@taskforcehq/taskforce 0.3.169 → 0.3.300

package/dist/server/routes/auth.js

@@ -0,0 +1,1296 @@
+/**
+ * Auth route module.
+ *
+ * Handles authentication, session management, email verification, password reset,
+ * invite flows, account status, and workspace-level team/user administration.
+ *
+ * Routes registered here:
+ *   GET  /api/taskforce/auth/runtime-config
+ *   GET  /api/taskforce/auth/session
+ *   GET  /api/taskforce/auth/admin-session
+ *   POST /api/taskforce/auth/profile
+ *   POST /api/taskforce/auth/login
+ *   POST /api/taskforce/auth/register
+ *   POST /api/taskforce/auth/verify-email/request
+ *   POST /api/taskforce/auth/verify-email/confirm
+ *   POST /api/taskforce/auth/password-reset/request
+ *   POST /api/taskforce/auth/password-reset/confirm
+ *   POST /api/taskforce/auth/invite/inspect
+ *   POST /api/taskforce/auth/invite/accept
+ *   POST /api/taskforce/auth/invite/join
+ *   POST /api/taskforce/auth/logout
+ *   GET  /api/taskforce/account/access-status
+ *   GET  /api/taskforce/account/entitlements
+ *   GET  /api/taskforce/account/plan-preview
+ *   GET  /api/taskforce/auth/workspace-members
+ *   GET  /api/taskforce/workspace/assignee-options
+ *   GET  /api/taskforce/admin/users
+ *   POST /api/taskforce/admin/users/invite
+ *   PATCH /api/taskforce/admin/users/:id/role
+ *   PATCH /api/taskforce/admin/users/:id/permission-mode
+ *   PATCH /api/taskforce/admin/users/:id/disable
+ *   POST /api/taskforce/admin/users/:id/invite/revoke
+ *   DELETE /api/taskforce/admin/users/:id
+ *   GET  /api/taskforce/admin/workspace-audit-logs
+ */
+import { parseJsonBody } from '../routes.js';
+import { hasValidSession, createClearSessionCookie, createSessionTokenCookie, resolveRequestAccess, resolveSessionCookieAttributesForRequest, } from '../auth.js';
+import { resolveEffectiveEmailConfig, sendEmail } from '../email.js';
+import { resolveDeploymentConfig } from '../../config/deployment.js';
+import { resolveRuntimeModeContract } from '../../shared/runtimeContract.js';
+import { resolveErrorStatusCode } from './shared.js';
+// === SECTION: Registration ===
+export function registerAuthRoutes(deps) {
+    const { addRoute, core, context, requestWorkspaceId, requestUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, shouldExposeDevAuthTokens, resolveRuntimeConfigBaseUrl, resolvePublicAuthBaseUrl, } = deps;
+    // === SECTION: Email delivery helpers ===
+    const getEmailConfig = () => {
+        if (context.authConfig?.runtimeMode !== 'cloud') {
+            return resolveEffectiveEmailConfig(process.env, { provider: 'console' });
+        }
+        const globalSettings = core.getGlobalSettings();
+        return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
+    };
+    const getAuthBehavior = () => {
+        const globalSettings = core.getGlobalSettings();
+        const authSettings = globalSettings.auth || {};
+        const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
+        const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
+        const signupSettings = core.getSignupMonetizationSettings();
+        return {
+            allowSelfRegistration: authSettings.allowSelfRegistration !== false,
+            requireVerifiedEmail: authSettings.requireVerifiedEmail !== false,
+            defaultNewUserBetaAccess: authSettings.defaultNewUserBetaAccess === true,
+            authRateLimitEnabled: authSettings.authRateLimitEnabled !== false,
+            authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
+                ? Math.floor(authRateLimitMaxRequestsRaw)
+                : 10,
+            authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
+                ? Math.floor(authRateLimitWindowMsRaw)
+                : 15 * 60_000,
+            signupMonetizationStrategy: signupSettings.strategy,
+            defaultSignupPlanVersionId: signupSettings.defaultSignupPlanVersionId
+        };
+    };
+    const getSiteBehavior = () => {
+        const globalSettings = core.getGlobalSettings();
+        const siteSettings = globalSettings.site || {};
+        return {
+            showRunTaskforceLocally: siteSettings.showRunTaskforceLocally !== false,
+            pricingPageEnabled: siteSettings.pricingPageEnabled !== false
+        };
+    };
+    const logAuthLink = (kind, email, token, req) => {
+        const base = resolvePublicAuthBaseUrl(req);
+        const urlPath = kind === 'verify-email'
+            ? `/login?mode=verify&token=${encodeURIComponent(token)}`
+            : `/login?mode=reset&token=${encodeURIComponent(token)}`;
+        console.info(`[Taskforce Auth] ${kind} email=${email} link=${base}${urlPath}`);
+    };
+    const deliverAuthEmail = async (kind, email, token, req) => {
+        const base = resolvePublicAuthBaseUrl(req);
+        const urlPath = kind === 'verify-email'
+            ? `/login?mode=verify&token=${encodeURIComponent(token)}`
+            : `/login?mode=reset&token=${encodeURIComponent(token)}`;
+        const link = `${base}${urlPath}`;
+        logAuthLink(kind, email, token, req);
+        const subject = kind === 'verify-email'
+            ? 'Verify your Taskforce account'
+            : 'Reset your Taskforce password';
+        const text = kind === 'verify-email'
+            ? `Welcome to Taskforce.\n\nVerify your email by opening this link:\n${link}\n\nIf you did not create an account, you can ignore this message.`
+            : `Reset your Taskforce password using this link:\n${link}\n\nIf you did not request this reset, you can ignore this message.`;
+        const result = await sendEmail({
+            to: email,
+            subject,
+            text
+        }, getEmailConfig());
+        if (result.ok) {
+            console.info(`[Taskforce Auth Email] kind=${kind} provider=${result.provider} to=${email} messageId=${result.messageId || '-'}`);
+        }
+        else {
+            console.warn(`[Taskforce Auth Email] kind=${kind} provider=${result.provider} to=${email} error=${result.error || 'unknown'}`);
+        }
+        return result;
+    };
+    const deliverInviteEmail = async (email, token, req, meta) => {
+        const base = resolvePublicAuthBaseUrl(req);
+        const link = `${base}/login?mode=invite&token=${encodeURIComponent(token)}`;
+        const subject = `You are invited to ${meta.workspaceName} on Taskforce`;
+        const text = `You have been invited to Taskforce.\n\nWorkspace: ${meta.workspaceName}\nInvited by: ${meta.inviterEmailOrLabel}\n\nAccept your invite and set your password:\n${link}\n\nIf you did not expect this invite, you can ignore this message.`;
+        const result = await sendEmail({
+            to: email,
+            subject,
+            text
+        }, getEmailConfig());
+        if (result.ok) {
+            console.info(`[Taskforce Auth Email] kind=invite provider=${result.provider} to=${email} messageId=${result.messageId || '-'}`);
+        }
+        else {
+            console.warn(`[Taskforce Auth Email] kind=invite provider=${result.provider} to=${email} error=${result.error || 'unknown'}`);
+        }
+        return result;
+    };
+    // === SECTION: Runtime config and session ===
+    // GET /api/taskforce/auth/runtime-config - Runtime URL hints for client endpoint resolution.
