@plandesk/api 1.0.0-beta.8 → 1.0.2

package/dist/invitations.js

@@ -6,6 +6,7 @@
  * call via runtime-validated Reflect, same pattern as agent-keys.ts.
  */
 import { makeSignature } from 'better-auth/crypto';
+import { ensureDefaultTeamForOrg } from './identity.js';
 export const INVITATION_ROLES = ['owner', 'admin', 'member'];
 export function isInvitationRole(value) {
     return INVITATION_ROLES.includes(value);
@@ -46,6 +47,7 @@ function parseInvitation(raw) {
         email: typeof raw.email === 'string' ? raw.email : '',
         role: typeof raw.role === 'string' ? raw.role : '',
         organizationId: typeof raw.organizationId === 'string' ? raw.organizationId : '',
+        teamId: typeof raw.teamId === 'string' && raw.teamId.length > 0 ? raw.teamId : null,
         inviterId: typeof raw.inviterId === 'string' ? raw.inviterId : '',
         status: typeof raw.status === 'string' ? raw.status : '',
         expiresAt: raw.expiresAt instanceof Date ? raw.expiresAt : new Date(String(raw.expiresAt ?? '')),
@@ -53,8 +55,10 @@ function parseInvitation(raw) {
     };
 }
 /**
- * Create an invitation using the caller's better-auth session (Cookie headers).
- * No mailer: sendInvitationEmail is unset; caller delivers claimUrl by hand.
+ * Create a workspace-scoped invitation using the caller's better-auth session
+ * (Cookie headers). The invitee joins the org AND the team on accept
+ * (better-auth does both when teamId is set). No mailer: caller delivers
+ * claimUrl by hand.
  */
 export async function createOrganizationInvitation(auth, opts) {
     const raw = await callPluginApi(auth, 'createInvitation', {
@@ -62,6 +66,7 @@ export async function createOrganizationInvitation(auth, opts) {
             email: opts.email.trim().toLowerCase(),
             role: opts.role,
             organizationId: opts.organizationId,
+            teamId: opts.teamId,
         },
         headers: opts.headers,
     });
@@ -69,6 +74,8 @@ export async function createOrganizationInvitation(auth, opts) {
     return {
         invitationId: invitation.id,
         claimUrl: invitationClaimUrl(opts.baseURL, invitation.id),
+        organizationId: opts.organizationId,
+        teamId: opts.teamId,
         invitation,
     };
 }
@@ -196,13 +203,18 @@ export async function ensureShellOwner(auth, organizationId) {
 }
 /**
  * Shell-side owner invitation for `plandesk admin invite-owner` (no GitHub, no mailer).
+ * The owner role is org-level; teamId targets the org's default workspace so
+ * the bootstrap satisfies the workspace-scoped invite contract (the owner
+ * reaches every workspace via the owner role regardless).
  */
 export async function mintOwnerInvitation(auth, opts) {
     const { headers } = await ensureShellOwner(auth, opts.organizationId);
+    const teamId = await ensureDefaultTeamForOrg(auth, opts.organizationId);
     const created = await createOrganizationInvitation(auth, {
         email: opts.email,
         role: 'owner',
         organizationId: opts.organizationId,
+        teamId,
         headers,
         baseURL: opts.baseURL,
     });

package/dist/organizations.d.ts

@@ -33,6 +33,9 @@ export declare function listOrganizationMembers(auth: BetterAuthInstance, organi
 export type InvitationPreview = {
     organizationId: string;
     organizationName: string;
+    /** Workspace (team) the invitee will join; null for legacy team-less rows. */
+    workspaceId: string | null;
+    workspaceName: string;
     role: string;
     email: string;
     status: string;

