, description: 'Comment deleted', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing comment id, task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AA8BA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,YAAY;AACrB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,0CAA0C;AACnD;AAAA,EACE,wBAAwB;AAAA,EACxB;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,gBAAgB,mCAAmC;AAEzD,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAAA,EAC1D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC7D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC5D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AACxD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,MAAM,EAAE,OAAO;AAAA,EACf,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,IAAI;AAC7B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAErD,MAAM,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAC9E,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,CAAC;AAcrG,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,MAAM,4BAA4B;AAC1E,UAAM,KAAK,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACvD,WAAO,MAAM,GAAG,SAAS,IAAI,KAAK;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBAAkB,KAAqC;AACpE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,IACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E,SAAS;AAAA,EACX;AAEA,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,IAAI,0BAA0B,KAAK,SAAS;AACnE,QAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,0DAA0D,sBAAsB;AAAA,IACnG,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,KAAK,OAAO,EAAE,UAAU,gBAAgB,OAAO,GAAG,WAAW,OAAO;AAC/E;AAOA,eAAe,kBAAkB,OAAoC;AACnE,QAAM,SAAS,MAAM,sBAAsB,MAAM,IAAI,WAAW,MAAM,KAAK;AAC3E,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,sBAAsB,IAAI,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM,SAAS;AACpF;AAEA,SAAS,qBAAqB,WAAsE;AAClG,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO,UAAU,oDAAoD,sCAAsC;AAAA,EAC7G,CAAC;AACH;AAOA,eAAe,qBAAqB,OAAqB,WAAkD;AACzG,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,UAAU,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACrD,IAAI;AAAA,IACJ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,qBAAqB,MAAM,SAAS;AACxD,SAAO;AACT;AAIA,eAAe,kBACb,OACA,eACkC;AAClC,QAAM,MAAM,oBAAI,IAAwB;AACxC,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC;AAChD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC/E;AACA,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI;AAC/F,UAAI,IAAI,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,SAAS,KAAK,CAAC;AAAA,IACtD;AAAA,EACF,SAAS,KAAK;AAEZ,WAAO,KAAK,oEAAoE,EAAE,IAAI,CAAC;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA+B,SAAkC;AACzF,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,OAAO,eAAe,QAAQ,IAAI,YAAY,KAAK,OAAO;AAChE,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB,MAAM,QAAQ;AAAA,IACd;AAAA,IACA,YAAY,MAAM,QAAQ;AAAA,IAC1B,aAAa,MAAM,SAAS;AAAA,IAC5B,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,IACjE,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,EACnE;AACF;AAEA,eAAe,UACb,OACA,WACA,YACA,iBACA;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,MAAM,IAAI;AAAA,IACrB,KAAK,MAAM,IAAI;AAAA,IACf,MAAM;AAAA,MACJ,QAAQ,MAAM,MAAM;AAAA,MACpB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,oBACP,UACA,UASA,oBACc;AACd,MAAI,CAAC,UAAU,aAAa,CAAC,SAAS,MAAM,CAAC,SAAS,UAAW,QAAO;AACxE,WAAS,QAAQ;AAAA,IACf;AAAA,IACA,2BAA2B;AAAA,MACzB,IAAI,SAAS;AAAA,MACb,WAAW,SAAS;AAAA,MACpB,WAAW,SAAS;AAAA,MACpB,aAAa,SAAS,eAAe;AAAA,MACrC,cAAc,SAAS,gBAAgB;AAAA,MACvC,YAAY,SAAS,cAAc;AAAA,MACnC,YACE,SAAS,qBAAqB,OAC1B,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,gBAAgB,MAAM;AAAA,MAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAChD,CAAC;AAED,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,CAAC,UAAU,KAAK,IAAI,MAAM,GAAG;AAAA,MACjC;AAAA,MACA;AAAA,QACE,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM;AAAA,QAC5B,WAAW;AAAA,MACb;AAAA,MACA;AAAA;AAAA,QAEE,SAAS,EAAE,WAAW,OAAO,IAAI,MAAM;AAAA,QACvC,OAAO,MAAM;AAAA,QACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,MACnC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,SAAS,IAAI,CAAC,YAAY,QAAQ,YAAY,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,IACrG;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,SAAS,IAAI,CAAC,YAAY,iBAAiB,SAAS,OAAO,CAAC;AAAA,MACnE;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM,WAAW,IAAI,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI;AAAA,IACvE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AAGnD,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,QAAQ,MAAM,QAAQ,MAAM,WAAW,KAAK;AAAA,MAC9C,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,QAAQ,KAA2C;AAC9G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,+BAA+B,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAElE,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,aAAa;AAAA,MAC5B;AAAA,QACE,IAAI,QAAQ,aAAa;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,cAAc,QAAQ,gBAAgB;AAAA,MACxC;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,WAAO,oBAAoB,UAAU,UAAU,QAAQ,aAAa,MAAM,MAAM;AAAA,EAClF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,6CAA6C;AAAA,EACzE;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AACnD,UAAM,qBAAqB,OAAO,WAAW,EAAE;AAE/C,UAAM,QAAQ,iCAAiC,MAAM,EAAE,IAAI,WAAW,IAAI,MAAM,WAAW,KAAK,CAAC;AAEjG,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,IAAI,KAA2C;AAC1G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,MAAM,EAAE;AAAA,EAChF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,QAAQ,IAAI,aAAa,IAAI,IAAI,KAAM,KAAiC;AAC9E,UAAM,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,UAAU,WAAW,QAAQ,MAAS;AAChF,UAAM,qBAAqB,OAAO,EAAE;AAEpC,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,IAAI,EAAE,GAAG,CAAC;AAC/D,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,IAAI;AAAA,IAClC;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,EAAE;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,+CAA+C;AAAA,EAC3E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,MAC5F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Task comments (T3.4b) \u2014 the \"Komentarze (2)\" thread in the task drawer of\n * screen 7: avatar, author name, timestamp, body, and a composer that posts on\n * \u2318\u21B5.