refactor(convex): DRY up backend, separate internals, and harden authorization

services/platform/app/features/approvals/components/approvals-client.tsx

@@ -119,7 +119,7 @@ export function ApprovalsClient({
   const pageSize = 10;
 
   const approvalsResult = useQuery(
-    api.approvals.queries.getApprovalsByOrganization,
+    api.approvals.queries.listApprovalsByOrganization,
     {
       organizationId,
       status: status === 'pending' ? 'pending' : undefined,

services/platform/app/features/approvals/hooks/use-update-approval-status.ts

@@ -1,7 +1,6 @@
 import { useMutation } from 'convex/react';
 import { api } from '@/convex/_generated/api';
 
-// Note: Uses preloaded query with complex filters - params not predictable
 export function useUpdateApprovalStatus() {
-  return useMutation(api.approvals.mutations.updateApprovalStatusPublic);
+  return useMutation(api.approvals.mutations.updateApprovalStatus);
 }

services/platform/app/features/automations/components/automation-assistant.tsx

@@ -297,7 +297,7 @@ function AutomationAssistantContent({
 
   // Load workflow to get threadId from metadata (use public API)
   const workflow = useQuery(
-    api.wf_definitions.queries.getWorkflowPublic,
+    api.wf_definitions.queries.getWorkflow,
     automationId ? { wfDefinitionId: automationId } : 'skip',
   );
 

services/platform/app/features/automations/components/automation-navigation.tsx

@@ -61,7 +61,7 @@ export function AutomationNavigation({
 
   // Fetch all versions of this automation
   const versions = useQuery(
-    api.wf_definitions.queries.listVersionsPublic,
+    api.wf_definitions.queries.listVersions,
     automation?.name && organizationId
       ? {
           organizationId: organizationId,

services/platform/app/features/automations/components/automations-client.tsx

@@ -38,13 +38,12 @@ export function AutomationsClient({
       organizationId,
       searchTerm: searchTerm || undefined,
       status: status && status.length > 0 ? status : undefined,
-      paginationOpts: { cursor: null, numItems: 1000 },
     }),
     [organizationId, searchTerm, status],
   );
 
   const automationsResult = useQuery(
-    api.wf_definitions.queries.getAutomations,
+    api.wf_definitions.queries.listAutomations,
     queryArgs,
   );
 

services/platform/app/features/automations/executions/executions-client.tsx

@@ -138,9 +138,9 @@ export function ExecutionsClient({
       dateFrom: dateFrom || undefined,
       dateTo: dateTo || undefined,
       cursor: undefined,
-      numItems: 1000,
+      numItems: pageSize,
     }),
-    [amId, searchTerm, status, triggeredBy, dateFrom, dateTo],
+    [amId, searchTerm, status, triggeredBy, dateFrom, dateTo, pageSize],
   );
 
   const executionsResult = useQuery(

services/platform/app/features/automations/executions/use-executions-table-config.tsx

@@ -47,7 +47,7 @@ export function useExecutionsTableConfig() {
     columns,
     searchPlaceholder: tCommon('search.placeholder'),
     stickyLayout: true as const,
-    pageSize: 10,
+    pageSize: 30,
     defaultSort: 'startedAt' as const,
     defaultSortDesc: true,
     infiniteScroll: true as const,

services/platform/app/features/automations/hooks/use-create-automation.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: Create operation - navigates to new automation page after creation
 export function useCreateAutomation() {
-  return useMutation(api.wf_definitions.mutations.createWorkflowWithStepsPublic);
+  return useMutation(api.wf_definitions.mutations.createWorkflowWithSteps);
 }

services/platform/app/features/automations/hooks/use-create-draft-from-active.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: Create operation - creates draft version from active workflow
 export function useCreateDraftFromActive() {
-  return useMutation(api.wf_definitions.mutations.createDraftFromActivePublic);
+  return useMutation(api.wf_definitions.mutations.createDraftFromActive);
 }

services/platform/app/features/automations/hooks/use-create-step.ts

@@ -1,10 +1,6 @@
-/**
- * Hook for creating workflow step definitions
- */
-
 import { useMutation } from 'convex/react';
 import { api } from '@/convex/_generated/api';
 
 export function useCreateStep() {
-  return useMutation(api.wf_step_defs.mutations.createStepPublic);
+  return useMutation(api.wf_step_defs.mutations.createStep);
 }

