@plandesk/api 1.0.0-beta.8 → 1.0.0

package/dist/server.js

@@ -19,16 +19,13 @@ import { createGoalsRouter } from './routes/goals.js';
 import { createSubmissionsRouter } from './routes/submissions.js';
 import { createOrgsRouter } from './routes/orgs.js';
 import { createServices } from './services/index.js';
-import { ProjectNotInOrgError } from './services/scope.js';
+import { ProjectNotInOrgError, WorkspaceNotFoundError } from './services/scope.js';
 import { ReadOnlyTokenError } from './auth-context.js';
 import { PermissionDeniedError } from './permissions.js';
 export function createApp(deps) {
-    const services = deps.services ?? createServices({ db: deps.db });
-    const { projectService, goalService, taskService, tagService, canvasService, documentService, folderService, noteService, commentService, agentRunService, syncService, fileService, artifactService, shareService, } = services;
     const bindHost = deps.bindHost ?? '127.0.0.1';
-    const app = new Hono();
-    // Create better-auth before org middleware so the same instance is recognized
-    // by AuthContext and mounted at /api/auth/* (BA4a session recognition).
+    // Create better-auth before services so workspace resolution is available
+    // to the project service (REQ-6).
     const betterAuthInstance = deps.betterAuthInstance ??
         (deps.betterAuth !== undefined
             ? createBetterAuth({
@@ -39,6 +36,9 @@ export function createApp(deps) {
                 github: deps.github,
             })
             : undefined);
+    const services = deps.services ?? createServices({ db: deps.db, auth: betterAuthInstance });
+    const { projectService, goalService, taskService, tagService, canvasService, documentService, folderService, noteService, commentService, agentRunService, syncService, fileService, artifactService, shareService, } = services;
+    const app = new Hono();
     // Always-on org resolution (better-auth apiKey/session, loopback, or guest).
     app.use('*', createOrgAuthMiddleware({
         db: deps.db,
@@ -53,6 +53,9 @@ export function createApp(deps) {
         if (err instanceof ProjectNotInOrgError) {
             return c.json({ error: 'not_found' }, 404);
         }
+        if (err instanceof WorkspaceNotFoundError) {
+            return c.json({ error: 'not_found' }, 404);
+        }
         if (err instanceof ReadOnlyTokenError || err instanceof PermissionDeniedError) {
             return c.json({ error: 'forbidden' }, 403);
         }

package/dist/services/agent-runs.js

@@ -62,6 +62,15 @@ export function createAgentRunService(deps) {
             if (!run) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, run.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (terminalStatuses.has(run.status)) {
                 throw new InvalidAgentRunError('Agent run is already complete');
             }
@@ -74,6 +83,15 @@ export function createAgentRunService(deps) {
             if (!run) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, run.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (terminalStatuses.has(run.status)) {
                 throw new InvalidAgentRunError('Agent run is already complete');
             }

package/dist/services/artifacts.js

@@ -53,6 +53,15 @@ export function createArtifactService(deps) {
             if (!artifact) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, artifact.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             return serializeArtifact(artifact);
         },
         async update(id, input) {
@@ -61,6 +70,15 @@ export function createArtifactService(deps) {
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (input.title !== undefined) {
                 assertNonEmptyTitle(input.title);
             }

package/dist/services/canvas.js

@@ -167,6 +167,15 @@ export function createCanvasService(deps) {
         },
         async deleteEdge(projectId, edgeId) {
             assertPermission(deps, 'edge', 'delete');
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return false;
+                }
+                throw error;
+            }
             const edge = await getEdgeByProjectAndId(db, projectId, edgeId);
             if (!edge) {
                 return false;