\n *\n * Hand-written rather than `makeCrudRoute`, for one reason that decides\n * everything else: **a caller who cannot see the task's project must not be able\n * to tell that the task exists.** A CRUD list would answer such a request with\n * an empty page \u2014 which is a different response from \"no such task\" and\n * therefore an existence oracle for every task id in the tenant. Here every\n * method funnels through the same `requireAccessibleTask` call before it touches\n * a comment, so \"not yours\" and \"does not exist\" produce one and the same 404\n * body, byte for byte.\n *\n * Because the route is hand-written it wires `runRouteMutationGuards` itself\n * (`packages/core/AGENTS.md` \u00A7 API Routes) \u2014 the same guard set every\n * `makeCrudRoute` write runs \u2014 and the writes go through the task-comment\n * commands so audit, undo, events and indexing stay consistent.\n *\n * Two more things the thread depends on:\n *\n *  - **Oldest first.** Screen 7 reads as a conversation, so the list sorts by\n *    `created_at ASC` with an id tiebreak, not the newest-first default a grid\n *    would want.\n *  - **The author's display name is resolved for rendering**, reusing the same\n *    `User` lookup `api/comments.ts` uses for the team-member timeline rather\n *    than inventing a cross-module join. A name that cannot be resolved degrades\n *    to `null` and the thread still renders \u2014 the comment is the record, the\n *    name is decoration.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { StaffTimeTaskComment } from '../../../../../data/entities'\nimport {\n  staffTimeTaskCommentCreateSchema,\n  staffTimeTaskCommentUpdateRequestSchema,\n} from '../../../../../data/validators'\nimport { staffTimeTaskCommentCommandIds } from '../../../../../commands/timesheets-task-comments'\nimport { STAFF_TIME_TRACKING_RESOURCE_KINDS } from '../../../../guards'\nimport {\n  loadTagProjectAccess as loadTaskProjectAccess,\n  requireAccessibleTask,\n  type TagAssignmentScope as TaskAccessScope,\n} from '../../../tags/access'\n\nconst logger = createLogger('staff').child({ component: 'api/timesheets/tasks/comments' })\n\nconst RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.timeTaskComment\n\nconst VIEW_FEATURE = 'staff.timesheets.tasks.view'\nconst MANAGE_FEATURE = 'staff.timesheets.tasks.manage'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [VIEW_FEATURE] },\n  POST: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n  DELETE: { requireAuth: true, requireFeatures: [MANAGE_FEATURE] },\n}\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n})\n\nconst commentItemSchema = z.object({\n  id: z.string().uuid(),\n  taskId: z.string().uuid(),\n  body: z.string(),\n  authorUserId: z.string().uuid().nullable(),\n  authorName: z.string().nullable(),\n  authorEmail: z.string().nullable(),\n  visibility: z.enum(['internal', 'customer']),\n  authorKind: z.enum(['staff', 'customer']),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst listResponseSchema = z.object({\n  items: z.array(commentItemSchema),\n  total: z.number().int(),\n  page: z.number().int(),\n  pageSize: z.number().int(),\n  totalPages: z.number().int(),\n})\n\nconst createResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n  taskId: z.string().uuid(),\n  authorUserId: z.string().uuid().nullable(),\n})\n\nconst okResponseSchema = z.object({ ok: z.boolean() })\n\nconst visibilitySchema = z.enum(['internal', 'customer'])\nconst createBodySchema = z.object({\n  body: z.string().trim().min(1).max(5000),\n  visibility: visibilitySchema.optional(),\n})\nconst updateBodySchema = z.object({\n  id: z.string().uuid(),\n  body: z.string().trim().min(1).max(5000).optional(),\n  visibility: visibilitySchema.optional(),\n})\n\ntype RouteContext = {\n  ctx: CommandRuntimeContext\n  scope: TaskAccessScope\n  translate: (key: string, fallback?: string) => string\n  taskId: string\n}\n\n/**\n * The task id comes from the path segment. Read from the URL rather than the\n * handler's `params` argument so the route behaves identically under the app's\n * catch-all dispatcher and under a direct call in tests.\n */\nfunction extractTaskId(req: Request): string | null {\n  try {\n    const match = new URL(req.url).pathname.match(/\\/tasks\\/([^/]+)\\/comments/)\n    const id = match?.[1] ? decodeURIComponent(match[1]) : null\n    return id && id.length > 0 ? id : null\n  } catch {\n    return null\n  }\n}\n\nasync function buildRouteContext(req: Request): Promise<RouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? auth.orgId ?? null\n  const userId = auth.sub ?? null\n  if (!tenantId || !organizationId || !userId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),\n    })\n  }\n\n  const taskId = extractTaskId(req)\n  if (!taskId) {\n    throw new CrudHttpError(400, {\n      error: translate('staff.time_tracking.taskComments.errors.taskIdRequired', 'Task id is required.'),\n    })\n  }\n\n  return { ctx, scope: { tenantId, organizationId, userId }, translate, taskId }\n}\n\n/**\n * The single gate every method passes through. Resolving project access before\n * the task is loaded \u2014 and answering both misses with one body \u2014 is what keeps\n * the endpoint from confirming that a task the caller may not see exists.