package/dist/organizations.js

@@ -87,9 +87,27 @@ export async function getInvitationPreview(auth, invitationId) {
         model: 'organization',
         where: [{ field: 'id', value: invitation.organizationId }],
     });
+    // better-auth stores team ids comma-joined on the invitation row; take the
+    // first. Scoped by org so a stale/foreign id cannot leak a name.
+    const workspaceId = typeof invitation.teamId === 'string' && invitation.teamId.length > 0
+        ? invitation.teamId.split(',')[0]
+        : null;
+    let workspaceName = '';
+    if (workspaceId !== null) {
+        const team = await adapter.findOne({
+            model: 'team',
+            where: [
+                { field: 'id', value: workspaceId },
+                { field: 'organizationId', value: invitation.organizationId },
+            ],
+        });
+        workspaceName = team?.name ?? '';
+    }
     return {
         organizationId: invitation.organizationId,
         organizationName: org?.name ?? '',
+        workspaceId,
+        workspaceName,
         role: invitation.role,
         email: invitation.email,
         status: invitation.status,

package/dist/projection.d.ts

@@ -47,5 +47,33 @@ export type ClientView = {
         expires_at: string | null;
     };
 };
+export type WorkspaceClientView = {
+    kind: 'workspace';
+    workspace: {
+        id: string;
+        name: string;
+    };
+    projects: Array<{
+        id: string;
+        name: string;
+        view: ClientView;
+    }>;
+    share: {
+        audience_name: string;
+        permissions: {
+            read: boolean;
+            submit: boolean;
+        };
+        expires_at: string | null;
+    };
+};
+export type AnyClientView = ClientView | WorkspaceClientView;
 export declare function buildClientView(db: Db, projectId: string, share: Share): Promise<ClientView | undefined>;
+/**
+ * Workspace projection: the existing per-project ClientView for every project in
+ * the shared workspace. Reuses buildClientView per project (no reimplementation).
+ * The workspace name is unknown to the projects table — the caller may pass it;
+ * otherwise the workspace id stands in (the share was validated at creation).
+ */
+export declare function buildWorkspaceClientView(db: Db, workspaceId: string, share: Share, workspaceName?: string): Promise<WorkspaceClientView | undefined>;
 //# sourceMappingURL=projection.d.ts.map

package/dist/projection.js

@@ -1,4 +1,4 @@
-import { getProject, listDocuments, listEdges, listTasks, parseSharePermissions, parseSharePolicy, } from '@plandesk/db';
+import { getProject, listDocuments, listEdges, listProjectsByWorkspace, listTasks, parseSharePermissions, parseSharePolicy, } from '@plandesk/db';
 function buildProgress(tasks) {
     const progress = {};
     for (const task of tasks) {
@@ -72,4 +72,32 @@ export async function buildClientView(db, projectId, share) {
         },
     };
 }
+/**
+ * Workspace projection: the existing per-project ClientView for every project in
+ * the shared workspace. Reuses buildClientView per project (no reimplementation).
+ * The workspace name is unknown to the projects table — the caller may pass it;
+ * otherwise the workspace id stands in (the share was validated at creation).
+ */
+export async function buildWorkspaceClientView(db, workspaceId, share, workspaceName) {
+    const workspaceProjects = await listProjectsByWorkspace(db, workspaceId);
+    const permissions = parseSharePermissions(share);
+    const projects = [];
+    for (const project of workspaceProjects) {
+        const view = await buildClientView(db, project.id, share);
+        if (view === undefined) {
+            continue;
+        }
+        projects.push({ id: project.id, name: project.name, view });
+    }
+    return {
+        kind: 'workspace',
+        workspace: { id: workspaceId, name: workspaceName ?? workspaceId },
+        projects,
+        share: {
+            audience_name: share.audienceName,
+            permissions,
+            expires_at: share.expiresAt?.toISOString() ?? null,
+        },
+    };
+}
 //# sourceMappingURL=projection.js.map

