@taskforcehq/taskforce 0.3.168

package/dist/core/Taskforce.realtimeMutation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/Taskforce.realtimeMutation.test.js

@@ -0,0 +1,76 @@
+import { describe, expect, it } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { TaskforceCore } from './Taskforce';
+function makeCore() {
+    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-realtime-mutation-test-'));
+    const core = new TaskforceCore({
+        projectRoot,
+        storagePath: path.join(projectRoot, '.taskforce')
+    });
+    return {
+        core,
+        cleanup: () => {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    };
+}
+describe('TaskforceCore realtime mutation stream', () => {
+    it('emits task upsert events for create and update paths (MCP/HTTP shared core)', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const events = [];
+            const off = core.onRealtimeMutation((event) => events.push(event));
+            const created = core.createTask({ title: 'Realtime Mutation Task' }, { workspaceId: 'workspace-a' });
+            core.updateTask(created.id, { description: 'updated via core' }, 'workspace-a');
+            off();
+            const taskEvents = events.filter((event) => event.entityType === 'task');
+            expect(taskEvents.length).toBe(2);
+            expect(taskEvents[0].changeType).toBe('upsert');
+            expect(taskEvents[0].workspaceId).toBe('workspace-a');
+            expect(taskEvents[0].entityIds).toContain(created.id);
+            expect(taskEvents[1].seq).toBeGreaterThan(taskEvents[0].seq);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('emits taxonomy events on taxonomy updates', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const events = [];
+            const off = core.onRealtimeMutation((event) => events.push(event));
+            core.updateTaxonomies([{ value: 'streaming', label: 'Streaming' }]);
+            off();
+            const taxonomyEvent = events.find((event) => event.entityType === 'taxonomy');
+            expect(taxonomyEvent).toBeTruthy();
+            expect(taxonomyEvent?.workspaceId).toBe('*');
+            expect(taxonomyEvent?.changeType).toBe('upsert');
+            expect(taxonomyEvent?.entityIds).toContain('__taxonomy_config__');
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('emits document metadata events and avoids duplicate emits for unchanged hash', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const events = [];
+            const off = core.onRealtimeMutation((event) => events.push(event));
+            core.upsertDocumentWatermark('workspace-docs', '.taskforce/docs/foo.md', 'hash-1', new Date().toISOString());
+            core.upsertDocumentWatermark('workspace-docs', '.taskforce/docs/foo.md', 'hash-1', new Date().toISOString());
+            core.deleteDocumentWatermark('workspace-docs', '.taskforce/docs/foo.md');
+            off();
+            const docEvents = events.filter((event) => event.entityType === 'document-metadata');
+            expect(docEvents.length).toBe(2);
+            expect(docEvents[0].changeType).toBe('upsert');
+            expect(docEvents[1].changeType).toBe('delete');
+            expect(docEvents.every((event) => event.workspaceId === 'workspace-docs')).toBe(true);
+        }
+        finally {
+            cleanup();
+        }
+    });
+});

package/dist/core/WorkspaceDelete.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/WorkspaceDelete.test.js

