@taskforcehq/taskforce 0.3.301 → 0.3.303

package/dist/mcp/runtime.test.js

@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -7,61 +7,8 @@ import { MCP_TOOL_REGISTRY } from './toolRegistry';
 import { TaskforceCore, TaskforceRuleError } from '../core/Taskforce';
 import { WorkspaceAssetStore } from '../storage/workspaceAssetStore';
 import { ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY, APP_GATE_DEFINITIONS, } from '../runtime/appGates';
-function createProjectRoot() {
-    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-mcp-runtime-'));
-    const core = new TaskforceCore({
-        projectRoot,
-        storagePath: path.join(projectRoot, '.taskforce')
-    });
-    try {
-        Object.defineProperty(core, 'getAccountAccessStatus', {
-            configurable: true,
-            value: () => ({
-                gate: 'ok',
-                hasEntitlement: true,
-                canAccessApp: true,
-                canAccessPlans: true,
-                signupMonetizationStrategy: 'none',
-                planSelectionRequired: false,
-                message: null,
-                entitlement: null
-            })
-        });
-        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-        core.ensureBootstrapUserAccess({
-            userId: 'owner-1',
-            workspaceId: 'workspace-1',
-            role: 'owner',
-            email: 'owner-1@example.com'
-        });
-    }
-    finally {
-        core.close();
-    }
-    return projectRoot;
-}
-async function listTools(projectRoot, runtimeMode) {
-    const runtime = createTaskforceMcpServer({
-        projectRoot,
-        runtimeMode,
-        logStartup: false,
-        auth: runtimeMode === 'cloud'
-            ? { scopes: ['tasks:read', 'tasks:write', 'workspace:read'] }
-            : undefined
-    });
-    const handler = runtime.server._requestHandlers.get('tools/list');
-    if (!handler) {
-        throw new Error('tools/list handler not registered');
-    }
-    return await handler({
-        jsonrpc: '2.0',
-        id: 'test-tools-list',
-        method: 'tools/list',
-        params: {}
-    }, {});
-}
-async function callTool(projectRoot, runtimeMode, name, args, options) {
-    const runtime = createTaskforceMcpServer({
+function createRuntime(projectRoot, runtimeMode, options) {
+    return createTaskforceMcpServer({
         projectRoot,
         runtimeMode,
         workspaceId: options?.workspaceId,
@@ -73,6 +20,8 @@ async function callTool(projectRoot, runtimeMode, name, args, options) {
                 actorType: 'oauth',
                 aiProfileToken: options?.authAiProfileToken || null,
                 aiProfileName: options?.authAiProfileName || null,
+                aiProfileIcon: options?.authAiProfileIcon || null,
+                aiProfileColor: options?.authAiProfileColor || null,
                 aiProfileDescription: options?.authAiProfileDescription || null,
                 aiProfileRole: options?.authAiProfileRole || null,
                 aiProfileProvider: options?.authAiProfileProvider || null,
@@ -81,6 +30,8 @@ async function callTool(projectRoot, runtimeMode, name, args, options) {
             }
             : undefined
     });
+}
+async function callToolWithRuntime(runtime, name, args, options) {
     const handler = runtime.server._requestHandlers.get('tools/call');
     if (!handler) {
         throw new Error('tools/call handler not registered');
@@ -110,20 +61,71 @@ async function callTool(projectRoot, runtimeMode, name, args, options) {
         }
     }, {});
 }
-async function readResource(projectRoot, runtimeMode, uri, options) {
-    const runtime = createTaskforceMcpServer({
+async function subscribeResource(runtime, uri) {
+    const handler = runtime.server._requestHandlers.get('resources/subscribe');
+    if (!handler) {
+        throw new Error('resources/subscribe handler not registered');
+    }
+    await handler({
+        jsonrpc: '2.0',
+        id: `test-resources-subscribe-${uri}`,
+        method: 'resources/subscribe',
+        params: { uri }
+    }, {});
+}
+function createProjectRoot() {
+    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-mcp-runtime-'));
+    const core = new TaskforceCore({
         projectRoot,
-        runtimeMode,
-        workspaceId: options?.workspaceId,
-        logStartup: false,
-        auth: runtimeMode === 'cloud'
-            ? {
-                scopes: ['tasks:read', 'tasks:write', 'workspace:read'],
-                userId: options?.authUserId || 'owner-1',