package/dist/routes/auth.js

@@ -1,6 +1,7 @@
 import { Hono } from 'hono';
 import { createOrgOwnerKey } from '../agent-keys.js';
 import { getAuthContext } from '../auth-context.js';
+import { getActiveTeamForSession, listTeamsForOrg, } from '../identity.js';
 import { listOrganizationsForUser, resolveOrganizationName } from '../organizations.js';
 import { requirePermission } from '../permissions.js';
 export function createAuthRouter(deps) {
@@ -27,12 +28,25 @@ export function createAuthRouter(deps) {
         let orgs = [
             { id: org.id, name: org.name, role: ctx.role ?? 'member' },
         ];
-        if (ctx.kind === 'session' && betterAuth !== undefined) {
-            const session = await betterAuth.api.getSession({ headers: c.req.raw.headers });
-            if (session === null) {
-                return c.json({ error: 'unauthorized' }, 401);
+        let activeWorkspace = null;
+        let workspaces = [];
+        if (betterAuth !== undefined) {
+            workspaces = await listTeamsForOrg(betterAuth, ctx.orgId);
+            if (ctx.kind === 'session') {
+                const session = await betterAuth.api.getSession({ headers: c.req.raw.headers });
+                if (session === null) {
+                    return c.json({ error: 'unauthorized' }, 401);
+                }
+                orgs = await listOrganizationsForUser(betterAuth, session.user.id);
+                const active = await getActiveTeamForSession(betterAuth, session.session.token, ctx.orgId);
+                activeWorkspace =
+                    active ?? (workspaces[0] !== undefined ? workspaces[0] : null);
+            }
+            else {
+                // Loopback: no session row to carry an active team — default to the
+                // first workspace (the org's default team) so the switcher still renders.
+                activeWorkspace = workspaces[0] !== undefined ? workspaces[0] : null;
             }
-            orgs = await listOrganizationsForUser(betterAuth, session.user.id);
         }
         return c.json({
             kind: ctx.kind,
@@ -40,6 +54,8 @@ export function createAuthRouter(deps) {
             role: ctx.role,
             org,
             orgs,
+            active_workspace: activeWorkspace,
+            workspaces,
         });
     });
     /**

package/dist/routes/comments.js

@@ -30,7 +30,9 @@ async function handleListComments(c, commentService, target) {
     const includeResolved = parseIncludeResolved(c.req.query('include_resolved'));
     const comments = await commentService.listByTarget(target, { includeResolved });
     if (!comments) {
-        return c.json({ error: 'not_found' }, 404);
+        // Fail-closed: out-of-scope target is a 404 with an empty collection body,
+        // leaking neither existence nor rows.
+        return c.json([], 404);
     }
     return c.json(comments);
 }