package/dist/services/comments.js

@@ -1,4 +1,4 @@
-import { createComment, deleteComment as dbDeleteComment, getComment as dbGetComment, getDocument as dbGetDocument, getNote as dbGetNote, getProject, getSubmission, getTask, listCommentsByProject as dbListCommentsByProject, listCommentsByTarget as dbListCommentsByTarget, updateComment as dbUpdateComment, } from '@plandesk/db';
+import { createComment, deleteComment as dbDeleteComment, getComment as dbGetComment, getDocument as dbGetDocument, getNote as dbGetNote, getSubmission, getTask, listCommentsByProject as dbListCommentsByProject, listCommentsByTarget as dbListCommentsByTarget, listCommentsByTargetInProject as dbListCommentsByTargetInProject, updateComment as dbUpdateComment, } from '@plandesk/db';
 import { serializeComment } from '../serialize.js';
 import { assertPermission, resolveOrgId } from './org-scope.js';
 import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
@@ -39,6 +39,15 @@ export function createCommentService(deps) {
             if (!projectId) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             assertNonEmptyBody(input.body);
             const comment = await createComment(db, {
                 projectId,
@@ -55,8 +64,14 @@ export function createCommentService(deps) {
         // in the file identity mean it travels in the body/query, never a path seg.
         async createForArtifact(projectId, artifactId, input) {
             assertPermission(deps, 'comment', 'create');
-            if (!(await getProject(db, projectId))) {
-                return undefined;
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
             if (artifactId.trim() === '') {
                 throw new InvalidCommentError('Artifact id must not be empty');
@@ -73,16 +88,33 @@ export function createCommentService(deps) {
             return serializeComment(comment);
         },
         async listForArtifact(projectId, artifactId, options) {
-            if (!(await getProject(db, projectId))) {
-                return undefined;
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
             }
-            return (await dbListCommentsByTarget(db, 'artifact', artifactId, options)).map(serializeComment);
+            // Artifact ids (file paths) are not globally unique — scope by projectId
+            // so project A's list never returns project B's same-path comment.
+            return (await dbListCommentsByTargetInProject(db, 'artifact', artifactId, projectId, options)).map(serializeComment);
         },
         async listByTarget(target, options) {
             const projectId = await targetProjectId(db, target);
             if (!projectId) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             return (await dbListCommentsByTarget(db, target.type, target.id, options)).map(serializeComment);
         },
         async resolveTargetProjectId(target) {
@@ -109,6 +141,22 @@ export function createCommentService(deps) {
             if (!existing) {
                 return undefined;
             }
+            const projectId = await targetProjectId(db, {
+                type: existing.targetType,
+                id: existing.targetId,
+            });
+            if (!projectId) {
+                return undefined;
+            }
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (input.body !== undefined) {
                 assertNonEmptyBody(input.body);
             }
@@ -116,13 +164,6 @@ export function createCommentService(deps) {
             if (!comment) {
                 return undefined;
             }
-            const projectId = await targetProjectId(db, {
-                type: comment.targetType,
-                id: comment.targetId,
-            });
-            if (!projectId) {
-                return undefined;
-            }
             return serializeComment(comment);
         },
         async delete(id) {
@@ -138,6 +179,15 @@ export function createCommentService(deps) {
             if (!projectId) {
                 return false;
             }
+            try {
+                await assertProjectInOrg(db, projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return false;
+                }
+                throw error;
+            }
             const deleted = await dbDeleteComment(db, id);
             if (!deleted) {
                 return false;

package/dist/services/documents.js

@@ -103,6 +103,15 @@ export function createDocumentService(deps) {
             if (!document) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, document.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             return serializeDocument(document);
         },
         async update(id, input) {
@@ -111,6 +120,15 @@ export function createDocumentService(deps) {
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (input.linkedTaskId !== undefined && input.linkedTaskId !== null) {
                 await assertTaskInProject(db, existing.projectId, input.linkedTaskId);
             }
@@ -138,6 +156,15 @@ export function createDocumentService(deps) {
             if (!document) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, document.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             return serializeDocument(document);
         },
         async delete(id) {
@@ -146,6 +173,15 @@ export function createDocumentService(deps) {
             if (!existing) {
                 return false;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return false;
+                }
+                throw error;
+            }
             await withTransaction(db, async (tx) => {
                 await detachDocumentChildren(tx, id);
                 await deleteCommentsByTarget(tx, 'document', id);

