@plandesk/api 0.20.0 → 1.0.0-beta.1

package/dist/services/share.js

@@ -1,5 +1,10 @@
-import { createShare as dbCreateShare, getDocument, getProject, getShare as dbGetShare, getShareByTokenHashRaw, getTask, hashShareToken, listDocuments, listShares as dbListShares, parseSharePermissions, parseSharePolicy, revokeShare as dbRevokeShare, } from '@plandesk/db';
+import { countRecentSubmissionsByParticipant, createGuestSession, createGuestSubmission, createShare as dbCreateShare, getDocument, getGuestSessionById, getProject, getShare as dbGetShare, getShareByTokenHashRaw, getTask, hashShareToken, listDocuments, listShares as dbListShares, listSubmissionsByShareAndParticipant, parseSharePermissions, parseSharePolicy, revokeShare as dbRevokeShare, } from '@plandesk/db';
+import { getAuthContext } from '../auth-context.js';
 import { buildClientView } from '../projection.js';
+import { assertPermission, resolveOrgId } from './org-scope.js';
+import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
+const GUEST_SUBMIT_RATE_LIMIT = 10;
+const GUEST_SUBMIT_RATE_WINDOW_MS = 60_000;
 export class InvalidShareError extends Error {
     constructor(message) {
         super(message);
@@ -22,6 +27,34 @@ export function serializeShare(share) {
     };
 }
 const RESOURCE_SHARE_DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}
+function parseInvitedEmails(raw) {
+    if (raw === null || raw === '') {
+        return [];
+    }
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) {
+        return [];
+    }
+    return parsed.filter((value) => typeof value === 'string').map(normalizeEmail);
+}
+function isEmailInvited(share, email) {
+    if (email === undefined || email.trim() === '') {
+        return false;
+    }
+    return parseInvitedEmails(share.invitedEmails).includes(normalizeEmail(email));
+}
+function isShareLive(share, now = new Date()) {
+    if (share.revokedAt !== null) {
+        return false;
+    }
+    if (share.expiresAt !== null && share.expiresAt <= now) {
+        return false;
+    }
+    return true;
+}
 // The rich-text editor stores document/comment bodies as HTML; this is a
 // deliberately small converter for that constrained, known markup (not
 // arbitrary HTML) rather than pulling in a DOM/HTML-parsing dependency.
@@ -131,15 +164,21 @@ function buildShareMarkdown(view, policy, origin) {
 export function createShareService(deps) {
     const { db } = deps;
     return {
-        createShare(projectId, input) {
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+        async createShare(projectId, input) {
+            assertPermission(deps, 'document', 'create');
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
             if (input.audienceName.trim() === '') {
                 throw new InvalidShareError('Share audience name must not be empty');
             }
-            const { share, token } = dbCreateShare(db, {
+            const { share, token } = await dbCreateShare(db, {
                 projectId,
                 audienceName: input.audienceName,
                 mode: input.mode,
@@ -150,34 +189,41 @@ export function createShareService(deps) {
             });
             return { share: serializeShare(share), token };
         },
-        listShares(projectId) {
-            const project = getProject(db, projectId);
-            if (!project) {
-                return undefined;
+        async listShares(projectId) {
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
             }
-            return dbListShares(db, projectId).map(serializeShare);
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
+            return (await dbListShares(db, projectId)).map(serializeShare);
         },
-        revokeShare(id) {
-            return dbRevokeShare(db, id) !== undefined;
+        async revokeShare(id) {
+            assertPermission(deps, 'document', 'delete');
+            return (await dbRevokeShare(db, id)) !== undefined;
         },
-        buildClientView(projectId, shareId) {
-            const share = dbGetShare(db, shareId);
+        async buildClientView(projectId, shareId) {
+            const share = await dbGetShare(db, shareId);
             if (!share || share.projectId !== projectId) {
                 return undefined;
             }
             return buildClientView(db, projectId, share);
         },
-        createResourceShare(input, origin) {
+        async createResourceShare(input, origin) {
+            assertPermission(deps, 'document', 'create');
             let projectId;
             let policy;
             let audienceName;
             if (input.resource.kind === 'task') {
-                const task = getTask(db, input.resource.id);
+                const task = await getTask(db, input.resource.id);
                 if (!task) {
                     return undefined;
                 }
                 projectId = task.projectId;
-                const linkedDocumentIds = listDocuments(db, projectId)
