@jlongo78/agent-spaces 0.10.0-beta.2 → 0.10.0-beta.4

package/.next/standalone/docs/plans/2026-04-23-consolidate-addons-plan.md

@@ -1,1509 +0,0 @@
-# Consolidate Addons Implementation Plan
-
-> **For Claude:** Use `superpowers:executing-plans` to implement this plan task-by-task. Repo convention: commit directly to `main` after each task; no PR (see `~/.claude/projects/-home-jlongo-development-spaces/memory/feedback_spaces_branch_workflow.md`).
-
-**Goal:** Fold `@spaces/pro` and `@spaces/teams` source into the `spaces` repo, delete the runtime addon loader, simplify the tier concept to a single `IS_MULTIUSER` flag, and keep `@spaces/cortex` as the only remaining external optional addon.
-
-**Architecture:** See `docs/plans/2026-04-23-consolidate-addons-design.md`.
-
-**Tech stack:** Next.js 16, TypeScript 5, Node ≥ 20.9, `better-sqlite3`, `@modelcontextprotocol/sdk`, `otpauth`, `qrcode`. No new frameworks introduced.
-
-**Estimated size:** ~40 files created, ~30 route files rewritten, ~150 LOC deleted from `bin/spaces.js`, ~100 LOC added to deps.
-
----
-
-## Phase A — Fold in `@spaces/pro` (network)
-
-### Task A1: Baseline — verify current state and build
-
-**Files:** none (sanity check)
-
-**Step 1: Confirm clean working tree**
-
-Run: `git status`
-Expected: only the known untracked files (`docs/FEATURE_DOC_GUIDE.md`, `docs/features/project-wizard.md`) plus the two new plan docs.
-
-**Step 2: Confirm current build succeeds**
-
-Run: `npm run build 2>&1 | tail -20`
-Expected: Next.js build completes. Note any pre-existing warnings — they are **not** fold-in regressions.
-
-**Step 3: Confirm existing `@spaces/pro` symlink**
-
-Run: `ls -la node_modules/@spaces/pro 2>&1 | head -3`
-Expected: shows the symlink target, or "No such file or directory" — either is fine. Record which for later cleanup.
-
-**Step 4: Commit baseline plan docs**
-
-```bash
-git add docs/plans/2026-04-23-consolidate-addons-design.md docs/plans/2026-04-23-consolidate-addons-plan.md
-git commit -m "docs(plans): add addon consolidation design + plan"
-```
-
----
-
-### Task A2: Copy `spaces-pro/src/network/` → `src/lib/network/`
-
-**Files:**
-- Create: `src/lib/network/` (whole tree, copied from `/home/jlongo/development/spaces-pro/src/network/`)
-- Create: `src/types/network.ts` (copied from `/home/jlongo/development/spaces-pro/src/types/network.ts`)
-
-**Step 1: Copy the tree**
-
-```bash
-cp -r /home/jlongo/development/spaces-pro/src/network src/lib/network
-cp /home/jlongo/development/spaces-pro/src/types/network.ts src/types/network.ts
-```
-
-**Step 2: Fix relative import in `src/lib/network/auth.ts`**
-
-The file imports `type { ApiKeyRecord } from '../types/network'`. That worked in the old layout (`spaces-pro/src/network/auth.ts` → `spaces-pro/src/types/network.ts`). In the new layout (`spaces/src/lib/network/auth.ts` → `spaces/src/types/network.ts`) the relative path is `../../types/network`.
-
-Edit `src/lib/network/auth.ts` line `import type { ApiKeyRecord } from '../types/network';` to:
-
-```ts
-import type { ApiKeyRecord } from '../../types/network';
-```
-
-**Step 3: Fix the same relative import in any other copied file**
-
-Run: `grep -rn "from '../types/network'" src/lib/network/`
-Expected: matches in `db.ts`, `client.ts`, `aggregator.ts`, `identity.ts`. Change each to `'../../types/network'`.
-
-Run: `grep -rn "from '../types/network'" src/lib/network/` again.
-Expected: no matches.
-
-**Step 4: Verify TypeScript sees the tree**
-
-Run: `npx tsc --noEmit --project tsconfig.json 2>&1 | grep -E "src/lib/network|src/types/network" | head -20`
-Expected: no type errors pointing at the new files. (Other type errors may exist from the still-present stub — ignore them until Task A3.)
-
-**Step 5: Commit**
-
-```bash
-git add src/lib/network src/types/network.ts
-git commit -m "feat(network): copy @spaces/pro network source into src/lib/network"
-```
-
----
-
-### Task A3: Rewrite `/api/network/*` route handlers to call local modules
-
-**Files:**
-- Modify (20 files): every `src/app/api/network/**/route.ts`
-
-Each route currently looks like:
-
-```ts
-import { NextRequest } from 'next/server';
-import { getPro } from '@/lib/pro';
-
-const notAvailable = () =>
-  Response.json({ error: 'Requires @spaces/pro' }, { status: 404 });
-
-export async function POST(req: NextRequest) {
-  const pro = getPro();
-  return pro?.network.api.terminalToken.POST(req) ?? notAvailable();
-}
-```
-
-Replace with direct call to the local module.
-
-**Step 1: List the route files**
-
-Run: `grep -rl "from '@/lib/pro'" src/app/api/network/ | sort`
-Expected output (20 files):
-
-```
-src/app/api/network/connect-callback/route.ts
-src/app/api/network/connect-request/[id]/route.ts
-src/app/api/network/connect-request/route.ts
-src/app/api/network/discovered/route.ts
-src/app/api/network/handshake/route.ts
-src/app/api/network/health/route.ts
-src/app/api/network/identity/route.ts
-src/app/api/network/keys/[id]/route.ts
-src/app/api/network/keys/route.ts
-src/app/api/network/nodes/[id]/route.ts
-src/app/api/network/nodes/check/route.ts
-src/app/api/network/nodes/route.ts
-src/app/api/network/panes/[id]/route.ts
-src/app/api/network/panes/route.ts
-src/app/api/network/projects/route.ts
-src/app/api/network/proxy/[nodeId]/[...path]/route.ts
-src/app/api/network/search/route.ts
-src/app/api/network/sessions/[id]/messages/route.ts
-src/app/api/network/sessions/[id]/route.ts
-src/app/api/network/sessions/route.ts
-src/app/api/network/terminal/token/route.ts
-src/app/api/network/workspaces/[id]/route.ts
-src/app/api/network/workspaces/route.ts
-```
-
-(Count may be 20-23 depending on routes added since the plan was written.)
-
-**Step 2: Rewrite `src/app/api/network/terminal/token/route.ts` as the first example**
-
-Replace entire file contents with:
-
-```ts
-import { NextRequest } from 'next/server';
-import * as terminalToken from '@/lib/network/api/terminalToken';
-
-export async function POST(req: NextRequest) {
-  return terminalToken.POST(req);
-}
-```
-
-The module at `src/lib/network/api/terminalToken.ts` already exports `POST`.
