@taskforcehq/taskforce 0.3.169 → 0.3.300

package/dist/core/WorkspaceLifecycleService.d.ts

@@ -0,0 +1,11 @@
+import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
+import type { WorkspaceDeleteSummary } from './types.js';
+export interface WorkspaceLifecycleServiceDeps {
+    db: DatabaseAdapter;
+    tenantId: string;
+    createRuleError: (message: string, statusCode?: number, code?: string) => Error;
+    revokeMcpCredentialsForWorkspace: (workspaceId: string, revokedByUserId?: string | null) => void;
+}
+export declare function deleteWorkspaceService(deps: WorkspaceLifecycleServiceDeps, input: {
+    workspaceId: string;
+}): WorkspaceDeleteSummary;

package/dist/core/WorkspaceLifecycleService.js

@@ -0,0 +1,88 @@
+export function deleteWorkspaceService(deps, input) {
+    const normalizedWorkspaceId = String(input.workspaceId || '').trim();
+    if (!normalizedWorkspaceId) {
+        throw deps.createRuleError('workspaceId is required', 400, 'WORKSPACE_ID_REQUIRED');
+    }
+    if (normalizedWorkspaceId.toLowerCase() === 'default') {
+        throw deps.createRuleError('workspaceId "default" is reserved.', 400, 'WORKSPACE_ID_RESERVED');
+    }
+    const tx = deps.db.transaction(() => {
+        const workspace = deps.db.prepare(`
+            SELECT id
+            FROM workspaces
+            WHERE tenant_id = ? AND id = ?
+            LIMIT 1
+        `).get(deps.tenantId, normalizedWorkspaceId);
+        if (!workspace?.id) {
+            throw deps.createRuleError('Workspace not found', 404, 'WORKSPACE_NOT_FOUND');
+        }
+        deps.revokeMcpCredentialsForWorkspace(normalizedWorkspaceId, 'system');
+        const deletedTaskRows = deps.db.prepare(`
+            SELECT id
+            FROM tasks
+            WHERE tenant_id = ? AND workspace_id = ?
+        `).all(deps.tenantId, normalizedWorkspaceId);
+        const deletedTaskIds = deletedTaskRows
+            .map((row) => String(row.id || '').trim())
+            .filter(Boolean);
+        const deletedDocumentRows = deps.db.prepare(`
+            SELECT path
+            FROM workspace_documents
+            WHERE tenant_id = ? AND workspace_id = ?
+        `).all(deps.tenantId, normalizedWorkspaceId);
+        const deletedDocumentPaths = deletedDocumentRows
+            .map((row) => String(row.path || '').trim())
+            .filter(Boolean);
+        const deletedAssetRows = deps.db.prepare(`
+            SELECT path, provider, workspace_id
+            FROM task_assets
+            WHERE tenant_id = ? AND workspace_id = ?
+        `).all(deps.tenantId, normalizedWorkspaceId);
+        const deletedAssets = deletedAssetRows
+            .map((row) => {
+            const path = String(row.path || '').trim();
+            if (!path)
+                return null;
+            return {
+                path,
+                provider: String(row.provider || '').toLowerCase() === 'r2' ? 'r2' : 'local',
+                workspaceId: String(row.workspace_id || normalizedWorkspaceId).trim() || normalizedWorkspaceId
+            };
+        })
+            .filter((row) => Boolean(row));
+        const counts = {};
+        const runDelete = (tableName, sql, ...params) => {
+            const result = deps.db.prepare(sql).run(...params);
+            counts[tableName] = Number(result?.changes || 0);
+        };
+        deps.db.prepare(`
+            UPDATE tasks
+            SET parent_task_id = NULL
+            WHERE tenant_id = ? AND workspace_id = ? AND parent_task_id IS NOT NULL
+        `).run(deps.tenantId, normalizedWorkspaceId);
+        runDelete('comments', 'DELETE FROM comments WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('task_events', 'DELETE FROM task_events WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('deleted_tasks', 'DELETE FROM deleted_tasks WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('workspace_sync_deletes', 'DELETE FROM workspace_sync_deletes WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('sync_idempotency', 'DELETE FROM sync_idempotency WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('sync_events', 'DELETE FROM sync_events WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('ui_state', 'DELETE FROM ui_state WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('workspace_settings', 'DELETE FROM workspace_settings WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('admin_audit_logs', 'DELETE FROM admin_audit_logs WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('auth_tokens', 'DELETE FROM auth_tokens WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('workspace_documents', 'DELETE FROM workspace_documents WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('ai_profiles', 'DELETE FROM ai_profiles WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('task_assets', 'DELETE FROM task_assets WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('tasks', 'DELETE FROM tasks WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('workspace_memberships', 'DELETE FROM workspace_memberships WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
+        runDelete('workspaces', 'DELETE FROM workspaces WHERE tenant_id = ? AND id = ?', deps.tenantId, normalizedWorkspaceId);
+        return {
+            deletedWorkspaceId: normalizedWorkspaceId,
+            deletedTaskIds,
+            deletedDocumentPaths,
+            deletedAssets,
+            counts
+        };
+    });
+    return tx();
+}