package/dist/services/files.js

@@ -1,4 +1,5 @@
-import { getFile } from '@plandesk/db';
+import { getFile, getFileInOrg } from '@plandesk/db';
+import { tryGetAuthContext } from '../auth-context.js';
 import { assertPermission, resolveOrgId } from './org-scope.js';
 import { assertProjectInOrg, ProjectNotInOrgError } from './scope.js';
 export function createFileService(deps) {
@@ -31,6 +32,23 @@ export function createFileService(deps) {
             return { id, url, filename: file.filename, mime: file.mime, size: file.size };
         },
         async get(id) {
+            const auth = tryGetAuthContext();
+            if (auth === undefined || auth.kind === 'guest') {
+                return undefined;
+            }
+            const file = await getFileInOrg(db, id, auth.orgId);
+            if (!file) {
+                return undefined;
+            }
+            try {
+                await assertProjectInOrg(db, file.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             const resolved = await storage.resolve(id);
             return resolved ?? undefined;
         },

package/dist/services/folders.js

@@ -75,6 +75,15 @@ export function createFolderService(deps) {
             if (!folder) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, folder.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             return serializeFolder(folder);
         },
         async update(id, input) {
@@ -83,6 +92,15 @@ export function createFolderService(deps) {
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (input.name !== undefined) {
                 assertNonEmptyName(input.name);
             }
@@ -105,6 +123,15 @@ export function createFolderService(deps) {
             if (!existing) {
                 return false;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return false;
+                }
+                throw error;
+            }
             // Never orphan: children folders and contained documents move to the
             // deleted folder's parent (or root when the folder was at root).
             await withTransaction(db, async (tx) => {

package/dist/services/goals.js

@@ -190,6 +190,15 @@ export function createGoalService(deps) {
             if (!goal) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, goal.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             return {
                 ...serializeGoal(goal),
                 cycle_tasks: await cycleTasksForGoal(db, goal.projectId, goalId),
@@ -213,6 +222,15 @@ export function createGoalService(deps) {
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             validateVerificationSurfaceInput(input.verificationSurface);
             const goal = await withTransaction(db, async (tx) => updateGoal(tx, goalId, input));
             if (!goal) {
@@ -226,6 +244,15 @@ export function createGoalService(deps) {
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (existing.status !== 'active') {
                 throw new InvalidGoalTransitionError('Goal can only be paused from active status');
             }
@@ -241,6 +268,15 @@ export function createGoalService(deps) {
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (existing.status !== 'paused') {
                 throw new InvalidGoalTransitionError('Goal can only be resumed from paused status');
             }
@@ -256,6 +292,15 @@ export function createGoalService(deps) {
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (existing.status === 'complete') {
                 throw new InvalidGoalTransitionError('Goal is already complete');
             }

package/dist/services/index.d.ts

@@ -1,4 +1,5 @@
 import type { Db } from '@plandesk/db';
+import type { BetterAuthInstance } from '../better-auth.js';
 import { type StorageAdapter } from '../storage/index.js';
 import { type CanvasService } from './canvas.js';
 import { type CommentService } from './comments.js';
@@ -19,6 +20,8 @@ export type ServicesDeps = {
     storage?: StorageAdapter;
     /** Fixed org scope for unit tests; production request path uses auth context. */
     orgId?: string;
+    /** better-auth instance for workspace resolution (project creation). */
+    auth?: BetterAuthInstance;
 };
 export type Services = {
     projectService: ProjectService;

package/dist/services/index.js

@@ -14,7 +14,7 @@ import { createTaskService } from './tasks.js';
 import { createShareService } from './share.js';
 import { createSyncService } from './sync.js';
 export function createServices(deps) {
-    const scoped = { db: deps.db, orgId: deps.orgId };
+    const scoped = { db: deps.db, orgId: deps.orgId, auth: deps.auth };
     const storage = deps.storage ?? createStorageAdapter({ db: deps.db });
     const projectService = createProjectService(scoped);
     const goalService = createGoalService(scoped);

