@plandesk/api 0.20.0 → 1.0.0-beta.1

package/dist/routes/comments.js

@@ -9,7 +9,7 @@ async function handleCreateComment(c, commentService, target) {
         return c.json({ error: 'invalid_argument' }, 400);
     }
     try {
-        const comment = commentService.create(target, {
+        const comment = await commentService.create(target, {
             body: body.body,
             passage: body.passage,
             anchor: body.anchor,
@@ -26,9 +26,9 @@ async function handleCreateComment(c, commentService, target) {
         throw error;
     }
 }
-function handleListComments(c, commentService, target) {
+async function handleListComments(c, commentService, target) {
     const includeResolved = parseIncludeResolved(c.req.query('include_resolved'));
-    const comments = commentService.listByTarget(target, { includeResolved });
+    const comments = await commentService.listByTarget(target, { includeResolved });
     if (!comments) {
         return c.json({ error: 'not_found' }, 404);
     }
@@ -44,9 +44,9 @@ export function createCommentsRouter(commentService) {
     router.get('/notes/:id/comments', (c) => handleListComments(c, commentService, { type: 'note', id: c.req.param('id') }));
     router.post('/submissions/:id/comments', (c) => handleCreateComment(c, commentService, { type: 'submission', id: c.req.param('id') }));
     router.get('/submissions/:id/comments', (c) => handleListComments(c, commentService, { type: 'submission', id: c.req.param('id') }));
-    router.get('/projects/:id/comments', (c) => {
+    router.get('/projects/:id/comments', async (c) => {
         const includeResolved = parseIncludeResolved(c.req.query('include_resolved'));
-        const comments = commentService.listByProject(c.req.param('id'), { includeResolved });
+        const comments = await commentService.listByProject(c.req.param('id'), { includeResolved });
         if (!comments) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -61,7 +61,7 @@ export function createCommentsRouter(commentService) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
         try {
-            const comment = commentService.createForArtifact(c.req.param('id'), body.artifact_id, {
+            const comment = await commentService.createForArtifact(c.req.param('id'), body.artifact_id, {
                 body: body.body,
                 passage: body.passage,
                 anchor: body.anchor,
@@ -78,13 +78,13 @@ export function createCommentsRouter(commentService) {
             throw error;
         }
     });
-    router.get('/projects/:id/artifact-comments', (c) => {
+    router.get('/projects/:id/artifact-comments', async (c) => {
         const artifactId = c.req.query('artifact_id');
         if (artifactId === undefined || artifactId === '') {
             return c.json({ error: 'invalid_argument' }, 400);
         }
         const includeResolved = parseIncludeResolved(c.req.query('include_resolved'));
-        const comments = commentService.listForArtifact(c.req.param('id'), artifactId, {
+        const comments = await commentService.listForArtifact(c.req.param('id'), artifactId, {
             includeResolved,
         });
         if (!comments) {
@@ -95,7 +95,7 @@ export function createCommentsRouter(commentService) {
     router.patch('/comments/:id', async (c) => {
         const body = await c.req.json();
         try {
-            const comment = commentService.update(c.req.param('id'), {
+            const comment = await commentService.update(c.req.param('id'), {
                 ...(body.body !== undefined ? { body: body.body } : {}),
                 ...(body.resolved !== undefined ? { resolved: body.resolved } : {}),
             });
@@ -111,8 +111,8 @@ export function createCommentsRouter(commentService) {
             throw error;
         }
     });
-    router.delete('/comments/:id', (c) => {
-        const deleted = commentService.delete(c.req.param('id'));
+    router.delete('/comments/:id', async (c) => {
+        const deleted = await commentService.delete(c.req.param('id'));
         if (!deleted) {
             return c.json({ error: 'not_found' }, 404);
         }