-
-**Step 3: Rewrite each remaining route by the same pattern**
-
-For each file, the mapping is mechanical. The `pro.network.api.X.Y(req)` call becomes `X.Y(req)` after `import * as X from '@/lib/network/api/X'`. Handler names (`GET`, `POST`, `PUT`, `DELETE`, `PATCH`) stay identical.
-
-Example — `src/app/api/network/workspaces/[id]/route.ts`:
-
-```ts
-import { NextRequest } from 'next/server';
-import * as workspacesById from '@/lib/network/api/workspacesById';
-
-export async function GET(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
-  return workspacesById.GET(req, ctx);
-}
-```
-
-(Confirm each file matches what `spaces-pro/src/network/api/workspacesById.ts` exports — some expose `GET` only, others expose `GET` + `DELETE`, etc. Copy the signature from the source module.)
-
-**Step 4: Verify no route still imports `@/lib/pro`**
-
-Run: `grep -rn "from '@/lib/pro'" src/`
-Expected: no matches.
-
-**Step 5: Verify TypeScript build**
-
-Run: `npx tsc --noEmit --project tsconfig.json 2>&1 | grep "src/app/api/network" | head -20`
-Expected: no errors in network routes.
-
-**Step 6: Commit**
-
-```bash
-git add src/app/api/network
-git commit -m "feat(network): rewrite /api/network/* to call local modules"
-```
-
----
-
-### Task A4: Delete `src/lib/pro.ts` and remaining references
-
-**Files:**
-- Delete: `src/lib/pro.ts`
-- Modify: any remaining file that imports from it (sessions, workspaces list routes — they call `hasPro()` for feature flags, not proxy calls)
-
-**Step 1: Find remaining consumers**
-
-Run: `grep -rn "from '@/lib/pro'" src/`
-Expected: should be empty after Task A3. If it isn't, list files.
-
-Run: `grep -rn "getPro\|hasPro" src/`
-Expected: matches in `src/app/api/sessions/route.ts`, `src/app/api/workspaces/route.ts`, `src/app/api/search/route.ts`, `src/app/api/cortex/federation/search/route.ts`.
-
-**Step 2: Replace each `hasPro()` guard with a direct check on `IS_FEDERATION`**
-
-For each match, the code looks like:
-
-```ts
-import { getPro } from '@/lib/pro';
-// ...
-if (hasPro()) { /* aggregate across federation */ }
-```
-
-Replace with:
-
-```ts
-import { IS_FEDERATION } from '@/lib/tier';
-// ...
-if (IS_FEDERATION) { /* aggregate across federation */ }
-```
-
-And for any code that actually called a pro method (e.g., `getPro().network.aggregateSessions(...)`), import the aggregator directly:
-
-```ts
-import { aggregateSessions } from '@/lib/network';
-// ...
-if (IS_FEDERATION) {
-  const extra = await aggregateSessions(/* ... */);
-  // ...
-}
-```
-
-`src/lib/network/index.ts` already exports `aggregateSessions`, `aggregateSearch`, `aggregateWorkspaces`.
-
-**Step 3: Delete the stub**
-
-```bash
-rm src/lib/pro.ts
-```
-
-**Step 4: Verify**
-
-Run: `grep -rn "from '@/lib/pro'\|getPro\|hasPro" src/`
-Expected: no matches.
-
-Run: `npm run build 2>&1 | tail -30`
-Expected: Next.js build succeeds.
-
-**Step 5: Commit**
-
-```bash
-git add -u
-git commit -m "refactor(network): drop @spaces/pro stub; use local network modules"
-```
-
----
-
-## Phase B — Fold in `@spaces/teams` (auth, admin, collab)
-
-### Task B1: Convert `src/lib/auth.ts` to `src/lib/auth/` folder
-
-**Files:**
-- Delete: `src/lib/auth.ts`
-- Create: `src/lib/auth/context.ts` (current auth.ts content)
-- Create: `src/lib/auth/index.ts` (re-export)
-
-**Step 1: Move the file**
-
-```bash
-mkdir -p src/lib/auth
-git mv src/lib/auth.ts src/lib/auth/context.ts
-```
-
-**Step 2: Create `src/lib/auth/index.ts`**
-
-Contents:
-
-```ts
-export { getAuthUser, withUser } from './context';
-```
-
-**Step 3: Verify existing imports still resolve**
-
-Run: `grep -rn "from '@/lib/auth'" src/ | head -5`
-Expected: still resolves (TypeScript `paths` + Next.js resolve `@/lib/auth` → `src/lib/auth/index.ts`).
-
-Run: `npx tsc --noEmit 2>&1 | grep "lib/auth" | head -10`
-Expected: no errors.
-
-**Step 4: Commit**
-
-```bash
-git add src/lib/auth
-git commit -m "refactor(auth): convert src/lib/auth.ts to folder module"
-```
-
----
-
-### Task B2: Copy teams auth into `src/lib/auth/`
-
-**Files:**
-- Create: `src/lib/auth/session.ts` (from `spaces-teams/src/auth/session.ts`)
-- Create: `src/lib/auth/totp.ts` (from `spaces-teams/src/auth/totp.ts`)
-- Modify: `src/lib/auth/index.ts`
-
-**Step 1: Copy files**
-
-```bash
-cp /home/jlongo/development/spaces-teams/src/auth/session.ts src/lib/auth/session.ts
-cp /home/jlongo/development/spaces-teams/src/auth/totp.ts src/lib/auth/totp.ts
-```
-
-**Step 2: Update `src/lib/auth/index.ts` to re-export**
-
-```ts
-export { getAuthUser, withUser } from './context';
-export {
-  issueSessionToken,
-  verifySessionToken,
-  setSessionCookie,
-  clearSessionCookie,
-  getSessionSecretHex,
-} from './session';
-export * as totp from './totp';
-```
-
-**Step 3: Verify no import rot**
-
-Run: `npx tsc --noEmit 2>&1 | grep "lib/auth" | head -10`
-Expected: no errors. (`totp.ts` depends on `otpauth` and `qrcode` — these aren't installed yet; Task D1 adds them. If tsc complains, defer the verification here to after Task D1.)
-
-**Step 4: Commit**
-
-```bash
-git add src/lib/auth
-git commit -m "feat(auth): fold @spaces/teams auth (session, totp) into src/lib/auth"
-```
-
----
-
-### Task B3: Copy admin modules into `src/lib/admin/`
-
-**Files:**
-- Create: `src/lib/admin/db.ts` (from `spaces-teams/src/admin/db.ts`)
-- Create: `src/lib/admin/index.ts` (from `spaces-teams/src/admin/index.ts`)
-
-**Step 1: Copy**
-
-```bash
-mkdir -p src/lib/admin
-cp /home/jlongo/development/spaces-teams/src/admin/db.ts src/lib/admin/db.ts
-cp /home/jlongo/development/spaces-teams/src/admin/index.ts src/lib/admin/index.ts
-```
-
-**Step 2: Verify exports**
-
-Run: `grep -E "^export" src/lib/admin/index.ts`
-Expected: re-exports from `./db` (createUser, getUser, listUsers, updateUser, deleteUser, resolveShellUser, recordLogin, recordSessionStart/End, getLoginEvents, getTerminalSessions, getActiveSessionCount, getDailyLoginCounts, getDailySessionMinutes, getUserSessionSummary, hashPassword, verifyPassword).