+                const linkedDocumentIds = (await listDocuments(db, projectId))
                     .filter((doc) => doc.linkedTaskId === task.id)
                     .map((doc) => doc.id);
                 policy = {
@@ -188,7 +234,7 @@ export function createShareService(deps) {
                 audienceName = `Agent link: ${task.label}`;
             }
             else {
-                const document = getDocument(db, input.resource.id);
+                const document = await getDocument(db, input.resource.id);
                 if (!document) {
                     return undefined;
                 }
@@ -199,7 +245,7 @@ export function createShareService(deps) {
             const expiresAt = input.expiresAt === null
                 ? null
                 : (input.expiresAt ?? new Date(Date.now() + RESOURCE_SHARE_DEFAULT_TTL_MS));
-            const { share, token } = dbCreateShare(db, {
+            const { share, token } = await dbCreateShare(db, {
                 projectId,
                 audienceName,
                 mode: 'public',
@@ -214,8 +260,8 @@ export function createShareService(deps) {
                 expiresAt: share.expiresAt?.toISOString() ?? null,
             };
         },
-        getResourceMarkdown(token, origin) {
-            const share = getShareByTokenHashRaw(db, hashShareToken(token));
+        async getResourceMarkdown(token, origin) {
+            const share = await getShareByTokenHashRaw(db, hashShareToken(token));
             if (!share) {
                 return { status: 'not_found' };
             }
@@ -223,12 +269,156 @@ export function createShareService(deps) {
             if (share.revokedAt !== null || (share.expiresAt !== null && share.expiresAt <= now)) {
                 return { status: 'gone' };
             }
-            const view = buildClientView(db, share.projectId, share);
+            const view = await buildClientView(db, share.projectId, share);
             if (!view) {
                 return { status: 'not_found' };
             }
             return { status: 'ok', markdown: buildShareMarkdown(view, parseSharePolicy(share), origin) };
         },
+        // Portal meta for the join gate UI. Live shares only; unknown/revoked/expired → not_found.
+        async getShareMeta(token) {
+            const share = await getShareByTokenHashRaw(db, hashShareToken(token));
+            if (!share || !isShareLive(share)) {
+                return { status: 'not_found' };
+            }
+            return { status: 'ok', audienceName: share.audienceName, mode: share.mode };
+        },
+        // Named join: mints a guest session scoped to this share. invite mode requires
+        // an allow-listed email (sync-server semantics: 403 email_not_invited).
+        async joinShare(token, input) {
+            const share = await getShareByTokenHashRaw(db, hashShareToken(token));
+            if (!share || !isShareLive(share)) {
+                return { status: 'unauthorized' };
+            }
+            const name = input.name.trim();
+            if (name === '') {
+                return { status: 'name_required' };
+            }
+            if (share.mode === 'invite' && !isEmailInvited(share, input.email)) {
+                return { status: 'email_not_invited' };
+            }
+            const { guest, token: sessionToken } = await createGuestSession(db, {
+                shareId: share.id,
+                projectId: share.projectId,
+                name,
+                email: input.email?.trim() || undefined,
+            });
+            return {
+                status: 'ok',
+                sessionToken,
+                participant: { id: guest.id, name: guest.name },
+                share: {
+                    audienceName: share.audienceName,
+                    permissions: parseSharePermissions(share),
+                },
+            };
+        },
+        // Guest-gated portal view: middleware has already verified the guest session
+        // matches this share token. The view is COMPUTED live (not a snapshot). Every
+        // failure shape collapses to undefined → uniform 404. Guest context has no
+        // orgId; buildClientView reads only this one project.
+        async getClientView(token) {
+            const auth = getAuthContext();
+            if (auth.kind !== 'guest') {
+                return undefined;
+            }
+            const share = await getShareByTokenHashRaw(db, hashShareToken(token));
+            if (!share || !isShareLive(share)) {
+                return undefined;
+            }
+            if (share.id !== auth.shareId || share.projectId !== auth.projectId) {
+                return undefined;
+            }
+            return buildClientView(db, share.projectId, share);
+        },
+        // Guest moderated inbox: write a pending share_submissions row the owner
+        // lists/triages on the same server (no cross-server hop).