-                actorType: 'oauth'
-            }
-            : undefined
+        storagePath: path.join(projectRoot, '.taskforce')
+    });
+    try {
+        Object.defineProperty(core, 'getAccountAccessStatus', {
+            configurable: true,
+            value: () => ({
+                gate: 'ok',
+                hasEntitlement: true,
+                canAccessApp: true,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: null,
+                entitlement: null
+            })
+        });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        core.ensureBootstrapUserAccess({
+            userId: 'owner-1',
+            workspaceId: 'workspace-1',
+            role: 'owner',
+            email: 'owner-1@example.com'
+        });
+    }
+    finally {
+        core.close();
+    }
+    return projectRoot;
+}
+async function listTools(projectRoot, runtimeMode) {
+    const runtime = createRuntime(projectRoot, runtimeMode);
+    const handler = runtime.server._requestHandlers.get('tools/list');
+    if (!handler) {
+        throw new Error('tools/list handler not registered');
+    }
+    return await handler({
+        jsonrpc: '2.0',
+        id: 'test-tools-list',
+        method: 'tools/list',
+        params: {}
+    }, {});
+}
+async function callTool(projectRoot, runtimeMode, name, args, options) {
+    const runtime = createRuntime(projectRoot, runtimeMode, options);
+    return await callToolWithRuntime(runtime, name, args, {
+        resolveProfile: options?.resolveProfile,
     });
+}
+async function readResource(projectRoot, runtimeMode, uri, options) {
+    const runtime = createRuntime(projectRoot, runtimeMode, options);
     const handler = runtime.server._requestHandlers.get('resources/read');
     if (!handler) {
         throw new Error('resources/read handler not registered');
@@ -136,19 +138,7 @@ async function readResource(projectRoot, runtimeMode, uri, options) {
     }, {});
 }
 async function listResources(projectRoot, runtimeMode, options) {
-    const runtime = createTaskforceMcpServer({
-        projectRoot,
-        runtimeMode,
-        workspaceId: options?.workspaceId,
-        logStartup: false,
-        auth: runtimeMode === 'cloud'
-            ? {
-                scopes: ['tasks:read', 'tasks:write', 'workspace:read'],
-                userId: options?.authUserId || 'owner-1',
-                actorType: 'oauth'
-            }
-            : undefined
-    });
+    const runtime = createRuntime(projectRoot, runtimeMode, options);
     const handler = runtime.server._requestHandlers.get('resources/list');
     if (!handler) {
         throw new Error('resources/list handler not registered');
@@ -302,6 +292,29 @@ describe('Taskforce MCP tool descriptions', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('does not let TASKFORCE_TOOLS prune the runtime tool catalog', async () => {
+        const projectRoot = createProjectRoot();
+        const previousValue = process.env.TASKFORCE_TOOLS;
+        process.env.TASKFORCE_TOOLS = 'get_task';
+        try {
+            const result = await listTools(projectRoot, 'cloud');
+            const runtimeToolNames = result.tools.map((tool) => tool.name).sort();
+            const registryToolNames = Object.entries(MCP_TOOL_REGISTRY)
+                .filter(([, entry]) => entry.permission.kind !== 'local-only' && entry.permission.kind !== 'session-only')
+                .map(([name]) => name)
+                .sort();
+            expect(runtimeToolNames).toEqual(registryToolNames);
+        }
+        finally {
+            if (previousValue === undefined) {
+                delete process.env.TASKFORCE_TOOLS;
+            }
+            else {
+                process.env.TASKFORCE_TOOLS = previousValue;
+            }
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('includes local-only guidance in local runtime tool descriptions', async () => {
         const projectRoot = createProjectRoot();
         try {
@@ -713,6 +726,8 @@ describe('Taskforce MCP tool descriptions', () => {
                 model: 'Codex',
                 surfaceType: 'coding_tool'
             }));
+            expect(currentProfile.bindingSource).toBe('connection_bootstrap');
+            expect(currentProfile.writeReady).toBe(true);
         }
         finally {
             fs.rmSync(projectRoot, { recursive: true, force: true });
@@ -788,6 +803,8 @@ describe('Taskforce MCP tool descriptions', () => {
                 authAiProfileName: 'Automation Codex'
             }));