package/dist/core/WorkspacePermissions.test.js

@@ -148,4 +148,99 @@ describe('TaskforceCore workspace permission invariants', () => {
             cleanup();
         }
     });
+    it('clears active task assignments when a workspace user is disabled', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member@example.com'
+            });
+            const active = core.createTask({ title: 'Assigned Active', assignee: 'member-1' }, { workspaceId: 'workspace-1' });
+            const archived = core.createTask({ title: 'Assigned Archived', assignee: 'member-1' }, { workspaceId: 'workspace-1' });
+            core.bulkArchive([archived.id], false, 'workspace-1');
+            expect(core.setWorkspaceUserDisabled('member-1', 'workspace-1', true)).toBe(true);
+            expect(core.getTask(active.id, 'workspace-1')?.assignee).toBe('unassigned');
+            expect(core.listArchive('workspace-1').archived.find((task) => task.id === archived.id)?.assignee).toBe('member-1');
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('clears active task assignments when a workspace user is removed', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member@example.com'
+            });
+            const active = core.createTask({ title: 'Assigned Active', assignee: 'member-1' }, { workspaceId: 'workspace-1' });
+            expect(core.removeWorkspaceUser('member-1', 'workspace-1')).toBe(true);
+            expect(core.getTask(active.id, 'workspace-1')?.assignee).toBe('unassigned');
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('preserves existing workspace members when sync receives a partial member snapshot', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member1@example.com'
+            });
+            core.ensureBootstrapUserAccess({
+                userId: 'member-2',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member2@example.com'
+            });
+            core.replaceWorkspaceUsersForSync({
+                workspaceId: 'workspace-1',
+                users: [
+                    {
+                        userId: 'owner-1',
+                        email: 'owner@example.com',
+                        displayName: 'Owner One',
+                        role: 'owner',
+                        permissionMode: 'read-write',
+                        betaAccess: true,
+                        status: 'active',
+                        disabled: false
+                    }
+                ]
+            });
+            const users = core.listWorkspaceUsers('workspace-1');
+            expect(users.map((user) => user.userId)).toEqual(expect.arrayContaining(['owner-1', 'member-1', 'member-2']));
+        }
+        finally {
+            cleanup();
+        }
+    });
 });