\n */\nasync function requireTaskAccess(route: RouteContext): Promise<void> {\n  const access = await loadTaskProjectAccess(route.ctx.container, route.scope)\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  await requireAccessibleTask(em, route.taskId, route.scope, access, route.translate)\n}\n\nfunction commentNotFoundError(translate: (key: string, fallback?: string) => string): CrudHttpError {\n  return new CrudHttpError(404, {\n    error: translate('staff.time_tracking.taskComments.errors.notFound', 'Comment not found or not accessible.'),\n  })\n}\n\n/**\n * A comment addressed through another task's URL is refused exactly like a\n * comment that does not exist, so the path segment cannot be swapped to reach a\n * thread the caller has no route to.\n */\nasync function requireCommentOnTask(route: RouteContext, commentId: string): Promise<StaffTimeTaskComment> {\n  const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n  const comment = await em.findOne(StaffTimeTaskComment, {\n    id: commentId,\n    taskId: route.taskId,\n    tenantId: route.scope.tenantId,\n    organizationId: route.scope.organizationId,\n    deletedAt: null,\n  })\n  if (!comment) throw commentNotFoundError(route.translate)\n  return comment\n}\n\ntype AuthorMeta = { name: string | null; email: string | null }\n\nasync function resolveAuthorMeta(\n  route: RouteContext,\n  authorUserIds: string[],\n): Promise<Map<string, AuthorMeta>> {\n  const map = new Map<string, AuthorMeta>()\n  const unique = Array.from(new Set(authorUserIds))\n  if (unique.length === 0) return map\n  try {\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const users = await findWithDecryption(\n      em,\n      User,\n      { id: { $in: unique } },\n      undefined,\n      { tenantId: route.scope.tenantId, organizationId: route.scope.organizationId },\n    )\n    for (const user of users) {\n      const name = typeof user.name === 'string' && user.name.trim().length > 0 ? user.name.trim() : null\n      map.set(user.id, { name, email: user.email ?? null })\n    }\n  } catch (err) {\n    // A thread that renders without display names is still a usable thread.\n    logger.warn('staff.timesheets.task comments failed to resolve author metadata', { err })\n  }\n  return map\n}\n\nfunction serializeComment(comment: StaffTimeTaskComment, authors: Map<string, AuthorMeta>) {\n  const authorUserId = comment.authorUserId ?? null\n  const meta = authorUserId ? authors.get(authorUserId) ?? null : null\n  const authorKind = comment.authorKind === 'customer' ? 'customer' : 'staff'\n  const customerName = comment.authorDisplaySnapshot?.displayName ?? null\n  return {\n    id: comment.id,\n    taskId: comment.taskId,\n    body: comment.body,\n    authorUserId,\n    authorName: authorKind === 'customer' ? customerName : meta?.name ?? null,\n    authorEmail: authorKind === 'customer' ? null : meta?.email ?? null,\n    visibility: comment.visibility === 'customer' ? 'customer' : 'internal',\n    authorKind,\n    createdAt: comment.createdAt ? comment.createdAt.toISOString() : null,\n    updatedAt: comment.updatedAt ? comment.updatedAt.toISOString() : null,\n  }\n}\n\nasync function runGuards(\n  route: RouteContext,\n  operation: 'create' | 'update' | 'delete',\n  resourceId: string | null,\n  mutationPayload: Record<string, unknown> | null,\n) {\n  return runRouteMutationGuards({\n    container: route.ctx.container,\n    req: route.ctx.request as Request,\n    auth: {\n      userId: route.scope.userId,\n      tenantId: route.scope.tenantId,\n      organizationId: route.scope.organizationId,\n    },\n    input: {\n      resourceKind: RESOURCE_KIND,\n      resourceId,\n      operation,\n      mutationPayload,\n    },\n  })\n}\n\nfunction withOperationHeader(\n  response: NextResponse,\n  logEntry: {\n    id?: string\n    undoToken?: string | null\n    commandId?: string\n    actionLabel?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n    createdAt?: Date | string | null\n  } | null | undefined,\n  fallbackResourceId: string,\n): NextResponse {\n  if (!logEntry?.undoToken || !logEntry.id || !logEntry.commandId) return response\n  response.headers.set(\n    'x-om-operation',\n    serializeOperationMetadata({\n      id: logEntry.id,\n      undoToken: logEntry.undoToken,\n      commandId: logEntry.commandId,\n      actionLabel: logEntry.actionLabel ?? null,\n      resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,\n      resourceId: logEntry.resourceId ?? fallbackResourceId,\n      executedAt:\n        logEntry.createdAt instanceof Date\n          ? logEntry.createdAt.toISOString()\n          : typeof logEntry.createdAt === 'string'\n            ? logEntry.createdAt\n            : new Date().toISOString(),\n    }),\n  )\n  return response\n}\n\nasync function errorResponse(err: unknown, message: string): Promise<Response> {\n  if (isCrudHttpError(err)) {\n    return NextResponse.json(err.body, { status: err.status })\n  }\n  const { translate } = await resolveTranslations()\n  if (err instanceof z.ZodError) {\n    return NextResponse.json(\n      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },\n      { status: 400 },\n    )\n  }\n  logger.error(message, { err })\n  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })\n}\n\nexport async function GET(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const query = listQuerySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n    })\n\n    const em = (route.ctx.container.resolve('em') as EntityManager).fork()\n    const [comments, total] = await em.findAndCount(\n      StaffTimeTaskComment,\n      {\n        taskId: route.taskId,\n        tenantId: route.scope.tenantId,\n        organizationId: route.scope.organizationId,\n        deletedAt: null,\n      },\n      {\n        // Oldest first \u2014 the drawer reads the thread top to bottom.