-
-**Step 3: Commit**
-
-```bash
-git add src/lib/admin
-git commit -m "feat(admin): fold @spaces/teams admin modules into src/lib/admin"
-```
-
----
-
-### Task B4: Copy collab bus + queries into `src/lib/collab/`
-
-**Files:**
-- Create: `src/lib/collab/broker.js` (from `spaces-teams/src/bus/broker.js`)
-- Create: `src/lib/collab/queries.js` (from `spaces-teams/src/db/queries.js`)
-- Create: `src/lib/collab/migrations.js` (from `spaces-teams/src/db/migrations.js`)
-
-**Step 1: Copy**
-
-```bash
-mkdir -p src/lib/collab
-cp /home/jlongo/development/spaces-teams/src/bus/broker.js src/lib/collab/broker.js
-cp /home/jlongo/development/spaces-teams/src/db/queries.js src/lib/collab/queries.js
-cp /home/jlongo/development/spaces-teams/src/db/migrations.js src/lib/collab/migrations.js
-```
-
-**Step 2: Fix relative requires inside the copied files**
-
-The copied `.js` files use `require('./...')` for sibling files. Since the directory layout changed (`bus/broker.js` used to require from `../db/queries`, for example), update requires:
-
-Run: `grep -n "require('\\.\\./" src/lib/collab/*.js`
-
-For each hit, replace `require('../db/queries')` → `require('./queries')`, `require('../db/migrations')` → `require('./migrations')`. Inside the new folder everything is a sibling.
-
-Verify: `grep -n "require('\\.\\./" src/lib/collab/*.js`
-Expected: no matches.
-
-**Step 3: Commit**
-
-```bash
-git add src/lib/collab
-git commit -m "feat(collab): fold @spaces/teams bus + queries into src/lib/collab"
-```
-
----
-
-### Task B5: Copy terminal-collaboration module
-
-**Files:**
-- Create: `src/lib/terminal/collaboration.js` (from `spaces-teams/src/terminal/collaboration.js`)
-
-**Step 1: Verify the destination dir exists**
-
-Run: `ls src/lib/terminal/ 2>&1`
-Expected: already exists (spaces has its own terminal modules).
-
-**Step 2: Copy**
-
-```bash
-cp /home/jlongo/development/spaces-teams/src/terminal/collaboration.js src/lib/terminal/collaboration.js
-```
-
-**Step 3: Fix requires**
-
-Run: `grep -n "require('" src/lib/terminal/collaboration.js`
-For any `require('../bus/broker')` → `require('../collab/broker')`, `require('../db/queries')` → `require('../collab/queries')`.
-
-**Step 4: Commit**
-
-```bash
-git add src/lib/terminal/collaboration.js
-git commit -m "feat(terminal): fold @spaces/teams terminal collaboration into src/lib/terminal"
-```
-
----
-
-### Task B6: Rewrite `/api/auth/*` routes
-
-**Files (7 routes):**
-- Modify: `src/app/api/auth/login/route.ts`
-- Modify: `src/app/api/auth/logout/route.ts`
-- Modify: `src/app/api/auth/me/route.ts`
-- Modify: `src/app/api/auth/totp/setup/route.ts`
-- Modify: `src/app/api/auth/totp/status/route.ts`
-- Modify: `src/app/api/auth/totp/verify/route.ts`
-
-**Step 1: Inspect the proxy pattern**
-
-Run: `cat src/app/api/auth/login/route.ts`
-
-Expected shape (approximate):
-
-```ts
-import { NextRequest } from 'next/server';
-import { getTeams } from '@/lib/teams';
-const na = () => Response.json({ error: 'Requires @spaces/teams' }, { status: 404 });
-export async function POST(req: NextRequest) {
-  return getTeams()?.auth.api.login.POST(req) ?? na();
-}
-```
-
-**Step 2: Rewrite each route**
-
-For `src/app/api/auth/login/route.ts`:
-
-```ts
-import { NextRequest } from 'next/server';
-import * as login from '@/lib/auth/api/login';
-
-export async function POST(req: NextRequest) {
-  return login.POST(req);
-}
-```
-
-Wait — we haven't copied the auth API handlers yet. That's this task's true first step.
-
-**Step 2a (correction): Copy `spaces-teams/src/auth/api/` into `src/lib/auth/api/`**
-
-```bash
-mkdir -p src/lib/auth/api
-cp -r /home/jlongo/development/spaces-teams/src/auth/api/*.ts src/lib/auth/api/
-```
-
-**Step 2b: Fix relative imports in the handlers**
-
-Run: `grep -rn "from '\\.\\./" src/lib/auth/api/`
-Expected matches: `from '../session'`, `from '../totp'` — these become `from '../session'` still works (handlers in `api/` sibling to `session.ts`). Verify each handler's imports resolve from the new path.
-
-If a handler imports `from '../../admin/db'`, it still works (now `src/lib/auth/api/*.ts` → `../../admin/db.ts` = `src/lib/admin/db.ts`).
-
-**Step 2c: Rewrite each of the 7 `/api/auth/*` route files**
-
-Pattern for each:
-
-```ts
-import { NextRequest } from 'next/server';
-import * as login from '@/lib/auth/api/login';
-export async function POST(req: NextRequest) { return login.POST(req); }
-```
-
-Copy the exported HTTP verbs from each handler (some are `GET`, some `POST`).
-
-**Step 3: Verify**
-
-Run: `grep -rn "from '@/lib/teams'" src/app/api/auth/`
-Expected: no matches.
-
-Run: `npx tsc --noEmit 2>&1 | grep "app/api/auth" | head -10`
-Expected: no errors.
-
-**Step 4: Commit**
-
-```bash
-git add src/lib/auth/api src/app/api/auth
-git commit -m "feat(auth): rewrite /api/auth/* to call local modules"
-```
-
----
-
-### Task B7: Rewrite `/api/admin/*` routes
-
-**Files (3 routes):**
-- Modify: `src/app/api/admin/users/route.ts`
-- Modify: `src/app/api/admin/users/[id]/route.ts`
-- Modify: `src/app/api/admin/analytics/route.ts`
-
-**Step 1: Copy admin API handlers**
-
-```bash
-mkdir -p src/lib/admin/api
-cp -r /home/jlongo/development/spaces-teams/src/admin/api/*.ts src/lib/admin/api/
-```
-
-**Step 2: Fix relative imports**
-
-Run: `grep -rn "from '" src/lib/admin/api/` and repair any `../../` paths that point outside the old teams package.