             expect(currentProfile.identityBound).toBe(true);
+            expect(currentProfile.bindingSource).toBe('connection_bootstrap');
+            expect(currentProfile.writeReady).toBe(true);
             expect(currentProfile.profileToken).toMatch(/^tfp_/);
             expect(currentProfile.profile).toEqual(expect.objectContaining({
                 name: 'Automation Codex',
@@ -817,6 +834,27 @@ describe('Taskforce MCP tool descriptions', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('reports token_lookup binding when get_current_profile is inspected with an explicit profileToken', async () => {
+        const projectRoot = createProjectRoot();
+        try {
+            const resolved = parseToolJson(await callTool(projectRoot, 'local', 'resolve_profile', {
+                name: 'Codex'
+            }, { resolveProfile: false }));
+            const payload = parseToolJson(await callTool(projectRoot, 'local', 'get_current_profile', {
+                profileToken: resolved.profile.profileToken,
+            }, { resolveProfile: false }));
+            expect(payload.identityBound).toBe(false);
+            expect(payload.bindingSource).toBe('token_lookup');
+            expect(payload.writeReady).toBe(true);
+            expect(payload.profile).toEqual(expect.objectContaining({
+                id: resolved.profile.id,
+                profileToken: resolved.profile.profileToken,
+            }));
+        }
+        finally {
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('recovers from an invalid per-call profileToken when the connection has a valid AI name', async () => {
         const projectRoot = createProjectRoot();
         try {
@@ -1214,6 +1252,8 @@ describe('Taskforce MCP tool descriptions', () => {
                 }
             }, {}));
             expect(payload.identityBound).toBe(true);
+            expect(payload.bindingSource).toBe('session');
+            expect(payload.writeReady).toBe(true);
             expect(payload.profile).toEqual(expect.objectContaining({
                 id: resolved.profile.id,
                 username: resolved.profile.username,
@@ -1235,6 +1275,8 @@ describe('Taskforce MCP tool descriptions', () => {
                 resolveProfile: false
             }));
             expect(payload.identityBound).toBe(false);
+            expect(payload.bindingSource).toBe('none');
+            expect(payload.writeReady).toBe(false);
             expect(payload.profile).toBeNull();
             expect(payload.taskFilter).toBeNull();
             expect(payload.nextTool).toBe('resolve_profile');
@@ -1251,13 +1293,29 @@ describe('Taskforce MCP tool descriptions', () => {
             const payload = parseToolJson(await callTool(projectRoot, 'cloud', 'get_current_profile', {}, {
                 workspaceId: 'workspace-1',
                 resolveProfile: false,
-                authAiProfileName: 'Automation Codex'
+                authAiProfileName: 'Automation Codex',
+                authAiProfileIcon: 'Code2',
+                authAiProfileColor: '#10a37f',
+                authAiProfileDescription: 'OpenAI Codex coding agent connected through MCP.',
+                authAiProfileRole: 'Coding Agent',
+                authAiProfileProvider: 'OpenAI',
+                authAiProfileModel: 'Codex',
+                authAiProfileSurfaceType: 'coding_tool'
             }));
             expect(payload.identityBound).toBe(true);
+            expect(payload.bindingSource).toBe('connection_bootstrap');
+            expect(payload.writeReady).toBe(true);
             expect(payload.profile).toEqual(expect.objectContaining({
                 name: 'Automation Codex',
                 username: 'automation-codex',
-                profileToken: expect.stringMatching(/^tfp_/)
+                profileToken: expect.stringMatching(/^tfp_/),
+                icon: 'Code2',
+                color: '#10a37f',
+                description: 'OpenAI Codex coding agent connected through MCP.',
+                role: 'Coding Agent',
+                provider: 'OpenAI',
+                model: 'Codex',
+                surfaceType: 'coding_tool'
             }));
             expect(payload.taskFilter).toEqual({ assignee: payload.profile.id });
             expect(payload.nextTool).toBe('list_tasks');
@@ -1453,6 +1511,150 @@ describe('Taskforce MCP tool descriptions', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('builds workstream listings from one historical task snapshot and returns task summaries', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce')