@@ -0,0 +1,140 @@
+import { describe, expect, it } from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { TaskforceCore } from './Taskforce';
+function makeCore() {
+    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-workspace-delete-'));
+    const core = new TaskforceCore({
+        projectRoot,
+        storagePath: path.join(projectRoot, '.taskforce')
+    });
+    return {
+        core,
+        cleanup: () => {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    };
+}
+function countByWorkspace(core, table, workspaceId) {
+    const row = core.getDatabaseAdapter().prepare(`
+        SELECT COUNT(*) AS count
+        FROM ${table}
+        WHERE tenant_id = ? AND workspace_id = ?
+    `).get(core.getTenantId(), workspaceId);
+    return Number(row?.count || 0);
+}
+describe('TaskforceCore deleteWorkspace', () => {
+    it('cascades deletion for workspace-scoped rows and preserves other workspaces', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const tenantId = core.getTenantId();
+            const wsDelete = 'workspace-delete';
+            const wsKeep = 'workspace-keep';
+            const now = '2026-03-03T10:00:00.000Z';
+            core.createWorkspace({ workspaceId: wsDelete, name: 'Workspace Delete' });
+            core.createWorkspace({ workspaceId: wsKeep, name: 'Workspace Keep' });
+            core.ensureBootstrapUserAccess({ userId: 'owner-del', workspaceId: wsDelete, role: 'owner', email: 'del@example.com' });
+            core.ensureBootstrapUserAccess({ userId: 'owner-keep', workspaceId: wsKeep, role: 'owner', email: 'keep@example.com' });
+            const parent = core.createTask({ title: 'Parent Delete', type: 'feature', category: 'default' }, { workspaceId: wsDelete });
+            const child = core.createTask({ title: 'Child Delete', type: 'feature', category: 'default', parentTaskId: parent.id }, { workspaceId: wsDelete });
+            const sibling = core.createTask({ title: 'Sibling Delete', type: 'feature', category: 'default' }, { workspaceId: wsDelete });
+            const keepTask = core.createTask({ title: 'Keep Task', type: 'feature', category: 'default' }, { workspaceId: wsKeep });
+            core.addComment(parent.id, 'comment delete', 'owner-del', wsDelete);
+            core.getDatabaseAdapter().prepare(`
+                INSERT INTO screenshots (id, tenant_id, workspace_id, task_id, path, fs_path, caption, timestamp)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('shot-delete', tenantId, wsDelete, parent.id, 'task-data/shot-delete.png', '/tmp/shot-delete.png', 'shot', now);
+            core.getDatabaseAdapter().prepare(`
+                INSERT INTO screenshots (id, tenant_id, workspace_id, task_id, path, fs_path, caption, timestamp)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('shot-keep', tenantId, wsKeep, keepTask.id, 'task-data/shot-keep.png', '/tmp/shot-keep.png', 'shot', now);
+            core.getDatabaseAdapter().prepare(`
+                INSERT INTO auth_tokens (id, tenant_id, user_id, workspace_id, purpose, token_hash, expires_at, used_at, revoked_at, created_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('token-delete', tenantId, 'owner-del', wsDelete, 'password_reset', 'hash-delete', '2099-01-01T00:00:00.000Z', null, null, now);
+            core.getDatabaseAdapter().prepare(`
+                INSERT INTO auth_tokens (id, tenant_id, user_id, workspace_id, purpose, token_hash, expires_at, used_at, revoked_at, created_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('token-keep', tenantId, 'owner-keep', wsKeep, 'password_reset', 'hash-keep', '2099-01-01T00:00:00.000Z', null, null, now);
+            core.updateUiState(wsDelete, 'owner-del', { stateKey: 'workspace-sync', patch: { enabled: true } });
+            core.updateUiState(wsKeep, 'owner-keep', { stateKey: 'workspace-sync', patch: { enabled: true } });
+            core.setWorkspacePlanMode(wsDelete, 'team', 'test');
+            core.setWorkspacePlanMode(wsKeep, 'team', 'test');
+            core.addAdminAuditLog({ action: 'test-delete', actorUserId: 'owner-del', actorRole: 'owner', workspaceId: wsDelete, details: { phase: 'before' } });
+            core.addAdminAuditLog({ action: 'test-keep', actorUserId: 'owner-keep', actorRole: 'owner', workspaceId: wsKeep, details: { phase: 'before' } });
