@taskforcehq/taskforce 0.3.302 → 0.3.303

package/dist/server/mockStripe.d.ts

@@ -11,6 +11,7 @@ type MockStripeCheckoutSessionRecord = {
     successUrl: string;
     cancelUrl: string;
     subscriptionId: string | null;
+    expiresAt: number;
     paymentStatus: 'unpaid' | 'paid';
     status: 'open' | 'complete' | 'expired';
 };

package/dist/server/mockStripe.js

@@ -122,6 +122,7 @@ function formatMockCheckoutSession(record, expandSubscription = false) {
         metadata: { ...record.metadata },
         payment_status: record.paymentStatus,
         status: record.status,
+        expires_at: record.expiresAt,
         subscription: record.subscriptionId
             ? (expandSubscription ? formatMockSubscription(getMockStripeSubscription(record.subscriptionId)) : record.subscriptionId)
             : null
@@ -243,6 +244,7 @@ export function createMockStripeClient() {
                         successUrl: String(params.success_url || '').trim(),
                         cancelUrl: String(params.cancel_url || '').trim(),
                         subscriptionId: null,
+                        expiresAt: Math.floor(Date.now() / 1000) + (24 * 60 * 60),
                         paymentStatus: 'unpaid',
                         status: 'open'
                     };

package/dist/server/routes/admin.js

@@ -101,7 +101,7 @@ export function registerAdminRoutes(deps) {
         const authSettings = globalSettings.auth || {};
         const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
         const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const signupSettings = core.getSignupMonetizationSettings();
+        const onboardingPolicy = core.getOnboardingPolicy();
         return {
             allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
             requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
@@ -113,8 +113,8 @@ export function registerAdminRoutes(deps) {
             authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
                 ? Math.floor(authRateLimitWindowMsRaw)
                 : 15 * 60_000,
-            signupMonetizationStrategy: signupSettings.strategy,
-            defaultSignupPlanVersionId: signupSettings.defaultSignupPlanVersionId
+            onboardingPolicyMode: onboardingPolicy.mode,
+            onboardingPlanVersionId: onboardingPolicy.planVersionId
         };
     };
     const getSiteBehavior = () => {
@@ -163,6 +163,10 @@ export function registerAdminRoutes(deps) {
         }
         return String(configured || resolvePublicAuthBaseUrl(req)).replace(/\/+$/, '');
     };
+    const resolveAdminCloudEnvironment = (req) => {
+        return resolveTaskforceCloudEnvironmentFromBaseUrl(resolveRuntimeConfigBaseUrl(req))
+            || resolveTaskforceCloudEnvironmentFromBaseUrl(resolveCloudLoginBaseUrl(req));
+    };
     const resolveMcpOauthAuthorizeUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/authorize`;
     const resolveMcpOauthTokenUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/token`;
     const resolveMcpOauthRegisterUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/register`;
@@ -964,6 +968,51 @@ export function registerAdminRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
     });
+    // DELETE /api/taskforce/admin/system-users/:id - Purge a test user in non-production cloud environments
+    addRoute('DELETE', '/api/taskforce/admin/system-users/:id', async (req, res, params) => {
+        if (!requireCloudRuntime(res, 'System user purge'))
+            return;
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
+            return;
+        }
+        const environment = resolveAdminCloudEnvironment(req);
+        if (environment !== 'staging' && environment !== 'performance') {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: 'System user purge is only available in staging and performance.',
+                code: 'SYSTEM_USER_PURGE_ENVIRONMENT_FORBIDDEN'
+            }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const actor = resolveAdminRequestActor(req);
+        try {
+            const summary = core.purgeSystemUser({
+                targetUserId: params.id,
+                actorUserId: actor.userId,
+                emailConfirmation: String(body?.emailConfirmation || '')
+            });
+            auditAdminAction(req, 'purge-system-user', {
+                targetUserId: params.id,
+                targetEmail: summary.email,
+                environment,
+                summary
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, environment, summary }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: String(error?.message || 'Unable to purge system user'),
+                code: error?.code,
+                details: error?.details || null
+            }));
+        }
+    });
     // === SECTION: Admin email settings ===
     // GET /api/taskforce/admin/email-settings - Read email provider settings
     addRoute('GET', '/api/taskforce/admin/email-settings', async (req, res) => {
@@ -1036,7 +1085,9 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
             return;
         }
-        const authSettings = core.getGlobalSettings().auth || {};
+        const globalSettings = core.getGlobalSettings();
+        const authSettings = globalSettings.auth || {};
+        const billingSettings = globalSettings.billing || {};