-
-**Step 3: Rewrite the 3 routes**
-
-`src/app/api/admin/users/route.ts`:
-
-```ts
-import { NextRequest } from 'next/server';
-import * as users from '@/lib/admin/api/users';
-
-export async function GET(req: NextRequest)  { return users.GET(req); }
-export async function POST(req: NextRequest) { return users.POST(req); }
-```
-
-`src/app/api/admin/users/[id]/route.ts`:
-
-```ts
-import { NextRequest } from 'next/server';
-import * as usersById from '@/lib/admin/api/usersById';
-
-type Ctx = { params: Promise<{ id: string }> };
-export async function GET(req: NextRequest, ctx: Ctx)    { return usersById.GET(req, ctx); }
-export async function PATCH(req: NextRequest, ctx: Ctx)  { return usersById.PATCH(req, ctx); }
-export async function DELETE(req: NextRequest, ctx: Ctx) { return usersById.DELETE(req, ctx); }
-```
-
-(Confirm handler exports match what `spaces-teams/src/admin/api/usersById.ts` actually exports.)
-
-`src/app/api/admin/analytics/route.ts`:
-
-```ts
-import { NextRequest } from 'next/server';
-import * as analytics from '@/lib/admin/api/analytics';
-
-export async function GET(req: NextRequest) { return analytics.GET(req); }
-```
-
-**Step 4: Verify + commit**
-
-Run: `grep -rn "from '@/lib/teams'" src/app/api/admin/`
-Expected: no matches.
-
-```bash
-git add src/lib/admin/api src/app/api/admin
-git commit -m "feat(admin): rewrite /api/admin/* to call local modules"
-```
-
----
-
-### Task B8: Rewrite workspace messages + context routes
-
-**Files (4 routes):**
-- Modify: `src/app/api/workspaces/[id]/messages/route.ts`
-- Modify: `src/app/api/workspaces/[id]/messages/[msgId]/route.ts`
-- Modify: `src/app/api/workspaces/[id]/context/route.ts`
-- Modify: `src/app/api/workspaces/[id]/context/[key]/route.ts`
-
-**Step 1: Copy collab API handlers**
-
-```bash
-mkdir -p src/lib/collab/api
-cp /home/jlongo/development/spaces-teams/src/api/messages.js src/lib/collab/api/messages.js
-cp /home/jlongo/development/spaces-teams/src/api/messageById.js src/lib/collab/api/messageById.js
-cp /home/jlongo/development/spaces-teams/src/api/context.js src/lib/collab/api/context.js
-cp /home/jlongo/development/spaces-teams/src/api/contextByKey.js src/lib/collab/api/contextByKey.js
-```
-
-**Step 2: Fix relative requires in the copied handlers**
-
-Run: `grep -n "require('" src/lib/collab/api/*.js`
-
-Replace paths so they resolve inside the new location:
-- `require('../bus/broker')` → `require('../broker')`
-- `require('../db/queries')` → `require('../queries')`
-- `require('../db/migrations')` → `require('../migrations')`
-
-Verify: `grep -n "require('\\.\\./" src/lib/collab/api/*.js`
-
-**Step 3: Rewrite the 4 routes**
-
-Current shape (from `src/app/api/workspaces/[id]/messages/route.ts`):
-
-```ts
-import { NextRequest } from 'next/server';
-import { getAuthUser, withUser } from '@/lib/auth';
-import { ensureInitialized } from '@/lib/db/init';
-import { getTeams } from '@/lib/teams';
-
-const na = () => Response.json({ error: 'Requires @spaces/teams' }, { status: 404 });
-
-export async function GET(request: NextRequest, ctx: { params: Promise<{ id: string }> }) {
-  const user = getAuthUser(request);
-  return withUser(user, async () => {
-    await ensureInitialized();
-    return getTeams()?.api.messages.GET(request, ctx) ?? na();
-  });
-}
-// ... POST, DELETE similar
-```
-
-Rewrite to:
-
-```ts
-import { NextRequest } from 'next/server';
-import { getAuthUser, withUser } from '@/lib/auth';
-import { ensureInitialized } from '@/lib/db/init';
-// Note: .js module; Next/tsc resolve this via allowJs + resolveJsonModule settings in tsconfig.json.
-// If tsconfig doesn't have allowJs, either enable it or add a local .d.ts shim (see Step 4).
-import * as messages from '@/lib/collab/api/messages';
-
-export async function GET(request: NextRequest, ctx: { params: Promise<{ id: string }> }) {
-  const user = getAuthUser(request);
-  return withUser(user, async () => {
-    await ensureInitialized();
-    return messages.GET(request, ctx);
-  });
-}
-
-export async function POST(request: NextRequest, ctx: { params: Promise<{ id: string }> }) {
-  const user = getAuthUser(request);
-  return withUser(user, async () => {
-    await ensureInitialized();
-    return messages.POST(request, ctx);
-  });
-}
-
-export async function DELETE(request: NextRequest, ctx: { params: Promise<{ id: string }> }) {
-  const user = getAuthUser(request);
-  return withUser(user, async () => {
-    await ensureInitialized();
-    return messages.DELETE(request, ctx);
-  });
-}
-```
-
-Apply the same transform to the three remaining routes (`messages/[msgId]`, `context`, `context/[key]`), substituting the appropriate module name (`messageById`, `context`, `contextByKey`) and handler verbs.
-
-**Step 4: If TS complains about `.js` imports**
-
-Check `tsconfig.json` for `"allowJs"`. If absent:
-
-```bash
-grep -n "allowJs" tsconfig.json
-```
-
-If not set, either add `"allowJs": true` under `compilerOptions` (simplest), or create local `.d.ts` shims in `src/types/collab-api.d.ts`:
-
-```ts
-declare module '@/lib/collab/api/messages' {
-  import type { NextRequest } from 'next/server';
-  type Ctx = { params: Promise<{ id: string }> };
-  export function GET(req: NextRequest, ctx: Ctx): Promise<Response>;
-  export function POST(req: NextRequest, ctx: Ctx): Promise<Response>;
-  export function DELETE(req: NextRequest, ctx: Ctx): Promise<Response>;
-}
-// …similar blocks for messageById, context, contextByKey
-```
-
-Prefer `allowJs: true` — less boilerplate, same type safety (handlers are JS so there's no extra type checking to gain).
-
-**Step 5: Verify + commit**
-
-Run: `grep -rn "from '@/lib/teams'" src/app/api/workspaces/`
-Expected: no matches.
-
-Run: `npm run build 2>&1 | tail -30`
-Expected: success.
-
-```bash
-git add -u src/app/api/workspaces src/lib/collab tsconfig.json
-git commit -m "feat(collab): rewrite workspace messages/context routes to call local modules"
-```
-
----
-
-### Task B9: Update `src/lib/config.ts`
-
-**Files:**
-- Modify: `src/lib/config.ts:5-7,22-32`
-
-**Step 1: Replace imports**
-
-Current:
-
-```ts
-import { HAS_MULTIUSER } from '@/lib/tier';
-import { getTeams } from '@/lib/teams';
-```
-
-Replace with:
-
-```ts
-import { IS_MULTIUSER } from '@/lib/flags';  // Phase C renames tier → flags
-import { resolveShellUser } from '@/lib/admin';
-```
-
-**Step 2: Replace the `getTeams()?.admin.resolveShellUser(...)` block**
-
-Current (lines 22-32):
-
-```ts
-export function getUserPaths(username: string) {
-  let resolvedUser = username;
-  if (HAS_MULTIUSER) {
-    try {
-      const teams = getTeams();
-      if (teams) resolvedUser = teams.admin.resolveShellUser(username);
-    } catch {}
-  }
-  // ...