+    // This route intentionally lives under /api/taskforce/auth/* so it remains reachable before sign-in.
+    addRoute('GET', '/api/taskforce/auth/runtime-config', async (req, res) => {
+        const requestBaseUrl = resolveRuntimeConfigBaseUrl(req);
+        const deployment = resolveDeploymentConfig(process.env, { requestBaseUrl });
+        const runtimeContract = resolveRuntimeModeContract(context.authConfig?.runtimeMode || 'local');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            config: {
+                cloudEnvironment: deployment.cloudEnvironment,
+                cloudBaseUrl: deployment.cloudBaseUrl || null,
+                cloudMcpBaseUrl: deployment.cloudMcpBaseUrl || null,
+                baseUrl: deployment.baseUrl || null,
+                apiBaseUrl: deployment.apiBaseUrl || null,
+                cloudAuthBaseUrl: deployment.cloudAuthBaseUrl || null,
+                wsBaseUrl: deployment.wsBaseUrl || null,
+                cloudAuthViaLocalProxy: deployment.cloudAuthViaLocalProxy,
+                runtimeMode: runtimeContract.runtimeMode,
+                authSource: runtimeContract.authSource,
+                workspaceMode: runtimeContract.workspaceMode,
+                workspaceSwitchingEnabled: runtimeContract.workspaceSwitchingEnabled
+            }
+        }));
+    });
+    addRoute('GET', '/api/taskforce/public/site-config', async (_req, res) => {
+        const siteBehavior = getSiteBehavior();
+        res.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Cross-Origin-Resource-Policy': 'cross-origin'
+        });
+        res.end(JSON.stringify({
+            success: true,
+            config: siteBehavior
+        }));
+    });
+    addRoute('GET', '/api/taskforce/public/site-config-script', async (_req, res) => {
+        const siteBehavior = getSiteBehavior();
+        const payload = JSON.stringify(siteBehavior).replace(/</g, '\\u003c');
+        res.writeHead(200, {
+            'Content-Type': 'application/javascript; charset=utf-8',
+            'Cache-Control': 'no-store',
+            'Cross-Origin-Resource-Policy': 'cross-origin'
+        });
+        res.end(`window.__TASKFORCE_SITE_CONFIG__ = ${payload};`);
+    });
+    // GET /api/taskforce/auth/session - Return current auth/session state
+    addRoute('GET', '/api/taskforce/auth/session', async (req, res) => {
+        const authConfig = context.authConfig;
+        const access = authConfig ? resolveRequestAccess(req, authConfig) : null;
+        const authenticated = Boolean(authConfig && hasValidSession(req, authConfig));
+        let role = access?.role || authConfig?.defaultRole || 'member';
+        let workspaceId = String(access?.workspaceId || authConfig?.defaultWorkspaceId || '').trim();
+        let userId = access?.userId || 'anonymous';
+        let email = null;
+        let displayName = null;
+        let betaAccess = true;
+        if (authenticated && access?.userId) {
+            betaAccess = core.getUserBetaAccess(access.userId);
+            const resolved = core.resolveUserAccess(access.userId, workspaceId, role);
+            if (resolved) {
+                role = resolved.role;
+                workspaceId = resolved.workspaceId;
+                userId = resolved.userId;
+                betaAccess = resolved.betaAccess;
+            }
+            else {
+                workspaceId = 'default';
+                role = authConfig?.defaultRole || 'member';
+            }
+            const identity = core.resolveUserIdentity(userId);
+            email = identity?.email || null;
+            displayName = identity?.displayName || null;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            authenticated,
+            userId,
+            workspaceId,
+            role,
+            email,
+            displayName,
+            betaAccess
+        }));
+    });
+    // GET /api/taskforce/auth/admin-session - Return global admin auth/session state
+    addRoute('GET', '/api/taskforce/auth/admin-session', async (req, res) => {
+        const actor = resolveAdminRequestActor(req);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            authenticated: actor.authenticated,
+            userId: actor.userId,
+            systemRole: actor.systemRole
+        }));
+    });
+    addRoute('POST', '/api/taskforce/auth/profile', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        if (!ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const userId = String(requestUserId(req) || '').trim();
+        if (!userId || userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        try {
+            const updated = core.updateUserDisplayName(userId, String(body?.displayName || ''));
+            if (!updated) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ success: false, error: 'User not found.', code: 'USER_NOT_FOUND' }));
+                return;
+            }
+            auditAuthAction(req, 'auth-profile-updated', {
+                userId,
+                displayName: updated.displayName || null
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                profile: {
+                    userId: updated.userId,
+                    email: updated.email,
+                    displayName: updated.displayName || null
+                }
+            }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to update profile.'), code: error?.code }));
+        }
+    });
+    // === SECTION: Login and register ===
+    // POST /api/taskforce/auth/login - Exchange email/password for secure session cookie
+    addRoute('POST', '/api/taskforce/auth/login', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const authConfig = context.authConfig;
+        if (!authConfig) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth context unavailable.' }));
+            return;
+        }
+        if (!authConfig.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth is not enabled.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const email = String(body?.email || '').trim().toLowerCase();
+        const password = String(body?.password || '');
+        const requestedWorkspaceId = String(body?.workspaceId || '').trim();
+        const workspaceIdCandidate = requestedWorkspaceId;
+        // Login must not be blocked when the user has zero workspaces. Use reserved "default"
+        // as transient session scope until setup creates/switches to a real workspace.