         const effective = getAuthBehavior();
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
@@ -1047,11 +1098,13 @@ export function registerAdminRoutes(deps) {
                 ...(typeof authSettings.authRateLimitEnabled === 'boolean' ? { authRateLimitEnabled: authSettings.authRateLimitEnabled } : {}),
                 ...(typeof authSettings.authRateLimitMaxRequests === 'number' ? { authRateLimitMaxRequests: authSettings.authRateLimitMaxRequests } : {}),
                 ...(typeof authSettings.authRateLimitWindowMs === 'number' ? { authRateLimitWindowMs: authSettings.authRateLimitWindowMs } : {}),
-                ...((authSettings.signupMonetizationStrategy === 'auto_assign_default' || authSettings.signupMonetizationStrategy === 'plan_selection_required')
-                    ? { signupMonetizationStrategy: authSettings.signupMonetizationStrategy }
+                ...((billingSettings.onboardingPolicy?.mode === 'require_plan_selection'
+                    || billingSettings.onboardingPolicy?.mode === 'auto_grant_free'
+                    || billingSettings.onboardingPolicy?.mode === 'auto_start_trial')
+                    ? { onboardingPolicyMode: billingSettings.onboardingPolicy.mode }
                     : {}),
-                ...(typeof authSettings.defaultSignupPlanVersionId === 'string' || authSettings.defaultSignupPlanVersionId === null
-                    ? { defaultSignupPlanVersionId: authSettings.defaultSignupPlanVersionId ?? null }
+                ...(typeof billingSettings.onboardingPolicy?.planVersionId === 'string' || billingSettings.onboardingPolicy?.planVersionId === null
+                    ? { onboardingPlanVersionId: billingSettings.onboardingPolicy?.planVersionId ?? null }
                     : {})
             },
             status: {
@@ -1061,8 +1114,8 @@ export function registerAdminRoutes(deps) {
                 authRateLimitEnabled: effective.authRateLimitEnabled,
                 authRateLimitMaxRequests: effective.authRateLimitMaxRequests,
                 authRateLimitWindowMs: effective.authRateLimitWindowMs,
-                signupMonetizationStrategy: effective.signupMonetizationStrategy,
-                defaultSignupPlanVersionId: effective.defaultSignupPlanVersionId
+                onboardingPolicyMode: effective.onboardingPolicyMode,
+                onboardingPlanVersionId: effective.onboardingPlanVersionId
             }
         }));
     });
@@ -1688,21 +1741,21 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const body = await parseJsonBody(req);
-        const signupMonetizationStrategy = body?.signupMonetizationStrategy === 'plan_selection_required'
-            ? 'plan_selection_required'
-            : 'auto_assign_default';
-        const defaultSignupPlanVersionId = typeof body?.defaultSignupPlanVersionId === 'string'
-            ? body.defaultSignupPlanVersionId.trim() || null
-            : body?.defaultSignupPlanVersionId === null
+        const onboardingPolicyMode = body?.onboardingPolicyMode === 'auto_grant_free' || body?.onboardingPolicyMode === 'auto_start_trial'
+            ? body.onboardingPolicyMode
+            : 'require_plan_selection';
+        const onboardingPlanVersionId = typeof body?.onboardingPlanVersionId === 'string'
+            ? body.onboardingPlanVersionId.trim() || null
+            : body?.onboardingPlanVersionId === null
                 ? null
                 : undefined;
-        const validation = core.validateSignupMonetizationSettings({
-            strategy: signupMonetizationStrategy,
-            ...(defaultSignupPlanVersionId !== undefined ? { defaultSignupPlanVersionId } : {})
+        const validation = core.validateOnboardingPolicy({
+            mode: onboardingPolicyMode,
+            ...(onboardingPlanVersionId !== undefined ? { planVersionId: onboardingPlanVersionId } : {})
         });
         if (!validation.valid) {
             res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: validation.message || 'Invalid signup monetization settings.', code: validation.code, details: validation.details }));
+            res.end(JSON.stringify({ error: validation.message || 'Invalid onboarding policy.', code: validation.code, details: validation.details }));
             return;
         }
         core.updateGlobalSettings({
@@ -1714,9 +1767,13 @@ export function registerAdminRoutes(deps) {
                 ...(typeof body?.authRateLimitMaxRequests === 'number' && Number.isFinite(body.authRateLimitMaxRequests)
                     ? { authRateLimitMaxRequests: Math.max(1, Math.floor(body.authRateLimitMaxRequests)) } : {}),
                 ...(typeof body?.authRateLimitWindowMs === 'number' && Number.isFinite(body.authRateLimitWindowMs)
-                    ? { authRateLimitWindowMs: Math.max(1000, Math.floor(body.authRateLimitWindowMs)) } : {}),
-                signupMonetizationStrategy,
-                ...(defaultSignupPlanVersionId !== undefined ? { defaultSignupPlanVersionId } : {})
+                    ? { authRateLimitWindowMs: Math.max(1000, Math.floor(body.authRateLimitWindowMs)) } : {})
+            },
+            billing: {
+                onboardingPolicy: {
+                    mode: onboardingPolicyMode,
+                    planVersionId: onboardingPlanVersionId ?? null
+                }
             }
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });

package/dist/server/routes/auth.d.ts

@@ -20,6 +20,7 @@
  *   POST /api/taskforce/auth/invite/join
  *   POST /api/taskforce/auth/logout
  *   GET  /api/taskforce/account/access-status
+ *   GET  /api/taskforce/account/profile-summary
  *   GET  /api/taskforce/account/entitlements
  *   GET  /api/taskforce/account/team-management-access
  *   GET  /api/taskforce/account/plan-preview

package/dist/server/routes/auth.js

@@ -20,6 +20,7 @@
  *   POST /api/taskforce/auth/invite/join
  *   POST /api/taskforce/auth/logout
  *   GET  /api/taskforce/account/access-status
+ *   GET  /api/taskforce/account/profile-summary
  *   GET  /api/taskforce/account/entitlements
  *   GET  /api/taskforce/account/team-management-access
  *   GET  /api/taskforce/account/plan-preview
@@ -73,6 +74,121 @@ export function registerAuthRoutes(deps) {
         const stateAllows = state === 'active' || state === 'trialing' || state === 'grace';
         return teamAllowed && stateAllows ? 'team' : 'personal';
     };
+    const resolveBillingConflictCodeForUser = (userIdRaw, gateRaw) => {
+        const userId = String(userIdRaw || '').trim();
+        const gate = String(gateRaw || '').trim().toLowerCase();
+        if (!userId || !gate || gate === 'ok')
+            return null;
+        const db = core.getDatabaseAdapter();
+        const tenantId = core.getTenantId();
+        try {
+            const row = db.prepare(`
+                SELECT session_id, status, expires_at
+                FROM billing_checkout_attempts
+                WHERE tenant_id = ? AND user_id = ?
+                ORDER BY created_at DESC, session_id DESC
+                LIMIT 1
+            `).get(tenantId, userId);
+            const sessionId = String(row?.session_id || '').trim();
+            const status = String(row?.status || '').trim().toLowerCase();
+            const expiresAt = String(row?.expires_at || '').trim();
+            if (!sessionId)
+                return null;
+            if (status === 'open' && expiresAt) {
+                const expiresAtMs = Date.parse(expiresAt);
+                if (Number.isFinite(expiresAtMs) && expiresAtMs <= Date.now()) {
+                    db.prepare(`
+                        UPDATE billing_checkout_attempts
+                        SET status = 'expired', updated_at = ?
+                        WHERE tenant_id = ? AND session_id = ?
+                    `).run(new Date().toISOString(), tenantId, sessionId);
+                    return 'CHECKOUT_SESSION_EXPIRED';
+                }
+            }
+            if (status === 'expired')
+                return 'CHECKOUT_SESSION_EXPIRED';
+            if (status === 'superseded')
+                return 'CHECKOUT_SESSION_SUPERSEDED';
+        }
+        catch {
+            return null;
+        }
+        return null;
+    };
+    const buildAccountProfileSummary = (req) => {
+        const userId = requestUserId(req);
+        const workspaceId = requestWorkspaceId(req);
+        const access = core.getAccountAccessStatus(userId);
+        const resolvedAccess = core.resolveUserAccess(userId, workspaceId, 'member');
+        const hintedRole = normalizeTeamWorkspaceRole(requestHeader(req, 'x-taskforce-workspace-role', ''));
+        const workspaceRole = normalizeTeamWorkspaceRole(resolvedAccess?.role || hintedRole || null);
+        const canManageWorkspace = workspaceRole === 'owner' || workspaceRole === 'admin';