+        });
+        try {
+            const category = core.getCategories()[0]?.value;
+            const type = core.getTypes()[0]?.value;
+            const firstWorkstream = core.createWorkstream({ title: 'Workstream one' }, 'workspace-1');
+            const secondWorkstream = core.createWorkstream({ title: 'Workstream two' }, 'workspace-1');
+            core.createTask({
+                title: 'Linked task one',
+                category,
+                type,
+                workstreamId: firstWorkstream.id,
+            }, { workspaceId: 'workspace-1', actorRef: 'owner-1' });
+            core.createTask({
+                title: 'Linked task two',
+                category,
+                type,
+                workstreamId: secondWorkstream.id,
+            }, { workspaceId: 'workspace-1', actorRef: 'owner-1' });
+            const archivedTask = core.createTask({
+                title: 'Archived linked task',
+                category,
+                type,
+                workstreamId: firstWorkstream.id,
+                status: 'done',
+            }, { workspaceId: 'workspace-1', actorRef: 'owner-1' });
+            core.archiveTask(archivedTask.id, false, undefined, 'workspace-1', { actorRef: 'owner-1' });
+        }
+        finally {
+            core.close();
+        }
+        const listTasksSpy = vi.spyOn(TaskforceCore.prototype, 'listTasks');
+        const listArchiveSpy = vi.spyOn(TaskforceCore.prototype, 'listArchive');
+        try {
+            const beforeListTasksCalls = listTasksSpy.mock.calls.length;
+            const beforeListArchiveCalls = listArchiveSpy.mock.calls.length;
+            const payload = parseToolJson(await callTool(projectRoot, 'local', 'list_workstreams', {}));
+            const firstWorkstreamPayload = payload.workstreams.find((entry) => entry.workstream.title === 'Workstream one');
+            const linkedTask = firstWorkstreamPayload?.tasks.find((task) => task.title === 'Archived linked task');
+            expect(listTasksSpy.mock.calls.length - beforeListTasksCalls).toBe(1);
+            expect(listArchiveSpy.mock.calls.length - beforeListArchiveCalls).toBe(1);
+            expect(linkedTask).toMatchObject({
+                title: 'Archived linked task',
+                workstreamId: firstWorkstreamPayload?.workstream.id,
+                status: 'done',
+            });
+            expect(linkedTask.description).toBeUndefined();
+            expect(linkedTask.comments).toBeUndefined();
+            expect(linkedTask.activity).toBeUndefined();
+            expect(linkedTask.attachments).toBeUndefined();
+            expect(linkedTask.checklistItems).toBeUndefined();
+        }
+        finally {
+            listTasksSpy.mockRestore();
+            listArchiveSpy.mockRestore();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('queues bulk resource invalidations instead of awaiting them in the write path', async () => {
+        const projectRoot = createProjectRoot();
+        const runtime = createRuntime(projectRoot, 'local');
+        const resourceUri = `taskforce://${path.basename(projectRoot)}/tasks`;
+        const sendResourceUpdatedSpy = vi
+            .spyOn(runtime.server, 'sendResourceUpdated')
+            .mockImplementation(async () => {
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        });
+        try {
+            await subscribeResource(runtime, resourceUri);
+            const created = parseToolJson(await callToolWithRuntime(runtime, 'create_task', {
+                title: 'Queued invalidation task'
+            }));
+            expect(created.title).toBe('Queued invalidation task');
+            expect(sendResourceUpdatedSpy).not.toHaveBeenCalled();
+            await new Promise((resolve) => setTimeout(resolve, 40));
+            expect(sendResourceUpdatedSpy).toHaveBeenCalledTimes(1);
+            expect(sendResourceUpdatedSpy).toHaveBeenCalledWith({ uri: resourceUri });
+        }
+        finally {
+            sendResourceUpdatedSpy.mockRestore();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('reads the bulk tasks resource as summary-only rows', async () => {
+        const projectRoot = createProjectRoot();
+        try {
+            const created = parseToolJson(await callTool(projectRoot, 'local', 'create_task', {
+                title: 'Verbose task',
+                description: 'This should stay off the bulk tasks resource'
+            }));
+            await callTool(projectRoot, 'local', 'add_comment', {
+                id: created.referenceLabel,