package/dist/routes/orgs.js

@@ -1,9 +1,10 @@
 import { Hono } from 'hono';
 import { getProjectInOrg, importProject, InvalidExportVersionError, PLANDESK_EXPORT_VERSION, } from '@plandesk/db';
-import { createScopedAgentKey } from '../agent-keys.js';
+import { createScopedAgentKey, createWorkspaceScopedAgentKey, } from '../agent-keys.js';
 import { getAuthContext, getOrgAuthContext } from '../auth-context.js';
 import { acceptOrganizationInvitation, createOrganizationInvitation, isAuthApiError, isInvitationRole, } from '../invitations.js';
 import { getInvitationPreview, getOrganizationById, listOrganizationMembers, } from '../organizations.js';
+import { createTeamForOrg, getTeamInOrg } from '../identity.js';
 import { requirePermission } from '../permissions.js';
 function isPermissionSet(value) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {
@@ -56,11 +57,11 @@ export function createOrgsRouter(db, options = {}) {
         return (await getOrganizationById(betterAuth, orgId)) !== undefined;
     }
     /**
-     * BA4b-3: mint a project-scoped agent key for `plandesk connect --to`.
-     * Caller must hold apiKey:create (owner key or session owner) — agent keys cannot.
-     * Raw key returned once; metadata is { projectId, orgId } (agent profile).
+     * REQ-A1: list teams (workspaces) in an org. Any org member may read.
+     * A workspace/project-scoped agent key sees only its own workspace (never
+     * sibling workspaces); owner keys and sessions keep full org reach.
      */
-    router.post('/orgs/:orgId/agent-keys', async (c) => {
+    router.get('/orgs/:orgId/workspaces', async (c) => {
         if (betterAuth === undefined) {
             return c.json({ error: 'unavailable' }, 503);
         }
@@ -68,16 +69,67 @@ export function createOrgsRouter(db, options = {}) {
         if (!(await requireKnownOrg(orgId))) {
             return c.json({ error: 'not_found' }, 404);
         }
-        requirePermission(getOrgAuthContext(), 'apiKey', 'create');
+        const adapter = (await betterAuth.$context).adapter;
+        let teams = await adapter.findMany({
+            model: 'team',
+            where: [{ field: 'organizationId', value: orgId }],
+        });
+        const authCtx = getOrgAuthContext();
+        if (authCtx.kind === 'apikey' && authCtx.profile === 'agent') {
+            const allowed = new Set();
+            if (authCtx.workspaceId !== undefined) {
+                allowed.add(authCtx.workspaceId);
+            }
+            else if (authCtx.projectId !== undefined) {
+                const project = await getProjectInOrg(db, authCtx.projectId, orgId);
+                if (project !== undefined) {
+                    allowed.add(project.workspaceId);
+                }
+            }
+            teams = teams.filter((t) => allowed.has(t.id));
+        }
+        return c.json({ workspaces: teams.map((t) => ({ id: t.id, name: t.name })) }, 200);
+    });
+    /**
+     * REQ-A2: create a team (workspace) in an org. Owner only — agent apikeys are
+     * rejected outright (403) so even a stray custom team:create permission (which
+     * AGENT_FORBIDDEN_RESOURCES strips) can never create a workspace.
+     */
+    router.post('/orgs/:orgId/workspaces', async (c) => {
+        if (betterAuth === undefined) {
+            return c.json({ error: 'unavailable' }, 503);
+        }
+        const orgId = c.req.param('orgId');
+        if (!(await requireKnownOrg(orgId))) {
+            return c.json({ error: 'not_found' }, 404);
+        }
+        const authCtx = getOrgAuthContext();
+        if (authCtx.kind === 'apikey' && authCtx.profile === 'agent') {
+            return c.json({ error: 'forbidden' }, 403);
+        }
+        requirePermission(authCtx, 'team', 'create');
         const body = await c.req.json();
-        if (typeof body.project_id !== 'string' || body.project_id.trim() === '') {
+        if (typeof body.name !== 'string' || body.name.trim() === '') {
             return c.json({ error: 'invalid_argument' }, 400);
         }
-        const projectId = body.project_id.trim();
-        const project = await getProjectInOrg(db, projectId, orgId);
-        if (project === undefined) {
+        const name = body.name.trim();
+        const team = await createTeamForOrg(betterAuth, orgId, name);
+        return c.json({ id: team.id, name: team.name }, 201);
+    });
+    /**
+     * BA4b-3 + REQ-A3: mint a project-scoped or workspace-scoped agent key.
+     * Caller must hold apiKey:create (owner key or session owner) — agent keys cannot.
+     */
+    router.post('/orgs/:orgId/agent-keys', async (c) => {
+        if (betterAuth === undefined) {
+            return c.json({ error: 'unavailable' }, 503);
+        }
+        const orgId = c.req.param('orgId');
+        if (!(await requireKnownOrg(orgId))) {
             return c.json({ error: 'not_found' }, 404);
         }
+        requirePermission(getOrgAuthContext(), 'apiKey', 'create');
+        const body = await c.req.json();
         let permissions;
         if (body.permissions !== undefined) {
             if (!isPermissionSet(body.permissions)) {
@@ -96,25 +148,66 @@ export function createOrgsRouter(db, options = {}) {
         if (userId === undefined) {
             return c.json({ error: 'unauthorized' }, 401);
         }
-        const mintInput = {
-            auth: betterAuth,
-            userId,
-            orgId,
-            projectId,
-            ...(permissions !== undefined ? { permissions } : {}),
-            ...(name !== undefined ? { name } : {}),
-        };
-        const minted = await createScopedAgentKey(mintInput);
-        return c.json({ token: minted.key, project_id: projectId }, 200);
+        const hasProjectId = typeof body.project_id === 'string' && body.project_id.trim() !== '';