+        async submitIssue(token, input) {
+            const auth = getAuthContext();
+            if (auth.kind !== 'guest') {
+                return { status: 'unauthorized' };
+            }
+            const share = await getShareByTokenHashRaw(db, hashShareToken(token));
+            if (!share || !isShareLive(share)) {
+                return { status: 'unauthorized' };
+            }
+            if (share.id !== auth.shareId || share.projectId !== auth.projectId) {
+                return { status: 'unauthorized' };
+            }
+            const permissions = parseSharePermissions(share);
+            if (permissions.submit !== true) {
+                return { status: 'submit_not_permitted' };
+            }
+            const title = input.title.trim();
+            if (title === '') {
+                return { status: 'title_required' };
+            }
+            const guest = await getGuestSessionById(db, auth.guestSessionId);
+            if (guest === undefined || guest.shareId !== share.id) {
+                return { status: 'unauthorized' };
+            }
+            const recent = await countRecentSubmissionsByParticipant(db, {
+                hostedShareId: share.id,
+                participantName: guest.name,
+                since: new Date(Date.now() - GUEST_SUBMIT_RATE_WINDOW_MS),
+            });
+            if (recent >= GUEST_SUBMIT_RATE_LIMIT) {
+                return { status: 'rate_limited' };
+            }
+            const bodyText = input.body?.trim() === '' ? null : (input.body?.trim() ?? null);
+            const severity = input.severity?.trim() === '' ? null : (input.severity?.trim() ?? null);
+            const taskRef = input.task_ref?.trim() === '' ? null : (input.task_ref?.trim() ?? null);
+            const row = await createGuestSubmission(db, {
+                projectId: share.projectId,
+                hostedShareId: share.id,
+                participantName: guest.name,
+                title,
+                body: bodyText,
+                severity,
+                taskRef,
+            });
+            return {
+                status: 'ok',
+                submission: {
+                    id: row.id,
+                    title: row.title,
+                    severity: row.severity,
+                    status: row.status,
+                    created_at: row.createdAt.toISOString(),
+                },
+            };
+        },
+        async listMySubmissions(token) {
+            const auth = getAuthContext();
+            if (auth.kind !== 'guest') {
+                return { status: 'unauthorized' };
+            }
+            const share = await getShareByTokenHashRaw(db, hashShareToken(token));
+            if (!share || !isShareLive(share)) {
+                return { status: 'unauthorized' };
+            }
+            if (share.id !== auth.shareId || share.projectId !== auth.projectId) {
+                return { status: 'unauthorized' };
+            }
+            const guest = await getGuestSessionById(db, auth.guestSessionId);
+            if (guest === undefined || guest.shareId !== share.id) {
+                return { status: 'unauthorized' };
+            }
+            const rows = await listSubmissionsByShareAndParticipant(db, {
+                hostedShareId: share.id,
+                participantName: guest.name,
+            });
+            return {
+                status: 'ok',
+                submissions: rows.map((row) => ({
+                    id: row.id,
+                    title: row.title,
+                    severity: row.severity,
+                    status: row.status,
+                    created_at: row.createdAt.toISOString(),
+                })),
+            };
+        },
     };
 }
 //# sourceMappingURL=share.js.map

package/dist/services/sync.d.ts

@@ -1,6 +1,5 @@
 import { type Db, type ShareSubmission, type ShareSubmissionStatus } from '@plandesk/db';
-import type { EventBus } from '../events.js';
-import type { ShareService } from './share.js';
+import { type OrgScopedDeps } from './org-scope.js';
 import type { TaskService } from './tasks.js';
 export declare class SyncUnavailableError extends Error {
     constructor(message?: string);
@@ -34,43 +33,22 @@ export type SerializedSubmission = {
     pulled_at: string;
 };
 export declare function serializeSubmission(row: ShareSubmission): SerializedSubmission;
-export type SyncServiceDeps = {
+export type SyncServiceDeps = OrgScopedDeps & {
     db: Db;
-    eventBus: EventBus;
     taskService: TaskService;
-    shareService: ShareService;
-};
-export type WatchPushController = {
-    onChange(): void;
-    dispose(): void;