-```
-
-Replace with:
-
-```ts
-export function getUserPaths(username: string) {
-  let resolvedUser = username;
-  if (IS_MULTIUSER) {
-    try {
-      resolvedUser = resolveShellUser(username);
-    } catch {}
-  }
-  // ...
-```
-
-**Step 3: Verify**
-
-Run: `grep -n "getTeams\|HAS_MULTIUSER" src/lib/config.ts`
-Expected: no matches.
-
-**Step 4: Note — the `IS_MULTIUSER` import won't resolve yet**
-
-`@/lib/flags` doesn't exist until Phase C. This is deliberate — keep the edit in this task so the config change lands with the teams fold-in, and let Phase C introduce the flags module that this now depends on. Leave the file in a broken import state; `npm run build` will fail on this file only. The next task fixes it.
-
----
-
-### Task B10: Delete `src/lib/teams.ts`
-
-**Files:**
-- Delete: `src/lib/teams.ts`
-
-**Step 1: Confirm no remaining imports**
-
-Run: `grep -rn "from '@/lib/teams'\|getTeams\|hasTeams" src/`
-Expected: only matches inside `src/lib/teams.ts` itself.
-
-**Step 2: Delete**
-
-```bash
-rm src/lib/teams.ts
-```
-
-**Step 3: Commit (partial — build still broken on flags.ts)**
-
-```bash
-git add -u
-git commit -m "refactor(teams): drop @spaces/teams stub; use local modules"
-```
-
----
-
-## Phase C — Replace `tier.ts` with `flags.ts`
-
-### Task C1: Create `src/lib/flags.ts`
-
-**Files:**
-- Create: `src/lib/flags.ts`
-
-**Step 1: Write the module**
-
-```ts
-/**
- * Runtime flags for the consolidated Spaces app.
- *
- * IS_MULTIUSER — when true, middleware enforces login, admin routes are live,
- * and config.ts resolves shell users via the admin DB. When false (default),
- * the app runs as a solo desktop workspace manager with no login.
- *
- * Federation is always on. The /api/network/* routes are live regardless of
- * mode; list endpoints return empty arrays when no peer nodes are configured.
- */
-export const IS_MULTIUSER: boolean =
-  process.env.SPACES_MULTIUSER === '1' ||
-  process.env.NEXT_PUBLIC_MULTIUSER === '1';
-
-export const IS_DESKTOP: boolean = !IS_MULTIUSER;
-
-/** Returned from /api/tier (name kept for route compatibility). */
-export function getTierFlags() {
-  let version = '0.0.0';
-  try { version = require('../../package.json').version; } catch {}
-  return {
-    tier: IS_MULTIUSER ? 'team' : 'community',
-    version,
-    hasAuth: IS_MULTIUSER,
-    hasAdmin: IS_MULTIUSER,
-    hasCollaboration: IS_MULTIUSER,
-    hasNetwork: true,
-    hasMultiuser: IS_MULTIUSER,
-    hasCortex: process.env.SPACES_HAS_CORTEX === '1',
-    isDesktop: IS_DESKTOP,
-    basePath: process.env.SPACES_BASE_PATH || '',
-  };
-}
-```
-
-**Step 2: Commit**
-
-```bash
-git add src/lib/flags.ts
-git commit -m "feat(flags): add IS_MULTIUSER runtime flag (federation always on)"
-```
-
----
-
-### Task C2: Point existing tier imports at `flags.ts`
-
-**Files:**
-- Modify: `src/middleware.ts:2`
-- Modify: `src/lib/auth/context.ts:4` (formerly `src/lib/auth.ts`)
-- Modify: `src/app/api/tier/route.ts`
-- Modify: `src/app/api/cortex/federation/search/route.ts`
-- Modify: any other file with `from '@/lib/tier'`
-
-**Step 1: Enumerate consumers**
-
-Run: `grep -rln "from '@/lib/tier'" src/`
-
-Expected matches (approx):
-- `src/middleware.ts` — uses `HAS_AUTH`
-- `src/lib/auth/context.ts` — uses `HAS_AUTH`
-- `src/lib/config.ts` — already changed in Task B9 to `IS_MULTIUSER` from flags
-- `src/app/api/tier/route.ts` — uses `getTierFlags`
-- `src/app/api/cortex/federation/search/route.ts` — uses `IS_FEDERATION`
-
-**Step 2: For each file, swap the import path and flag names**
-
-| Old import | New import | Old flag | New flag |
-|---|---|---|---|
-| `from '@/lib/tier'` | `from '@/lib/flags'` | `HAS_AUTH` | `IS_MULTIUSER` |
-| `from '@/lib/tier'` | `from '@/lib/flags'` | `HAS_MULTIUSER` | `IS_MULTIUSER` |
-| `from '@/lib/tier'` | *(remove import)* | `HAS_NETWORK` | *(federation always-on; delete the guard)* |
-| `from '@/lib/tier'` | *(remove import)* | `IS_FEDERATION` | *(federation always-on; delete the guard)* |
-| `from '@/lib/tier'` | `from '@/lib/flags'` | `getTierFlags` | `getTierFlags` (same) |
-| `from '@/lib/tier'` | `from '@/lib/flags'` | `IS_DESKTOP` | `IS_DESKTOP` (same) |
-
-For the one `IS_FEDERATION` consumer (`src/app/api/cortex/federation/search/route.ts`), delete the guard block entirely:
-
-```ts
-// before
-import { IS_FEDERATION } from '@/lib/tier';
-// ...
-if (!IS_FEDERATION) {
-  return NextResponse.json({ error: 'Federation not available' }, { status: 403 });
-}
-
-// after — drop the import and the block; federation is always on
-```
-
-Example — `src/middleware.ts`:
-
-```ts
-// before
-import { HAS_AUTH } from '@/lib/tier';
-if (!HAS_AUTH) return NextResponse.next();
-
-// after
-import { IS_MULTIUSER } from '@/lib/flags';
-if (!IS_MULTIUSER) return NextResponse.next();
-```
-
-`src/lib/auth/context.ts` (same pattern — just rename the import).
-
-**Step 3: Verify**
-
-Run: `grep -rn "from '@/lib/tier'" src/`
-Expected: no matches.
-
-Run: `grep -rn "HAS_AUTH\|HAS_MULTIUSER\|HAS_NETWORK" src/`
-Expected: no matches.
-
-Run: `npm run build 2>&1 | tail -30`
-Expected: success.