+        const hasTeamId = typeof body.team_id === 'string' && body.team_id.trim() !== '';
+        if (hasProjectId && hasTeamId) {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        if (hasProjectId) {
+            const projectId = body.project_id.trim();
+            const project = await getProjectInOrg(db, projectId, orgId);
+            if (project === undefined) {
+                return c.json({ error: 'not_found' }, 404);
+            }
+            const mintInput = {
+                auth: betterAuth,
+                userId,
+                orgId,
+                projectId,
+                ...(permissions !== undefined ? { permissions } : {}),
+                ...(name !== undefined ? { name } : {}),
+            };
+            const minted = await createScopedAgentKey(mintInput);
+            return c.json({ token: minted.key, project_id: projectId }, 200);
+        }
+        if (hasTeamId) {
+            const teamId = body.team_id.trim();
+            const adapter = (await betterAuth.$context).adapter;
+            const team = await adapter.findOne({
+                model: 'team',
+                where: [
+                    { field: 'id', value: teamId },
+                    { field: 'organizationId', value: orgId },
+                ],
+            });
+            if (team === null) {
+                return c.json({ error: 'not_found' }, 404);
+            }
+            const minted = await createWorkspaceScopedAgentKey({
+                auth: betterAuth,
+                userId,
+                orgId,
+                teamId,
+                ...(permissions !== undefined ? { permissions } : {}),
+                ...(name !== undefined ? { name } : {}),
+            });
+            return c.json({ token: minted.key, team_id: teamId }, 200);
+        }
+        return c.json({ error: 'invalid_argument' }, 400);
     });
     /**
-     * List better-auth org members (role + email). Any org member may read.
+     * List better-auth org members (role + email). Any org member may read; agent
+     * apikeys never receive member PII (403). Owner keys and sessions unchanged.
      */
     router.get('/orgs/:id/members', async (c) => {
         const orgId = c.req.param('id');
         if (!(await requireKnownOrg(orgId))) {
             return c.json({ error: 'not_found' }, 404);
         }
+        const authCtx = getOrgAuthContext();
+        if (authCtx.kind === 'apikey' && authCtx.profile === 'agent') {
+            return c.json({ error: 'forbidden' }, 403);
+        }
         if (betterAuth === undefined) {
             return c.json({ error: 'unavailable' }, 503);
         }
@@ -122,9 +215,11 @@ export function createOrgsRouter(db, options = {}) {
         return c.json({ members }, 200);
     });
     /**
-     * BA3c: invite by email (link-only, no mailer). Owners and admins may invite
-     * (invitation:create); better-auth still blocks a non-owner inviting an owner.
-     * Returns claimUrl for the inviter to deliver by hand.
+     * BA3c / RFC§5: invite by email to a workspace (link-only, no mailer). The
+     * team_id is required — invites are workspace-scoped; accepting joins the
+     * team, not just the org. Owners and admins may invite (invitation:create);
+     * better-auth still blocks a non-owner inviting an owner. Returns claimUrl
+     * for the inviter to deliver by hand.
      */
     router.post('/orgs/:id/invitations', async (c) => {
         const orgId = c.req.param('id');
@@ -147,17 +242,27 @@ export function createOrgsRouter(db, options = {}) {
         if (typeof body.role !== 'string' || !isInvitationRole(body.role)) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
+        if (typeof body.team_id !== 'string' || body.team_id.trim() === '') {
+            return c.json({ error: 'invalid_argument', message: 'team_id is required' }, 400);
+        }
+        const teamId = body.team_id.trim();
+        const team = await getTeamInOrg(betterAuth, teamId, orgId);
+        if (team === undefined) {
+            return c.json({ error: 'not_found' }, 404);
+        }
         try {
             const created = await createOrganizationInvitation(betterAuth, {
                 email: body.email,
                 role: body.role,
                 organizationId: orgId,
+                teamId,
                 headers: c.req.raw.headers,
                 baseURL,
             });
             return c.json({
                 invitationId: created.invitationId,
                 claimUrl: created.claimUrl,
+                teamId: created.teamId,
             }, 201);
         }
         catch (err) {
@@ -215,6 +320,7 @@ export function createOrgsRouter(db, options = {}) {
                 organizationId: result.member.organizationId,
                 role: result.member.role,
                 userId: result.member.userId,
+                teamId: result.invitation.teamId,
             }, 200);
         }
         catch (err) {
@@ -241,6 +347,15 @@ export function createOrgsRouter(db, options = {}) {
             return c.json({ error: 'not_found' }, 404);
         }
         requirePermission(getOrgAuthContext(), 'organization', 'update');
+        // Import lands the project in the org-default workspace (the portable
+        // format carries no workspace), so a workspace/project-scoped agent key
+        // would escape its scope. Reject scoped callers before reading the body.
+        const importAuthCtx = getOrgAuthContext();
+        if ((importAuthCtx.kind === 'apikey' &&
+            (importAuthCtx.workspaceId !== undefined || importAuthCtx.projectId !== undefined)) ||
+            (importAuthCtx.kind === 'loopback' && importAuthCtx.workspaceId !== undefined)) {
+            return c.json({ error: 'forbidden' }, 403);
+        }
         let body;
         try {
             body = await c.req.json();