\n        orderBy: { createdAt: 'asc', id: 'asc' },\n        limit: query.pageSize,\n        offset: (query.page - 1) * query.pageSize,\n      },\n    )\n\n    const authors = await resolveAuthorMeta(\n      route,\n      comments.map((comment) => comment.authorUserId).filter((id): id is string => typeof id === 'string'),\n    )\n\n    return NextResponse.json({\n      items: comments.map((comment) => serializeComment(comment, authors)),\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: query.pageSize > 0 ? Math.ceil(total / query.pageSize) : 0,\n    })\n  } catch (err) {\n    return errorResponse(err, 'staff.timesheets.tasks.comments.GET failed')\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = createBodySchema.parse(raw ?? {})\n    // `authorUserId` is never forwarded: whatever the client sent is dropped\n    // here and the command stamps the authenticated caller instead.\n    const input = parseScopedCommandInput(\n      staffTimeTaskCommentCreateSchema,\n      { taskId: route.taskId, body: parsedBody.body, visibility: parsedBody.visibility ?? 'internal' },\n      route.ctx,\n      route.translate,\n    )\n\n    const guardResult = await runGuards(route, 'create', route.taskId, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      typeof input,\n      { commentId: string; taskId: string; authorUserId: string | null }\n    >(staffTimeTaskCommentCommandIds.create, { input, ctx: route.ctx })\n\n    await guardResult.runAfterSuccess()\n\n    const response = NextResponse.json(\n      {\n        id: result?.commentId ?? null,\n        taskId: route.taskId,\n        authorUserId: result?.authorUserId ?? null,\n      },\n      { status: 201 },\n    )\n    return withOperationHeader(response, logEntry, result?.commentId ?? route.taskId)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.POST failed')\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const raw = await readJsonSafe(req, {})\n    const parsedBody = updateBodySchema.parse(raw ?? {})\n    await requireCommentOnTask(route, parsedBody.id)\n\n    const input = staffTimeTaskCommentUpdateRequestSchema.parse({\n      id: parsedBody.id,\n      body: parsedBody.body,\n      visibility: parsedBody.visibility,\n    })\n\n    const guardResult = await runGuards(route, 'update', input.id, input as unknown as Record<string, unknown>)\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<typeof input, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.update,\n      { input, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, input.id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.PUT failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const route = await buildRouteContext(req)\n    await requireTaskAccess(route)\n\n    const url = new URL(req.url)\n    const raw = await readJsonSafe(req, {})\n    const rawId = url.searchParams.get('id') ?? (raw as { id?: unknown } | null)?.id\n    const id = z.string().uuid().parse(typeof rawId === 'string' ? rawId : undefined)\n    await requireCommentOnTask(route, id)\n\n    const guardResult = await runGuards(route, 'delete', id, { id })\n    if (!guardResult.ok) return guardResult.response\n\n    const commandBus = route.ctx.container.resolve('commandBus') as CommandBus\n    const { logEntry } = await commandBus.execute<{ id: string }, { commentId: string; taskId: string }>(\n      staffTimeTaskCommentCommandIds.delete,\n      { input: { id }, ctx: route.ctx },\n    )\n\n    await guardResult.runAfterSuccess()\n\n    return withOperationHeader(NextResponse.json({ ok: true }), logEntry, id)\n  } catch (err) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return errorResponse(err, 'staff.timesheets.tasks.comments.DELETE failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Task comments',\n  methods: {\n    GET: {\n      summary: 'List task comments',\n      description:\n        'Returns the task comment thread oldest-first, with the author display name resolved for rendering. Answers 404 \u2014 identical to a task that does not exist \u2014 when the task belongs to a project the caller cannot see.',\n      query: listQuerySchema,\n      responses: [{ status: 200, description: 'Comment thread', schema: listResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.view' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    POST: {\n      summary: 'Post a task comment',\n      description:\n        'Adds a comment to the task. The author is stamped from the authenticated caller \u2014 an authorUserId supplied by the client is ignored.',\n      requestBody: { contentType: 'application/json', schema: createBodySchema },\n      responses: [{ status: 201, description: 'Comment created', schema: createResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },\n        { status: 404, description: 'Task not found or not accessible' },\n      ],\n    },\n    PUT: {\n      summary: 'Edit a task comment',\n      description:\n        'Updates a comment body. Only the comment author may edit, unless the caller holds staff.timesheets.manage_all. Honours the optimistic-lock header.',\n      requestBody: { contentType: 'application/json', schema: updateBodySchema },\n      responses: [{ status: 200, description: 'Comment updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload, missing