+            core.recordSyncEvent(wsDelete, { eventType: 'pull', status: 'success' });
+            core.recordSyncEvent(wsKeep, { eventType: 'pull', status: 'success' });
+            core.writePushIdempotency(wsDelete, 'delete-key', '{}');
+            core.writePushIdempotency(wsKeep, 'keep-key', '{}');
+            core.deleteTask(child.id, wsDelete);
+            core.upsertDocumentWatermark(wsDelete, `docs/workspaces/${wsDelete}/notes.md`, 'hash-delete', now);
+            core.upsertDocumentWatermark(wsKeep, `docs/workspaces/${wsKeep}/notes.md`, 'hash-keep', now);
+            core.getDatabaseAdapter().prepare(`
+                INSERT INTO task_assets (
+                    tenant_id, workspace_id, path, provider, version, content_type, size_bytes, sha256,
+                    uploaded_at, scan_engine, scan_verdict, scan_details, scan_scanned_at, quarantine_status,
+                    deleted_at, purge_after, updated_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run(tenantId, wsDelete, `workspaces/${wsDelete}/tasks/${parent.id}/attachments/spec.md`, 'local', 1, 'text/markdown', 10, 'sha-delete', now, 'none', 'clean', null, now, 'none', null, null, now);
+            core.getDatabaseAdapter().prepare(`
+                INSERT INTO task_assets (
+                    tenant_id, workspace_id, path, provider, version, content_type, size_bytes, sha256,
+                    uploaded_at, scan_engine, scan_verdict, scan_details, scan_scanned_at, quarantine_status,
+                    deleted_at, purge_after, updated_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run(tenantId, wsKeep, `workspaces/${wsKeep}/tasks/${keepTask.id}/attachments/spec.md`, 'local', 1, 'text/markdown', 10, 'sha-keep', now, 'none', 'clean', null, now, 'none', null, null, now);
+            const summary = core.deleteWorkspace({ workspaceId: wsDelete });
+            expect(summary.deletedWorkspaceId).toBe(wsDelete);
+            expect(summary.deletedTaskIds).toEqual(expect.arrayContaining([parent.id, sibling.id]));
+            expect(summary.deletedDocumentPaths).toContain(`docs/workspaces/${wsDelete}/notes.md`);
+            expect(summary.deletedAssets.some((asset) => asset.workspaceId === wsDelete)).toBe(true);
+            expect(summary.counts.workspaces).toBe(1);
+            expect(summary.counts.workspace_memberships).toBeGreaterThan(0);
+            expect(summary.counts.tasks).toBeGreaterThan(0);
+            const workspaceDeleteExists = core.getDatabaseAdapter().prepare(`
+                SELECT 1 FROM workspaces WHERE tenant_id = ? AND id = ? LIMIT 1
+            `).get(tenantId, wsDelete);
+            const workspaceKeepExists = core.getDatabaseAdapter().prepare(`
+                SELECT 1 FROM workspaces WHERE tenant_id = ? AND id = ? LIMIT 1
+            `).get(tenantId, wsKeep);
+            expect(Boolean(workspaceDeleteExists)).toBe(false);
+            expect(Boolean(workspaceKeepExists)).toBe(true);
+            const scopedTables = [
+                'tasks',
+                'comments',
+                'screenshots',
+                'workspace_memberships',
+                'auth_tokens',
+                'ui_state',
+                'workspace_settings',
+                'admin_audit_logs',
+                'workspace_sync_deletes',
+                'sync_idempotency',
+                'sync_events',
+                'workspace_documents',
+                'task_assets'
+            ];
+            for (const table of scopedTables) {
+                expect(countByWorkspace(core, table, wsDelete)).toBe(0);
+            }
+            expect(countByWorkspace(core, 'tasks', wsKeep)).toBeGreaterThan(0);
+            expect(countByWorkspace(core, 'workspace_memberships', wsKeep)).toBeGreaterThan(0);
+            expect(countByWorkspace(core, 'workspace_documents', wsKeep)).toBeGreaterThan(0);
+            expect(countByWorkspace(core, 'task_assets', wsKeep)).toBeGreaterThan(0);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('rejects deleting the reserved default workspace', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            expect(() => core.deleteWorkspace({ workspaceId: 'default' })).toThrowError(/reserved/i);
+        }
+        finally {
+            cleanup();
+        }
+    });
+});

