@pylonsync/create-pylon 0.19.0 → 0.20.0

package/templates/saas/components/setup-checklist.tsx

@@ -1,8 +1,8 @@
 "use client";
 
 import React, { useState } from "react";
-import { callFn } from "@pylonsync/react";
-import { Check, X } from "lucide-react";
+import { callFn, Link } from "@pylonsync/react";
+import { Check, ChevronRight, X } from "lucide-react";
 
 export interface SetupState {
   orgId: string;
@@ -13,9 +13,9 @@ export interface SetupState {
 }
 
 /**
- * "Getting started" on the Overview. Items are derived from real data (a
+ * "Get started" steps on the Overview. Each step is derived from real data (a
  * project exists, a teammate or pending invite exists, Pro is active), so the
- * list ticks itself off; it disappears when all three are done or an
+ * list ticks itself off. It disappears when all three are done or an
  * owner/admin dismisses it for the workspace.
  */
 export function SetupChecklist({ state }: { state: SetupState }) {
@@ -23,10 +23,10 @@ export function SetupChecklist({ state }: { state: SetupState }) {
   const items = [
     { done: state.hasProject, label: "Create a project", href: "/dashboard/projects" },
     { done: state.hasTeammate, label: "Invite a teammate", href: "/dashboard/members" },
-    { done: state.hasBilling, label: "Start your Pro trial", href: "/dashboard/billing" },
+    { done: state.hasBilling, label: "Start the Pro trial", href: "/dashboard/billing" },
   ];
-  const remaining = items.filter((i) => !i.done).length;
-  if (hidden || remaining === 0) return null;
+  const doneCount = items.filter((i) => i.done).length;
+  if (hidden || doneCount === items.length) return null;
 
   async function dismiss() {
     setHidden(true);
@@ -38,42 +38,44 @@ export function SetupChecklist({ state }: { state: SetupState }) {
   }
 
   return (
-    <div className="rounded-xl border border-zinc-200 bg-white p-5">
-      <div className="flex items-center justify-between">
-        <div>
-          <h2 className="text-sm font-semibold text-zinc-900">Getting started</h2>
-          <p className="mt-0.5 text-xs text-zinc-500">
-            {items.length - remaining} of {items.length} done
-          </p>
+    <div className="rounded-xl border border-zinc-200/80 bg-white">
+      <div className="flex items-center justify-between gap-3 border-b border-zinc-100 px-4 py-3">
+        <div className="flex items-center gap-3">
+          <h2 className="text-[13px] font-semibold text-zinc-900">Get started</h2>
+          <span className="font-mono text-[11.5px] tabular-nums text-zinc-400">
+            {doneCount}/{items.length}
+          </span>
         </div>
         {state.canDismiss && (
           <button
             type="button"
             onClick={() => void dismiss()}
-            aria-label="Dismiss checklist"
+            aria-label="Hide the setup steps"
             className="flex size-7 items-center justify-center rounded-md text-zinc-400 hover:bg-zinc-100 hover:text-zinc-700"
           >
             <X className="size-4" />
           </button>
         )}
       </div>
-      <ul className="mt-3 divide-y divide-zinc-100">
+      <ul className="grid divide-y divide-zinc-100 sm:grid-cols-3 sm:divide-x sm:divide-y-0">
         {items.map((it) => (
-          <li key={it.label} className="flex items-center gap-3 py-2.5">
-            <span
-              className={
-                "flex size-5 shrink-0 items-center justify-center rounded-full border " +
-                (it.done ? "border-emerald-500 bg-emerald-500 text-white" : "border-zinc-300")
-              }
-            >
-              {it.done && <Check className="size-3" />}
-            </span>
+          <li key={it.label}>
             {it.done ? (
-              <span className="text-sm text-zinc-400 line-through">{it.label}</span>
+              <div className="flex items-center gap-2.5 px-4 py-3 text-[13px] text-zinc-400">
+                <span className="flex size-[18px] items-center justify-center rounded-full bg-brand text-white">
+                  <Check className="size-3" strokeWidth={2.5} />
+                </span>
+                <span className="line-through">{it.label}</span>
+              </div>
             ) : (
-              <a href={it.href} className="text-sm font-medium text-zinc-900 hover:underline">
-                {it.label} →
-              </a>
+              <Link
+                href={it.href}
+                className="group flex items-center gap-2.5 px-4 py-3 text-[13px] font-medium text-zinc-800 transition-colors hover:bg-zinc-50"
+              >
+                <span className="size-[18px] rounded-full border-[1.5px] border-dashed border-zinc-300" />
+                {it.label}
+                <ChevronRight className="ml-auto size-3.5 text-zinc-300 transition-transform group-hover:translate-x-0.5 group-hover:text-zinc-500" />
+              </Link>
             )}
           </li>
         ))}