task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete a task comment',\n      description:\n        'Soft-deletes a comment so its audit trail survives. Only the comment author may delete, unless the caller holds staff.timesheets.manage_all.',\n      requestBody: { contentType: 'application/json', schema: z.object({ id: z.string().uuid() }) },\n      responses: [{ status: 200, description: 'Comment deleted', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Missing comment id, task id or organization scope' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Not the author and missing staff.timesheets.manage_all' },\n        { status: 404, description: 'Task or comment not found or not accessible' },\n        { status: 409, description: 'Optimistic lock conflict' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AA8BA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,0CAA0C;AACnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,YAAY;AACrB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,0CAA0C;AACnD;AAAA,EACE,wBAAwB;AAAA,EACxB;AAAA,OAEK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,gCAAgC,CAAC;AAEzF,MAAM,gBAAgB,mCAAmC;AAEzD,MAAM,eAAe;AACrB,MAAM,iBAAiB;AAEhB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAAA,EAC1D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC7D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC5D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AACxD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,MAAM,EAAE,OAAO;AAAA,EACf,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AAAA,EAC3C,YAAY,EAAE,KAAK,CAAC,SAAS,UAAU,CAAC;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,IAAI;AAC7B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC3C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAErD,MAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,UAAU,CAAC;AACxD,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,EACvC,YAAY,iBAAiB,SAAS;AACxC,CAAC;AACD,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAClD,YAAY,iBAAiB,SAAS;AACxC,CAAC;AAcD,SAAS,cAAc,KAA6B;AAClD,MAAI;AACF,UAAM,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,MAAM,4BAA4B;AAC1E,UAAM,KAAK,QAAQ,CAAC,IAAI,mBAAmB,MAAM,CAAC,CAAC,IAAI;AACvD,WAAO,MAAM,GAAG,SAAS,IAAI,KAAK;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,kBAAkB,KAAqC;AACpE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAEzG,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,IACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E,SAAS;AAAA,EACX;AAEA,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,IAAI,0BAA0B,KAAK,SAAS;AACnE,QAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ;AAC3C,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,uCAAuC;AAAA,IACvF,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,0DAA0D,sBAAsB;AAAA,IACnG,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,KAAK,OAAO,EAAE,UAAU,gBAAgB,OAAO,GAAG,WAAW,OAAO;AAC/E;AAOA,eAAe,kBAAkB,OAAoC;AACnE,QAAM,SAAS,MAAM,sBAAsB,MAAM,IAAI,WAAW,MAAM,KAAK;AAC3E,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,sBAAsB,IAAI,MAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM,SAAS;AACpF;AAEA,SAAS,qBAAqB,WAAsE;AAClG,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO,UAAU,oDAAoD,sCAAsC;AAAA,EAC7G,CAAC;AACH;AAOA,eAAe,qBAAqB,OAAqB,WAAkD;AACzG,QAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,QAAM,UAAU,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACrD,IAAI;AAAA,IACJ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM,MAAM;AAAA,IACtB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,qBAAqB,MAAM,SAAS;AACxD,SAAO;AACT;AAIA,eAAe,kBACb,OACA,eACkC;AAClC,QAAM,MAAM,oBAAI,IAAwB;AACxC,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC;AAChD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,eAAe;AAAA,IAC/E;AACA,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SAAS,IAAI,KAAK,KAAK,KAAK,IAAI;AAC/F,UAAI,IAAI,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,SAAS,KAAK,CAAC;AAAA,IACtD;AAAA,EACF,SAAS,KAAK;AAEZ,WAAO,KAAK,oEAAoE,EAAE,IAAI,CAAC;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA+B,SAAkC;AACzF,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,OAAO,eAAe,QAAQ,IAAI,YAAY,KAAK,OAAO;AAChE,QAAM,aAAa,QAAQ,eAAe,aAAa,aAAa;AACpE,QAAM,eAAe,QAAQ,uBAAuB,eAAe;AACnE,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,QAAQ,QAAQ;AAAA,IAChB,MAAM,QAAQ;AAAA,IACd;AAAA,IACA,YAAY,eAAe,aAAa,eAAe,MAAM,QAAQ;AAAA,IACrE,aAAa,eAAe,aAAa,OAAO,MAAM,SAAS;AAAA,IAC/D,YAAY,QAAQ,eAAe,aAAa,aAAa;AAAA,IAC7D;AAAA,IACA,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,IACjE,WAAW,QAAQ,YAAY,QAAQ,UAAU,YAAY,IAAI;AAAA,EACnE;AACF;AAEA,eAAe,UACb,OACA,WACA,YACA,iBACA;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,MAAM,IAAI;AAAA,IACrB,KAAK,MAAM,IAAI;AAAA,IACf,MAAM;AAAA,MACJ,QAAQ,MAAM,MAAM;AAAA,MACpB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,oBACP,UACA,UASA,oBACc;AACd,MAAI,CAAC,UAAU,aAAa,CAAC,SAAS,MAAM,CAAC,SAAS,UAAW,QAAO;AACxE,WAAS,QAAQ;AAAA,IACf;AAAA,IACA,2BAA2B;AAAA,MACzB,IAAI,SAAS;AAAA,MACb,WAAW,SAAS;AAAA,MACpB,WAAW,SAAS;AAAA,MACpB,aAAa,SAAS,eAAe;AAAA,MACrC,cAAc,SAAS,gBAAgB;AAAA,MACvC,YAAY,SAAS,cAAc;AAAA,MACnC,YACE,SAAS,qBAAqB,OAC1B,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAe,cAAc,KAAc,SAAoC;AAC7E,MAAI,gBAAgB,GAAG,GAAG;AACxB,WAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAC3D;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,eAAe,EAAE,UAAU;AAC7B,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,gCAAgC,iBAAiB,GAAG,SAAS,IAAI,OAAO;AAAA,MAC3F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,MAAM,SAAS,EAAE,IAAI,CAAC;AAC7B,SAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yBAAyB,