package/dist/core/WorkspacePermissions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/WorkspacePermissions.test.js

@@ -0,0 +1,151 @@
+import { describe, expect, it } from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { TaskforceCore } from './Taskforce';
+function makeCore() {
+    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-workspace-perm-'));
+    const core = new TaskforceCore({
+        projectRoot,
+        storagePath: path.join(projectRoot, '.taskforce')
+    });
+    return {
+        core,
+        cleanup: () => {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    };
+}
+describe('TaskforceCore workspace permission invariants', () => {
+    it('enforces member read-only via permission_mode in resolveUserAccess', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member@example.com'
+            });
+            expect(core.setWorkspaceUserPermissionMode('member-1', 'workspace-1', 'read-only')).toBe(true);
+            const access = core.resolveUserAccess('member-1', 'workspace-1', 'member');
+            expect(access?.permissionMode).toBe('read-only');
+            expect(access?.role).toBe('read-only');
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('rejects permission_mode updates for owner/admin', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            expect(() => core.setWorkspaceUserPermissionMode('owner-1', 'workspace-1', 'read-only')).toThrowError(/members/i);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('prevents demoting the last workspace owner', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            expect(() => core.updateWorkspaceUserRole('owner-1', 'workspace-1', 'admin')).toThrowError(/last workspace owner/i);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('prevents disabling and removing the last workspace owner', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            expect(() => core.setWorkspaceUserDisabled('owner-1', 'workspace-1', true)).toThrowError(/last workspace owner/i);
+            expect(() => core.removeWorkspaceUser('owner-1', 'workspace-1')).toThrowError(/last workspace owner/i);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('transfers ownership and keeps one active owner', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member@example.com'
+            });
+            expect(core.transferWorkspaceOwnership({
+                workspaceId: 'workspace-1',
+                fromUserId: 'owner-1',
+                toUserId: 'member-1'
+            })).toBe(true);
+            const users = core.listWorkspaceUsers('workspace-1');
+            const newOwner = users.find((u) => u.userId === 'member-1');
+            const previousOwner = users.find((u) => u.userId === 'owner-1');
+            expect(newOwner?.role).toBe('owner');
+            expect(previousOwner?.role).toBe('admin');
+            expect(core.countWorkspaceOwners('workspace-1')).toBe(1);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('marks deactivated users as disabled in access resolution immediately', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member@example.com'
+            });
+            expect(core.setWorkspaceUserDisabled('member-1', 'workspace-1', true)).toBe(true);
+            const access = core.resolveUserAccess('member-1', 'workspace-1', 'member');
+            expect(access?.disabled).toBe(true);
+        }
+        finally {
+            cleanup();
+        }
+    });
+});

package/dist/core/WorkspacePlanMode.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/WorkspacePlanMode.test.js

@@ -0,0 +1,104 @@
+import { describe, expect, it } from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { TaskforceCore } from './Taskforce';
+function makeProjectRoot() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-plan-mode-'));
+}
+function openCore(projectRoot) {
+    return new TaskforceCore({
+        projectRoot,
+        storagePath: path.join(projectRoot, '.taskforce')
+    });
+}
+describe('TaskforceCore account-level plan mode and invite revoke', () => {
+    it('derives workspace plan mode from owner account plan across all owned workspaces', () => {
+        const projectRoot = makeProjectRoot();
+        const initial = openCore(projectRoot);
+        try {
+            const now = new Date().toISOString();
+            const db = initial.db;
+            db.prepare(`
+                INSERT INTO workspaces (id, tenant_id, slug, name, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?)
+            `).run('workspace-single', 'default', 'workspace-single', 'Single', now, now);
+            db.prepare(`
+                INSERT INTO workspaces (id, tenant_id, slug, name, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?)
+            `).run('workspace-team', 'default', 'workspace-team', 'Team', now, now);
+            db.prepare(`
+                INSERT INTO workspaces (id, tenant_id, slug, name, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?)
+            `).run('workspace-u1-second', 'default', 'workspace-u1-second', 'Second U1 Workspace', now, now);
+            db.prepare(`
+                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
+            `).run('u1', 'default', 'u1@example.com', 'U1', 'token', 'u1', now, now);
+            db.prepare(`
+                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
+            `).run('u2', 'default', 'u2@example.com', 'U2', 'token', 'u2', now, now);
+            db.prepare(`
+                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
+            `).run('u3', 'default', 'u3@example.com', 'U3', 'token', 'u3', now, now);
+            db.prepare(`
+                INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('m1', 'default', 'workspace-single', 'u1', 'owner', 'active', now, now);
+            db.prepare(`
+                INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('m2', 'default', 'workspace-team', 'u2', 'owner', 'active', now, now);
+            db.prepare(`
+                INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('m3', 'default', 'workspace-team', 'u3', 'member', 'active', now, now);
+            db.prepare(`
+                INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('m4', 'default', 'workspace-u1-second', 'u1', 'owner', 'active', now, now);
+            initial.setUserAccountPlanMode('u2', 'team');
+        }
+        finally {
+            initial.close();
+        }
+        const reopened = openCore(projectRoot);
+        try {
+            expect(reopened.getWorkspacePlanMode('workspace-single')).toBe('personal');
+            expect(reopened.getWorkspacePlanMode('workspace-team')).toBe('team');
+            expect(reopened.getWorkspacePlanMode('workspace-u1-second')).toBe('personal');
+            reopened.setWorkspacePlanMode('workspace-single', 'team');
+            expect(reopened.getWorkspacePlanMode('workspace-single')).toBe('team');
+            expect(reopened.getWorkspacePlanMode('workspace-u1-second')).toBe('team');
+        }
+        finally {
+            reopened.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('marks invite token as revoked and inspect reflects revoked state', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-invite', name: 'Invite Workspace' });
+            core.ensureBootstrapUserAccess({
+                userId: 'user-invite',
+                workspaceId: 'workspace-invite',
+                role: 'member',
+                email: 'invite@example.com'
+            });
+            const invite = core.requestInviteAcceptance({ userId: 'user-invite', workspaceId: 'workspace-invite' });
+            expect(typeof invite.token).toBe('string');
+            const revoke = core.revokeInviteAcceptanceForUser('user-invite');
+            expect(revoke.revoked).toBeGreaterThan(0);
+            const inspected = core.inspectInviteAcceptance(String(invite.token));
+            expect(inspected.state).toBe('revoked');
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+});