+                text: 'This comment should stay off the bulk tasks resource',
+                author: 'ai-profile-019d15c5-6ad3-7bf0-9b9e-fa9c366c3ff4'
+            });
+            const taskResource = await readResource(projectRoot, 'cloud', `taskforce://${path.basename(projectRoot)}/tasks`, {
+                workspaceId: 'workspace-1',
+                authUserId: 'owner-1'
+            });
+            const payload = JSON.parse(String(taskResource.contents[0]?.text || '{}'));
+            const resourceTask = payload.tasks.find((task) => task.referenceLabel === created.referenceLabel);
+            expect(resourceTask).toMatchObject({
+                referenceLabel: created.referenceLabel,
+                title: 'Verbose task',
+            });
+            expect(resourceTask.description).toBeUndefined();
+            expect(resourceTask.comments).toBeUndefined();
+            expect(resourceTask.activity).toBeUndefined();
+            expect(resourceTask.attachments).toBeUndefined();
+            expect(resourceTask.checklistItems).toBeUndefined();
+        }
+        finally {
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('reads initiative listings with summary initiative and workstream records only', async () => {
+        const projectRoot = createProjectRoot();
+        try {
+            const initiative = parseToolJson(await callTool(projectRoot, 'local', 'create_initiative', {
+                title: 'Summary initiative',
+                description: 'Verbose initiative details should stay off the bulk listing'
+            }));
+            await callTool(projectRoot, 'local', 'create_workstream', {
+                title: 'Summary workstream',
+                description: 'Verbose workstream details should stay off the bulk listing',
+                initiativeId: initiative.initiative.referenceLabel
+            });
+            const initiatives = parseToolJson(await callTool(projectRoot, 'local', 'list_initiatives', {}));
+            const listedInitiative = initiatives.initiatives.find((entry) => entry.initiative.referenceLabel === initiative.initiative.referenceLabel);
+            const listedWorkstream = listedInitiative?.workstreams.find((entry) => entry.title === 'Summary workstream');
+            expect(listedInitiative).toBeTruthy();
+            expect(listedInitiative.initiative.description).toBeUndefined();
+            expect(listedWorkstream).toBeTruthy();
+            expect(listedWorkstream.description).toBeUndefined();
+            expect(listedWorkstream.taskIds).toBeUndefined();
+        }
+        finally {
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('creates MCP tasks as unassigned when no explicit assignee is provided', async () => {
         const projectRoot = createProjectRoot();
         try {
@@ -1494,6 +1696,42 @@ describe('Taskforce MCP tool descriptions', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('returns summary-shaped task entries from the shared tasks resource', async () => {
+        const projectRoot = createProjectRoot();
+        try {
+            const core = new TaskforceCore({
+                projectRoot,
+                storagePath: path.join(projectRoot, '.taskforce')
+            });
+            core.createTask({
+                title: 'Resource summary task',
+                description: 'Verbose task description',
+                comments: [{ id: 'comment-1', author: 'user', text: 'Hello', timestamp: '2026-04-13T01:00:00.000Z' }],
+                attachments: [{ name: 'note.md', path: 'notes/note.md' }],
+                checklistItems: [{ id: 'item-1', taskId: 'temp', title: 'Check me', isCompleted: false, order: 0, createdAt: '2026-04-13T01:00:00.000Z' }],
+            }, {
+                workspaceId: 'workspace-1',
+                actorRef: 'owner-1'
+            });
+            core.close();
+            const tasksResource = await readResource(projectRoot, 'cloud', `taskforce://${path.basename(projectRoot)}/tasks`, {
+                workspaceId: 'workspace-1',
+                authUserId: 'owner-1'
+            });
+            const payload = JSON.parse(String(tasksResource.contents[0]?.text || '{}'));
+            const task = payload.tasks.find((entry) => entry.title === 'Resource summary task');
+            expect(task).toBeDefined();
+            expect(task.description).toBeUndefined();
+            expect(task.comments).toBeUndefined();
+            expect(task.taskEvents).toBeUndefined();
+            expect(task.activity).toBeUndefined();
