@taskforcehq/taskforce 0.3.169 → 0.3.300

package/dist/core/SystemAdmin.test.js

@@ -6,16 +6,50 @@ import { TaskforceCore } from './Taskforce';
 function makeProjectRoot() {
     return fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-system-admin-'));
 }
-function openCore(projectRoot) {
-    return new TaskforceCore({
+function seedPlans(core) {
+    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab', status: 'active' });
+    core.updatePlanVersion({
+        planId: 'collab',
+        versionNumber: 1,
+        seatLimit: 5
+    });
+    core.updatePlanVersionFeatures({
+        planVersionId: 'starter-v1',
+        features: [
+            { featureKey: 'workspace.switching', access: 'enabled' }
+        ]
+    });
+    core.updatePlanVersionFeatures({
+        planVersionId: 'collab-v1',
+        features: [
+            { featureKey: 'collaboration.invites', access: 'enabled' },
+            { featureKey: 'collaboration.team_management', access: 'enabled' },
+            { featureKey: 'context.uploads', access: 'enabled' },
+            { featureKey: 'workspace.switching', access: 'enabled' }
+        ]
+    });
+    core.updateGlobalSettings({
+        auth: {
+            signupMonetizationStrategy: 'auto_assign_default',
+            defaultSignupPlanVersionId: 'starter-v1'
+        }
+    });
+}
+function openCore(projectRoot, options = {}) {
+    const core = new TaskforceCore({
         projectRoot,
         storagePath: path.join(projectRoot, '.taskforce')
     });
+    if (options.seedDefaultPlans === true) {
+        seedPlans(core);
+    }
+    return core;
 }
 describe('TaskforceCore system admin model', () => {
     it('creates billing row for registration without workspace', () => {
         const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot);
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             const created = core.registerPasswordUser({
                 email: 'billing-noworkspace@example.com',
@@ -29,8 +63,8 @@ describe('TaskforceCore system admin model', () => {
                 LIMIT 1
             `).get('default', created.userId);
             expect(row?.user_id).toBe(created.userId);
-            expect(row?.tier).toBe('free');
-            expect(row?.entitlement_state).toBe('free');
+            expect(row?.tier).toBe('starter');
+            expect(row?.entitlement_state).toBe('active');
         }
         finally {
             core.close();
@@ -39,7 +73,7 @@ describe('TaskforceCore system admin model', () => {
     });
     it('creates billing row for registration with workspace', () => {
         const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot);
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
             const created = core.registerPasswordUser({
@@ -56,17 +90,459 @@ describe('TaskforceCore system admin model', () => {
                 LIMIT 1
             `).get('default', created.userId);
             expect(row?.user_id).toBe(created.userId);
-            expect(row?.tier).toBe('free');
-            expect(row?.entitlement_state).toBe('free');
+            expect(row?.tier).toBe('starter');
+            expect(row?.entitlement_state).toBe('active');
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('uses configured signup default plan version for registration when auto-assign config is valid', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            core.createPlanVersion({
+                planId: 'collab',
+                versionNumber: 2,
+                isDefault: true,
+                seatLimit: 10
+            });
+            core.updatePlanVersionFeatures({
+                planVersionId: 'collab-v2',
+                features: [
+                    { featureKey: 'collaboration.invites', access: 'enabled' },
+                    { featureKey: 'collaboration.team_management', access: 'enabled' },
+                    { featureKey: 'context.uploads', access: 'enabled' },
+                    { featureKey: 'workspace.switching', access: 'enabled' }
+                ]
+            });
+            core.createPlanVersion({
+                planId: 'starter',
+                versionNumber: 2,
+                isDefault: false,
+                seatLimit: null
+            });
+            core.updateGlobalSettings({
+                auth: {
+                    signupMonetizationStrategy: 'auto_assign_default',
+                    defaultSignupPlanVersionId: 'collab-v2'
+                }
+            });
+            const created = core.registerPasswordUser({
+                email: 'configured-signup@example.com',
+                password: 'password123'
+            });
+            const entitlement = core.getAccountEntitlement(created.userId);
+            const db = core.db;
+            const billing = db.prepare(`
+                SELECT tier, entitlement_state
+                FROM user_billing
+                WHERE tenant_id = ? AND user_id = ?