package/templates/saas/components/task-ui.tsx

@@ -0,0 +1,199 @@
+import React from "react";
+import { initials } from "@/lib/names";
+import { daysUntil, type TaskStatus } from "@/lib/tasks";
+
+// Small presentational pieces shared by the Overview, the project list, and
+// the task board. No data access here: every component renders from props.
+
+/** Status glyph: an outlined circle that fills as the task moves to done. */
+export function StatusIcon({
+  status,
+  className = "size-3.5",
+}: {
+  status: string;
+  className?: string;
+}) {
+  const s = status as TaskStatus;
+  if (s === "done") {
+    return (
+      <svg viewBox="0 0 14 14" className={`${className} shrink-0 text-brand`} aria-hidden>
+        <circle cx="7" cy="7" r="6.25" fill="currentColor" stroke="currentColor" strokeWidth="1.5" />
+        <path d="M4.3 7.2 6.1 9l3.6-3.8" fill="none" stroke="white" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" />
+      </svg>
+    );
+  }
+  const tone =
+    s === "in_progress" ? "text-amber-500" : s === "in_review" ? "text-emerald-500" : "text-zinc-400";
+  // The share of the inner disc that is filled: 0 for to do, half for in
+  // progress, three quarters for in review.
+  const fill = s === "in_progress" ? 0.5 : s === "in_review" ? 0.75 : 0;
+  const r = 3.25;
+  const c = 2 * Math.PI * r;
+  return (
+    <svg viewBox="0 0 14 14" className={`${className} shrink-0 ${tone}`} aria-hidden>
+      <circle cx="7" cy="7" r="6.25" fill="none" stroke="currentColor" strokeWidth="1.5" />
+      {fill > 0 ? (
+        <circle
+          cx="7"
+          cy="7"
+          r={r}
+          fill="none"
+          stroke="currentColor"
+          strokeWidth={r * 2}
+          strokeDasharray={`${c * fill} ${c}`}
+          transform="rotate(-90 7 7)"
+        />
+      ) : null}
+    </svg>
+  );
+}
+
+/** Priority glyph: three bars for high/medium/low, a filled square for urgent. */
+export function PriorityIcon({
+  priority,
+  className = "size-3.5",
+}: {
+  priority?: string | null;
+  className?: string;
+}) {
+  const p = priority ?? "none";
+  if (p === "urgent") {
+    return (
+      <svg viewBox="0 0 14 14" className={`${className} shrink-0 text-orange-500`} aria-hidden>
+        <rect x="1" y="1" width="12" height="12" rx="3" fill="currentColor" />
+        <path d="M7 3.8v4" stroke="white" strokeWidth="1.6" strokeLinecap="round" />
+        <circle cx="7" cy="10.1" r="0.95" fill="white" />
+      </svg>
+    );
+  }
+  if (p === "none") {
+    return (
+      <svg viewBox="0 0 14 14" className={`${className} shrink-0 text-zinc-300`} aria-hidden>
+        <path d="M2.5 7h2M6 7h2M9.5 7h2" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" />
+      </svg>
+    );
+  }
+  const level = p === "high" ? 3 : p === "medium" ? 2 : 1;
+  return (
+    <svg viewBox="0 0 14 14" className={`${className} shrink-0 text-zinc-600`} aria-hidden>
+      {[0, 1, 2].map((i) => (
+        <rect
+          key={i}
+          x={2 + i * 3.75}
+          y={9.5 - i * 3}
+          width="2.5"
+          height={2.5 + i * 3}
+          rx="0.75"
+          fill="currentColor"
+          opacity={i < level ? 1 : 0.22}
+        />
+      ))}
+    </svg>
+  );
+}
+
+// Stable avatar color per person, hashed from their id.
+const AVATAR_TONES = [
+  "bg-[#e0e7ff] text-[#3730a3]",
+  "bg-[#dcfce7] text-[#166534]",
+  "bg-[#fef3c7] text-[#92400e]",