-};
-export type WatchPushOptions = {
-    debounceMs?: number;
-    onPushError?: (err: unknown) => void;
 };
 export declare function createSyncService(deps: SyncServiceDeps): {
-    push(projectId: string, remote: SyncRemote): Promise<{
-        pushed: number;
-    }>;
-    publishProject(projectId: string, input: {
-        serverUrl: string;
-        syncToken: string;
-    }): Promise<{
-        globalProjectId: string;
-        pushed: number;
-    }>;
     pull(projectId: string, remote: SyncRemote): Promise<{
         pulled: number;
     }>;
-    listTriage(projectId: string, status?: ShareSubmissionStatus): SerializedSubmission[];
-    getSubmission(submissionId: string): SerializedSubmission | undefined;
-    setRemote(projectId: string, remote: SyncRemote): void;
-    getRemote(projectId: string): SyncRemote | undefined;
-    triage(submissionId: string, action: "accept" | "reject", remote: SyncRemote, asTask?: {
+    listTriage(projectId: string, status?: ShareSubmissionStatus): Promise<SerializedSubmission[]>;
+    getSubmission(submissionId: string): Promise<SerializedSubmission | undefined>;
+    setRemote(projectId: string, remote: SyncRemote): Promise<void>;
+    getRemote(projectId: string): Promise<SyncRemote | undefined>;
+    triage(submissionId: string, action: "accept" | "reject", remote?: SyncRemote, asTask?: {
         label?: string;
         description?: string;
     }, linkTaskId?: string): Promise<SerializedSubmission>;
-    watchPush(projectId: string, remote: SyncRemote, opts?: WatchPushOptions): WatchPushController;
 };
 export type SyncService = ReturnType<typeof createSyncService>;
 //# sourceMappingURL=sync.d.ts.map

package/dist/services/sync.js

@@ -1,5 +1,5 @@
-import { randomUUID } from 'node:crypto';
-import { getPullCursor, getShare, getSubmission as dbGetSubmission, getSyncRemote, listSubmissions, parseSharePermissions, setPullCursor, setSubmissionStatus, setSyncRemote, upsertSubmission, } from '@plandesk/db';
+import { getPullCursor, getSubmission as dbGetSubmission, getSyncRemote, listSubmissions, setPullCursor, setSubmissionStatus, setSyncRemote, upsertSubmission, } from '@plandesk/db';
+import { assertPermission } from './org-scope.js';
 export class SyncUnavailableError extends Error {
     constructor(message = 'sync server unavailable') {
         super(message);
@@ -40,16 +40,6 @@ export function serializeSubmission(row) {
         pulled_at: row.pulledAt.toISOString(),
     };
 }
-function parseInvitedEmails(raw) {
-    if (raw === null || raw === '') {
-        return [];
-    }
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed)) {
-        return [];
-    }
-    return parsed.filter((value) => typeof value === 'string');
-}
 function buildDesc(submission) {
     const footer = `Reported by ${submission.participantName} (client) via Plan Desk`;
     if (submission.body === null || submission.body === '') {
@@ -78,108 +68,19 @@ async function ackSubmission(remote, submissionId, status) {
         throw new SyncUnavailableError(`sync server returned ${String(response.status)}`);
     }
 }
-async function pushProjection(remote, share, view) {
-    const base = remote.serverUrl.replace(/\/$/, '');
-    const url = `${base}/api/sync/v1/projects/${encodeURIComponent(remote.globalProjectId)}/projection`;
-    let response;
-    try {
-        response = await fetch(url, {
-            method: 'PUT',
-            headers: {
-                Authorization: `Bearer ${remote.syncToken}`,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-                share: {
-                    token_hash: share.tokenHash,
-                    audience_name: share.audienceName,
-                    permissions: parseSharePermissions(share),
-                    mode: share.mode,
-                    invited_emails: parseInvitedEmails(share.invitedEmails),
-                    expires_at: share.expiresAt?.toISOString() ?? null,
-                },
-                version: Date.now(),
-                view,
-            }),
-        });
-    }
-    catch {
-        throw new SyncUnavailableError();
-    }
-    if (response.status === 401) {
-        throw new SyncUnauthorizedError();
-    }
-    if (!response.ok) {
-        throw new SyncUnavailableError(`sync server returned ${String(response.status)}`);
+/** Optional remote: single-server guest submit has no cross-server ack. */
+async function maybeAck(remote, submissionId, status) {
+    if (remote === undefined) {
+        return;
     }
-}
-function createWatchPush(push, projectId, remote, opts) {
-    const debounceMs = opts?.debounceMs ?? 1500;
-    const onPushError = opts?.onPushError ??