+                LIMIT 1
+            `).get(core.getTenantId(), created.userId);
+            expect(entitlement.planVersionId).toBe('collab-v2');
+            expect(entitlement.planId).toBe('collab');
+            expect(billing?.tier).toBe('collab');
+            expect(billing?.entitlement_state).toBe('active');
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('fails registration when auto-assign signup config is stale or invalid', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            core.updateGlobalSettings({
+                auth: {
+                    signupMonetizationStrategy: 'auto_assign_default',
+                    defaultSignupPlanVersionId: 'missing-v9'
+                }
+            });
+            expect(() => core.registerPasswordUser({
+                email: 'fallback-signup@example.com',
+                password: 'password123'
+            })).toThrowError(/was not found/i);
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('registers without an entitlement when plan selection is required', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            core.updateGlobalSettings({
+                auth: {
+                    signupMonetizationStrategy: 'plan_selection_required',
+                    defaultSignupPlanVersionId: null
+                }
+            });
+            const created = core.registerPasswordUser({
+                email: 'pending-plan@example.com',
+                password: 'password123'
+            });
+            expect(created.planSelectionRequired).toBe(true);
+            expect(core.hasAccountEntitlement(created.userId)).toBe(false);
+            const db = core.db;
+            const billing = db.prepare(`
+                SELECT entitlement_state, tier
+                FROM user_billing
+                WHERE tenant_id = ? AND user_id = ?
+                LIMIT 1
+            `).get('default', created.userId);
+            expect(billing?.entitlement_state).toBe('pending_plan_selection');
+            expect(String(billing?.tier || '')).toBe('');
+            expect(core.getAccountAccessStatus(created.userId)).toMatchObject({
+                gate: 'plan_selection_required',
+                hasEntitlement: false,
+                canAccessApp: false,
+                canAccessPlans: true
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('removes legacy documents.workspace_access plan feature rows during startup normalization', () => {
+        const projectRoot = makeProjectRoot();
+        let core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            const db = core.db;
+            const now = new Date().toISOString();
+            db.prepare(`
+                INSERT INTO plan_feature_matrix (tenant_id, plan_version_id, feature_key, access, config_json, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?)
+                ON CONFLICT (tenant_id, plan_version_id, feature_key) DO UPDATE SET
+                    access = excluded.access,
+                    config_json = excluded.config_json,
+                    updated_at = excluded.updated_at
+            `).run('default', 'collab-v1', 'documents.workspace_access', 'enabled', '{}', now, now);
+        }
+        finally {
+            core.close();
+        }
+        core = openCore(projectRoot);
+        try {
+            const db = core.db;
+            const row = db.prepare(`
+                SELECT feature_key
+                FROM plan_feature_matrix
+                WHERE tenant_id = ? AND plan_version_id = ? AND feature_key = ?
+                LIMIT 1
+            `).get('default', 'collab-v1', 'documents.workspace_access');
+            expect(row).toBeUndefined();
+            const snapshot = core.listPlanVersions('collab').find((version) => version.planVersionId === 'collab-v1');
+            expect(snapshot).toBeDefined();
+            expect(snapshot.features['documents.workspace_access']).toBeUndefined();
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('assigns the explicitly selected signup plan version instead of the default signup plan', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
+            core.updatePlanVersion({
+                planId: 'free',
+                versionNumber: 1,
+                seatLimit: 1
+            });
+            core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'archived' });
+            core.updateGlobalSettings({
+                auth: {
+                    signupMonetizationStrategy: 'auto_assign_default',
+                    defaultSignupPlanVersionId: 'starter-v1'
+                }
+            });
+            const created = core.registerPasswordUser({
+                email: 'selected-plan@example.com',
+                password: 'password123',
+                planVersionId: 'free-v1'
+            });
+            expect(created.planSelectionRequired).toBe(false);
+            expect(core.getAccountEntitlement(created.userId)).toMatchObject({
+                planVersionId: 'free-v1',
+                planId: 'free',
+                state: 'active'
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('treats accounts without an entitlement or pending-selection marker as plan selection required', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            core.updateGlobalSettings({
+                auth: {
+                    signupMonetizationStrategy: 'plan_selection_required',
+                    defaultSignupPlanVersionId: null
+                }
+            });
+            const now = new Date().toISOString();
+            const db = core.db;
+            db.prepare(`
+                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, password_hash, system_role, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, 'user', 1, 0, ?, ?)