+  "bg-[#fce7f3] text-[#9d174d]",
+  "bg-[#e0f2fe] text-[#075985]",
+  "bg-[#ede9fe] text-[#5b21b6]",
+];
+
+export function toneFor(key: string): string {
+  let h = 0;
+  for (let i = 0; i < key.length; i++) h = (h * 31 + key.charCodeAt(i)) >>> 0;
+  return AVATAR_TONES[h % AVATAR_TONES.length];
+}
+
+export function Avatar({
+  id,
+  name,
+  size = "sm",
+}: {
+  id: string;
+  name: string;
+  size?: "xs" | "sm" | "md";
+}) {
+  const dims =
+    size === "xs" ? "size-[18px] text-[8.5px]" : size === "sm" ? "size-6 text-[10px]" : "size-8 text-[11.5px]";
+  return (
+    <span
+      title={name}
+      className={`inline-flex shrink-0 items-center justify-center rounded-full font-semibold ${dims} ${toneFor(id)}`}
+    >
+      {initials(name)}
+    </span>
+  );
+}
+
+/** A dashed ring for tasks with nobody assigned. */
+export function EmptyAvatar({ size = "sm" }: { size?: "xs" | "sm" }) {
+  const dims = size === "xs" ? "size-[18px]" : "size-6";
+  return (
+    <span
+      title="Unassigned"
+      className={`inline-flex shrink-0 rounded-full border border-dashed border-zinc-300 ${dims}`}
+    />
+  );
+}
+
+const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+
+/** "Sep 30" from `YYYY-MM-DD`, read as a calendar day (no time zone shift). */
+export function shortDay(day: string): string {
+  const [, m, d] = day.split("-").map(Number);
+  return `${MONTHS[(m ?? 1) - 1]} ${d}`;
+}
+
+/**
+ * Due date with its urgency: red when overdue, amber when due today or
+ * tomorrow. `today` comes from the server render so the SSR HTML and the
+ * hydrated client agree.
+ */
+export function DueLabel({
+  due,
+  today,
+  done,
+}: {
+  due?: string | null;
+  today: string;
+  done?: boolean;
+}) {
+  if (!due) return null;
+  const days = daysUntil(due, today);
+  const tone = done
+    ? "text-zinc-400"
+    : days < 0
+      ? "text-red-600"
+      : days <= 1
+        ? "text-amber-600"
+        : "text-zinc-500";
+  const label = done ? shortDay(due) : days === 0 ? "Today" : days === 1 ? "Tomorrow" : shortDay(due);
+  return <span className={`whitespace-nowrap text-[12px] tabular-nums ${tone}`}>{label}</span>;
+}
+
+/** A thin progress bar with the percentage beside it. */
+export function Progress({ percent, className = "" }: { percent: number; className?: string }) {
+  return (
+    <div className={`flex items-center gap-2.5 ${className}`}>
+      <div className="h-1.5 flex-1 overflow-hidden rounded-full bg-zinc-100">
+        <div className="h-full rounded-full bg-brand" style={{ width: `${percent}%` }} />
+      </div>
+      <span className="w-9 text-right font-mono text-[11.5px] tabular-nums text-zinc-500">{percent}%</span>
+    </div>
+  );
+}
+
+/** Project monogram tile, colored per project. */
+export function ProjectMark({ id, name, className = "size-7 text-[11px]" }: { id: string; name: string; className?: string }) {
+  return (
+    <span
+      className={`inline-flex shrink-0 items-center justify-center rounded-md font-semibold ${className} ${toneFor(id)}`}
+    >
+      {initials(name)}
+    </span>
+  );
+}

package/templates/saas/functions/createProject.ts

@@ -1,6 +1,6 @@
 import { mutation, v } from "@pylonsync/functions";
 import { normalizeProjectName } from "../lib/projects";
-import { canCreateProject, planFromSubscription } from "../lib/plans";
+import { canCreateProject, planFromSubscriptions } from "../lib/plans";
 