package/dist/routes/documents.js

@@ -15,12 +15,12 @@ function resolveLinkedTaskId(body) {
 }
 export function createDocumentsRouter(documentService) {
     const router = new Hono();
-    router.get('/projects/:id/documents', (c) => {
+    router.get('/projects/:id/documents', async (c) => {
         const pagination = parsePaginationParams(c.req.query('limit'), c.req.query('offset'));
         if (pagination === 'invalid') {
             return c.json({ error: 'invalid_argument' }, 400);
         }
-        const tree = documentService.listTree(c.req.param('id'), pagination);
+        const tree = await documentService.listTree(c.req.param('id'), pagination);
         if (!tree) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -32,7 +32,7 @@ export function createDocumentsRouter(documentService) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
         try {
-            const document = documentService.create(c.req.param('id'), {
+            const document = await documentService.create(c.req.param('id'), {
                 title: body.title,
                 body: body.body,
                 statusLine: body.status_line,
@@ -52,8 +52,8 @@ export function createDocumentsRouter(documentService) {
             throw error;
         }
     });
-    router.get('/documents/:id', (c) => {
-        const document = documentService.get(c.req.param('id'));
+    router.get('/documents/:id', async (c) => {
+        const document = await documentService.get(c.req.param('id'));
         if (!document) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -63,7 +63,7 @@ export function createDocumentsRouter(documentService) {
         const body = await c.req.json();
         const linkedTaskId = resolveLinkedTaskId(body);
         try {
-            const document = documentService.update(c.req.param('id'), {
+            const document = await documentService.update(c.req.param('id'), {
                 ...(body.title !== undefined ? { title: body.title } : {}),
                 ...(body.body !== undefined ? { body: body.body } : {}),
                 ...(body.status_line !== undefined ? { statusLine: body.status_line } : {}),
@@ -83,15 +83,15 @@ export function createDocumentsRouter(documentService) {
             throw error;
         }
     });
-    router.delete('/documents/:id', (c) => {
-        const deleted = documentService.delete(c.req.param('id'));
+    router.delete('/documents/:id', async (c) => {
+        const deleted = await documentService.delete(c.req.param('id'));
         if (!deleted) {
             return c.json({ error: 'not_found' }, 404);
         }
         return c.body(null, 204);
     });
-    router.get('/tasks/:id/document', (c) => {
-        const document = documentService.getByTask(c.req.param('id'));
+    router.get('/tasks/:id/document', async (c) => {
+        const document = await documentService.getByTask(c.req.param('id'));
         if (!document) {
             return c.json({ error: 'not_found' }, 404);
         }

package/dist/routes/folders.js

@@ -2,8 +2,8 @@ import { Hono } from 'hono';
 import { InvalidFolderError } from '../services/folders.js';
 export function createFoldersRouter(folderService) {
     const router = new Hono();
-    router.get('/projects/:id/folders', (c) => {
-        const folders = folderService.list(c.req.param('id'));
+    router.get('/projects/:id/folders', async (c) => {
+        const folders = await folderService.list(c.req.param('id'));
         if (!folders) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -15,7 +15,7 @@ export function createFoldersRouter(folderService) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
         try {
-            const folder = folderService.create(c.req.param('id'), {
+            const folder = await folderService.create(c.req.param('id'), {
                 name: body.name,
                 parentFolderId: body.parent_folder_id,
             });
@@ -31,8 +31,8 @@ export function createFoldersRouter(folderService) {
             throw error;
         }
     });
-    router.get('/folders/:id', (c) => {
-        const folder = folderService.get(c.req.param('id'));
+    router.get('/folders/:id', async (c) => {
+        const folder = await folderService.get(c.req.param('id'));
         if (!folder) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -41,7 +41,7 @@ export function createFoldersRouter(folderService) {
     router.patch('/folders/:id', async (c) => {
         const body = await c.req.json();
         try {
-            const folder = folderService.update(c.req.param('id'), {
+            const folder = await folderService.update(c.req.param('id'), {
                 ...(body.name !== undefined ? { name: body.name } : {}),
                 ...(body.parent_folder_id !== undefined ? { parentFolderId: body.parent_folder_id } : {}),
             });
@@ -57,8 +57,8 @@ export function createFoldersRouter(folderService) {
             throw error;
         }
     });
-    router.delete('/folders/:id', (c) => {
-        const deleted = folderService.delete(c.req.param('id'));
+    router.delete('/folders/:id', async (c) => {
+        const deleted = await folderService.delete(c.req.param('id'));
         if (!deleted) {
             return c.json({ error: 'not_found' }, 404);
         }