+        const workspaceId = workspaceIdCandidate || 'default';
+        // Password flow (preferred)
+        if (email && password) {
+            const authBehavior = getAuthBehavior();
+            let authResult = core.authenticatePasswordUserDetailed({
+                email,
+                password,
+                workspaceId,
+                fallbackRole: authConfig.defaultRole,
+                requireVerifiedEmail: authBehavior.requireVerifiedEmail
+            });
+            if (authBehavior.requireVerifiedEmail && (!authResult.ok || !authResult.access) && authResult.code === 'EMAIL_NOT_VERIFIED') {
+                const bootstrapEmail = String(process.env.TASKFORCE_BOOTSTRAP_ADMIN_EMAIL || '').trim().toLowerCase();
+                const bootstrapPassword = String(process.env.TASKFORCE_BOOTSTRAP_ADMIN_PASSWORD || '');
+                if (bootstrapEmail && bootstrapPassword && email === bootstrapEmail && password === bootstrapPassword) {
+                    core.markEmailVerified(email);
+                    authResult = core.authenticatePasswordUserDetailed({
+                        email,
+                        password,
+                        workspaceId,
+                        fallbackRole: authConfig.defaultRole,
+                        requireVerifiedEmail: authBehavior.requireVerifiedEmail
+                    });
+                }
+            }
+            if (!authResult.ok || !authResult.access) {
+                auditAuthAction(req, 'auth-login-failed', {
+                    email,
+                    workspaceId,
+                    code: authResult.code || 'INVALID_CREDENTIALS'
+                });
+                if (authResult.code === 'EMAIL_NOT_VERIFIED') {
+                    res.writeHead(403, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ success: false, error: 'Email not verified.', code: 'EMAIL_NOT_VERIFIED' }));
+                    return;
+                }
+                res.writeHead(401, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ success: false, error: 'Invalid email/password.' }));
+                return;
+            }
+            let access = authResult.access;
+            const resolvedWorkspaceId = core.resolvePreferredUserWorkspaceId(access.userId, {
+                preferredWorkspaceId: requestedWorkspaceId || null,
+                persistedWorkspaceId: access.workspaceId || null
+            });
+            if (resolvedWorkspaceId && resolvedWorkspaceId !== access.workspaceId) {
+                const resolvedAccess = core.resolveUserAccess(access.userId, resolvedWorkspaceId, access.role);
+                if (resolvedAccess) {
+                    access = {
+                        userId: resolvedAccess.userId,
+                        workspaceId: resolvedAccess.workspaceId,
+                        role: resolvedAccess.role
+                    };
+                }
+            }
+            const cookie = createSessionTokenCookie(`pwd:${access.userId}`, authConfig, {
+                role: access.role,
+                workspaceId: access.workspaceId,
+                userId: access.userId,
+                ...resolveSessionCookieAttributesForRequest(req, authConfig)
+            });
+            auditAuthAction(req, 'auth-login-success', {
+                email,
+                userId: access.userId,
+                workspaceId: access.workspaceId,
+                role: access.role
+            });
+            res.setHeader('Set-Cookie', cookie);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, method: 'password' }));
+            return;
+        }
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: false, error: 'Email and password are required.' }));
+    });
+    // POST /api/taskforce/auth/register - Create account and exchange for secure session cookie
+    addRoute('POST', '/api/taskforce/auth/register', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const authConfig = context.authConfig;
+        if (!authConfig) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth context unavailable.' }));
+            return;
+        }
+        if (!authConfig.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth is not enabled.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const email = String(body?.email || '').trim().toLowerCase();
+        const password = String(body?.password || '');
+        const displayName = String(body?.displayName || email.split('@')[0] || email).trim();
+        const workspaceIdInput = typeof body?.workspaceId === 'string'
+            ? body.workspaceId.trim()
+            : '';
+        const selectedPlanVersionId = typeof body?.planVersionId === 'string'
+            ? body.planVersionId.trim()
+            : '';
+        const authBehavior = getAuthBehavior();
+        if (!authBehavior.allowSelfRegistration) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Self-registration is currently disabled.' }));
+            return;
+        }
+        if (!email || !password) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Email and password are required.' }));
+            return;
+        }
+        try {
+            const hasRequestedWorkspace = Boolean(workspaceIdInput && workspaceIdInput.toLowerCase() !== 'default');
+            const role = hasRequestedWorkspace
+                ? (core.hasWorkspaceAdmin(workspaceIdInput) ? 'member' : 'owner')
+                : 'member';
+            const created = core.registerPasswordUser({
+                email,
+                password,
+                workspaceId: hasRequestedWorkspace ? workspaceIdInput : undefined,
+                planVersionId: selectedPlanVersionId || undefined,
+                displayName,
+                role,
+                betaAccess: authBehavior.defaultNewUserBetaAccess
+            });
+            const sessionWorkspaceId = created.workspaceId || '';
+            const cookie = createSessionTokenCookie(`pwd:${created.userId}`, authConfig, {
+                role: created.role,
+                workspaceId: sessionWorkspaceId,
+                userId: created.userId,
+                ...resolveSessionCookieAttributesForRequest(req, authConfig)
+            });
+            let emailSent = true;
+            let emailError;
+            let verificationToken;
+            if (authBehavior.requireVerifiedEmail) {
+                const verification = core.requestEmailVerification({ email });
+                verificationToken = verification.token || null;
+                if (verification.token) {
+                    const delivery = await deliverAuthEmail('verify-email', email, verification.token, req);
+                    emailSent = delivery.ok;
+                    emailError = delivery.error;
+                }
+            }
+            auditAuthAction(req, 'auth-register-success', {
+                email,
+                userId: created.userId,
+                workspaceId: created.workspaceId || null,
+                role: created.role,
+                emailSent
+            });
+            res.setHeader('Set-Cookie', cookie);
+            res.writeHead(201, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                method: 'password',