package/dist/hooks/authGuardPolicy.d.ts

@@ -0,0 +1,26 @@
+export interface AuthGuardInputs {
+    shouldGateProtectedApiCalls: boolean;
+    runtimeMode: 'local' | 'cloud';
+    authSessionResolved: boolean;
+    authRequiredForApi: boolean;
+    isAuthenticated: boolean;
+}
+export interface AuthGuardPolicy {
+    shouldDeferProtectedApiCalls: boolean;
+    shouldBlockProtectedApiCalls: boolean;
+    canCallProtectedApi: boolean;
+}
+export declare function deriveAuthGuardPolicy(inputs: AuthGuardInputs): AuthGuardPolicy;
+export declare function shouldSkipDataVersionPolling(args: {
+    isOpen: boolean;
+    authBlocked: boolean;
+    authRequiredForApi: boolean;
+    isAuthenticated: boolean;
+    canCallProtectedApi: boolean;
+}): boolean;
+export declare function shouldSkipDataVersionTick(args: {
+    shouldGateProtectedApiCalls: boolean;
+    authSessionResolved: boolean;
+    authRequiredForApi: boolean;
+    isAuthenticated: boolean;
+}): boolean;

package/dist/hooks/authGuardPolicy.js

@@ -0,0 +1,32 @@
+export function deriveAuthGuardPolicy(inputs) {
+    const isCloudRuntime = inputs.runtimeMode === 'cloud';
+    const shouldDeferProtectedApiCalls = Boolean(inputs.shouldGateProtectedApiCalls && isCloudRuntime && !inputs.authSessionResolved);
+    const shouldBlockProtectedApiCalls = Boolean(inputs.shouldGateProtectedApiCalls
+        && isCloudRuntime
+        && inputs.authSessionResolved
+        && inputs.authRequiredForApi
+        && !inputs.isAuthenticated);
+    return {
+        shouldDeferProtectedApiCalls,
+        shouldBlockProtectedApiCalls,
+        canCallProtectedApi: !(shouldDeferProtectedApiCalls || shouldBlockProtectedApiCalls)
+    };
+}
+export function shouldSkipDataVersionPolling(args) {
+    if (!args.isOpen)
+        return true;
+    if (!args.canCallProtectedApi)
+        return true;
+    if (args.authBlocked)
+        return true;
+    if (args.authRequiredForApi && !args.isAuthenticated)
+        return true;
+    return false;
+}
+export function shouldSkipDataVersionTick(args) {
+    if (args.shouldGateProtectedApiCalls && !args.authSessionResolved)
+        return true;
+    if (args.authRequiredForApi && !args.isAuthenticated)
+        return true;
+    return false;
+}

package/dist/hooks/authGuardPolicy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hooks/authGuardPolicy.test.js