package/dist/routes/goals.js

@@ -46,7 +46,7 @@ export function createGoalsRouter(goalService) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
         try {
-            const goal = goalService.create(c.req.param('id'), {
+            const goal = await goalService.create(c.req.param('id'), {
                 objective: body.objective,
                 ...(body.status !== undefined ? { status: body.status } : {}),
                 ...mapGoalInput(body),
@@ -60,15 +60,15 @@ export function createGoalsRouter(goalService) {
             return handleGoalError(c, error);
         }
     });
-    router.get('/projects/:id/goals', (c) => {
-        const goals = goalService.listByProject(c.req.param('id'));
+    router.get('/projects/:id/goals', async (c) => {
+        const goals = await goalService.listByProject(c.req.param('id'));
         if (!goals) {
             return c.json({ error: 'not_found' }, 404);
         }
         return c.json(goals);
     });
-    router.get('/goals/:id', (c) => {
-        const goal = goalService.get(c.req.param('id'));
+    router.get('/goals/:id', async (c) => {
+        const goal = await goalService.get(c.req.param('id'));
         if (!goal) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -80,7 +80,7 @@ export function createGoalsRouter(goalService) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
         try {
-            const goal = goalService.update(c.req.param('id'), mapGoalInput(body));
+            const goal = await goalService.update(c.req.param('id'), mapGoalInput(body));
             if (!goal) {
                 return c.json({ error: 'not_found' }, 404);
             }
@@ -90,9 +90,9 @@ export function createGoalsRouter(goalService) {
             return handleGoalError(c, error);
         }
     });
-    router.post('/goals/:id/pause', (c) => {
+    router.post('/goals/:id/pause', async (c) => {
         try {
-            const goal = goalService.pause(c.req.param('id'));
+            const goal = await goalService.pause(c.req.param('id'));
             if (!goal) {
                 return c.json({ error: 'not_found' }, 404);
             }
@@ -102,9 +102,9 @@ export function createGoalsRouter(goalService) {
             return handleGoalError(c, error);
         }
     });
-    router.post('/goals/:id/resume', (c) => {
+    router.post('/goals/:id/resume', async (c) => {
         try {
-            const goal = goalService.resume(c.req.param('id'));
+            const goal = await goalService.resume(c.req.param('id'));
             if (!goal) {
                 return c.json({ error: 'not_found' }, 404);
             }
@@ -123,7 +123,7 @@ export function createGoalsRouter(goalService) {
             // empty body is valid when the goal has no verification_surface
         }
         try {
-            const goal = goalService.complete(c.req.param('id'), body.evidence);
+            const goal = await goalService.complete(c.req.param('id'), body.evidence);
             if (!goal) {
                 return c.json({ error: 'not_found' }, 404);
             }

package/dist/routes/notes.js

@@ -3,12 +3,12 @@ import { InvalidNoteError } from '../services/notes.js';
 import { parsePaginationParams } from '../serialize.js';
 export function createNotesRouter(noteService) {
     const router = new Hono();
-    router.get('/projects/:id/notes', (c) => {
+    router.get('/projects/:id/notes', async (c) => {
         const pagination = parsePaginationParams(c.req.query('limit'), c.req.query('offset'));
         if (pagination === 'invalid') {
             return c.json({ error: 'invalid_argument' }, 400);
         }
-        const notes = noteService.list(c.req.param('id'), pagination);
+        const notes = await noteService.list(c.req.param('id'), pagination);
         if (!notes) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -20,7 +20,7 @@ export function createNotesRouter(noteService) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
         try {
-            const note = noteService.create(c.req.param('id'), {
+            const note = await noteService.create(c.req.param('id'), {
                 title: body.title,
                 body: body.body,
             });
@@ -36,8 +36,8 @@ export function createNotesRouter(noteService) {
             throw error;
         }
     });
-    router.get('/notes/:id', (c) => {
-        const note = noteService.get(c.req.param('id'));
+    router.get('/notes/:id', async (c) => {
+        const note = await noteService.get(c.req.param('id'));
         if (!note) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -46,7 +46,7 @@ export function createNotesRouter(noteService) {
     router.patch('/notes/:id', async (c) => {
         const body = await c.req.json();
         try {
-            const note = noteService.update(c.req.param('id'), {
+            const note = await noteService.update(c.req.param('id'), {
                 ...(body.title !== undefined ? { title: body.title } : {}),
                 ...(body.body !== undefined ? { body: body.body } : {}),
             });
@@ -62,8 +62,8 @@ export function createNotesRouter(noteService) {
             throw error;
         }
     });
-    router.delete('/notes/:id', (c) => {
-        const deleted = noteService.delete(c.req.param('id'));
+    router.delete('/notes/:id', async (c) => {
+        const deleted = await noteService.delete(c.req.param('id'));
         if (!deleted) {
             return c.json({ error: 'not_found' }, 404);
         }