 // createProject — the free-tier cap lives here, on the server. The Project
 // policy denies client inserts, so a browser cannot skip the paywall by
@@ -23,21 +23,15 @@ export default mutation<
     // Any member of the workspace may create a project. Fails closed.
     await ctx.requireMember(args.orgId);
 
-    const subs = (await ctx.db.unsafe.list("StripeSubscription")) as Array<{
-      referenceId: string;
-      plan?: string;
-      status?: string;
-    }>;
-    const sub = subs.find((s) => s.referenceId === args.orgId) ?? null;
-    const plan = planFromSubscription(sub);
+    const subs = (await ctx.db.unsafe.query("StripeSubscription", {
+      referenceId: args.orgId,
+    })) as Array<{ plan?: string; status?: string }>;
+    const plan = planFromSubscriptions(subs);
 
-    const projects = (await ctx.db.unsafe.list("Project")) as Array<{
-      orgId: string;
+    const projects = (await ctx.db.unsafe.query("Project", { orgId: args.orgId })) as Array<{
       status?: string;
     }>;
-    const active = projects.filter(
-      (p) => p.orgId === args.orgId && (p.status ?? "active") !== "archived",
-    ).length;
+    const active = projects.filter((p) => (p.status ?? "active") !== "archived").length;
     if (!canCreateProject(plan, active)) {
       throw ctx.error(
         "LIMIT_REACHED",

package/templates/saas/functions/createTask.ts

@@ -0,0 +1,67 @@
+import { mutation, v } from "@pylonsync/functions";
+import { memberName } from "../lib/members";
+import {
+  isTaskPriority,
+  isTaskStatus,
+  normalizeDueDate,
+  normalizeTaskTitle,
+} from "../lib/tasks";
+
+// createTask — adds a task to a project. The workspace comes from the
+// project row, never from the caller, and the caller must be a member of it.
+// An assignee must be a member of the same workspace.
+export default mutation<
+  {
+    projectId: string;
+    title: string;
+    status?: string;
+    priority?: string;
+    assigneeId?: string;
+    dueDate?: string;
+  },
+  { id: string }
+>({
+  args: {
+    projectId: v.string(),
+    title: v.string(),
+    status: v.optional(v.string()),
+    priority: v.optional(v.string()),
+    assigneeId: v.optional(v.string()),
+    dueDate: v.optional(v.string()),
+  },
+  async handler(ctx, args) {
+    const title = normalizeTaskTitle(args.title);
+    if (!title) throw ctx.error("INVALID_ARGS", "Task title must be 1–200 characters.");
+    const status = args.status ?? "todo";
+    if (!isTaskStatus(status)) throw ctx.error("INVALID_ARGS", "Unknown task status.");
+    const priority = args.priority ?? "none";
+    if (!isTaskPriority(priority)) throw ctx.error("INVALID_ARGS", "Unknown task priority.");
+    const dueDate = args.dueDate ? normalizeDueDate(args.dueDate) : null;
+    if (args.dueDate && !dueDate) throw ctx.error("INVALID_ARGS", "Due date must be YYYY-MM-DD.");
+
+    const project = await ctx.db.unsafe.get("Project", args.projectId);
+    if (!project) throw ctx.error("NOT_FOUND", "Project not found.");
+    const orgId = String(project.orgId);
+    await ctx.requireMember(orgId);
+
+    let assigneeName: string | null = null;
+    if (args.assigneeId) {
+      assigneeName = await memberName(ctx.db, orgId, args.assigneeId);
+      if (assigneeName === null) {
+        throw ctx.error("INVALID_ARGS", "The assignee is not a member of this workspace.");
+      }
+    }
+
+    const id = (await ctx.db.unsafe.insert("Task", {
+      orgId,
+      projectId: args.projectId,
+      title,
+      status,
+      priority,
+      ...(args.assigneeId ? { assigneeId: args.assigneeId, assigneeName } : {}),
+      ...(dueDate ? { dueDate } : {}),
+      ...(status === "done" ? { completedAt: new Date().toISOString() } : {}),
+    })) as string;
+    return { id };
+  },
+});