+            expect(task.attachments).toBeUndefined();
+            expect(task.checklistItems).toBeUndefined();
+        }
+        finally {
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('persists save_task_attachment through canonical task attachments', async () => {
         const projectRoot = createProjectRoot();
         try {

package/dist/migrations/billingSchemaParity.test.js

@@ -25,6 +25,7 @@ describe('billing schema parity', () => {
             expect(names.has('user_billing')).toBe(true);
             expect(names.has('stripe_webhook_events')).toBe(true);
             expect(names.has('stripe_webhook_failures')).toBe(true);
+            expect(names.has('billing_checkout_attempts')).toBe(true);
             expect(names.has('billing_config')).toBe(true);
             expect(names.has('billing_price_mappings')).toBe(true);
         }
@@ -101,9 +102,11 @@ describe('billing schema parity', () => {
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS user_billing');
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS stripe_webhook_events');
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS stripe_webhook_failures');
+        expect(sql).toContain('CREATE TABLE IF NOT EXISTS billing_checkout_attempts');
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS billing_config');
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS billing_price_mappings');
         expect(sql).toContain('CREATE INDEX IF NOT EXISTS idx_stripe_webhook_failures_purge_after');
+        expect(sql).toContain('CREATE INDEX IF NOT EXISTS idx_billing_checkout_attempts_user_status');
         expect(sql).toContain('CREATE INDEX IF NOT EXISTS idx_billing_price_mappings_plan');
         expect(sql).toContain('CREATE UNIQUE INDEX IF NOT EXISTS idx_billing_price_mappings_active_interval');
     });

package/dist/migrations/taskSchemaMigrations.js

@@ -122,9 +122,13 @@ export function ensureAssigneeTaskSchema(db) {
 export function ensureTaskReferenceSchema(db) {
     const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
     const hasReferenceNumberColumn = columns.some((c) => c.name === 'reference_number');
+    const hasLocalReferenceNumberColumn = columns.some((c) => c.name === 'local_reference_number');
     if (!hasReferenceNumberColumn) {
         db.exec(`ALTER TABLE tasks ADD COLUMN reference_number INTEGER`);
     }
+    if (!hasLocalReferenceNumberColumn) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN local_reference_number INTEGER`);
+    }
     db.exec(`
         CREATE TABLE IF NOT EXISTS workspace_task_reference_sequences (
             tenant_id TEXT NOT NULL DEFAULT 'default',
@@ -132,6 +136,12 @@ export function ensureTaskReferenceSchema(db) {
             next_reference_number INTEGER NOT NULL DEFAULT 0,
             PRIMARY KEY (tenant_id, workspace_id)
         );
+        CREATE TABLE IF NOT EXISTS workspace_local_task_reference_sequences (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            next_reference_number INTEGER NOT NULL DEFAULT 0,
+            PRIMARY KEY (tenant_id, workspace_id)
+        );
     `);
     const workspaceRows = db.prepare(`
         SELECT DISTINCT
@@ -141,7 +151,7 @@ export function ensureTaskReferenceSchema(db) {
         ORDER BY tenant_id ASC, workspace_id ASC
     `).all();
     const selectRows = db.prepare(`
-        SELECT id, reference_number, created_at
+        SELECT id, reference_number, local_reference_number, created_at
         FROM tasks
         WHERE tenant_id = ? AND workspace_id = ?
         ORDER BY created_at ASC, id ASC
@@ -171,11 +181,20 @@ export function ensureTaskReferenceSchema(db) {
             const currentReferenceNumber = Number.isFinite(rawReferenceNumber) && rawReferenceNumber > 0
                 ? Math.floor(rawReferenceNumber)
                 : null;
+            const rawLocalReferenceNumber = Number(row.local_reference_number);
+            const currentLocalReferenceNumber = Number.isFinite(rawLocalReferenceNumber) && rawLocalReferenceNumber > 0
+                ? Math.floor(rawLocalReferenceNumber)
+                : null;
             if (currentReferenceNumber && !seen.has(currentReferenceNumber)) {
                 seen.add(currentReferenceNumber);
                 nextReferenceNumber = Math.max(nextReferenceNumber, currentReferenceNumber);
                 continue;
             }
+            // Provisional local references are intentionally non-canonical and should
+            // not be promoted to T-### during schema repair or restart migrations.