-        ((err) => {
-            const message = err instanceof Error ? err.message : String(err);
-            console.error(`sync watch push failed: ${message}`);
-        });
-    let timer;
-    let disposed = false;
-    const runPush = () => {
-        timer = undefined;
-        void push(projectId, remote).catch(onPushError);
-    };
-    return {
-        onChange() {
-            if (disposed) {
-                return;
-            }
-            if (timer !== undefined) {
-                clearTimeout(timer);
-            }
-            timer = setTimeout(runPush, debounceMs);
-        },
-        dispose() {
-            disposed = true;
-            if (timer !== undefined) {
-                clearTimeout(timer);
-                timer = undefined;
-            }
-        },
-    };
+    await ackSubmission(remote, submissionId, status);
 }
 export function createSyncService(deps) {
-    const { db, eventBus, taskService, shareService } = deps;
+    const { db, taskService } = deps;
     return {
-        async push(projectId, remote) {
-            const shares = shareService.listShares(projectId);
-            if (shares === undefined) {
-                throw new SyncUnavailableError('project not found');
-            }
-            const active = shares.filter((share) => share.revoked_at === null);
-            let pushed = 0;
-            for (const serialized of active) {
-                const shareRow = getShare(db, serialized.id);
-                if (shareRow === undefined) {
-                    continue;
-                }
-                const view = shareService.buildClientView(projectId, serialized.id);
-                if (view === undefined) {
-                    continue;
-                }
-                await pushProjection(remote, shareRow, view);
-                pushed += 1;
-            }
-            return { pushed };
-        },
-        async publishProject(projectId, input) {
-            const globalProjectId = randomUUID();
-            const { pushed } = await this.push(projectId, {
-                serverUrl: input.serverUrl,
-                globalProjectId,
-                syncToken: input.syncToken,
-            });
-            return { globalProjectId, pushed };
-        },
         async pull(projectId, remote) {
-            const cursor = getPullCursor(db, projectId);
+            assertPermission(deps, 'task', 'update');
+            const cursor = await getPullCursor(db, projectId);
             const base = remote.serverUrl.replace(/\/$/, '');
             const url = new URL(`${base}/api/sync/v1/projects/${encodeURIComponent(remote.globalProjectId)}/submissions`);
             if (cursor !== undefined) {
@@ -205,7 +106,7 @@ export function createSyncService(deps) {
             let pulled = 0;
             let maxCreatedAt = cursor;
             for (const submission of remoteSubmissions) {
-                const inserted = upsertSubmission(db, {
+                const inserted = await upsertSubmission(db, {
                     id: submission.id,
                     projectId,
                     hostedShareId: submission.share_id,
@@ -226,29 +127,29 @@ export function createSyncService(deps) {
                 }
             }
             if (maxCreatedAt !== undefined && maxCreatedAt !== cursor) {
-                setPullCursor(db, projectId, maxCreatedAt);
+                await setPullCursor(db, projectId, maxCreatedAt);
             }
             if (pulled > 0) {
-                eventBus.emit({ type: 'submissions_pulled', projectId });
             }
             return { pulled };
         },
-        listTriage(projectId, status) {
-            return listSubmissions(db, projectId, status).map(serializeSubmission);
+        async listTriage(projectId, status) {
+            return (await listSubmissions(db, projectId, status)).map(serializeSubmission);
         },
-        getSubmission(submissionId) {
-            const submission = dbGetSubmission(db, submissionId);
+        async getSubmission(submissionId) {
+            const submission = await dbGetSubmission(db, submissionId);
             return submission === undefined ? undefined : serializeSubmission(submission);
         },
-        setRemote(projectId, remote) {
-            setSyncRemote(db, projectId, {
+        async setRemote(projectId, remote) {
+            assertPermission(deps, 'task', 'update');
+            await setSyncRemote(db, projectId, {
                 serverUrl: remote.serverUrl,
                 globalProjectId: remote.globalProjectId,
                 syncToken: remote.syncToken,
             });
         },
-        getRemote(projectId) {
-            const row = getSyncRemote(db, projectId);
+        async getRemote(projectId) {
+            const row = await getSyncRemote(db, projectId);
             if (row === undefined) {
                 return undefined;
             }
@@ -259,39 +160,40 @@ export function createSyncService(deps) {
             };
         },
         async triage(submissionId, action, remote, asTask, linkTaskId) {
+            assertPermission(deps, 'task', 'create');
             if (asTask !== undefined && linkTaskId !== undefined) {
                 throw new InvalidTriageInputError('as_task and link_task_id are mutually exclusive');
             }
-            const submission = dbGetSubmission(db, submissionId);
+            const submission = await dbGetSubmission(db, submissionId);
             if (submission === undefined) {
                 throw new InvalidTriageError();
             }
             if (submission.status !== 'pending') {
                 // Idempotent retry recovery: a prior triage may have committed the terminal
-                // status locally but failed to ack the remote (sync server briefly down),
+                // status locally but failed to ack the remote (legacy remote briefly down),
                 // leaving local/remote divergence with no recovery path. Re-ack when the
                 // retry's action matches the recorded outcome; ack is idempotent remotely.