-
-**Step 4: Commit**
-
-```bash
-git add -u
-git commit -m "refactor(flags): swap @/lib/tier imports to @/lib/flags"
-```
-
----
-
-### Task C3: Delete `src/lib/tier.ts`
-
-**Files:**
-- Delete: `src/lib/tier.ts`
-
-**Step 1: Delete**
-
-```bash
-rm src/lib/tier.ts
-```
-
-**Step 2: Verify + commit**
-
-```bash
-npm run build 2>&1 | tail -20
-git add -u
-git commit -m "refactor(flags): drop src/lib/tier.ts"
-```
-
----
-
-## Phase D — Launcher simplification + binaries + deps
-
-### Task D1: Add npm deps
-
-**Files:**
-- Modify: `package.json`
-
-**Step 1: Add runtime deps**
-
-In `package.json` under `"dependencies"`, add (alphabetical order):
-
-```json
-"otpauth": "^9.0.0",
-"qrcode": "^1.5.0",
-```
-
-`@modelcontextprotocol/sdk` and `better-sqlite3` are already listed.
-
-**Step 2: Add dev type deps**
-
-Under `"devDependencies"`, verify `@types/qrcode` is present (it is). No change needed.
-
-**Step 3: Install**
-
-```bash
-npm install
-```
-
-Expected: lockfile updates, no errors.
-
-**Step 4: Verify the now-complete TS build**
-
-Run: `npm run build 2>&1 | tail -30`
-Expected: success. If `src/lib/auth/totp.ts` flagged `otpauth`/`qrcode` unresolved earlier, it now resolves.
-
-**Step 5: Commit**
-
-```bash
-git add package.json package-lock.json
-git commit -m "feat(deps): add otpauth + qrcode for local TOTP/admin"
-```
-
----
-
-### Task D2: Copy teams binaries into `bin/`
-
-**Files:**
-- Create: `bin/spaces-msg.js` (from `spaces-teams/bin/spaces-msg.js`)
-- Create: `bin/spaces-mcp.js` (from `spaces-teams/bin/mcp-server.js`)
-- Create: `bin/spaces-hook.js` (from `spaces-teams/bin/spaces-hook.js`)
-- Modify: `package.json` (add `spaces-msg` bin entry)
-
-**Step 1: Copy**
-
-```bash
-cp /home/jlongo/development/spaces-teams/bin/spaces-msg.js   bin/spaces-msg.js
-cp /home/jlongo/development/spaces-teams/bin/mcp-server.js   bin/spaces-mcp.js
-cp /home/jlongo/development/spaces-teams/bin/spaces-hook.js  bin/spaces-hook.js
-chmod +x bin/spaces-msg.js bin/spaces-mcp.js bin/spaces-hook.js
-```
-
-**Step 2: Update requires inside each bin file**
-
-Run: `grep -n "require('" bin/spaces-msg.js bin/spaces-mcp.js bin/spaces-hook.js`
-
-Any `require('@spaces/teams')` or `require('../src/...')` needs to point at the new location. Most likely these scripts import local modules under `spaces-teams/src/`; update to `../src/lib/collab/...` or `../src/lib/admin/...` as appropriate.
-
-Specifically:
-- `bin/spaces-msg.js` makes HTTP calls to the running server, no internal requires — likely no changes.
-- `bin/spaces-mcp.js` (MCP server) probably requires broker/queries — update to `../src/lib/collab/broker` etc.
-- `bin/spaces-hook.js` likely similar.
-
-**Step 3: Add `spaces-msg` to `package.json#bin`**
-
-Current:
-
-```json
-"bin": {
-  "spaces": "./bin/spaces.js"
-},
-```
-
-Change to:
-
-```json
-"bin": {
-  "spaces": "./bin/spaces.js",
-  "spaces-msg": "./bin/spaces-msg.js"
-},
-```
-
-(`spaces-mcp` and `spaces-hook` are invoked via absolute path from config files — no bin entry.)
-
-**Step 4: Commit**
-
-```bash
-git add bin/spaces-msg.js bin/spaces-mcp.js bin/spaces-hook.js package.json
-git commit -m "feat(bin): fold @spaces/teams binaries into spaces/bin"
-```
-
----
-
-### Task D3: Strip tier detection from `bin/spaces.js`
-
-**Files:**
-- Modify: `bin/spaces.js` (delete lines ~242-360 tier/NODE_PATH block; simplify auto-setup trigger)
-
-**Step 1: Identify the block**
-
-Run: `sed -n '240,360p' bin/spaces.js`
-
-The block covers:
-- Tier resolution (CLI → env → config → auto-detect)
-- "Server tier prerequisites" check (requires `@spaces/teams` for team, `@spaces/pro` for federation)
-- Session secret lookup + `autoSetup` call (gated on `tier !== 'community'`)
-- NODE_PATH munging for pro/teams/cortex
-- Smoke-test load of `@spaces/teams`
-
-**Step 2: Replace with a simpler block**
-
-Replace lines 242-360 with:
-
-```js
-  // ─── Multiuser flag ────────────────────────────────────────
-  // Launcher stays in "desktop" mode unless the operator opts in via env or CLI.
-  // Multiuser enables login, admin UI, and the admin.db / session_secret bootstrap.
-  // Federation is always on — the /api/network/* routes exist regardless of mode.
-  const isMultiuser = cliFlags.multiuser === true
-    || process.env.SPACES_MULTIUSER === '1'
-    || savedConfig.multiuser === true;
-
-  console.log('');
-  console.log('  Spaces - Agent Workspace Manager');
-  console.log('  =================================');
-  console.log('');
-  console.log(`  Mode: ${isMultiuser ? 'multiuser' : 'desktop'}`);
-
-  const childEnv = { ...process.env };
-
-  if (isMultiuser) {
-    // Ensure session secret + admin DB exist. The auto-setup helper handles both.
-    let sessionSecret = process.env.SPACES_SESSION_SECRET || '';
-    if (!sessionSecret && fs.existsSync(SESSION_SECRET_PATH)) {
-      sessionSecret = fs.readFileSync(SESSION_SECRET_PATH, 'utf-8').trim();
-    }
-    const adminDbPath = path.join(SPACES_DIR, 'admin.db');
-    if (!fs.existsSync(adminDbPath) || !sessionSecret) {
-      const { autoSetup } = require('./lib/auto-setup');
-      const result = autoSetup({ SPACES_DIR, SESSION_SECRET_PATH, ADMIN_DB_PATH: adminDbPath, CONFIG_PATH, port: PORT, basePath });
-      sessionSecret = result.sessionSecret;
-    }
-    childEnv.SPACES_SESSION_SECRET = sessionSecret;
-    process.env.SPACES_SESSION_SECRET = sessionSecret;
-    childEnv.SPACES_MULTIUSER = '1';
-    process.env.SPACES_MULTIUSER = '1';
-    console.log(`  Admin DB: ${adminDbPath}`);
-  }
-
-  if (basePath) {
-    childEnv.SPACES_BASE_PATH = basePath;
-    console.log(`  Base path: ${basePath}`);
-  }
-  if (allowedOrigins) {
-    childEnv.SPACES_ALLOWED_ORIGINS = allowedOrigins;
-    process.env.SPACES_ALLOWED_ORIGINS = allowedOrigins;
-    console.log(`  Allowed origins: ${allowedOrigins}`);
-  }
-```
-
-**Step 3: Remove the `require('@spaces/pro')` / `require('@spaces/teams')` resolution helpers**
-
-Run: `grep -n "@spaces/\\(pro\\|teams\\)" bin/spaces.js`
-
-Delete the functions around lines 749-780 (`resolveProPath`, `resolveTeamsPath`, probe logic). Replace any remaining references to `proPath`/`teamsPath`/`teamsPath` with literal `false` or delete the referencing code.