+                role: created.role,
+                workspaceSetupRequired: !created.workspaceId,
+                planSelectionRequired: created.planSelectionRequired === true,
+                verificationRequired: authBehavior.requireVerifiedEmail,
+                emailSent,
+                emailError,
+                verificationToken: authBehavior.requireVerifiedEmail && shouldExposeDevAuthTokens()
+                    ? (verificationToken || null)
+                    : undefined
+            }));
+        }
+        catch (error) {
+            const statusCode = Number(error?.statusCode || 400);
+            const message = String(error?.message || 'Unable to register');
+            auditAuthAction(req, 'auth-register-failed', {
+                email,
+                workspaceId: workspaceIdInput || null,
+                code: error?.code || 'REGISTER_FAILED',
+                statusCode
+            });
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: message, code: error?.code }));
+        }
+    });
+    // === SECTION: Email verification ===
+    // POST /api/taskforce/auth/verify-email/request - Request new verification email/token
+    addRoute('POST', '/api/taskforce/auth/verify-email/request', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const body = await parseJsonBody(req);
+        const email = String(body?.email || '').trim().toLowerCase();
+        if (!email) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Email is required.' }));
+            return;
+        }
+        try {
+            let emailSent = true;
+            let emailError;
+            const verification = core.requestEmailVerification({ email });
+            if (verification.token) {
+                const delivery = await deliverAuthEmail('verify-email', email, verification.token, req);
+                emailSent = delivery.ok;
+                emailError = delivery.error;
+            }
+            auditAuthAction(req, 'auth-verify-request', {
+                email,
+                emailSent
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                emailSent,
+                emailError,
+                verificationToken: shouldExposeDevAuthTokens() ? (verification.token || null) : undefined
+            }));
+        }
+        catch (error) {
+            auditAuthAction(req, 'auth-verify-request-failed', {
+                email,
+                statusCode: resolveErrorStatusCode(error, 400)
+            });
+            res.writeHead(resolveErrorStatusCode(error, 400), { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to request verification') }));
+        }
+    });
+    // POST /api/taskforce/auth/verify-email/confirm - Verify email using one-time token
+    addRoute('POST', '/api/taskforce/auth/verify-email/confirm', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const body = await parseJsonBody(req);
+        const token = String(body?.token || '').trim();
+        if (!token) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Token is required.' }));
+            return;
+        }
+        const verified = core.verifyEmailWithToken(token);
+        if (!verified) {
+            auditAuthAction(req, 'auth-verify-confirm-failed', {
+                tokenProvided: true
+            });
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Invalid or expired token.' }));
+            return;
+        }
+        auditAuthAction(req, 'auth-verify-confirm-success', {
+            tokenProvided: true
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true }));
+    });
+    // === SECTION: Password reset ===
+    // POST /api/taskforce/auth/password-reset/request - Request password reset token
+    addRoute('POST', '/api/taskforce/auth/password-reset/request', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const body = await parseJsonBody(req);
+        const email = String(body?.email || '').trim().toLowerCase();
+        if (!email) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Email is required.' }));
+            return;
+        }
+        try {
+            let emailSent = true;
+            let emailError;
+            const reset = core.requestPasswordReset({ email });
+            if (reset.token) {
+                const delivery = await deliverAuthEmail('password-reset', email, reset.token, req);
+                emailSent = delivery.ok;
+                emailError = delivery.error;
+            }
+            auditAuthAction(req, 'auth-password-reset-request', {
+                email,
+                emailSent
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                emailSent,
+                emailError,
+                resetToken: shouldExposeDevAuthTokens() ? (reset.token || null) : undefined
+            }));
+        }
+        catch (error) {
+            auditAuthAction(req, 'auth-password-reset-request-failed', {
+                email,
+                statusCode: resolveErrorStatusCode(error, 400)
+            });
+            res.writeHead(resolveErrorStatusCode(error, 400), { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to request password reset') }));
+        }
+    });
+    // POST /api/taskforce/auth/password-reset/confirm - Reset password using one-time token
+    addRoute('POST', '/api/taskforce/auth/password-reset/confirm', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const body = await parseJsonBody(req);
+        const token = String(body?.token || '').trim();
+        const password = String(body?.password || '');
+        if (!token || !password) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Token and password are required.' }));
+            return;
+        }
+        try {
+            const updated = core.resetPasswordWithToken({ token, password });
+            if (!updated) {
+                auditAuthAction(req, 'auth-password-reset-confirm-failed', {
+                    tokenProvided: true
+                });
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ success: false, error: 'Invalid or expired token.' }));
+                return;
+            }
+            auditAuthAction(req, 'auth-password-reset-confirm-success', {
+                tokenProvided: true
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true }));
+        }
+        catch (error) {
+            auditAuthAction(req, 'auth-password-reset-confirm-failed', {
+                tokenProvided: true,
+                statusCode: resolveErrorStatusCode(error, 400)
+            });
+            res.writeHead(resolveErrorStatusCode(error, 400), { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to reset password') }));
+        }
+    });
+    // === SECTION: Invite flows ===
+    // POST /api/taskforce/auth/invite/inspect - Inspect invite acceptance token
+    addRoute('POST', '/api/taskforce/auth/invite/inspect', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const body = await parseJsonBody(req);
+        const token = String(body?.token || '').trim();
+        if (!token) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Token is required.' }));
+            return;
+        }
+        const details = core.inspectInviteAcceptance(token);