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,gBAAgB,MAAM;AAAA,MAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAChD,CAAC;AAED,UAAM,KAAM,MAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACrE,UAAM,CAAC,UAAU,KAAK,IAAI,MAAM,GAAG;AAAA,MACjC;AAAA,MACA;AAAA,QACE,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM;AAAA,QAC5B,WAAW;AAAA,MACb;AAAA,MACA;AAAA;AAAA,QAEE,SAAS,EAAE,WAAW,OAAO,IAAI,MAAM;AAAA,QACvC,OAAO,MAAM;AAAA,QACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,MACnC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,SAAS,IAAI,CAAC,YAAY,QAAQ,YAAY,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,QAAQ;AAAA,IACrG;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,SAAS,IAAI,CAAC,YAAY,iBAAiB,SAAS,OAAO,CAAC;AAAA,MACnE;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM,WAAW,IAAI,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI;AAAA,IACvE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AAGnD,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,EAAE,QAAQ,MAAM,QAAQ,MAAM,WAAW,MAAM,YAAY,WAAW,cAAc,WAAW;AAAA,MAC/F,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,QAAQ,KAA2C;AAC9G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,+BAA+B,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAElE,UAAM,YAAY,gBAAgB;AAElC,UAAM,WAAW,aAAa;AAAA,MAC5B;AAAA,QACE,IAAI,QAAQ,aAAa;AAAA,QACzB,QAAQ,MAAM;AAAA,QACd,cAAc,QAAQ,gBAAgB;AAAA,MACxC;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,WAAO,oBAAoB,UAAU,UAAU,QAAQ,aAAa,MAAM,MAAM;AAAA,EAClF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,6CAA6C;AAAA,EACzE;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,aAAa,iBAAiB,MAAM,OAAO,CAAC,CAAC;AACnD,UAAM,qBAAqB,OAAO,WAAW,EAAE;AAE/C,UAAM,QAAQ,wCAAwC,MAAM;AAAA,MAC1D,IAAI,WAAW;AAAA,MACf,MAAM,WAAW;AAAA,MACjB,YAAY,WAAW;AAAA,IACzB,CAAC;AAED,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,MAAM,IAAI,KAA2C;AAC1G,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,MAAM,EAAE;AAAA,EAChF,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,4CAA4C;AAAA,EACxE;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,UAAM,kBAAkB,KAAK;AAE7B,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC;AACtC,UAAM,QAAQ,IAAI,aAAa,IAAI,IAAI,KAAM,KAAiC;AAC9E,UAAM,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,UAAU,WAAW,QAAQ,MAAS;AAChF,UAAM,qBAAqB,OAAO,EAAE;AAEpC,UAAM,cAAc,MAAM,UAAU,OAAO,UAAU,IAAI,EAAE,GAAG,CAAC;AAC/D,QAAI,CAAC,YAAY,GAAI,QAAO,YAAY;AAExC,UAAM,aAAa,MAAM,IAAI,UAAU,QAAQ,YAAY;AAC3D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,MACpC,+BAA+B;AAAA,MAC/B,EAAE,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,IAAI;AAAA,IAClC;AAEA,UAAM,YAAY,gBAAgB;AAElC,WAAO,oBAAoB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU,EAAE;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,cAAc,KAAK,+CAA+C;AAAA,EAC3E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB,CAAC;AAAA,MACtF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,MACjE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,MAC5F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB,CAAC;AAAA,MACrF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/timesheets/tasks/[id]/release/route.js

@@ -0,0 +1,32 @@
+import {
+  TASK_ASSIGNMENT_VIEW_FEATURE,
+  createTaskAssignmentPostHandler,
+  taskAssignmentResponseSchema
+} from "../../../../../lib/time-tracking/taskAssignmentRoute.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: [TASK_ASSIGNMENT_VIEW_FEATURE] }
+};
+const POST = createTaskAssignmentPostHandler("release");
+const openApi = {
+  tag: "Staff",
+  summary: "Release a task you hold",
+  methods: {
+    POST: {
+      summary: "Release a task you hold",
+      description: "Clears the assignee of a task the caller is assigned to, making it claimable again; the project assigners are notified. Only the current assignee may release (403 otherwise); managers keep using PUT /api/staff/timesheets/tasks.",
+      responses: [{ status: 200, description: "Release a task you hold", schema: taskAssignmentResponseSchema }],
+      errors: [
+        { status: 401, description: "Unauthorized" },
+        { status: 403, description: "The caller is not the current assignee" },
+        { status: 404, description: "Task not found, or not on a project the caller can see" },
+        { status: 409, description: "The task changed since the version the caller sent, or it is no longer assigned to the caller (`task_assignment_changed`)" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/timesheets/tasks/[id]/release/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/staff/api/timesheets/tasks/%5Bid%5D/release/route.ts"],
+  "sourcesContent": ["import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  TASK_ASSIGNMENT_VIEW_FEATURE,\n  createTaskAssignmentPostHandler,\n  taskAssignmentResponseSchema,\n} from '../../../../../lib/time-tracking/taskAssignmentRoute'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: [TASK_ASSIGNMENT_VIEW_FEATURE] },\n}\n\nexport const POST = createTaskAssignmentPostHandler('release')\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Release a task you hold',\n  methods: {\n    POST: {\n      summary: 'Release a task you hold',\n      description: 'Clears the assignee of a task the caller is assigned to, making it claimable again; the project assigners are notified. Only the current assignee may release (403 otherwise); managers keep using PUT /api/staff/timesheets/tasks.',\n      responses: [{ status: 200, description: 'Release a task you hold', schema: taskAssignmentResponseSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'The caller is not the current assignee' },\n        { status: 404, description: 'Task not found, or not on a project the caller can see' },\n        { status: 409, description: 'The task changed since the version the caller sent, or it is no longer assigned to the caller (`task_assignment_changed`)' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC7E;AAEO,MAAM,OAAO,gCAAgC,SAAS;AAEtD,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,6BAA6B,CAAC;AAAA,MACzG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,yDAAyD;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,4HAA4H;AAAA,MAC1J;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/timesheets/tasks/route.js