package/dist/routes/projects.js

@@ -4,6 +4,7 @@ import { InvalidGoalReferenceError } from '../services/tasks.js';
 import { InvalidTagError } from '../services/tags.js';
 import { isStringArray } from './tasks.js';
 import { parsePaginationParams } from '../serialize.js';
+import { WorkspaceNotFoundError } from '../services/scope.js';
 export function createProjectsRouter(projectService, taskService) {
     const router = new Hono();
     router.get('/projects', async (c) => {
@@ -18,11 +19,23 @@ export function createProjectsRouter(projectService, taskService) {
         if (typeof body.name !== 'string' || body.name.trim() === '') {
             return c.json({ error: 'invalid_argument' }, 400);
         }
-        const project = await projectService.create({
-            name: body.name,
-            description: body.description,
-        });
-        return c.json(project, 201);
+        const workspaceId = typeof body.workspace_id === 'string' && body.workspace_id.length > 0
+            ? body.workspace_id
+            : undefined;
+        try {
+            const project = await projectService.create({
+                name: body.name,
+                description: body.description,
+                ...(workspaceId !== undefined ? { workspaceId } : {}),
+            });
+            return c.json(project, 201);
+        }
+        catch (error) {
+            if (error instanceof WorkspaceNotFoundError) {
+                return c.json({ error: 'not_found' }, 404);
+            }
+            throw error;
+        }
     });
     router.get('/projects/:id', async (c) => {
         const project = await projectService.get(c.req.param('id'));
@@ -36,6 +49,24 @@ export function createProjectsRouter(projectService, taskService) {
         if (body.name !== undefined && (typeof body.name !== 'string' || body.name.trim() === '')) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
+        if (body.workspace_id !== undefined && body.workspace_id !== null) {
+            if (typeof body.workspace_id !== 'string' || body.workspace_id.trim() === '') {
+                return c.json({ error: 'invalid_argument' }, 400);
+            }
+            try {
+                const moved = await projectService.moveProjectToWorkspace(c.req.param('id'), body.workspace_id);
+                if (!moved) {
+                    return c.json({ error: 'not_found' }, 404);
+                }
+                return c.json(moved);
+            }
+            catch (error) {
+                if (error instanceof WorkspaceNotFoundError) {
+                    return c.json({ error: 'not_found' }, 404);
+                }
+                throw error;
+            }
+        }
         const project = await projectService.update(c.req.param('id'), {
             ...(body.name !== undefined ? { name: body.name } : {}),
             ...(body.description !== undefined ? { description: body.description } : {}),