+        if (details.state === 'missing' || details.state === 'used' || details.state === 'expired' || details.state === 'revoked') {
+            auditAuthAction(req, details.state === 'expired' ? 'auth-invite-opened-expired' : 'auth-invite-opened-invalid', {
+                state: details.state
+            });
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, state: details.state, error: 'Invalid or expired invite token.' }));
+            return;
+        }
+        auditAuthAction(req, 'auth-invite-opened', {
+            userId: details.userId,
+            email: details.email,
+            workspaceId: details.workspaceId,
+            inviteeKind: details.inviteeKind,
+            passwordRequired: details.passwordRequired === true
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            state: details.state,
+            email: details.email,
+            workspaceId: details.workspaceId,
+            inviteeKind: details.inviteeKind,
+            passwordRequired: details.passwordRequired === true
+        }));
+    });
+    // POST /api/taskforce/auth/invite/accept - Accept invite token and set password
+    addRoute('POST', '/api/taskforce/auth/invite/accept', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const authConfig = context.authConfig;
+        if (!authConfig) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth context unavailable.' }));
+            return;
+        }
+        if (!authConfig.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth is not enabled.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const token = String(body?.token || '').trim();
+        const password = String(body?.password || '');
+        if (!token || !password) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Token and password are required.' }));
+            return;
+        }
+        try {
+            const accepted = core.acceptInviteWithToken({ token, password });
+            const cookie = createSessionTokenCookie(`pwd:${accepted.userId}`, authConfig, {
+                role: accepted.role,
+                workspaceId: accepted.workspaceId,
+                userId: accepted.userId,
+                ...resolveSessionCookieAttributesForRequest(req, authConfig)
+            });
+            res.setHeader('Set-Cookie', cookie);
+            auditAuthAction(req, 'auth-invite-accepted', {
+                userId: accepted.userId,
+                email: accepted.email,
+                workspaceId: accepted.workspaceId,
+                role: accepted.role
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, workspaceId: accepted.workspaceId }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            auditAuthAction(req, error?.code === 'INVITE_TOKEN_EXPIRED' ? 'auth-invite-accept-expired' : 'auth-invite-accept-failed', {
+                code: error?.code || 'INVITE_ACCEPT_FAILED',
+                statusCode
+            });
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to accept invite'), code: error?.code }));
+        }
+    });
+    // POST /api/taskforce/auth/invite/join - Accept invite token for existing authenticated users.
+    addRoute('POST', '/api/taskforce/auth/invite/join', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const authConfig = context.authConfig;
+        if (!authConfig) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth context unavailable.' }));
+            return;
+        }
+        if (!authConfig.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth is not enabled.' }));
+            return;
+        }
+        const access = resolveRequestAccess(req, authConfig);
+        if (!access.authenticated || !access.userId || access.userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.', code: 'AUTH_REQUIRED' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const token = String(body?.token || '').trim();
+        if (!token) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Token is required.', code: 'TOKEN_REQUIRED' }));
+            return;
+        }
+        try {
+            const accepted = core.joinInviteWithAuthenticatedUser({ token, userId: access.userId });
+            const sessionId = String(access.sessionId || `pwd:${accepted.userId}`).trim() || `pwd:${accepted.userId}`;
+            const cookie = createSessionTokenCookie(sessionId, authConfig, {
+                role: accepted.role,
+                workspaceId: accepted.workspaceId,
+                userId: accepted.userId,
+                ...resolveSessionCookieAttributesForRequest(req, authConfig)
+            });
+            res.setHeader('Set-Cookie', cookie);
+            auditAuthAction(req, 'auth-invite-joined', {
+                userId: accepted.userId,
+                email: accepted.email,
+                workspaceId: accepted.workspaceId,
+                role: accepted.role
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, workspaceId: accepted.workspaceId }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            auditAuthAction(req, 'auth-invite-join-failed', {
+                code: error?.code || 'INVITE_JOIN_FAILED',
+                statusCode
+            });
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to join invite'), code: error?.code }));
+        }
+    });
+    // === SECTION: Logout ===
+    // POST /api/taskforce/auth/logout - Clear auth session cookie
+    addRoute('POST', '/api/taskforce/auth/logout', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Authentication'))
+            return;
+        const authConfig = context.authConfig;
+        if (!authConfig) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Auth context unavailable.' }));
+            return;
+        }
+        const cookieName = authConfig.sessionCookieName || 'taskforce_session';
+        const attrs = resolveSessionCookieAttributesForRequest(req, authConfig);
+        const sameSite = attrs.sameSite || 'Lax';
+        const securePart = attrs.secure ? '; Secure' : '';
+        const clearBase = `${cookieName}=; Path=/; HttpOnly; SameSite=${sameSite}; Max-Age=0${securePart}`;
+        const hostRaw = String(req.headers['x-forwarded-host'] || req.headers.host || '').trim();
+        const host = hostRaw.split(',')[0]?.trim().split(':')[0]?.trim().toLowerCase() || '';
+        const domains = new Set();
+        if (authConfig.sessionCookieDomain)
+            domains.add(authConfig.sessionCookieDomain);
+        if (host) {
+            domains.add(host);
+            const parts = host.split('.').filter(Boolean);
+            if (parts.length >= 2) {
+                const parent = `.${parts.slice(-2).join('.')}`;
+                domains.add(parent);
+            }
+        }
+        const clearCookies = [createClearSessionCookie(authConfig, attrs), clearBase];
+        for (const domain of domains) {
+            clearCookies.push(`${clearBase}; Domain=${domain}`);
+        }
+        res.setHeader('Set-Cookie', [...new Set(clearCookies)]);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true }));
+    });
+    // === SECTION: Account access and entitlements ===
+    // GET /api/taskforce/account/access-status - Resolve whether the signed-in account can enter the app or must pick a plan first.