package/dist/core/WorkspacePlanMode.test.js

@@ -7,10 +7,38 @@ function makeProjectRoot() {
     return fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-plan-mode-'));
 }
 function openCore(projectRoot) {
-    return new TaskforceCore({
+    const core = new TaskforceCore({
         projectRoot,
         storagePath: path.join(projectRoot, '.taskforce')
     });
+    const db = core.db;
+    const now = new Date().toISOString();
+    const addFreeMapping = (planVersionId) => {
+        db.prepare(`
+            INSERT OR IGNORE INTO billing_price_mappings (
+                tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run('default', planVersionId, 'month', `free:${planVersionId}:month`, 'free', 1, 0, null, now, now);
+    };
+    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter' });
+    addFreeMapping('starter-v1');
+    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab' });
+    addFreeMapping('collab-v1');
+    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab', status: 'active' });
+    core.updatePlanVersion({
+        planId: 'collab',
+        versionNumber: 1,
+        seatLimit: 5
+    });
+    core.updatePlanVersionFeatures({
+        planVersionId: 'collab-v1',
+        features: [
+            { featureKey: 'collaboration.invites', access: 'enabled' },
+            { featureKey: 'collaboration.team_management', access: 'enabled' }
+        ]
+    });
+    return core;
 }
 describe('TaskforceCore account-level plan mode and invite revoke', () => {
     it('derives workspace plan mode from owner account plan across all owned workspaces', () => {
@@ -101,4 +129,89 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('classifies invited placeholder users as new users and registered users as existing users', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-invite', name: 'Invite Workspace' });
+            core.ensureBootstrapUserAccess({
+                userId: 'user-new',
+                workspaceId: 'workspace-invite',
+                role: 'member',
+                email: 'new@example.com'
+            });
+            core.ensurePasswordUser({
+                email: 'existing@example.com',
+                password: 'Password123!',
+                workspaceId: 'workspace-invite',
+                role: 'member'
+            });
+            const inviteNew = core.requestInviteAcceptance({ userId: 'user-new', workspaceId: 'workspace-invite' });
+            const inspectNew = core.inspectInviteAcceptance(String(inviteNew.token));
+            expect(inspectNew.inviteeKind).toBe('new_user');
+            expect(inspectNew.passwordRequired).toBe(true);
+            const existingUserId = core.resolveUserIdentity('user-new')?.userId;
+            expect(existingUserId).toBe('user-new');
+            const existingLookup = core.db.prepare(`
+                SELECT id FROM users WHERE tenant_id = ? AND email = ? LIMIT 1
+            `).get('default', 'existing@example.com');
+            const inviteExisting = core.requestInviteAcceptance({ userId: String(existingLookup?.id || ''), workspaceId: 'workspace-invite' });
+            const inspectExisting = core.inspectInviteAcceptance(String(inviteExisting.token));
+            expect(inspectExisting.inviteeKind).toBe('existing_user');
+            expect(inspectExisting.passwordRequired).toBe(false);
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('joins invite for existing authenticated users without changing their password hash', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-invite', name: 'Invite Workspace' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-user',
+                workspaceId: 'workspace-invite',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.setUserAccountPlanMode('owner-user', 'team');
+            const existing = core.ensurePasswordUser({
+                email: 'existing@example.com',
+                password: 'Password123!',
+                workspaceId: 'workspace-invite',
+                role: 'member'
+            });
+            core.setWorkspaceUserDisabled(existing.userId, 'workspace-invite', true);
+            const db = core.db;
+            db.prepare(`
+                UPDATE workspace_memberships
+                SET status = 'invited'
+                WHERE tenant_id = ? AND user_id = ? AND workspace_id = ?
+            `).run('default', existing.userId, 'workspace-invite');
+            const before = db.prepare(`
+                SELECT password_hash FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+            `).get('default', existing.userId);
+            const invite = core.requestInviteAcceptance({ userId: existing.userId, workspaceId: 'workspace-invite' });
+            const accepted = core.joinInviteWithAuthenticatedUser({
+                token: String(invite.token),
+                userId: existing.userId
+            });
+            const after = db.prepare(`
+                SELECT password_hash FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+            `).get('default', existing.userId);
+            const membership = db.prepare(`
+                SELECT status FROM workspace_memberships WHERE tenant_id = ? AND user_id = ? AND workspace_id = ? LIMIT 1
+            `).get('default', existing.userId, 'workspace-invite');
+            expect(accepted.workspaceId).toBe('workspace-invite');
+            expect(before?.password_hash).toBeTruthy();
+            expect(after?.password_hash).toBe(before?.password_hash);
+            expect(membership?.status).toBe('active');
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
 });