package/dist/routes/orgs.d.ts

@@ -0,0 +1,17 @@
+import { Hono } from 'hono';
+import { type Db } from '@plandesk/db';
+import type { BetterAuthInstance } from '../better-auth.js';
+export type OrgsRouterOptions = {
+    betterAuth?: BetterAuthInstance;
+    /** Base URL for claim links returned from invitations (no trailing slash required). */
+    baseURL?: string;
+};
+/**
+ * There is deliberately no `POST /orgs`.
+ *
+ * An org is only ever created by better-auth identity provisioning (BA4c) or by
+ * `ensureLocalBetterAuthOrganization` at `serve` boot for the local single-org case.
+ * Both bound creation by construction, which is why no quota is needed to bound it.
+ */
+export declare function createOrgsRouter(db: Db, options?: OrgsRouterOptions): Hono;
+//# sourceMappingURL=orgs.d.ts.map

package/dist/routes/orgs.js

@@ -0,0 +1,241 @@
+import { Hono } from 'hono';
+import { getProjectInOrg, importProject, InvalidExportVersionError, PLANDESK_EXPORT_VERSION, } from '@plandesk/db';
+import { createScopedAgentKey } from '../agent-keys.js';
+import { getAuthContext, getOrgAuthContext } from '../auth-context.js';
+import { acceptOrganizationInvitation, createOrganizationInvitation, isAuthApiError, isInvitationRole, } from '../invitations.js';
+import { getOrganizationById } from '../organizations.js';
+import { requirePermission } from '../permissions.js';
+function isPermissionSet(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    for (const actions of Object.values(value)) {
+        if (!Array.isArray(actions) ||
+            !actions.every((action) => typeof action === 'string')) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Resolve the better-auth user id that will own the minted agent key.
+ * Apikey (owner key) carries userId; session needs a better-auth session cookie.
+ */
+async function resolveMintUserId(betterAuth, headers) {
+    const ctx = getAuthContext();
+    if (ctx.kind === 'apikey') {
+        return ctx.userId;
+    }
+    if (ctx.kind === 'session') {
+        const baSession = await betterAuth.api.getSession({ headers });
+        if (baSession === null) {
+            return undefined;
+        }
+        return baSession.user.id;
+    }
+    return undefined;
+}
+/**
+ * There is deliberately no `POST /orgs`.
+ *
+ * An org is only ever created by better-auth identity provisioning (BA4c) or by
+ * `ensureLocalBetterAuthOrganization` at `serve` boot for the local single-org case.
+ * Both bound creation by construction, which is why no quota is needed to bound it.
+ */
+export function createOrgsRouter(db, options = {}) {
+    const router = new Hono();
+    const betterAuth = options.betterAuth;
+    const baseURL = options.baseURL ?? 'http://127.0.0.1';
+    async function requireKnownOrg(orgId) {
+        if (getOrgAuthContext().orgId !== orgId) {
+            return false;
+        }
+        if (betterAuth === undefined) {
+            return true;
+        }
+        return (await getOrganizationById(betterAuth, orgId)) !== undefined;
+    }
+    /**
+     * BA4b-3: mint a project-scoped agent key for `plandesk connect --to`.
+     * Caller must hold apiKey:create (owner key or session owner) — agent keys cannot.
+     * Raw key returned once; metadata is { projectId, orgId } (agent profile).
+     */
+    router.post('/orgs/:orgId/agent-keys', async (c) => {
+        if (betterAuth === undefined) {
+            return c.json({ error: 'unavailable' }, 503);
+        }
+        const orgId = c.req.param('orgId');
+        if (!(await requireKnownOrg(orgId))) {
+            return c.json({ error: 'not_found' }, 404);
+        }
+        requirePermission(getOrgAuthContext(), 'apiKey', 'create');
+        const body = await c.req.json();
+        if (typeof body.project_id !== 'string' || body.project_id.trim() === '') {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        const projectId = body.project_id.trim();
+        const project = await getProjectInOrg(db, projectId, orgId);
+        if (project === undefined) {
+            return c.json({ error: 'not_found' }, 404);
+        }
+        let permissions;
+        if (body.permissions !== undefined) {
+            if (!isPermissionSet(body.permissions)) {
+                return c.json({ error: 'invalid_argument' }, 400);
+            }
+            permissions = body.permissions;
+        }
+        let name;
+        if (body.name !== undefined) {
+            if (typeof body.name !== 'string' || body.name.trim() === '') {
+                return c.json({ error: 'invalid_argument' }, 400);
+            }
+            name = body.name.trim();
+        }
+        const userId = await resolveMintUserId(betterAuth, c.req.raw.headers);
+        if (userId === undefined) {
+            return c.json({ error: 'unauthorized' }, 401);
+        }
+        const mintInput = {
+            auth: betterAuth,
+            userId,
+            orgId,
+            projectId,
+            ...(permissions !== undefined ? { permissions } : {}),
+            ...(name !== undefined ? { name } : {}),
+        };
+        const minted = await createScopedAgentKey(mintInput);
+        return c.json({ token: minted.key, project_id: projectId }, 200);