+                // Single-server (no remote): local status is the only status — no re-ack.
                 if ((action === 'accept' && submission.status === 'accepted') ||
                     (action === 'reject' && submission.status === 'rejected')) {
-                    await ackSubmission(remote, submissionId, submission.status);
+                    await maybeAck(remote, submissionId, submission.status);
                 }
                 return serializeSubmission(submission);
             }
             const projectId = submission.projectId;
             if (action === 'accept' && linkTaskId !== undefined) {
-                const existingTask = taskService.get(linkTaskId);
+                const existingTask = await taskService.get(linkTaskId);
                 if (existingTask === undefined || existingTask.project_id !== projectId) {
                     throw new InvalidTriageInputError('link_task_id does not reference an existing task in this project');
                 }
-                const updated = setSubmissionStatus(db, submissionId, {
+                const updated = await setSubmissionStatus(db, submissionId, {
                     status: 'accepted',
                     linkedTaskId: linkTaskId,
                 });
                 if (updated === undefined) {
                     throw new InvalidTriageError();
                 }
-                eventBus.emit({ type: 'submissions_pulled', projectId });
-                await ackSubmission(remote, submissionId, 'accepted');
+                await maybeAck(remote, submissionId, 'accepted');
                 return serializeSubmission(updated);
             }
             if (action === 'accept') {
@@ -300,12 +202,10 @@ export function createSyncService(deps) {
                 // caller — enforced here at the single service chokepoint so both the HTTP
                 // route and the MCP tool are covered.
                 //
-                // create + setSubmissionStatus run as two synchronous steps, but the submission
-                // was validated to exist immediately above with no intervening await, so under
-                // better-sqlite3's single-connection sync model the row cannot vanish and
-                // setSubmissionStatus cannot spuriously return undefined. taskService.create
-                // self-transacts, so an outer transaction here is neither possible nor needed.
-                const task = taskService.create(projectId, {
+                // create + setSubmissionStatus run as two sequential steps after validating
+                // the submission exists. taskService.create self-transacts, so an outer
+                // transaction here is neither possible nor needed.
+                const task = await taskService.create(projectId, {
                     label: asTask?.label ?? submission.title,
                     status: 'scope',
                     description: asTask?.description ?? buildDesc(submission),
@@ -313,28 +213,23 @@ export function createSyncService(deps) {
                 if (task === undefined) {
                     throw new InvalidTriageError('project not found');
                 }
-                const updated = setSubmissionStatus(db, submissionId, {
+                const updated = await setSubmissionStatus(db, submissionId, {
                     status: 'accepted',
                     linkedTaskId: task.id,
                 });
                 if (updated === undefined) {
                     throw new InvalidTriageError();
                 }
-                eventBus.emit({ type: 'submissions_pulled', projectId });
-                await ackSubmission(remote, submissionId, 'accepted');
+                await maybeAck(remote, submissionId, 'accepted');
                 return serializeSubmission(updated);
             }
-            const updated = setSubmissionStatus(db, submissionId, { status: 'rejected' });
+            const updated = await setSubmissionStatus(db, submissionId, { status: 'rejected' });
             if (updated === undefined) {
                 throw new InvalidTriageError();
             }
-            eventBus.emit({ type: 'submissions_pulled', projectId });
-            await ackSubmission(remote, submissionId, 'rejected');
+            await maybeAck(remote, submissionId, 'rejected');
             return serializeSubmission(updated);
         },
-        watchPush(projectId, remote, opts) {
-            return createWatchPush((id, rem) => this.push(id, rem), projectId, remote, opts);
-        },
     };
 }
 //# sourceMappingURL=sync.js.map