package/templates/saas/functions/deleteProject.ts

@@ -0,0 +1,17 @@
+import { mutation, v } from "@pylonsync/functions";
+
+// deleteProject — removes a project and every task in it. The caller must be
+// a member of the project's own workspace.
+export default mutation<{ projectId: string }, { ok: true; tasks: number }>({
+  args: { projectId: v.string() },
+  async handler(ctx, args) {
+    const project = await ctx.db.unsafe.get("Project", args.projectId);
+    if (!project) throw ctx.error("NOT_FOUND", "Project not found.");
+    await ctx.requireMember(String(project.orgId));
+
+    const tasks = await ctx.db.unsafe.query("Task", { projectId: args.projectId });
+    for (const t of tasks) await ctx.db.unsafe.delete("Task", String(t.id));
+    await ctx.db.unsafe.delete("Project", args.projectId);
+    return { ok: true, tasks: tasks.length };
+  },
+});

package/templates/saas/functions/deleteTask.ts

@@ -0,0 +1,14 @@
+import { mutation, v } from "@pylonsync/functions";
+
+// deleteTask — removes one task. The caller must be a member of the task's
+// own workspace.
+export default mutation<{ taskId: string }, { ok: true }>({
+  args: { taskId: v.string() },
+  async handler(ctx, args) {
+    const task = await ctx.db.unsafe.get("Task", args.taskId);
+    if (!task) throw ctx.error("NOT_FOUND", "Task not found.");
+    await ctx.requireMember(String(task.orgId));
+    await ctx.db.unsafe.delete("Task", args.taskId);
+    return { ok: true };
+  },
+});

package/templates/saas/functions/seedWorkspace.ts

@@ -0,0 +1,46 @@
+import { mutation, v } from "@pylonsync/functions";
+import { workspaceMembers } from "../lib/members";
+import { planSampleWorkspace } from "../lib/sample-workspace";
+
+// seedWorkspace — fills an empty workspace with the sample projects and
+// tasks in lib/sample-workspace.ts. Owners and admins only. It does nothing
+// when the workspace already has a project, so calling it twice is safe.
+// Tasks are assigned to the workspace's current members.
+export default mutation<{ orgId: string }, { seeded: boolean; projects: number; tasks: number }>({
+  args: { orgId: v.string() },
+  async handler(ctx, args) {
+    await ctx.requireMember(args.orgId, { role: ["owner", "admin"] });
+
+    const existing = await ctx.db.unsafe.query("Project", { orgId: args.orgId });
+    if (existing.length > 0) return { seeded: false, projects: 0, tasks: 0 };
+
+    const members = await workspaceMembers(ctx.db, args.orgId);
+    // The caller first, so the tasks marked for member 0 land on them.
+    members.sort((a, b) => (a.userId === ctx.auth.userId ? -1 : b.userId === ctx.auth.userId ? 1 : 0));
+    const plan = planSampleWorkspace(members, new Date());
+
+    let taskCount = 0;
+    for (const p of plan) {
+      const projectId = (await ctx.db.unsafe.insert("Project", {
+        orgId: args.orgId,
+        name: p.name,
+        description: p.description,
+        status: p.status,
+      })) as string;
+      for (const t of p.tasks) {
+        await ctx.db.unsafe.insert("Task", {
+          orgId: args.orgId,
+          projectId,
+          title: t.title,
+          status: t.status,
+          priority: t.priority,
+          dueDate: t.dueDate,
+          ...(t.completedAt ? { completedAt: t.completedAt } : {}),
+          ...(t.assigneeId ? { assigneeId: t.assigneeId, assigneeName: t.assigneeName } : {}),
+        });
+        taskCount++;
+      }
+    }
+    return { seeded: true, projects: plan.length, tasks: taskCount };
+  },
+});