@@ -5,12 +5,12 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { resolveCrudRecordId, parseScopedCommandInput } from "@open-mercato/shared/lib/api/scoped";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
 import { createLogger } from "@open-mercato/shared/lib/logger";
-import { StaffTimeTask, StaffTimeTaskTag } from "../../../data/entities.js";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { StaffSupportTicket, StaffTimeTask, StaffTimeTaskStatus, StaffTimeTaskTag } from "../../../data/entities.js";
 import { staffTimeTaskCreateSchema, staffTimeTaskUpdateSchema } from "../../../data/validators.js";
 import { staffTimeTaskCommandIds } from "../../../commands/timesheets-tasks.js";
-import { resolveFeatureAccess } from "../../../lib/time-tracking/featureAccess.js";
-import { MANAGE_PROJECTS_FEATURE, resolveProjectAccess } from "../../../lib/time-tracking/access.js";
-import { readTimeTrackingSettings } from "../../../lib/time-tracking/settings.js";
+import { resolveListProjectAccess } from "../../../lib/time-tracking/listProjectAccess.js";
 import { sanitizeSearchTerm, parseBooleanFlag } from "../../helpers.js";
 import { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from "../../openapi.js";
 const logger = createLogger("staff").child({ component: "api/timesheets/tasks" });
@@ -29,6 +29,8 @@ const F = {
   position: "position",
   created_by_user_id: "created_by_user_id",
   closed_at: "closed_at",
+  source: "source",
+  customer_id: "customer_id",
   created_at: "created_at",
   updated_at: "updated_at"
 };
@@ -54,52 +56,26 @@ const listSchema = z.object({
   parentTaskId: z.string().uuid().optional(),
   tagIds: z.string().optional(),
   topLevelOnly: z.string().optional(),
+  unassigned: z.string().optional(),
+  source: z.enum(["internal", "portal"]).optional(),
+  customerId: z.string().uuid().optional(),
+  supportCategory: z.string().optional(),
+  supportReference: z.string().optional(),
+  portalStatus: z.enum(["received", "in_progress", "resolved"]).optional(),
+  supportUnnotified: z.string().optional(),
   sortField: z.string().optional(),
   sortDir: z.enum(["asc", "desc"]).optional()
 }).passthrough();
 const IMPOSSIBLE_ID = "00000000-0000-0000-0000-000000000000";
-const DENIED_ACCESS = { canManageAll: false, projectIds: [], staffMemberId: null };
-const accessByRequest = /* @__PURE__ */ new WeakMap();
-async function resolveAssignmentGraceDays(container, tenantId) {
-  try {
-    const configService = container.resolve("moduleConfigService");
-    const settings = await readTimeTrackingSettings(configService, { tenantId });
-    return settings.access.assignmentGraceDays;
-  } catch {
-    return null;
-  }
-}
-async function loadProjectAccess(container, userId, tenantId, organizationId) {
-  if (!tenantId || !organizationId) return { ...DENIED_ACCESS };
-  const scope = { tenantId, organizationId };
-  try {
-    const access = await resolveFeatureAccess(container, userId, [MANAGE_PROJECTS_FEATURE], scope);
-    const em = container.resolve("em");
-    return await resolveProjectAccess({
-      em: em.fork(),
-      userId,
-      tenantId,
-      organizationId,
-      canManageAll: access.allowed,
-      userFeatures: access.grantedFeatures,
-      assignmentGraceDays: await resolveAssignmentGraceDays(container, tenantId)
-    });
-  } catch (err) {
-    logger.error("staff.timesheets.tasks access resolution failed", { err });
-    return { ...DENIED_ACCESS };
-  }
+const SUPPORT_FILTER_MAX_TASK_IDS = 1e3;
+const supportFilterTruncatedRequests = /* @__PURE__ */ new WeakSet();
+function markTaskListTotalCapped(payload, ctx) {
+  if (ctx.request && supportFilterTruncatedRequests.has(ctx.request)) payload.totalIsCapped = true;
 }
-async function resolveListProjectAccess(ctx) {
-  const tenantId = ctx.auth?.tenantId ?? null;
-  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
-  const load = () => loadProjectAccess(ctx.container, ctx.auth?.sub ?? null, tenantId, organizationId);
-  const request = ctx.request;
-  if (!request) return load();
-  const cached = accessByRequest.get(request);
-  if (cached) return cached;
-  const pending = load();
-  accessByRequest.set(request, pending);
-  return pending;
+function intersectIds(current, next) {
+  if (current === null) return next;
+  const allowed = new Set(next);
+  return current.filter((id) => allowed.has(id));
 }
 function splitIdList(value) {
   if (typeof value !== "string" || value.trim().length === 0) return null;
@@ -129,6 +105,50 @@ async function resolveTaskIdsForTags(ctx, tagIds) {
     return [...seen.entries()].filter(([, tags]) => tags.size >= required).map(([taskId]) => taskId);
   } catch (err) {
     logger.error("staff.timesheets.tasks tag filter resolution failed", { err });
+    getTelemetryRuntime()?.reportError(err, { module: "staff", code: "staff.task_tag_filter_failed" });
+    return [];
+  }
+}
+async function resolveTaskIdsForSupport(ctx, criteria) {
+  const tenantId = ctx.auth?.tenantId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+  if (!tenantId || !organizationId) return [];