package/dist/routes/shares.js

@@ -34,6 +34,34 @@ export function createSharesRouter(shareService) {
     };
     router.post('/tasks/:id/share', createShareHandler('task'));
     router.post('/documents/:id/share', createShareHandler('document'));
+    // Share an entire workspace (all its projects) with a client. Owner-gated in
+    // the service via getTeamInOrg (workspace must be in the caller's org).
+    router.post('/workspaces/:workspaceId/share', async (c) => {
+        const workspaceId = c.req.param('workspaceId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: 'invalid_json' }, 400);
+        }
+        const audienceName = (body.audience_name ?? '').trim();
+        if (audienceName === '') {
+            return c.json({ error: 'invalid_argument' }, 400);
+        }
+        const mode = body.mode === 'public' ? 'public' : 'invite';
+        const origin = new URL(c.req.url).origin;
+        const result = await shareService.createWorkspaceShare(workspaceId, {
+            audienceName,
+            mode,
+            permissions: { read: true, submit: body.submit === true },
+            ...(body.invited_emails !== undefined ? { invitedEmails: body.invited_emails } : {}),
+        }, origin);
+        if (result === undefined) {
+            return c.json({ error: 'not_found' }, 404);
+        }
+        return c.json({ url: result.url, token: result.token }, 201);
+    });
     // Hono doesn't match a literal `.md` suffix inside a param, so the route
     // takes the raw segment and the handler enforces + strips the extension.
     router.get('/share/:tokenWithExt', async (c) => {
@@ -118,6 +146,7 @@ export function createSharesRouter(shareService) {
             body: body.body,
             severity: body.severity,
             task_ref: body.task_ref,
+            project_id: body.project_id,
         });
         if (result.status === 'unauthorized') {
             return c.json({ error: 'unauthorized' }, 401);
@@ -128,6 +157,9 @@ export function createSharesRouter(shareService) {
         if (result.status === 'title_required') {
             return c.json({ error: 'title_required' }, 400);
         }
+        if (result.status === 'project_required') {
+            return c.json({ error: 'project_required' }, 400);
+        }
         if (result.status === 'rate_limited') {
             return c.json({ error: 'rate_limited' }, 429);
         }

package/dist/routes/tasks.js

@@ -48,6 +48,9 @@ export function createTasksRouter(taskService) {
             return c.json({ error: 'invalid_argument' }, 400);
         }
         const result = await taskService.claim(c.req.param('id'), body.agent_ref);
+        if (result === undefined) {
+            return c.json({ error: 'not_found' }, 404);
+        }
         if (!result.claimed) {
             return c.json(result, 409);
         }

package/dist/serialize.d.ts

@@ -10,6 +10,7 @@ export declare function serializeProject(project: Project): {
     id: string;
     name: string;
     description: string | null;
+    workspace_id: string;
     created_at: string;
     updated_at: string;
 };
@@ -18,6 +19,7 @@ export declare function serializeProjectDetail(project: Project, summary: TaskSt
     id: string;
     name: string;
     description: string | null;
+    workspace_id: string;
     created_at: string;
     updated_at: string;
 };

package/dist/serialize.js

@@ -26,6 +26,7 @@ export function serializeProject(project) {
         id: project.id,
         name: project.name,
         description: project.description,
+        workspace_id: project.workspaceId,
         created_at: project.createdAt.toISOString(),
         updated_at: project.updatedAt.toISOString(),
     };