services/platform/app/features/automations/hooks/use-delete-automation.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: Optimistic updates not added - automations table uses local state for filtering
 export function useDeleteAutomation() {
-  return useMutation(api.wf_definitions.mutations.deleteWorkflowPublic);
+  return useMutation(api.wf_definitions.mutations.deleteWorkflow);
 }

services/platform/app/features/automations/hooks/use-duplicate-automation.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: Create operation - clones workflow with new ID
 export function useDuplicateAutomation() {
-  return useMutation(api.wf_definitions.mutations.duplicateWorkflowPublic);
+  return useMutation(api.wf_definitions.mutations.duplicateWorkflow);
 }

services/platform/app/features/automations/hooks/use-publish-automation-draft.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: Complex state change - converts draft to active version
 export function usePublishAutomationDraft() {
-  return useMutation(api.wf_definitions.mutations.publishDraftPublic);
+  return useMutation(api.wf_definitions.mutations.publishDraft);
 }

services/platform/app/features/automations/hooks/use-start-workflow.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: Triggers workflow execution - creates execution record
 export function useStartWorkflow() {
-  return useMutation(api.workflow_engine.engine.startWorkflow);
+  return useMutation(api.workflow_engine.mutations.startWorkflow);
 }

services/platform/app/features/automations/hooks/use-update-automation.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: Updates workflow steps/config - complex nested structure
 export function useUpdateAutomation() {
-  return useMutation(api.wf_definitions.mutations.updateWorkflowPublic);
+  return useMutation(api.wf_definitions.mutations.updateWorkflow);
 }

services/platform/app/features/automations/hooks/use-update-step.ts

@@ -1,10 +1,6 @@
-/**
- * Hook for updating workflow step definitions
- */
-
 import { useMutation } from 'convex/react';
 import { api } from '@/convex/_generated/api';
 
 export function useUpdateStep() {
-  return useMutation(api.wf_step_defs.mutations.updateStepPublic);
+  return useMutation(api.wf_step_defs.mutations.updateStep);
 }

services/platform/app/features/chat/components/human-input-request-card.tsx

@@ -44,7 +44,7 @@ function HumanInputRequestCardComponent({
   const [selectedValues, setSelectedValues] = useState<string[]>([]);
 
   const submitResponse = useMutation(
-    api.agent_tools.human_input.submit_human_input_response.submitHumanInputResponse,
+    api.agent_tools.human_input.mutations.submitHumanInputResponse,
   );
 
   const isPending = status === 'pending';

services/platform/app/features/chat/components/integration-approval-card.tsx

@@ -53,7 +53,7 @@ function IntegrationApprovalCardComponent({
   const [isRejecting, setIsRejecting] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
-  const updateApprovalStatus = useMutation(api.approvals.mutations.updateApprovalStatusPublic);
+  const updateApprovalStatus = useMutation(api.approvals.mutations.updateApprovalStatus);
   const executeApprovedOperation = useAction(
     api.approvals.actions.executeApprovedIntegrationOperation
   );

services/platform/app/features/chat/components/workflow-creation-approval-card.tsx

@@ -74,7 +74,7 @@ function WorkflowCreationApprovalCardComponent({
 
   // No optimistic update: approval triggers external workflow creation action with
   // side effects that cannot be safely rolled back if the mutation fails.
-  const updateApprovalStatus = useMutation(api.approvals.mutations.updateApprovalStatusPublic);
+  const updateApprovalStatus = useMutation(api.approvals.mutations.updateApprovalStatus);
   const executeApprovedWorkflow = useAction(
     api.approvals.actions.executeApprovedWorkflowCreation
   );

services/platform/app/features/chat/hooks/use-generate-upload-url.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: Utility - returns URL, doesn't affect any query
 export function useGenerateUploadUrl() {
-  return useMutation(api.file.mutations.generateUploadUrl);
+  return useMutation(api.files.mutations.generateUploadUrl);
 }

services/platform/app/features/chat/hooks/use-human-input-requests.ts

@@ -48,7 +48,7 @@ export function useHumanInputRequests(threadId: string | undefined) {
  */
 export function useSubmitHumanInputResponse() {
   const submitMutation = useMutation(
-    api.agent_tools.human_input.submit_human_input_response.submitHumanInputResponse,
+    api.agent_tools.human_input.mutations.submitHumanInputResponse,
   );
 