+    });
+    /**
+     * BA3c: invite by email (link-only, no mailer). Session owner only
+     * (member:create). Returns claimUrl for the inviter to deliver by hand.
+     */
+    router.post('/orgs/:id/invitations', async (c) => {
+        const orgId = c.req.param('id');
+        if (!(await requireKnownOrg(orgId))) {
+            return c.json({ error: 'not_found' }, 404);
+        }
+        const authCtx = getOrgAuthContext();
+        // Session owner only — token/loopback cannot drive better-auth createInvitation.
+        if (authCtx.kind !== 'session') {
+            return c.json({ error: 'forbidden' }, 403);
+        }
+        requirePermission(authCtx, 'member', 'create');
+        if (betterAuth === undefined) {
+            return c.json({ error: 'unavailable' }, 503);
+        }
+        const body = await c.req.json();
+        if (typeof body.email !== 'string' || body.email.trim() === '') {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        if (typeof body.role !== 'string' || !isInvitationRole(body.role)) {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        try {
+            const created = await createOrganizationInvitation(betterAuth, {
+                email: body.email,
+                role: body.role,
+                organizationId: orgId,
+                headers: c.req.raw.headers,
+                baseURL,
+            });
+            return c.json({
+                invitationId: created.invitationId,
+                claimUrl: created.claimUrl,
+            }, 201);
+        }
+        catch (err) {
+            if (isAuthApiError(err)) {
+                if (err.statusCode === 403 || err.status === 'FORBIDDEN') {
+                    return c.json({ error: 'forbidden' }, 403);
+                }
+                return c.json({ error: 'invalid_argument', message: err.message }, 400);
+            }
+            throw err;
+        }
+    });
+    /**
+     * BA3c: accept invitation. Session-gated at the handler (public path so
+     * org-less invitees can reach it); not org-gated. Single-use → 410 on retry.
+     */
+    router.post('/invitations/:invitationId/accept', async (c) => {
+        if (betterAuth === undefined) {
+            return c.json({ error: 'unavailable' }, 503);
+        }
+        const invitationId = c.req.param('invitationId');
+        if (invitationId.trim() === '') {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        const session = await betterAuth.api.getSession({ headers: c.req.raw.headers });
+        if (session === null) {
+            return c.json({ error: 'unauthorized' }, 401);
+        }
+        try {
+            const result = await acceptOrganizationInvitation(betterAuth, {
+                invitationId,
+                headers: c.req.raw.headers,
+            });
+            return c.json({
+                invitationId: result.invitation.id,
+                organizationId: result.member.organizationId,
+                role: result.member.role,
+                userId: result.member.userId,
+            }, 200);
+        }
+        catch (err) {
+            if (isAuthApiError(err)) {
+                // Already accepted / expired / missing → single-use CAS failure.
+                if (err.statusCode === 400 ||
+                    err.status === 'BAD_REQUEST' ||
+                    err.message.toLowerCase().includes('invitation')) {
+                    return c.json({ error: 'gone', message: err.message }, 410);
+                }
+                if (err.statusCode === 403 || err.status === 'FORBIDDEN') {
+                    return c.json({ error: 'forbidden' }, 403);
+                }
+                return c.json({ error: 'invalid_argument', message: err.message }, 400);
+            }
+            throw err;
+        }
+    });
+    // Promote a portable export into this org (one-way authority handoff).
+    router.post('/orgs/:id/import', async (c) => {
+        const orgId = c.req.param('id');
+        // Org-scoped: token for org-B cannot import into org-A.
+        if (!(await requireKnownOrg(orgId))) {
+            return c.json({ error: 'not_found' }, 404);
+        }
+        requirePermission(getOrgAuthContext(), 'organization', 'update');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        if (body === null || typeof body !== 'object') {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        const data = body;
+        if (typeof data.version !== 'string' || data.version !== PLANDESK_EXPORT_VERSION) {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        if (data.project === undefined || typeof data.project !== 'object') {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        try {
+            // orgId always from authenticated path/context — never from the body.
+            const { projectId } = await importProject(db, data, { orgId });
+            return c.json({ globalProjectId: projectId }, 201);
+        }
+        catch (err) {
+            if (err instanceof InvalidExportVersionError) {
+                return c.json({ error: 'invalid_argument' }, 400);
+            }
+            throw err;
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=orgs.js.map