+            `).run('user-missing-entitlement', 'default', 'broken@example.com', 'Broken', 'password', 'broken@example.com', 'hash', now, now);
+            expect(core.getAccountAccessStatus('user-missing-entitlement')).toMatchObject({
+                gate: 'plan_selection_required',
+                hasEntitlement: false,
+                canAccessApp: false,
+                planSelectionRequired: true
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('repairs missing default version during startup for existing plans', () => {
+        const projectRoot = makeProjectRoot();
+        const initial = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            const db = initial.db;
+            db.prepare(`
+                UPDATE plan_versions
+                SET is_default = 0
+                WHERE tenant_id = ? AND plan_id = ?
+            `).run('default', 'starter');
+        }
+        finally {
+            initial.close();
+        }
+        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
+        try {
+            const db = reopened.db;
+            const row = db.prepare(`
+                SELECT plan_version_id, is_default
+                FROM plan_versions
+                WHERE tenant_id = ? AND plan_id = ? AND plan_version_id = ?
+                LIMIT 1
+            `).get('default', 'starter', 'starter-v1');
+            expect(row?.plan_version_id).toBe('starter-v1');
+            expect(row?.is_default).toBe(1);
+            expect(reopened.getRequiredDefaultPlanVersionId('starter')).toBe('starter-v1');
+        }
+        finally {
+            reopened.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('persists signup monetization defaults during startup for existing installs', () => {
+        const projectRoot = makeProjectRoot();
+        const initial = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            initial.updateGlobalSettings({
+                auth: {
+                    allowSelfRegistration: true
+                }
+            });
+        }
+        finally {
+            initial.close();
+        }
+        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
+        try {
+            expect(reopened.getSignupMonetizationSettings()).toEqual({
+                strategy: 'auto_assign_default',
+                defaultSignupPlanVersionId: 'starter-v1'
+            });
+            expect(reopened.getGlobalSettings().auth).toMatchObject({
+                signupMonetizationStrategy: 'auto_assign_default',
+                defaultSignupPlanVersionId: 'starter-v1'
+            });
+        }
+        finally {
+            reopened.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('repairs signup monetization defaults on the same startup pass that repairs missing plan defaults', () => {
+        const projectRoot = makeProjectRoot();
+        const initial = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            initial.updateGlobalSettings({
+                auth: {
+                    allowSelfRegistration: true
+                }
+            });
+            const db = initial.db;
+            db.prepare(`
+                UPDATE plan_versions
+                SET is_default = 0
+                WHERE tenant_id = ? AND plan_id = ?
+            `).run('default', 'starter');
+        }
+        finally {
+            initial.close();
+        }
+        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
+        try {
+            expect(reopened.getSignupMonetizationSettings()).toEqual({
+                strategy: 'auto_assign_default',
+                defaultSignupPlanVersionId: 'starter-v1'
+            });
+        }
+        finally {
+            reopened.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('does not inject a default signup plan version when strategy is plan selection required', () => {
+        const projectRoot = makeProjectRoot();
+        const initial = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            initial.updateGlobalSettings({
+                auth: {
+                    signupMonetizationStrategy: 'plan_selection_required',
+                    defaultSignupPlanVersionId: null
+                }
+            });
+        }
+        finally {
+            initial.close();
+        }
+        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
+        try {
+            expect(reopened.getSignupMonetizationSettings()).toEqual({
+                strategy: 'plan_selection_required',
+                defaultSignupPlanVersionId: null
+            });
+        }
+        finally {
+            reopened.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('migrates legacy seat-limit feature config to version seatLimit during startup', () => {
+        const projectRoot = makeProjectRoot();
+        const initial = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            const db = initial.db;
+            const now = new Date().toISOString();
+            db.prepare(`
+                UPDATE plan_versions
+                SET seat_limit = NULL, updated_at = ?
+                WHERE tenant_id = ? AND plan_version_id = ?
+            `).run(now, 'default', 'collab-v1');
+            db.prepare(`
+                INSERT INTO plan_feature_matrix (tenant_id, plan_version_id, feature_key, access, config_json, created_at, updated_at)
+                VALUES (?, ?, 'collaboration.seat_limit', 'limited', ?, ?, ?)