   return {

services/platform/app/features/conversations/actions/improve-message.ts

@@ -8,7 +8,7 @@ export async function improveMessage(
   instruction?: string,
 ): Promise<{ improvedMessage: string; error?: string }> {
   try {
-    const result = await fetchAction(api.improve_message.improveMessage, {
+    const result = await fetchAction(api.improve_message.actions.improveMessage, {
       originalMessage,
       instruction,
     });

services/platform/app/features/conversations/hooks/use-generate-upload-url.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: Utility - returns URL, doesn't affect any query
 export function useGenerateUploadUrl() {
-  return useMutation(api.file.mutations.generateUploadUrl);
+  return useMutation(api.files.mutations.generateUploadUrl);
 }

services/platform/app/features/documents/components/document-preview-dialog.tsx

@@ -43,7 +43,7 @@ export function DocumentPreviewDialog({
 
   // Use documentId if available, otherwise use storagePath
   const dataById = useQuery(
-    api.documents.queries.getDocumentByIdPublic,
+    api.documents.queries.getDocumentById,
     open && Boolean(documentId)
       ? {
           documentId: documentId as Id<'documents'>,

services/platform/app/features/documents/components/document-team-tags-dialog.tsx

@@ -49,7 +49,7 @@ function DocumentTeamTagsDialogContent({
 
   // Fetch only teams that the current user belongs to
   const teamsResult = useQuery(
-    api.member.getMyTeams,
+    api.members.queries.getMyTeams,
     organizationId ? { organizationId } : 'skip',
   );
   const teams = teamsResult?.teams ?? null;

services/platform/app/features/documents/components/document-upload-dialog.tsx

@@ -36,7 +36,7 @@ export function DocumentUploadDialog({
 
   // Fetch user's teams via Convex query
   const teamsResult = useQuery(
-    api.member.getMyTeams,
+    api.members.queries.getMyTeams,
     open ? { organizationId } : 'skip',
   );
   const teams = teamsResult?.teams ?? null;

services/platform/app/features/documents/components/documents-client.tsx

@@ -97,7 +97,7 @@ export function DocumentsClient({
   );
 
   const documentsResult = useQuery(
-    api.documents.queries.getDocumentsCursor,
+    api.documents.queries.listDocuments,
     queryArgs,
   );
 

services/platform/app/features/documents/components/onedrive-import-dialog.tsx

@@ -453,7 +453,7 @@ export function OneDriveImportDialog({
 
   // Fetch user's teams via Convex query (only in settings stage)
   const teamsResult = useConvexQuery(
-    api.member.getMyTeams,
+    api.members.queries.getMyTeams,
     stage === 'settings' ? { organizationId } : 'skip',
   );
   const teams = teamsResult?.teams ?? null;

services/platform/app/features/documents/components/rag-status-badge.tsx

@@ -64,7 +64,8 @@ export function RagStatusBadge({
     [t],
   );
 
-  const handleRetry = async () => {
+  const handleRetry = async (e: React.MouseEvent) => {
+    e.stopPropagation();
     if (!documentId) {
       toast({
         title: t('rag.toast.documentIdRequired'),
@@ -135,7 +136,10 @@ export function RagStatusBadge({
       <>
         <button
           type="button"
-          onClick={() => setIsCompletedDialogOpen(true)}
+          onClick={(e) => {
+            e.stopPropagation();
+            setIsCompletedDialogOpen(true);
+          }}
           className="cursor-pointer"
           aria-label={t('rag.dialog.indexed.title')}
         >
@@ -168,7 +172,10 @@ export function RagStatusBadge({
       <span className="inline-flex items-center gap-1.5">
         <button
           type="button"
-          onClick={() => setIsFailedDialogOpen(true)}
+          onClick={(e) => {
+            e.stopPropagation();
+            setIsFailedDialogOpen(true);
+          }}
           className="cursor-pointer"
           aria-label={t('rag.dialog.failed.title')}
         >

services/platform/app/features/documents/hooks/use-document-upload.ts

@@ -7,7 +7,7 @@ import { api } from '@/convex/_generated/api';
 import { useT } from '@/lib/i18n/client';
 import type { Id } from '@/convex/_generated/dataModel';
 
-export { DOCUMENT_MAX_FILE_SIZE as MAX_FILE_SIZE_BYTES } from '@/lib/shared/file-types';
+import { DOCUMENT_MAX_FILE_SIZE } from '@/lib/shared/file-types';
 