+    addRoute('GET', '/api/taskforce/account/access-status', async (req, res) => {
+        if (!ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Authentication required.' }));
+            return;
+        }
+        try {
+            const userId = requestUserId(req);
+            const payload = core.getAccountAccessStatus(userId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(payload));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve account access status'), code: error?.code, details: error?.details }));
+        }
+    });
+    // GET /api/taskforce/account/entitlements - Resolve effective plan/features for the active workspace.
+    addRoute('GET', '/api/taskforce/account/entitlements', async (req, res) => {
+        if (!ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Authentication required.' }));
+            return;
+        }
+        try {
+            const wid = requestWorkspaceId(req);
+            const userId = requestUserId(req);
+            const payload = core.getAccountEntitlementsPayload({ userId, workspaceId: wid });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(payload));
+        }
+        catch (error) {
+            if (error?.code === 'ENTITLEMENT_NOT_FOUND') {
+                const access = core.getAccountAccessStatus(requestUserId(req));
+                if (access.gate === 'plan_selection_required') {
+                    res.writeHead(403, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({
+                        error: access.message,
+                        code: 'PLAN_SELECTION_REQUIRED',
+                        details: {
+                            gate: access.gate,
+                            planSelectionRequired: access.planSelectionRequired,
+                            canAccessPlans: access.canAccessPlans
+                        }
+                    }));
+                    return;
+                }
+            }
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve entitlements'), code: error?.code, details: error?.details }));
+        }
+    });
+    // GET /api/taskforce/account/plan-preview - Read-only payload for upgrade/support CTAs.
+    addRoute('GET', '/api/taskforce/account/plan-preview', async (req, res) => {
+        if (!ensureCloudPlanData(req, res))
+            return;
+        if (!ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Authentication required.' }));
+            return;
+        }
+        try {
+            const wid = requestWorkspaceId(req);
+            const userId = requestUserId(req);
+            const payload = core.getAccountEntitlementsPayload({ userId, workspaceId: wid });
+            const canInvite = Boolean(payload?.features?.['collaboration.invites']?.allowed);
+            const seatUsage = payload.seatUsage || { used: 0, limit: null, remaining: null };
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                currentPlan: payload.planId,
+                state: payload.state,
+                seatUsage,
+                upgradeHints: canInvite
+                    ? []
+                    : ['Team management requires a TEAM plan in active/trialing/grace state.'],
+                supportLink: 'mailto:support@taskforcehq.ai'
+            }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to build plan preview'), code: error?.code, details: error?.details }));
+        }
+    });
+    // === SECTION: Workspace team management (workspace admin) ===
+    // GET /api/taskforce/auth/workspace-members - Auth-backed workspace member list for local runtime identity hydration.
+    addRoute('GET', '/api/taskforce/auth/workspace-members', async (req, res) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        if (context.authConfig?.runtimeMode === 'cloud' && context.authConfig?.enabled && !ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Authentication required.' }));
+            return;
+        }
+        const wid = requestWorkspaceId(req);
+        const users = core.listWorkspaceUsers(wid);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ users }));
+    });
+    // GET /api/taskforce/workspace/assignee-options - Read active workspace humans and registered AI collaborators for task assignee selection.
+    addRoute('GET', '/api/taskforce/workspace/assignee-options', async (req, res) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        if (context.authConfig?.runtimeMode === 'cloud' && context.authConfig?.enabled && !ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Authentication required.' }));
+            return;
+        }
+        const wid = requestWorkspaceId(req);
+        const includeProfileToken = context.authConfig?.enabled !== true || ensureWorkspaceAdminRole(req);
+        const workspaceUsers = core
+            .listWorkspaceUsers(wid)
+            .filter((user) => String(user.status || '').trim().toLowerCase() === 'active' && user.disabled !== true)
+            .map((user) => ({
+            value: user.userId,
+            label: String(user.displayName || user.email || user.userId).trim() || user.userId,
+            icon: 'User',
+            color: '#22c55e',
+            kind: 'member',
+            userId: user.userId,
+            email: user.email,
+            displayName: user.displayName ?? null,
+            status: user.status,
+            disabled: user.disabled === true
+        }));
+        const aiProfiles = core
+            .listAiProfiles(wid)
+            .map((profile) => ({
+            value: profile.id,
+            label: profile.name,
+            ...(includeProfileToken ? { profileToken: profile.profileToken } : {}),
+            username: profile.username,
+            icon: profile.icon,
+            color: profile.color,
+            kind: 'agent',
+            description: profile.description ?? null,
+            role: profile.role ?? null,
+            provider: profile.provider ?? null,
+            model: profile.model ?? null,
+            surfaceType: profile.surfaceType ?? null,
+            createdAt: profile.createdAt,
+            updatedAt: profile.updatedAt,
+            lastActiveAt: profile.lastActiveAt ?? null
+        }));
+        const assignees = [...workspaceUsers, ...aiProfiles];
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ assignees }));
+    });
+    // POST /api/taskforce/workspace/ai-profiles/merge - Merge a duplicate AI profile into another, reassigning all references.