package/templates/saas/functions/setProjectStatus.ts

@@ -0,0 +1,41 @@
+import { mutation, v } from "@pylonsync/functions";
+import { canCreateProject, planFromSubscriptions } from "../lib/plans";
+
+// setProjectStatus — archives or restores a project. Restoring counts
+// against the free plan's active-project cap the same way createProject
+// does, so archiving and restoring cannot get a free workspace past it.
+export default mutation<{ projectId: string; status: string }, { id: string; status: string }>({
+  args: { projectId: v.string(), status: v.string() },
+  async handler(ctx, args) {
+    if (args.status !== "active" && args.status !== "archived") {
+      throw ctx.error("INVALID_ARGS", "Status must be active or archived.");
+    }
+    const project = await ctx.db.unsafe.get("Project", args.projectId);
+    if (!project) throw ctx.error("NOT_FOUND", "Project not found.");
+    const orgId = String(project.orgId);
+    await ctx.requireMember(orgId);
+
+    const current = (project.status as string | undefined) ?? "active";
+    if (current === args.status) return { id: args.projectId, status: current };
+
+    if (args.status === "active") {
+      const subs = (await ctx.db.unsafe.query("StripeSubscription", {
+        referenceId: orgId,
+      })) as Array<{ plan?: string; status?: string }>;
+      const plan = planFromSubscriptions(subs);
+      const projects = (await ctx.db.unsafe.query("Project", { orgId })) as Array<{
+        status?: string;
+      }>;
+      const active = projects.filter((p) => (p.status ?? "active") !== "archived").length;
+      if (!canCreateProject(plan, active)) {
+        throw ctx.error(
+          "LIMIT_REACHED",
+          "This workspace is at the free plan's project limit. Upgrade to Pro for unlimited projects.",
+        );
+      }
+    }
+
+    await ctx.db.unsafe.update("Project", args.projectId, { status: args.status });
+    return { id: args.projectId, status: args.status };
+  },
+});

package/templates/saas/functions/updateProfile.ts

@@ -3,6 +3,9 @@ import { mutation, v } from "@pylonsync/functions";
 // The one User field a person may edit about themselves. Email changes
 // need re-verification and passwords have their own route, so the User
 // policy denies client writes and this function owns display-name edits.
+// Tasks keep a copy of their assignee's name (see the Task entity in
+// app.ts), so the person's assigned tasks in their current workspaces are
+// updated with the new name.
 export default mutation<{ displayName: string }, { displayName: string }>({
   args: { displayName: v.string() },
   async handler(ctx, args) {
@@ -13,6 +16,16 @@ export default mutation<{ displayName: string }, { displayName: string }>({
       throw ctx.error("INVALID_ARGS", "Name must be 1–60 characters.");
     }
     await ctx.db.unsafe.update("User", userId, { displayName });
+    // Only in workspaces the person still belongs to: a former member must
+    // not be able to write into a workspace they have left.
+    const memberships = await ctx.db.unsafe.query("OrgMember", { userId });
+    const orgs = new Set(memberships.map((m) => String(m.orgId)));
+    const assigned = await ctx.db.unsafe.query("Task", { assigneeId: userId });
+    for (const t of assigned) {
+      if (orgs.has(String(t.orgId)) && t.assigneeName !== displayName) {
+        await ctx.db.unsafe.update("Task", String(t.id), { assigneeName: displayName });
+      }
+    }
     return { displayName };
   },
 });

package/templates/saas/functions/updateProject.ts

@@ -3,8 +3,8 @@ import { normalizeProjectName } from "../lib/projects";
 