+            if (!currentReferenceNumber && currentLocalReferenceNumber) {
+                continue;
+            }
             nextReferenceNumber += 1;
             seen.add(nextReferenceNumber);
             updateReference.run(nextReferenceNumber, tenantId, workspaceId, taskId);
@@ -185,6 +204,8 @@ export function ensureTaskReferenceSchema(db) {
     db.exec(`
         CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_workspace_reference
         ON tasks(tenant_id, workspace_id, reference_number);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_workspace_local_reference
+        ON tasks(tenant_id, workspace_id, local_reference_number);
     `);
 }
 export function ensureWorkspaceSchema(db) {
@@ -215,6 +236,23 @@ export function ensureWorkspaceSchema(db) {
             updated_at TEXT
         );
 
+        CREATE TABLE IF NOT EXISTS user_avatar_upload_drafts (
+            draft_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            user_id TEXT NOT NULL,
+            storage_key TEXT NOT NULL,
+            mime_type TEXT NOT NULL,
+            original_filename TEXT NOT NULL,
+            size_bytes INTEGER NOT NULL DEFAULT 0,
+            storage_provider TEXT NOT NULL DEFAULT 'local',
+            finalized_at TEXT,
+            consumed_at TEXT,
+            discarded_at TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+        );
+
         CREATE TABLE IF NOT EXISTS auth_tokens (
             id TEXT PRIMARY KEY,
             tenant_id TEXT NOT NULL DEFAULT 'default',
@@ -356,6 +394,20 @@ export function ensureWorkspaceSchema(db) {
     if (!hasWorkspaceIdColumn) {
         db.exec(`ALTER TABLE auth_tokens ADD COLUMN workspace_id TEXT`);
     }
+    if (db.provider === 'postgres') {
+        try {
+            db.exec(`ALTER TABLE user_avatar_upload_drafts ADD COLUMN IF NOT EXISTS consumed_at TEXT`);
+        }
+        catch {
+            // Best-effort repair for older dev databases.
+        }
+    }
+    else {
+        const avatarDraftColumns = db.prepare(`PRAGMA table_info(user_avatar_upload_drafts)`).all();
+        if (avatarDraftColumns.length > 0 && !avatarDraftColumns.some((c) => c.name === 'consumed_at')) {
+            db.exec(`ALTER TABLE user_avatar_upload_drafts ADD COLUMN consumed_at TEXT`);
+        }
+    }
     const mcpTokenColumns = db.prepare(`PRAGMA table_info(mcp_access_tokens)`).all();
     if (mcpTokenColumns.length > 0) {
         const requiredColumns = [
@@ -441,6 +493,18 @@ export function ensureBillingSchema(db) {
             created_at TEXT NOT NULL
         );
 
+        CREATE TABLE IF NOT EXISTS billing_checkout_attempts (
+            session_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            user_id TEXT NOT NULL,
+            plan_version_id TEXT NOT NULL,
+            billing_interval TEXT,
+            status TEXT NOT NULL DEFAULT 'open',
+            expires_at TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+        );
+
         CREATE TABLE IF NOT EXISTS billing_config (
             tenant_id TEXT PRIMARY KEY,
             config_json TEXT NOT NULL DEFAULT '{}',
@@ -468,6 +532,8 @@ export function ensureBillingSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_stripe_webhook_failures_tenant ON stripe_webhook_failures(tenant_id);
         CREATE INDEX IF NOT EXISTS idx_stripe_webhook_failures_event ON stripe_webhook_failures(event_id);
         CREATE INDEX IF NOT EXISTS idx_stripe_webhook_failures_purge_after ON stripe_webhook_failures(purge_after);
+        CREATE INDEX IF NOT EXISTS idx_billing_checkout_attempts_user_status ON billing_checkout_attempts(tenant_id, user_id, status, created_at);
+        CREATE INDEX IF NOT EXISTS idx_billing_checkout_attempts_plan_status ON billing_checkout_attempts(tenant_id, plan_version_id, status, created_at);
         CREATE INDEX IF NOT EXISTS idx_billing_price_mappings_plan ON billing_price_mappings(tenant_id, plan_version_id);
         CREATE INDEX IF NOT EXISTS idx_billing_price_mappings_active ON billing_price_mappings(tenant_id, active);
     `);
@@ -671,6 +737,7 @@ export function ensureEntitlementsSchema(db) {
             updated_by TEXT,
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL,
+            FOREIGN KEY (account_id) REFERENCES users(id) ON DELETE CASCADE,
             FOREIGN KEY (plan_version_id) REFERENCES plan_versions(plan_version_id)
         );
 

package/dist/qaOpen.test.d.ts

@@ -0,0 +1 @@
+export {};