+    addRoute('POST', '/api/taskforce/workspace/ai-profiles/merge', async (req, res) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const wid = requestWorkspaceId(req);
+        const keepId = String(body.keepId || '').trim();
+        const mergeId = String(body.mergeId || '').trim();
+        if (!keepId || !mergeId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'keepId and mergeId are required.' }));
+            return;
+        }
+        try {
+            const profile = core.mergeAiProfiles({ workspaceId: wid, keepId, mergeId });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ profile }));
+        }
+        catch (err) {
+            const status = err?.statusCode ?? 500;
+            res.writeHead(status, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err?.message ?? 'Merge failed.' }));
+        }
+    });
+    // GET /api/taskforce/admin/users - List workspace users for team management.
+    addRoute('GET', '/api/taskforce/admin/users', async (req, res) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const wid = requestWorkspaceId(req);
+        const gate = core.evaluateFeatureAccess({
+            userId: requestUserId(req),
+            workspaceId: wid,
+            featureKey: 'collaboration.team_management'
+        });
+        if (!gate.allowed) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team management is unavailable for this account entitlement.', code: gate.reasonCode }));
+            return;
+        }
+        const users = core.listWorkspaceUsers(wid);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ users }));
+    });
+    // POST /api/taskforce/admin/users/invite - Invite a user into a workspace.
+    addRoute('POST', '/api/taskforce/admin/users/invite', async (req, res) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const wid = String(body?.workspaceId || requestWorkspaceId(req)).trim() || 'default';
+        const email = String(body?.email || '').trim().toLowerCase();
+        const role = String(body?.role || 'member').trim().toLowerCase();
+        const permissionMode = String(body?.permissionMode || 'read-write').trim().toLowerCase();
+        if (!email || !email.includes('@')) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Valid email is required.' }));
+            return;
+        }
+        const inviteGate = core.evaluateFeatureAccess({
+            userId: requestUserId(req),
+            workspaceId: wid,
+            featureKey: 'collaboration.invites'
+        });
+        if (!inviteGate.allowed) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invites are unavailable for this account entitlement.', code: inviteGate.reasonCode }));
+            return;
+        }
+        try {
+            const invited = core.inviteWorkspaceUser({
+                workspaceId: wid,
+                email,
+                role: role === 'owner' || role === 'admin' ? role : 'member'
+            });
+            if (role === 'member') {
+                core.setWorkspaceUserPermissionMode(invited.userId, wid, permissionMode === 'read-only' ? 'read-only' : 'read-write');
+            }
+            const inviteToken = core.requestInviteAcceptance({ userId: invited.userId, workspaceId: wid });
+            let inviteEmailSent = true;
+            let inviteEmailError = null;
+            if (inviteToken.token) {
+                const workspace = core.getWorkspaceProfile(wid);
+                const actorIdentity = core.resolveUserIdentity(requestUserId(req));
+                const inviterEmailOrLabel = String(actorIdentity?.email || requestUserId(req) || 'Taskforce').trim();
+                const delivery = await deliverInviteEmail(email, inviteToken.token, req, {
+                    workspaceName: String(workspace?.name || wid),
+                    inviterEmailOrLabel
+                });
+                inviteEmailSent = delivery.ok;
+                inviteEmailError = delivery.ok ? null : String(delivery.error || 'INVITE_EMAIL_FAILED');
+            }
+            auditAuthAction(req, 'invite-user', {
+                workspaceId: wid,
+                invitedUserId: invited.userId,
+                email,
+                role,
+                permissionMode: role === 'member' ? (permissionMode === 'read-only' ? 'read-only' : 'read-write') : 'read-write',
+                inviteEmailSent
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                user: core.listWorkspaceUsers(wid).find((item) => item.userId === invited.userId) || invited,
+                inviteEmailSent,
+                inviteEmailError
+            }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to invite user'), code: error?.code, details: error?.details }));
+        }
+    });
+    // PATCH /api/taskforce/admin/users/:id/role - Update workspace role for a user.
+    addRoute('PATCH', '/api/taskforce/admin/users/:id/role', async (req, res, params) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const wid = String(body?.workspaceId || requestWorkspaceId(req)).trim() || 'default';
+        const role = String(body?.role || '').trim().toLowerCase();
+        if (role !== 'owner' && role !== 'admin' && role !== 'member') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'role must be owner, admin, or member' }));
+            return;
+        }
+        const gate = core.evaluateFeatureAccess({
+            userId: requestUserId(req),
+            workspaceId: wid,
+            featureKey: 'collaboration.team_management'
+        });
+        if (!gate.allowed) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team management is unavailable for this account entitlement.', code: gate.reasonCode }));
+            return;
+        }
+        try {
+            const success = core.updateWorkspaceUserRole(params.id, wid, role);
+            if (!success) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'User membership not found.' }));
+                return;
+            }
+            auditAuthAction(req, 'update-workspace-user-role', { workspaceId: wid, targetUserId: params.id, role });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to update role'), code: error?.code }));
+        }
+    });
+    // PATCH /api/taskforce/admin/users/:id/permission-mode - Update member permission mode.