+  try {
+    const em = ctx.container.resolve("em").fork();
+    const where = { tenantId, organizationId, deletedAt: null };
+    if (criteria.supportCategory) where.categoryValue = criteria.supportCategory;
+    if (criteria.supportReference) where.supportReference = { $ilike: `${escapeLikePattern(criteria.supportReference)}%` };
+    if (criteria.supportUnnotified) where.unnotifiedAt = { $ne: null };
+    const rows = await findWithDecryption(
+      em,
+      StaffSupportTicket,
+      where,
+      { fields: ["taskId"], limit: SUPPORT_FILTER_MAX_TASK_IDS + 1, orderBy: { createdAt: "desc" } },
+      { tenantId, organizationId }
+    );
+    if (rows.length > SUPPORT_FILTER_MAX_TASK_IDS && ctx.request) supportFilterTruncatedRequests.add(ctx.request);
+    return Array.from(new Set(rows.slice(0, SUPPORT_FILTER_MAX_TASK_IDS).map((row) => row.taskId)));
+  } catch (err) {
+    logger.error("staff.timesheets.tasks support filter resolution failed", { err });
+    getTelemetryRuntime()?.reportError(err, { module: "staff", code: "staff.task_support_filter_failed" });
+    return [];
+  }
+}
+async function resolveStatusIdsForPortalStatus(ctx, portalStatus) {
+  const tenantId = ctx.auth?.tenantId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+  if (!tenantId || !organizationId) return [];
+  try {
+    const em = ctx.container.resolve("em").fork();
+    const where = { tenantId, organizationId, deletedAt: null };
+    if (portalStatus === "resolved") where.isDone = true;
+    else if (portalStatus === "received") Object.assign(where, { isDone: false, isDefault: true });
+    else Object.assign(where, { isDone: false, isDefault: false });
+    const rows = await em.find(StaffTimeTaskStatus, where, { fields: ["id"] });
+    return rows.map((row) => row.id);
+  } catch (err) {
+    logger.error("staff.timesheets.tasks portal status filter resolution failed", { err });
+    getTelemetryRuntime()?.reportError(err, { module: "staff", code: "staff.task_portal_status_filter_failed" });
     return [];
   }
 }
@@ -138,12 +158,23 @@ async function buildTaskListFilters(query, ctx) {
   for (const raw of [query.ids, query.id]) {
     const parsed = splitIdList(raw);
     if (parsed === null) continue;
-    narrowIds = narrowIds ? narrowIds.filter((id) => parsed.includes(id)) : parsed;
+    narrowIds = intersectIds(narrowIds, parsed);
   }
   const requestedTagIds = splitIdList(query.tagIds);
   if (requestedTagIds !== null) {
     const tagged = requestedTagIds.length === 0 ? [] : await resolveTaskIdsForTags(ctx, requestedTagIds);
-    narrowIds = narrowIds ? narrowIds.filter((id) => tagged.includes(id)) : tagged;
+    narrowIds = intersectIds(narrowIds, tagged);
+  }
+  const supportCategory = typeof query.supportCategory === "string" ? query.supportCategory.trim() : "";
+  const supportReference = sanitizeSearchTerm(query.supportReference) ?? "";
+  const supportUnnotified = parseBooleanFlag(query.supportUnnotified);
+  if (supportCategory || supportReference || supportUnnotified) {
+    const supportTaskIds = await resolveTaskIdsForSupport(ctx, {
+      supportCategory: supportCategory || void 0,
+      supportReference: supportReference || void 0,
+      supportUnnotified
+    });
+    narrowIds = intersectIds(narrowIds, supportTaskIds);
   }
   const access = await resolveListProjectAccess(ctx);
   let projectIds = null;
@@ -170,10 +201,17 @@ async function buildTaskListFilters(query, ctx) {
   }
   if (typeof query.taskStatusId === "string" && query.taskStatusId.trim().length > 0) {
     filters[F.task_status_id] = query.taskStatusId.trim();
+  } else if (query.portalStatus) {
+    const statusIds = await resolveStatusIdsForPortalStatus(ctx, query.portalStatus);
+    filters[F.task_status_id] = { $in: statusIds.length > 0 ? statusIds : [IMPOSSIBLE_ID] };
   }
   if (typeof query.assigneeStaffMemberId === "string" && query.assigneeStaffMemberId.trim().length > 0) {
     filters[F.assignee_staff_member_id] = query.assigneeStaffMemberId.trim();
+  } else if (parseBooleanFlag(query.unassigned)) {
+    filters[F.assignee_staff_member_id] = { $eq: null };
   }
+  if (query.source) filters[F.source] = query.source;
+  if (query.customerId) filters[F.customer_id] = query.customerId;
   if (typeof query.parentTaskId === "string" && query.parentTaskId.trim().length > 0) {
     filters[F.parent_task_id] = query.parentTaskId.trim();
   } else if (parseBooleanFlag(query.topLevelOnly)) {
@@ -204,6 +242,8 @@ const taskListFields = [
   F.position,
   F.created_by_user_id,
   F.closed_at,
+  F.source,
+  F.customer_id,
   F.created_at,
   F.updated_at
 ];
@@ -238,6 +278,9 @@ const crud = makeCrudRoute({
     buildFilters: buildTaskListFilters
   },
   enrichers: { entityId: "staff:staff_time_task" },
+  hooks: {
+    afterList: (payload, ctx) => markTaskListTotalCapped(payload, ctx)
+  },
   actions: {
     create: {
       commandId: staffTimeTaskCommandIds.create,
@@ -289,6 +332,8 @@ const taskListItemSchema = z.object({
   position: z.number().int().nullable().optional(),
   created_by_user_id: z.string().uuid().nullable().optional(),
   closed_at: z.string().nullable().optional(),
+  source: z.enum(["internal", "portal"]).nullable().optional(),
+  customer_id: z.string().uuid().nullable().optional(),
   created_at: z.string().nullable().optional(),
   updated_at: z.string().nullable().optional(),
   /** This task's own entries, in raw minutes. */
@@ -323,7 +368,9 @@ export {
   GET,
   POST,
   PUT,
+  SUPPORT_FILTER_MAX_TASK_IDS,
   buildTaskListFilters,
+  markTaskListTotalCapped,
   metadata,
   openApi,
   resolveListProjectAccess,