@@ -0,0 +1,76 @@
+import { describe, expect, it } from 'vitest';
+import { deriveAuthGuardPolicy, shouldSkipDataVersionPolling, shouldSkipDataVersionTick } from './authGuardPolicy';
+describe('authGuardPolicy', () => {
+    it('does not defer or block protected APIs in local runtime', () => {
+        const policy = deriveAuthGuardPolicy({
+            shouldGateProtectedApiCalls: true,
+            runtimeMode: 'local',
+            authSessionResolved: false,
+            authRequiredForApi: true,
+            isAuthenticated: false
+        });
+        expect(policy.shouldDeferProtectedApiCalls).toBe(false);
+        expect(policy.shouldBlockProtectedApiCalls).toBe(false);
+        expect(policy.canCallProtectedApi).toBe(true);
+    });
+    it('defers protected APIs in cloud runtime before auth session resolves', () => {
+        const policy = deriveAuthGuardPolicy({
+            shouldGateProtectedApiCalls: true,
+            runtimeMode: 'cloud',
+            authSessionResolved: false,
+            authRequiredForApi: false,
+            isAuthenticated: false
+        });
+        expect(policy.shouldDeferProtectedApiCalls).toBe(true);
+        expect(policy.shouldBlockProtectedApiCalls).toBe(false);
+        expect(policy.canCallProtectedApi).toBe(false);
+    });
+    it('blocks protected APIs in cloud runtime when auth is required but user is not authenticated', () => {
+        const policy = deriveAuthGuardPolicy({
+            shouldGateProtectedApiCalls: true,
+            runtimeMode: 'cloud',
+            authSessionResolved: true,
+            authRequiredForApi: true,
+            isAuthenticated: false
+        });
+        expect(policy.shouldDeferProtectedApiCalls).toBe(false);
+        expect(policy.shouldBlockProtectedApiCalls).toBe(true);
+        expect(policy.canCallProtectedApi).toBe(false);
+    });
+    it('keeps data-version polling active only when preconditions are met', () => {
+        expect(shouldSkipDataVersionPolling({
+            isOpen: true,
+            authBlocked: false,
+            authRequiredForApi: false,
+            isAuthenticated: false,
+            canCallProtectedApi: true
+        })).toBe(false);
+        expect(shouldSkipDataVersionPolling({
+            isOpen: false,
+            authBlocked: false,
+            authRequiredForApi: false,
+            isAuthenticated: false,
+            canCallProtectedApi: true
+        })).toBe(true);
+    });
+    it('skips data-version tick checks until auth gate conditions are satisfied', () => {
+        expect(shouldSkipDataVersionTick({
+            shouldGateProtectedApiCalls: true,
+            authSessionResolved: false,
+            authRequiredForApi: false,
+            isAuthenticated: false
+        })).toBe(true);
+        expect(shouldSkipDataVersionTick({
+            shouldGateProtectedApiCalls: true,
+            authSessionResolved: true,
+            authRequiredForApi: true,
+            isAuthenticated: false
+        })).toBe(true);
+        expect(shouldSkipDataVersionTick({
+            shouldGateProtectedApiCalls: true,
+            authSessionResolved: true,
+            authRequiredForApi: true,
+            isAuthenticated: true
+        })).toBe(false);
+    });
+});

package/dist/hooks/useDraggable.d.ts

@@ -0,0 +1,12 @@
+interface Position {
+    x: number;
+    y: number;
+}
+export declare function useDraggable(initialPosition?: Position): {
+    position: Position;
+    isDragging: boolean;
+    handleMouseDown: (e: React.MouseEvent) => void;
+    modalRef: import("react").RefObject<HTMLDivElement | null>;
+    setPosition: import("react").Dispatch<import("react").SetStateAction<Position>>;
+};
+export {};