+                ON CONFLICT (tenant_id, plan_version_id, feature_key) DO UPDATE SET
+                    access = excluded.access,
+                    config_json = excluded.config_json,
+                    updated_at = excluded.updated_at
+            `).run('default', 'collab-v1', JSON.stringify({ seat_limit: 7 }), now, now);
+        }
+        finally {
+            initial.close();
+        }
+        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
+        try {
+            const version = reopened.getPlanVersionFeatures('collab', 'collab-v1');
+            expect(version.seatLimit).toBe(7);
+            expect(version.features['collaboration.seat_limit']?.config || {}).toEqual({});
+        }
+        finally {
+            reopened.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('normalizes legacy billing mirror rows during startup', () => {
+        const projectRoot = makeProjectRoot();
+        const initial = openCore(projectRoot, { seedDefaultPlans: true });
+        let legacyUserId = '';
+        try {
+            const created = initial.registerPasswordUser({
+                email: 'legacy-billing@example.com',
+                password: 'password123'
+            });
+            legacyUserId = created.userId;
+            const db = initial.db;
+            db.prepare(`
+                UPDATE user_billing
+                SET tier = 'free',
+                    entitlement_state = 'free'
+                WHERE tenant_id = ? AND user_id = ?
+            `).run('default', legacyUserId);
+        }
+        finally {
+            initial.close();
+        }
+        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
+        try {
+            const db = reopened.db;
+            const row = db.prepare(`
+                SELECT tier, entitlement_state
+                FROM user_billing
+                WHERE tenant_id = ? AND user_id = ?
+                LIMIT 1
+            `).get('default', legacyUserId);
+            expect(row?.tier).toBe('starter');
+            expect(row?.entitlement_state).toBe('active');
+        }
+        finally {
+            reopened.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('does not seed business plans into an empty catalog on startup', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: false });
+        try {
+            expect(core.listPlanCatalog()).toEqual([]);
         }
         finally {
             core.close();
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('keeps a custom catalog untouched on startup', () => {
+        const projectRoot = makeProjectRoot();
+        const initial = openCore(projectRoot, { seedDefaultPlans: false });
+        try {
+            const db = initial.db;
+            const now = new Date().toISOString();
+            db.prepare(`DELETE FROM plan_feature_matrix WHERE tenant_id = ?`).run('default');
+            db.prepare(`DELETE FROM plan_versions WHERE tenant_id = ?`).run('default');
+            db.prepare(`DELETE FROM plan_catalog WHERE tenant_id = ?`).run('default');
+            db.prepare(`
+                INSERT INTO plan_catalog (plan_id, tenant_id, display_name, status, created_at, updated_at)
+                VALUES (?, ?, ?, 'active', ?, ?)
+            `).run('enterprise', 'default', 'Enterprise', now, now);
+            db.prepare(`
+                INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, seat_limit, metadata_json, created_at, updated_at)
+                VALUES (?, ?, ?, 1, 1, 25, '{}', ?, ?)