+    addRoute('PATCH', '/api/taskforce/admin/users/:id/permission-mode', async (req, res, params) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const wid = String(body?.workspaceId || requestWorkspaceId(req)).trim() || 'default';
+        const mode = String(body?.mode || '').trim().toLowerCase();
+        if (mode !== 'read-only' && mode !== 'read-write') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'mode must be read-only or read-write' }));
+            return;
+        }
+        const gate = core.evaluateFeatureAccess({
+            userId: requestUserId(req),
+            workspaceId: wid,
+            featureKey: 'collaboration.team_management'
+        });
+        if (!gate.allowed) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team management is unavailable for this account entitlement.', code: gate.reasonCode }));
+            return;
+        }
+        try {
+            const success = core.setWorkspaceUserPermissionMode(params.id, wid, mode);
+            if (!success) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'User membership not found.' }));
+                return;
+            }
+            auditAuthAction(req, 'update-workspace-user-permission-mode', { workspaceId: wid, targetUserId: params.id, mode });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to update permission mode'), code: error?.code }));
+        }
+    });
+    // PATCH /api/taskforce/admin/users/:id/disable - Disable or reactivate a workspace user.
+    addRoute('PATCH', '/api/taskforce/admin/users/:id/disable', async (req, res, params) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const wid = String(body?.workspaceId || requestWorkspaceId(req)).trim() || 'default';
+        const disabled = body?.disabled === true;
+        const gate = core.evaluateFeatureAccess({
+            userId: requestUserId(req),
+            workspaceId: wid,
+            featureKey: 'collaboration.team_management'
+        });
+        if (!gate.allowed) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team management is unavailable for this account entitlement.', code: gate.reasonCode }));
+            return;
+        }
+        try {
+            const success = core.setWorkspaceUserDisabled(params.id, wid, disabled);
+            if (!success) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'User membership not found.' }));
+                return;
+            }
+            auditAuthAction(req, 'set-workspace-user-disabled', { workspaceId: wid, targetUserId: params.id, disabled });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to update disabled state'), code: error?.code }));
+        }
+    });
+    // POST /api/taskforce/admin/users/:id/invite/revoke - Revoke invite acceptance token.
+    addRoute('POST', '/api/taskforce/admin/users/:id/invite/revoke', async (req, res, params) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const wid = String(body?.workspaceId || requestWorkspaceId(req)).trim() || 'default';
+        const gate = core.evaluateFeatureAccess({
+            userId: requestUserId(req),
+            workspaceId: wid,
+            featureKey: 'collaboration.team_management'
+        });
+        if (!gate.allowed) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team management is unavailable for this account entitlement.', code: gate.reasonCode }));
+            return;
+        }
+        const revoked = core.revokeInviteAcceptanceForUser(params.id);
+        auditAuthAction(req, 'revoke-invite', { workspaceId: wid, targetUserId: params.id, revoked: revoked.revoked });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true, revoked: revoked.revoked }));
+    });
+    // DELETE /api/taskforce/admin/users/:id - Remove workspace membership.
+    addRoute('DELETE', '/api/taskforce/admin/users/:id', async (req, res, params) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const reqUrl = new URL(req.url || '/api/taskforce/admin/users/:id', 'http://localhost');
+        const wid = String(reqUrl.searchParams.get('workspaceId') || requestWorkspaceId(req)).trim() || 'default';
+        const gate = core.evaluateFeatureAccess({
+            userId: requestUserId(req),
+            workspaceId: wid,
+            featureKey: 'collaboration.team_management'
+        });
+        if (!gate.allowed) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team management is unavailable for this account entitlement.', code: gate.reasonCode }));
+            return;
+        }
+        try {
+            const success = core.removeWorkspaceUser(params.id, wid);
+            if (!success) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'User membership not found.' }));
+                return;
+            }
+            auditAuthAction(req, 'remove-workspace-user', { workspaceId: wid, targetUserId: params.id });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to remove user'), code: error?.code }));
+        }
+    });
+    // GET /api/taskforce/admin/workspace-audit-logs - Read workspace-scoped admin audit events for team management.
+    addRoute('GET', '/api/taskforce/admin/workspace-audit-logs', async (req, res) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const wid = requestWorkspaceId(req);
+        const gate = core.evaluateFeatureAccess({
+            userId: requestUserId(req),
+            workspaceId: wid,
+            featureKey: 'collaboration.team_management'
+        });
+        if (!gate.allowed) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team management is unavailable for this account entitlement.', code: gate.reasonCode }));
+            return;
+        }
+        const reqUrl = new URL(req.url || '/api/taskforce/admin/workspace-audit-logs', 'http://localhost');
+        const limitRaw = Number(reqUrl.searchParams.get('limit') || '100');
+        const offsetRaw = Number(reqUrl.searchParams.get('offset') || '0');
+        const limit = Number.isFinite(limitRaw) ? Math.max(1, Math.min(500, Math.floor(limitRaw))) : 100;
+        const offset = Number.isFinite(offsetRaw) ? Math.max(0, Math.floor(offsetRaw)) : 0;
+        const events = core.listAdminAuditLogs(wid, limit, offset).map((event) => ({
+            id: event.id,
+            action: event.action,
+            actorUserId: event.actorUserId,
+            actorRole: event.actorRole,
+            workspaceId: event.workspaceId,
+            details: event.details,
+            createdAt: event.ts
+        }));
+        const total = core.countAdminAuditLogs(wid);
+        const page = Math.floor(offset / limit) + 1;
+        const pages = Math.max(1, Math.ceil(total / limit));
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ events, workspaceId: wid, limit, offset, total, page, pages }));
+    });
+}