package/dist/routes/projects.js

@@ -6,26 +6,26 @@ import { isStringArray } from './tasks.js';
 import { parsePaginationParams } from '../serialize.js';
 export function createProjectsRouter(projectService, taskService) {
     const router = new Hono();
-    router.get('/projects', (c) => {
+    router.get('/projects', async (c) => {
         const pagination = parsePaginationParams(c.req.query('limit'), c.req.query('offset'));
         if (pagination === 'invalid') {
             return c.json({ error: 'invalid_argument' }, 400);
         }
-        return c.json(projectService.list(pagination));
+        return c.json(await projectService.list(pagination));
     });
     router.post('/projects', async (c) => {
         const body = await c.req.json();
         if (typeof body.name !== 'string' || body.name.trim() === '') {
             return c.json({ error: 'invalid_argument' }, 400);
         }
-        const project = projectService.create({
+        const project = await projectService.create({
             name: body.name,
             description: body.description,
         });
         return c.json(project, 201);
     });
-    router.get('/projects/:id', (c) => {
-        const project = projectService.get(c.req.param('id'));
+    router.get('/projects/:id', async (c) => {
+        const project = await projectService.get(c.req.param('id'));
         if (!project) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -36,7 +36,7 @@ export function createProjectsRouter(projectService, taskService) {
         if (body.name !== undefined && (typeof body.name !== 'string' || body.name.trim() === '')) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
-        const project = projectService.update(c.req.param('id'), {
+        const project = await projectService.update(c.req.param('id'), {
             ...(body.name !== undefined ? { name: body.name } : {}),
             ...(body.description !== undefined ? { description: body.description } : {}),
         });
@@ -45,8 +45,8 @@ export function createProjectsRouter(projectService, taskService) {
         }
         return c.json(project);
     });
-    router.delete('/projects/:id', (c) => {
-        const deleted = projectService.delete(c.req.param('id'));
+    router.delete('/projects/:id', async (c) => {
+        const deleted = await projectService.delete(c.req.param('id'));
         if (!deleted) {
             return c.json({ error: 'not_found' }, 404);
         }
@@ -74,7 +74,7 @@ export function createProjectsRouter(projectService, taskService) {
             dueDate = null;
         }
         try {
-            const task = taskService.create(c.req.param('id'), {
+            const task = await taskService.create(c.req.param('id'), {
                 label: body.label,
                 ...(body.status !== undefined ? { status: body.status } : {}),
                 ...(body.description !== undefined ? { description: body.description } : {}),
@@ -99,7 +99,7 @@ export function createProjectsRouter(projectService, taskService) {
             throw error;
         }
     });
-    router.get('/projects/:id/tasks', (c) => {
+    router.get('/projects/:id/tasks', async (c) => {
         try {
             const pagination = parsePaginationParams(c.req.query('limit'), c.req.query('offset'));
             if (pagination === 'invalid') {
@@ -109,7 +109,7 @@ export function createProjectsRouter(projectService, taskService) {
             // Repeated ?tag= params filter with OR semantics (task matches if it has
             // ANY of the given tags).
             const tags = c.req.queries('tag');
-            const tasks = taskService.listByProject(c.req.param('id'), { status, ...(tags !== undefined && tags.length > 0 ? { tags } : {}) }, pagination);
+            const tasks = await taskService.listByProject(c.req.param('id'), { status, ...(tags !== undefined && tags.length > 0 ? { tags } : {}) }, pagination);
             if (!tasks) {
                 return c.json({ error: 'not_found' }, 404);
             }
@@ -122,8 +122,8 @@ export function createProjectsRouter(projectService, taskService) {
             throw error;
         }
     });
-    router.get('/projects/:id/next-task', (c) => {
-        const result = taskService.nextActionable(c.req.param('id'));
+    router.get('/projects/:id/next-task', async (c) => {
+        const result = await taskService.nextActionable(c.req.param('id'));
         if (!result) {
             return c.json({ error: 'not_found' }, 404);
         }