-
-**Step 4: Update help text**
-
-Replace CLI flag documentation for `--tier` with `--multiuser` and `--federation` flags. Remove the `install teams|pro` references.
-
-Replace (around lines 80-95):
-
-```js
-    spaces install <teams|pro>   Install a tier package
-```
-
-With: *(delete the line)*
-
-Replace:
-
-```js
-    spaces --tier team           Override tier (community|team|federation)
-```
-
-With:
-
-```js
-    spaces --multiuser           Enable multiuser mode (login, admin UI)
-```
-
-*(no `--federation` flag — federation is always on)*
-
-**Step 5: Update CLI flag parsing**
-
-Around lines 70-74, replace:
-
-```js
-else if (args[i] === '--tier' && args[i + 1]) { cliFlags.tier = args[++i]; }
-```
-
-With:
-
-```js
-else if (args[i] === '--multiuser') { cliFlags.multiuser = true; }
-```
-
-**Step 6: Verify the launcher boots**
-
-Run: `node bin/spaces.js --help | head -30`
-Expected: help text shows `--multiuser` (no `--tier`), no `install teams|pro`.
-
-Run: `SPACES_DESKTOP=1 node bin/spaces-dev.js &` then `curl http://localhost:3457/api/tier | head`
-Expected: JSON with `"tier": "community"`, `"hasAuth": false`.
-
-Kill the dev server: `pkill -f spaces-dev`.
-
-**Step 7: Commit**
-
-```bash
-git add bin/spaces.js
-git commit -m "refactor(launcher): drop tier detection + NODE_PATH munging"
-```
-
----
-
-### Task D4: Strip tier workflow from `bin/spaces-install.js`
-
-**Files:**
-- Modify: `bin/spaces-install.js`
-
-**Step 1: Identify tier-only code**
-
-Run: `grep -n "@spaces/\\(pro\\|teams\\)\\|tierMap\\|tier =" bin/spaces-install.js`
-
-The file currently supports `spaces install <teams|pro|cortex>`. After fold-in, `teams` and `pro` are internal — only `cortex` remains installable.
-
-**Step 2: Delete `teams` and `pro` entries from the `PACKAGES` table**
-
-Around lines 36-50:
-
-```js
-const PACKAGES = {
-  teams: { name: '@spaces/teams', ... },
-  pro:   { name: '@spaces/pro',   ... },
-  cortex: { name: '@spaces/cortex', ... },
-};
-```
-
-Delete the `teams` and `pro` keys; keep `cortex`.
-
-**Step 3: Delete tier-setting logic**
-
-Around lines 304-326 (the `tierMap = { teams: 'team', pro: 'federation' }` block and surrounding if/else), delete. Cortex install should no longer touch the tier field.
-
-Around lines 575-625 (uninstall path that resets tier to community), delete — cortex uninstall doesn't affect tier.
-
-**Step 4: Update help text**
-
-Replace `spaces install <teams|pro|cortex>` mentions with `spaces install cortex`.
-
-**Step 5: Verify**
-
-Run: `node bin/spaces-install.js --help 2>&1 | head -10`
-Expected: only mentions cortex as an installable.
-
-Run: `node bin/spaces-install.js teams 2>&1 | head -5`
-Expected: error "Unknown package: teams" (or similar), not a successful install attempt.
-
-**Step 6: Commit**
-
-```bash
-git add bin/spaces-install.js
-git commit -m "refactor(install): remove teams+pro install workflow; cortex only"
-```
-
----
-
-### Task D5: Update `bin/lib/auto-setup.js`
-
-**Files:**
-- Modify: `bin/lib/auto-setup.js`
-
-**Step 1: Inspect current signature**
-
-Run: `head -40 bin/lib/auto-setup.js`
-
-The function receives `tier` in its args bag. After fold-in, `tier` is meaningless — auto-setup either runs (multiuser enabled) or doesn't (launcher never calls it in desktop mode).
-
-**Step 2: Remove `tier` from the function signature and body**
-
-Delete any reference to `args.tier` or the variable `tier` inside the function. The function's only job is: ensure `SPACES_DIR` exists, write a session secret if missing, create the admin DB from the teams' migrations module.
-
-**Step 3: Update the migrations import**
-
-The function currently does `require('@spaces/teams/bus/broker')` or similar to run migrations. Update to:
-
-```js
-const collabMigrations = require('../../src/lib/collab/migrations');
-const adminDb = require('../../src/lib/admin/db');
-// ... call collabMigrations.runMigrations(...) and adminDb.getAdminDb() ...
-```
-
-(Verify the actual APIs of the copied modules — the existing auto-setup.js should have the call pattern; just retarget the paths.)
-
-**Step 4: Verify**
-
-Run: `rm -f /tmp/test-setup/admin.db /tmp/test-setup/session_secret && SPACES_DIR=/tmp/test-setup node -e "require('./bin/lib/auto-setup').autoSetup({ SPACES_DIR: '/tmp/test-setup', SESSION_SECRET_PATH: '/tmp/test-setup/session_secret', ADMIN_DB_PATH: '/tmp/test-setup/admin.db', CONFIG_PATH: '/tmp/test-setup/config.json', port: 3457, basePath: '' })"`
-
-Expected: creates admin.db + session_secret, prints success.
-
-Clean up: `rm -rf /tmp/test-setup`.
-
-**Step 5: Commit**
-
-```bash
-git add bin/lib/auto-setup.js
-git commit -m "refactor(auto-setup): drop tier arg; target local migrations"
-```
-
----
-
-## Phase E — Smoke, docs, archive
-
-### Task E1: Smoke-test desktop mode
-
-**Step 1: Fresh dev boot in desktop mode**
-
-```bash
-pkill -f spaces-dev 2>/dev/null; sleep 1
-npm run dev > /tmp/spaces-dev.log 2>&1 &
-sleep 10
-```
-
-**Step 2: Verify `/api/tier` reflects desktop**
-
-```bash
-curl -s http://localhost:3457/api/tier | head
-```
-
-Expected: `"tier":"community"`, `"hasAuth":false`, `"hasMultiuser":false`.
-
-**Step 3: Verify root page loads without redirect to /login**
-
-```bash
-curl -sI http://localhost:3457/ | head -5
-```
-
-Expected: `HTTP/1.1 200` (or 307 to `/m/` on mobile UA, but not to `/login`).