 /**
  * Calculate SHA-256 hash of a file using Web Crypto API
@@ -39,7 +39,6 @@ interface UploadFilesOptions {
 interface CreateDocumentResult {
   success: boolean;
   documentId: Id<'documents'>;
-  error?: string;
 }
 
 interface UploadOptions {
@@ -52,7 +51,7 @@ export function useDocumentUpload(options: UploadOptions) {
   const { t } = useT('documents');
   const [isUploading, setIsUploading] = useState(false);
   const abortControllerRef = useRef<AbortController | null>(null);
-  const generateUploadUrl = useMutation(api.file.mutations.generateUploadUrl);
+  const generateUploadUrl = useMutation(api.files.mutations.generateUploadUrl);
   const createDocumentFromUpload = useMutation(
     api.documents.mutations.createDocumentFromUpload,
   );
@@ -82,8 +81,8 @@ export function useDocumentUpload(options: UploadOptions) {
 
     // Check file sizes
     for (const file of files) {
-      if (file.size > MAX_FILE_SIZE_BYTES) {
-        const maxSizeMB = MAX_FILE_SIZE_BYTES / (1024 * 1024);
+      if (file.size > DOCUMENT_MAX_FILE_SIZE) {
+        const maxSizeMB = DOCUMENT_MAX_FILE_SIZE / (1024 * 1024);
         const fileSizeMB = (file.size / (1024 * 1024)).toFixed(1);
         const error = t('upload.fileSizeExceeded', {
           name: file.name,
@@ -164,7 +163,7 @@ export function useDocumentUpload(options: UploadOptions) {
         (result: CreateDocumentResult) => !result.success,
       );
       if (failedUploads.length > 0) {
-        throw new Error(failedUploads[0].error || t('upload.uploadFailed'));
+        throw new Error(t('upload.uploadFailed'));
       }
 
       // Show success toast

services/platform/app/features/products/hooks/use-create-product.ts

@@ -7,5 +7,5 @@ import { api } from '@/convex/_generated/api';
  * where multiple products are created and proper validation is needed.
  */
 export function useCreateProduct() {
-  return useMutation(api.products.mutations.createProductPublic);
+  return useMutation(api.products.mutations.createProduct);
 }

services/platform/app/features/settings/integrations/hooks/use-create-integration.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: useAction - preloaded query with specific name param makes optimistic complex
 export function useCreateIntegration() {
-  return useAction(api.integrations.actions.create.create);
+  return useAction(api.integrations.actions.create);
 }

services/platform/app/features/settings/integrations/hooks/use-delete-integration.ts

@@ -6,5 +6,5 @@ export interface UseDeleteIntegrationParams {
 }
 
 export function useDeleteIntegration({ integrationName }: UseDeleteIntegrationParams) {
-  return useMutation(api.integrations.mutations.delete_integration.deleteIntegration);
+  return useMutation(api.integrations.mutations.deleteIntegration);
 }

services/platform/app/features/settings/integrations/hooks/use-sso-credentials.ts

@@ -2,5 +2,5 @@ import { useAction } from 'convex/react';
 import { api } from '@/convex/_generated/api';
 
 export function useSsoCredentials() {
-  return useAction(api.sso_providers.queries.getSsoCredentialsForEmail);
+  return useAction(api.sso_providers.actions.getSsoCredentialsForEmail);
 }

services/platform/app/features/settings/integrations/hooks/use-test-integration.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: useAction returns test result - can't predict success/failure
 export function useTestIntegration() {
-  return useAction(api.integrations.actions.test_connection.testConnection);
+  return useAction(api.integrations.actions.testConnection);
 }

services/platform/app/features/settings/integrations/hooks/use-update-integration.ts

@@ -3,5 +3,5 @@ import { api } from '@/convex/_generated/api';
 
 // Note: useAction - preloaded query with specific name param makes optimistic complex
 export function useUpdateIntegration() {
-  return useAction(api.integrations.actions.update.update);
+  return useAction(api.integrations.actions.update);
 }

services/platform/app/features/settings/teams/components/team-create-dialog.tsx

@@ -32,7 +32,7 @@ export function TeamCreateDialog({
   const { t: tSettings } = useT('settings');
   const { t: tCommon } = useT('common');
   const { toast } = useToast();
-  const addMember = useMutation(api.team_members.addMember);
+  const addMember = useMutation(api.team_members.mutations.addMember);
 
   const nameRequiredError = tSettings('teams.teamNameRequired');
   const schema = useMemo(