package/dist/core/WorkspacePreferenceService.d.ts

@@ -0,0 +1,41 @@
+import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
+import type { UserGlobalSyncSettings } from './types.js';
+export type WorkspaceSyncSettingsPayloadLike = Record<string, Record<string, unknown>>;
+export interface UserWorkspaceRecordLike {
+    id?: string | null;
+}
+export interface WorkspacePreferenceServiceDeps {
+    db: DatabaseAdapter;
+    tenantId: string;
+    createRuleError: (message: string, statusCode?: number, code?: string) => Error;
+    getGlobalSettingsStore: () => DatabaseAdapter;
+    ensureStructuredSettingsTables: (store: DatabaseAdapter) => void;
+    writeSettingsPayloadRow: (store: DatabaseAdapter, tableName: 'user_preferences' | 'workspace_settings', identity: [string, string, string], payload: Record<string, unknown>, updatedAt: string) => void;
+    listUserWorkspaces: (userId: string) => UserWorkspaceRecordLike[];
+    workspaceSyncSettingsAllowlist: Set<string>;
+}
+export declare function sanitizeUserGlobalSyncSettingsService(input: unknown): UserGlobalSyncSettings;
+export declare function getUserGlobalSyncSettingsService(deps: WorkspacePreferenceServiceDeps, userId: string): {
+    settings: UserGlobalSyncSettings;
+    updatedAt: string | null;
+};
+export declare function upsertUserGlobalSyncSettingsService(deps: WorkspacePreferenceServiceDeps, userId: string, settings: unknown, updatedAt?: string | null): {
+    settings: UserGlobalSyncSettings;
+    updatedAt: string;
+    applied: boolean;
+};
+export declare function sanitizeWorkspaceShareableSyncSettingsService(allowlist: Set<string>, input: unknown): WorkspaceSyncSettingsPayloadLike;
+export declare function getWorkspaceShareableSyncSettingsService(deps: WorkspacePreferenceServiceDeps, workspaceId: string): {
+    settings: WorkspaceSyncSettingsPayloadLike;
+    updatedAt: string | null;
+};
+export declare function upsertWorkspaceShareableSyncSettingsService(deps: WorkspacePreferenceServiceDeps, workspaceId: string, settings: unknown, updatedAt?: string | null): {
+    settings: WorkspaceSyncSettingsPayloadLike;
+    updatedAt: string | null;
+    applied: boolean;
+};
+export declare function resolvePreferredWorkspaceIdService(deps: WorkspacePreferenceServiceDeps, allowDefault: boolean): string | null;
+export declare function resolvePreferredUserWorkspaceIdService(deps: WorkspacePreferenceServiceDeps, userId: string, options?: {
+    preferredWorkspaceId?: string | null;
+    persistedWorkspaceId?: string | null;
+}): string | null;