-
-**Step 4: Verify `/api/workspaces` responds (no auth required)**
-
-```bash
-curl -s http://localhost:3457/api/workspaces | head
-```
-
-Expected: JSON array (possibly empty), no 401.
-
-**Step 5: Verify `/api/network/health` responds (federation is always on)**
-
-```bash
-curl -s http://localhost:3457/api/network/health | head
-```
-
-Expected: 200 with health payload. No "Requires @spaces/pro" 404 — federation is now always available.
-
-**Step 6: Shut down**
-
-```bash
-pkill -f spaces-dev
-```
-
----
-
-### Task E2: Smoke-test multiuser mode
-
-**Step 1: Provision secret + admin DB**
-
-```bash
-rm -rf ~/.spaces/admin.db ~/.spaces/session_secret 2>/dev/null
-SPACES_MULTIUSER=1 node bin/spaces.js setup-admin  # creates initial admin
-```
-
-If `setup-admin` prompts for credentials, enter a test user (e.g., `admin` / `admin-test-pw`).
-
-**Step 2: Boot in multiuser mode**
-
-```bash
-SPACES_MULTIUSER=1 npm run dev > /tmp/spaces-dev.log 2>&1 &
-sleep 10
-```
-
-**Step 3: Verify redirect to /login for root**
-
-```bash
-curl -sI http://localhost:3457/ | head -5
-```
-
-Expected: `HTTP/1.1 307` → `Location: /login?...`.
-
-**Step 4: Verify `/api/auth/login` accepts the admin credentials**
-
-```bash
-curl -s -X POST http://localhost:3457/api/auth/login \
-  -H 'Content-Type: application/json' \
-  -d '{"username":"admin","password":"admin-test-pw"}' \
-  -c /tmp/spaces-cookies.txt | head
-```
-
-Expected: JSON with `{"ok":true,...}` and a `spaces-session` cookie set.
-
-**Step 5: Verify `/api/admin/users` with the session returns the user list**
-
-```bash
-curl -s http://localhost:3457/api/admin/users -b /tmp/spaces-cookies.txt | head
-```
-
-Expected: JSON array containing the admin user.
-
-**Step 6: Shut down**
-
-```bash
-pkill -f spaces-dev
-rm -f /tmp/spaces-cookies.txt
-```
-
----
-
-### Task E3: Run the existing test suite
-
-```bash
-npm test 2>&1 | tail -40
-```
-
-Expected: green. If a test references `@spaces/pro` / `@spaces/teams` / `@/lib/pro` / `@/lib/teams`, fix it (replace with the new module path) before committing.
-
----
-
-### Task E4: Archive the retired repos
-
-**Files:**
-- Move: `/home/jlongo/development/spaces-pro/` → `~/archive/spaces-pro/`
-- Move: `/home/jlongo/development/spaces-teams/` → `~/archive/spaces-teams/`
-
-**Step 1: Create archive dir**
-
-```bash
-mkdir -p ~/archive
-```
-
-**Step 2: Confirm the GitHub remotes are up to date before moving (safety)**
-
-```bash
-cd /home/jlongo/development/spaces-pro && git status && git log -1 --oneline
-cd /home/jlongo/development/spaces-teams && git status && git log -1 --oneline
-cd /home/jlongo/development/spaces
-```
-
-Expected: each shows a clean tree (or known uncommitted state that was intentional). If dirty, commit + push the remaining work on each repo before archiving. **Do not archive over uncommitted work.**
-
-**Step 3: Move**
-
-```bash
-mv /home/jlongo/development/spaces-pro ~/archive/
-mv /home/jlongo/development/spaces-teams ~/archive/
-```
-
-**Step 4: Confirm no leftover reference from spaces**
-
-```bash
-cd /home/jlongo/development/spaces
-grep -rn "spaces-pro\|spaces-teams" docs/ README.md package.json 2>/dev/null | grep -v "2026-04-23-consolidate-addons" | head -10
-```
-
-Expected: no matches outside the plan docs. If there are stale doc references, update them (or delete).
-
----
-
-### Task E5: Update README + docs
-
-**Files:**
-- Modify: `README.md`
-- Modify: `docs/architecture.md` (if it mentions tiers/addons)
-
-**Step 1: Sweep the README for tier mentions**
-
-Run: `grep -n "tier\|@spaces/teams\|@spaces/pro\|install teams\|install pro" README.md`
-
-For each hit, update:
-- Drop any mention of `spaces install teams` / `spaces install pro`.
-- Replace "community / team / federation tier" language with "desktop (default) / multiuser (`--multiuser`)". Federation is always on and needs no flag.
-- Keep cortex mentions intact — it's still an addon.
-
-**Step 2: Bump version**
-
-`package.json`: `"version": "0.9.10"` → `"version": "0.10.0"`.
-
-**Step 3: Commit**
-
-```bash
-git add README.md docs/ package.json package-lock.json
-git commit -m "docs: document multiuser/federation flags; drop tier terminology"
-```
-
----
-
-### Task E6: Final verification
-
-**Step 1: Clean install test**
-
-```bash
-rm -rf node_modules .next
-npm ci
-npm run build 2>&1 | tail -20
-```
-
-Expected: green build from scratch.
-
-**Step 2: Grep for dead references**
-
-```bash
-grep -rn "@spaces/pro\|@spaces/teams\|from '@/lib/pro'\|from '@/lib/teams'\|from '@/lib/tier'\|getPro\|hasPro\|getTeams\|hasTeams\|HAS_AUTH\|HAS_MULTIUSER\|HAS_NETWORK\|IS_FEDERATION\|SPACES_TIER\|SPACES_FEDERATION" src/ bin/ scripts/ 2>/dev/null | head -20
-```
-
-Expected: no matches (outside the plan/design docs — grep excludes `docs/` above).
-
-**Step 3: Final commit + tag**
-
-```bash
-git tag v0.10.0
-git log --oneline -20
-```
-
-Expected: clean history of phase commits.
-
----
-
-## Self-review checklist
-
-Run through this before marking the plan done:
-
-- [ ] **Phase coverage:** pro → teams → flags → launcher → deps → binaries → smoke. Any phase missing?
-- [ ] **Route coverage:** 20 network routes, 7 auth routes, 3 admin routes, 4 collab routes rewritten. All accounted for in Tasks A3, B6, B7, B8.
-- [ ] **Placeholder scan:** search this file for "TBD", "TODO", "implement later" — should be zero matches.
-- [ ] **Type consistency:** `IS_MULTIUSER` / `IS_FEDERATION` / `IS_DESKTOP` spelled identically across plan + design + code samples.
-- [ ] **Cortex untouched:** no task modifies `src/lib/cortex/*`, the cortex stub, or `@spaces/cortex` resolution.
-- [ ] **Desktop default preserved:** middleware's early-return behavior on `!IS_MULTIUSER` matches the old `!HAS_AUTH` — same UX for solo users.
-- [ ] **Commit per task:** every task ends with a `git commit` step — no drift between tasks.