package/dist/services/notes.js

@@ -52,6 +52,15 @@ export function createNoteService(deps) {
             if (!note) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, note.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             return serializeNote(note);
         },
         async update(id, input) {
@@ -60,6 +69,15 @@ export function createNoteService(deps) {
             if (!existing) {
                 return undefined;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return undefined;
+                }
+                throw error;
+            }
             if (input.title !== undefined) {
                 assertNonEmptyTitle(input.title);
             }
@@ -75,6 +93,15 @@ export function createNoteService(deps) {
             if (!existing) {
                 return false;
             }
+            try {
+                await assertProjectInOrg(db, existing.projectId, resolveOrgId(deps));
+            }
+            catch (error) {
+                if (error instanceof ProjectNotInOrgError) {
+                    return false;
+                }
+                throw error;
+            }
             const deleted = await dbDeleteNote(db, id);
             if (!deleted) {
                 return false;

package/dist/services/projects.d.ts

@@ -1,4 +1,5 @@
 import { type Db, type TaskStatus } from '@plandesk/db';
+import type { BetterAuthInstance } from '../better-auth.js';
 import { serializeEdge, serializeProject, serializeTask, type PaginationParams, type SerializedDocument, type TaskStatusSummary } from '../serialize.js';
 import { type OrgScopedDeps } from './org-scope.js';
 type SerializedProject = ReturnType<typeof serializeProject>;
@@ -33,6 +34,10 @@ export type ScaffoldPlanInput = {
     /** Name for a new project. Required when projectId is omitted; ignored when it is set. */
     name?: string;
     description?: string | null;
+    /** Target workspace (team) for a new project. A workspace/project-scoped agent
+     * key must target its own scope (or omit this to default to it); a mismatch is
+     * a 404. Ignored when projectId is set. */
+    workspaceId?: string;
     tasks: ScaffoldTaskInput[];
     edges?: ScaffoldEdgeInput[];
     documents?: ScaffoldDocumentInput[];
@@ -51,10 +56,12 @@ export type ScaffoldPlanResult = {
 };
 export type ProjectServiceDeps = OrgScopedDeps & {
     db: Db;
+    auth?: BetterAuthInstance;
 };
 export type CreateProjectInput = {
     name: string;
     description?: string | null;
+    workspaceId?: string;
 };
 export type UpdateProjectInput = {
     name?: string;
@@ -65,6 +72,7 @@ export declare function createProjectService(deps: ProjectServiceDeps): {
         id: string;
         name: string;
         description: string | null;
+        workspace_id: string;
         created_at: string;
         updated_at: string;
     }>;
@@ -72,6 +80,7 @@ export declare function createProjectService(deps: ProjectServiceDeps): {
         id: string;
         name: string;
         description: string | null;
+        workspace_id: string;
         created_at: string;
         updated_at: string;
     }[]>;
@@ -80,6 +89,7 @@ export declare function createProjectService(deps: ProjectServiceDeps): {
         id: string;
         name: string;
         description: string | null;
+        workspace_id: string;
         created_at: string;
         updated_at: string;
     } | undefined>;
@@ -87,6 +97,23 @@ export declare function createProjectService(deps: ProjectServiceDeps): {
         id: string;
         name: string;
         description: string | null;
+        workspace_id: string;
+        created_at: string;
+        updated_at: string;
+    } | undefined>;
+    /**
+     * Move a project to another workspace (team) in the caller's org.
+     *
+     * Owner-gated: a workspace/project-scoped agent key must not move projects
+     * (it would drag a project out of its scope), so scoped callers are rejected
+     * before any existence check. Requires project:create authority (owner/admin).
+     * The target team must exist in the caller's org; otherwise 404.
+     */
+    moveProjectToWorkspace(id: string, workspaceId: string): Promise<{
+        id: string;
+        name: string;
+        description: string | null;
+        workspace_id: string;
         created_at: string;
         updated_at: string;
     } | undefined>;