 // updateProject — the reference example for a first-party server function, and
 // the core authoring loop end to end: entity → policy → FUNCTION → call it from
-// the client. The Projects tab's edit form (app/dashboard/dashboard-client.tsx)
-// saves through this via `callFn("updateProject", …)`.
+// the client. The project dialog (app/dashboard/projects-client.tsx) saves
+// through this via `callFn("updateProject", …)`.
 //
 // Why a server function and not a direct client `db.update`? Two reasons the
 // pattern exists:
@@ -17,9 +17,8 @@ import { normalizeProjectName } from "../lib/projects";
 //      FORBIDDEN otherwise). Pass `{ role: ["owner", "admin"] }` to make edits
 //      admin-only.
 //
-// Quick archive/delete stay as direct client `db` writes — the Project row
-// policy (`auth.tenantId == data.orgId`) already covers "edit a row you own".
-// Reach for a function when you need more than that.
+// Archive/restore (setProjectStatus) and delete (deleteProject) are server
+// functions too: the Project policy denies every direct client write.
 export default mutation<
   { projectId: string; name: string; description?: string },
   { id: string; name: string }

package/templates/saas/functions/updateTask.ts

@@ -0,0 +1,88 @@
+import { mutation, v } from "@pylonsync/functions";
+import { memberName } from "../lib/members";
+import {
+  isTaskPriority,
+  isTaskStatus,
+  normalizeDueDate,
+  normalizeTaskTitle,
+} from "../lib/tasks";
+
+// updateTask — changes the fields a person edits on the board. Only the
+// fields passed are written. An empty string clears `assigneeId` or
+// `dueDate`. The caller must be a member of the task's own workspace, and the
+// task can never move to another project or workspace.
+export default mutation<
+  {
+    taskId: string;
+    title?: string;
+    status?: string;
+    priority?: string;
+    assigneeId?: string;
+    dueDate?: string;
+  },
+  { id: string }
+>({
+  args: {
+    taskId: v.string(),
+    title: v.optional(v.string()),
+    status: v.optional(v.string()),
+    priority: v.optional(v.string()),
+    assigneeId: v.optional(v.string()),
+    dueDate: v.optional(v.string()),
+  },
+  async handler(ctx, args) {
+    const task = await ctx.db.unsafe.get("Task", args.taskId);
+    if (!task) throw ctx.error("NOT_FOUND", "Task not found.");
+    const orgId = String(task.orgId);
+    await ctx.requireMember(orgId);
+
+    const patch: Record<string, unknown> = {};
+    if (args.title !== undefined) {
+      const title = normalizeTaskTitle(args.title);
+      if (!title) throw ctx.error("INVALID_ARGS", "Task title must be 1–200 characters.");
+      patch.title = title;
+    }
+    if (args.status !== undefined) {
+      if (!isTaskStatus(args.status)) throw ctx.error("INVALID_ARGS", "Unknown task status.");
+      patch.status = args.status;
+      if (args.status === "done" && task.status !== "done") {
+        patch.completedAt = new Date().toISOString();
+      } else if (args.status !== "done") {
+        patch.completedAt = null;
+      }
+    }
+    if (args.priority !== undefined) {
+      if (!isTaskPriority(args.priority)) throw ctx.error("INVALID_ARGS", "Unknown task priority.");
+      patch.priority = args.priority;
+    }
+    if (args.assigneeId !== undefined) {
+      if (args.assigneeId === (task.assigneeId ?? "")) {
+        // Unchanged. The dialog sends every field, and a person who has since
+        // left the workspace stays assigned until someone picks a new owner.
+      } else if (args.assigneeId === "") {
+        patch.assigneeId = null;
+        patch.assigneeName = null;
+      } else {
+        const name = await memberName(ctx.db, orgId, args.assigneeId);
+        if (name === null) {
+          throw ctx.error("INVALID_ARGS", "The assignee is not a member of this workspace.");
+        }
+        patch.assigneeId = args.assigneeId;
+        patch.assigneeName = name;
+      }
+    }
+    if (args.dueDate !== undefined) {
+      if (args.dueDate === "") {
+        patch.dueDate = null;
+      } else {
+        const due = normalizeDueDate(args.dueDate);
+        if (!due) throw ctx.error("INVALID_ARGS", "Due date must be YYYY-MM-DD.");
+        patch.dueDate = due;
+      }
+    }
+    if (Object.keys(patch).length > 0) {
+      await ctx.db.unsafe.update("Task", args.taskId, patch);
+    }
+    return { id: args.taskId };
+  },
+});