package/dist/core/WorkspacePreferenceService.js

@@ -0,0 +1,246 @@
+import { normalizeTaskforceTheme } from '../utils/theme.js';
+export function sanitizeUserGlobalSyncSettingsService(input) {
+    const source = input && typeof input === 'object' ? input : {};
+    const next = {};
+    const theme = normalizeTaskforceTheme(source.theme);
+    if (theme) {
+        next.theme = theme;
+    }
+    const operatingMode = typeof source.operatingMode === 'string' ? source.operatingMode.trim() : '';
+    if (operatingMode === 'core' || operatingMode === 'operations') {
+        next.operatingMode = operatingMode;
+    }
+    const localizationRaw = source.localization && typeof source.localization === 'object'
+        ? source.localization
+        : null;
+    if (localizationRaw) {
+        const localization = {};
+        const locale = typeof localizationRaw.locale === 'string' ? localizationRaw.locale.trim() : '';
+        if (locale) {
+            localization.locale = locale;
+        }
+        const weekStartsOn = typeof localizationRaw.weekStartsOn === 'string'
+            ? localizationRaw.weekStartsOn.trim().toLowerCase()
+            : '';
+        if (weekStartsOn === 'sunday' || weekStartsOn === 'monday') {
+            localization.weekStartsOn = weekStartsOn;
+        }
+        if (Object.keys(localization).length > 0) {
+            next.localization = localization;
+        }
+    }
+    return next;
+}
+export function getUserGlobalSyncSettingsService(deps, userId) {
+    const normalizedUserId = String(userId || '').trim();
+    if (!normalizedUserId) {
+        return { settings: {}, updatedAt: null };
+    }
+    const store = deps.getGlobalSettingsStore();
+    deps.ensureStructuredSettingsTables(store);
+    try {
+        const row = store.prepare(`
+            SELECT payload, updated_at
+            FROM user_preferences
+            WHERE tenant_id = ? AND user_id = ? AND prefs_key = ?
+            LIMIT 1
+        `).get(deps.tenantId, normalizedUserId, 'cloud_sync_global');
+        if (!row?.payload) {
+            return { settings: {}, updatedAt: null };
+        }
+        const parsed = JSON.parse(row.payload);
+        return {
+            settings: sanitizeUserGlobalSyncSettingsService(parsed),
+            updatedAt: typeof row.updated_at === 'string' ? row.updated_at : null
+        };
+    }
+    catch {
+        return { settings: {}, updatedAt: null };
+    }
+}
+export function upsertUserGlobalSyncSettingsService(deps, userId, settings, updatedAt) {
+    const normalizedUserId = String(userId || '').trim();
+    if (!normalizedUserId) {
+        throw deps.createRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+    }
+    const sanitized = sanitizeUserGlobalSyncSettingsService(settings);
+    const current = getUserGlobalSyncSettingsService(deps, normalizedUserId);
+    const incomingUpdatedAt = typeof updatedAt === 'string' && updatedAt.trim().length > 0
+        ? updatedAt.trim()
+        : null;
+    const incomingMs = incomingUpdatedAt ? Date.parse(incomingUpdatedAt) : NaN;
+    const currentMs = current.updatedAt ? Date.parse(current.updatedAt) : NaN;
+    if (incomingUpdatedAt
+        && Number.isFinite(incomingMs)
+        && Number.isFinite(currentMs)
+        && incomingMs <= currentMs) {
+        return {
+            settings: current.settings,
+            updatedAt: current.updatedAt || new Date().toISOString(),
+            applied: false
+        };
+    }
+    const now = Number.isFinite(incomingMs) && incomingUpdatedAt
+        ? incomingUpdatedAt
+        : new Date().toISOString();
+    const store = deps.getGlobalSettingsStore();
+    deps.ensureStructuredSettingsTables(store);
+    deps.writeSettingsPayloadRow(store, 'user_preferences', [deps.tenantId, normalizedUserId, 'cloud_sync_global'], sanitized, now);
+    return {
+        settings: sanitized,
+        updatedAt: now,
+        applied: true
+    };
+}
+export function sanitizeWorkspaceShareableSyncSettingsService(allowlist, input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+        return {};
+    }
+    const source = input;
+    const next = {};
+    for (const key of allowlist) {
+        const rawValue = source[key];
+        if (!rawValue || typeof rawValue !== 'object' || Array.isArray(rawValue))
+            continue;
+        next[key] = { ...rawValue };
+    }
+    return next;
+}
+export function getWorkspaceShareableSyncSettingsService(deps, workspaceId) {
+    const normalizedWorkspaceId = String(workspaceId || '').trim() || 'default';
+    const store = deps.getGlobalSettingsStore();
+    deps.ensureStructuredSettingsTables(store);
+    if (deps.workspaceSyncSettingsAllowlist.size === 0) {
+        return { settings: {}, updatedAt: null };
+    }
+    try {
+        const rows = store.prepare(`
+            SELECT settings_key, payload, updated_at
+            FROM workspace_settings
+            WHERE tenant_id = ? AND workspace_id = ?
+        `).all(deps.tenantId, normalizedWorkspaceId);
+        const settings = {};
+        let latestUpdatedAt = null;
+        for (const row of rows) {
+            const key = String(row?.settings_key || '').trim();
+            if (!deps.workspaceSyncSettingsAllowlist.has(key) || !row?.payload)