+            `).run('enterprise-v1', 'default', 'enterprise', now, now);
+        }
+        finally {
+            initial.close();
+        }
+        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
+        try {
+            const plans = reopened.listPlanCatalog();
+            expect(plans.map((plan) => plan.planId)).toEqual(['enterprise']);
+            expect(reopened.getDefaultPlanVersionIdByMode('personal')).toBe('enterprise-v1');
+        }
+        finally {
+            reopened.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('assigns first registered user as system_admin and later users as user', () => {
         const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot);
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             const first = core.registerPasswordUser({
                 email: 'first@example.com',
@@ -87,7 +563,7 @@ describe('TaskforceCore system admin model', () => {
     });
     it('applies registration betaAccess at user level', () => {
         const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot);
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
             core.registerPasswordUser({
@@ -112,7 +588,7 @@ describe('TaskforceCore system admin model', () => {
     });
     it('enforces last-system-admin guard on demote and disable', () => {
         const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot);
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             const first = core.registerPasswordUser({
                 email: 'first@example.com',
@@ -128,7 +604,7 @@ describe('TaskforceCore system admin model', () => {
     });
     it('does not auto-promote system role from workspace role changes post-migration', () => {
         const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot);
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             const first = core.registerPasswordUser({
                 email: 'first@example.com',
@@ -154,6 +630,95 @@ describe('TaskforceCore system admin model', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('lists system users without ambiguous updated_at ordering', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            const admin = core.registerPasswordUser({
+                email: 'admin@example.com',
+                password: 'password123'
+            });
+            const member = core.registerPasswordUser({
+                email: 'member@example.com',
+                password: 'password123'
+            });
+            core.createPlanVersion({
+                planId: 'starter',
+                versionNumber: 2,
+                isDefault: true
+            });
+            core.updateAccountEntitlement({
+                accountId: member.userId,
+                planVersionId: 'starter-v2',
+                entitlementState: 'active',
+                actorUserId: admin.userId,
+                actorRole: 'system_admin'
+            });
+            const users = core.listSystemUsers();
+            expect(users.map((user) => user.email)).toContain('admin@example.com');
+            expect(users.map((user) => user.email)).toContain('member@example.com');
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('creates v1 automatically when a new plan is created', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            const plan = core.upsertPlanCatalog({
+                planId: 'enterprise',
+                displayName: 'Enterprise',
+                status: 'active'
+            });
+            expect(plan.planId).toBe('enterprise');
+            const versions = core.listPlanVersions('enterprise');
+            expect(versions).toHaveLength(1);
+            expect(versions[0]).toMatchObject({
+                planVersionId: 'enterprise-v1',
+                planId: 'enterprise',
+                versionNumber: 1,
+                isDefault: true,
+                seatLimit: null
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('does not recreate v1 when an existing plan is updated', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            core.upsertPlanCatalog({
+                planId: 'enterprise',
+                displayName: 'Enterprise',
+                status: 'active'
+            });
+            core.createPlanVersion({
+                planId: 'enterprise',
+                versionNumber: 2,
+                isDefault: true,
+                seatLimit: 25
+            });
+            core.upsertPlanCatalog({
+                planId: 'enterprise',
+                displayName: 'Enterprise Plus',
+                status: 'archived'
+            });
+            const versions = core.listPlanVersions('enterprise');
+            expect(versions.map((version) => version.planVersionId)).toEqual(['enterprise-v2', 'enterprise-v1']);
+            expect(versions.find((version) => version.planVersionId === 'enterprise-v1')).toMatchObject({
+                isDefault: false
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('backfills owner/admin memberships once and does not rerun after completion', () => {
         const projectRoot = makeProjectRoot();
         const initial = openCore(projectRoot);
@@ -279,7 +844,7 @@ describe('TaskforceCore system admin model', () => {
     });
     it('resolvePreferredUserWorkspaceId returns null for users with no active memberships', () => {
         const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot);
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             const created = core.registerPasswordUser({
                 email: 'nomembership@example.com',

package/dist/core/TaskActivityService.d.ts

@@ -0,0 +1,21 @@
+import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
+import type { Comment, TaskActivityItem, TaskActor, TaskEvent, TaskEventDetails } from './Taskforce.js';
+export interface TaskActivityServiceDeps {
+    db: DatabaseAdapter;
+    tenantId: string;
+    generateEntityId: (prefix: string) => string;
+    normalizeWorkspaceId: (workspaceId: string | undefined) => string;
+    resolveWorkspaceActor: (workspaceId: string, actorRef: unknown) => TaskActor | null;
+}
+export declare function replaceTaskCommentsService(deps: TaskActivityServiceDeps, taskId: string, workspaceId: string, comments: Comment[]): void;
+export declare function listTaskEventsInternalService(deps: TaskActivityServiceDeps, taskId: string, workspaceId: string): TaskEvent[];
+export declare function buildTaskActivityService(comments: Comment[], taskEvents: TaskEvent[]): TaskActivityItem[];
+export declare function addTaskEventService(deps: TaskActivityServiceDeps, input: {
+    taskId: string;
+    workspaceId: string;
+    action: string;
+    actor: unknown;
+    createdAt?: string;
+    details?: TaskEventDetails;
+}): void;
+export declare function replaceTaskEventsService(deps: TaskActivityServiceDeps, taskId: string, workspaceId: string, taskEvents: TaskEvent[]): void;