+                continue;
+            try {
+                const parsed = JSON.parse(row.payload);
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                    continue;
+                settings[key] = parsed;
+                const rowUpdatedAt = typeof row.updated_at === 'string' ? row.updated_at : null;
+                if (rowUpdatedAt && (!latestUpdatedAt || rowUpdatedAt > latestUpdatedAt)) {
+                    latestUpdatedAt = rowUpdatedAt;
+                }
+            }
+            catch {
+                continue;
+            }
+        }
+        return { settings, updatedAt: latestUpdatedAt };
+    }
+    catch {
+        return { settings: {}, updatedAt: null };
+    }
+}
+export function upsertWorkspaceShareableSyncSettingsService(deps, workspaceId, settings, updatedAt) {
+    const normalizedWorkspaceId = String(workspaceId || '').trim() || 'default';
+    if (!normalizedWorkspaceId) {
+        throw deps.createRuleError('workspaceId is required', 400, 'WORKSPACE_ID_REQUIRED');
+    }
+    const sanitized = sanitizeWorkspaceShareableSyncSettingsService(deps.workspaceSyncSettingsAllowlist, settings);
+    if (deps.workspaceSyncSettingsAllowlist.size === 0) {
+        return { settings: {}, updatedAt: null, applied: false };
+    }
+    const current = getWorkspaceShareableSyncSettingsService(deps, normalizedWorkspaceId);
+    const incomingUpdatedAt = typeof updatedAt === 'string' && updatedAt.trim().length > 0
+        ? updatedAt.trim()
+        : null;
+    const incomingMs = incomingUpdatedAt ? Date.parse(incomingUpdatedAt) : NaN;
+    const currentMs = current.updatedAt ? Date.parse(current.updatedAt) : NaN;
+    if (incomingUpdatedAt
+        && Number.isFinite(incomingMs)
+        && Number.isFinite(currentMs)
+        && incomingMs <= currentMs) {
+        return {
+            settings: current.settings,
+            updatedAt: current.updatedAt,
+            applied: false
+        };
+    }
+    const now = Number.isFinite(incomingMs) && incomingUpdatedAt
+        ? incomingUpdatedAt
+        : new Date().toISOString();
+    const store = deps.getGlobalSettingsStore();
+    deps.ensureStructuredSettingsTables(store);
+    const tx = store.transaction(() => {
+        for (const key of deps.workspaceSyncSettingsAllowlist) {
+            const payload = sanitized[key];
+            if (!payload)
+                continue;
+            deps.writeSettingsPayloadRow(store, 'workspace_settings', [deps.tenantId, normalizedWorkspaceId, key], payload, now);
+        }
+    });
+    tx();
+    return {
+        settings: getWorkspaceShareableSyncSettingsService(deps, normalizedWorkspaceId).settings,
+        updatedAt: now,
+        applied: true
+    };
+}
+export function resolvePreferredWorkspaceIdService(deps, allowDefault) {
+    const taskRows = deps.db.prepare(`
+        SELECT workspace_id, COUNT(*) AS task_count, MAX(COALESCE(updated_at, created_at)) AS latest_activity
+        FROM tasks
+        WHERE tenant_id = ?
+        GROUP BY workspace_id
+        ORDER BY task_count DESC, latest_activity DESC
+    `).all(deps.tenantId);
+    const taskWorkspaceIds = taskRows
+        .map((row) => String(row.workspace_id || '').trim())
+        .filter((value) => value.length > 0);
+    const nonDefaultTaskWorkspaceIds = taskWorkspaceIds.filter((id) => id !== 'default');
+    if (nonDefaultTaskWorkspaceIds.length >= 1)
+        return nonDefaultTaskWorkspaceIds[0];
+    const workspaceRows = deps.db.prepare(`
+        SELECT id, updated_at
+        FROM workspaces
+        WHERE tenant_id = ?
+        ORDER BY updated_at DESC, created_at DESC
+    `).all(deps.tenantId);
+    const workspaceIds = workspaceRows
+        .map((row) => String(row.id || '').trim())
+        .filter((value) => value.length > 0);
+    const nonDefaultWorkspaceIds = workspaceIds.filter((id) => id !== 'default');
+    if (nonDefaultWorkspaceIds.length >= 1)
+        return nonDefaultWorkspaceIds[0];
+    if (!allowDefault)
+        return null;
+    if (taskWorkspaceIds.includes('default'))
+        return 'default';
+    if (workspaceIds.includes('default'))
+        return 'default';
+    return null;
+}
+export function resolvePreferredUserWorkspaceIdService(deps, userId, options) {
+    const normalizedUserId = String(userId || '').trim();
+    if (!normalizedUserId || normalizedUserId === 'anonymous')
+        return null;
+    const workspaces = deps.listUserWorkspaces(normalizedUserId);
+    if (workspaces.length === 0)
+        return null;
+    const accessibleIds = new Set(workspaces
+        .map((workspace) => String(workspace.id || '').trim())
+        .filter(Boolean));
+    const preferredWorkspaceId = String(options?.preferredWorkspaceId || '').trim();
+    if (preferredWorkspaceId && accessibleIds.has(preferredWorkspaceId)) {
+        return preferredWorkspaceId;
+    }
+    const persistedWorkspaceId = String(options?.persistedWorkspaceId || '').trim();
+    if (persistedWorkspaceId && accessibleIds.has(persistedWorkspaceId)) {
+        return persistedWorkspaceId;
+    }
+    return String(workspaces[0]?.id || '').trim() || null;
+}

package/dist/core/WorkspaceSyncSettings.test.d.ts

@@ -0,0 +1 @@
+export {};