+        const db = core.getDatabaseAdapter();
+        const tenantId = core.getTenantId();
+        let billingRow;
+        try {
+            billingRow = db.prepare(`
+                SELECT stripe_status, stripe_customer_id, stripe_subscription_id, stripe_price_id, billing_interval,
+                       trial_end, current_period_end, effective_until, entitlement_state, tier
+                FROM user_billing
+                WHERE tenant_id = ? AND user_id = ?
+                LIMIT 1
+            `).get(tenantId, userId);
+        }
+        catch {
+            billingRow = undefined;
+        }
+        const planId = String(access.entitlement?.planId || billingRow?.tier || '').trim() || null;
+        const planVersionId = String(access.entitlement?.planVersionId || '').trim() || null;
+        let planRow;
+        if (planId) {
+            try {
+                planRow = db.prepare(`
+                    SELECT display_name
+                    FROM plan_catalog
+                    WHERE tenant_id = ? AND plan_id = ?
+                    LIMIT 1
+                `).get(tenantId, planId);
+            }
+            catch {
+                planRow = undefined;
+            }
+        }
+        let teamPlanMode = 'unknown';
+        try {
+            const entitlements = core.getAccountEntitlementsPayload({ userId, workspaceId });
+            teamPlanMode = resolveTeamPlanModeFromEntitlements(entitlements);
+        }
+        catch (error) {
+            if (error?.code === 'ENTITLEMENT_NOT_FOUND' && (access.gate === 'plan_selection_required' || access.gate === 'checkout_pending')) {
+                teamPlanMode = 'personal';
+            }
+        }
+        const billingConflictCode = resolveBillingConflictCodeForUser(userId, access.gate);
+        return {
+            stripeStatus: billingRow?.stripe_status || null,
+            stripeCustomerId: billingRow?.stripe_customer_id || null,
+            stripeSubscriptionId: billingRow?.stripe_subscription_id || null,
+            stripePriceId: billingRow?.stripe_price_id || null,
+            billingInterval: billingRow?.billing_interval || null,
+            trialEnd: billingRow?.trial_end || null,
+            currentPeriodEnd: billingRow?.current_period_end || null,
+            effectiveUntil: billingRow?.effective_until || null,
+            entitlementState: access.entitlement?.state || billingRow?.entitlement_state || null,
+            planVersionId,
+            planId,
+            planName: planRow?.display_name ? String(planRow.display_name) : planId,
+            gate: access.gate,
+            message: access.message,
+            billingConflictCode,
+            planSelectionRequired: access.planSelectionRequired,
+            workspaceId,
+            workspaceRole,
+            canManageWorkspace,
+            teamPlanMode,
+            teamManagementAllowed: canManageWorkspace && teamPlanMode === 'team'
+        };
+    };
     // === SECTION: Email delivery helpers ===
     const getEmailConfig = () => {
         if (context.authConfig?.runtimeMode !== 'cloud') {
@@ -86,7 +202,7 @@ export function registerAuthRoutes(deps) {
         const authSettings = globalSettings.auth || {};
         const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
         const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const signupSettings = core.getSignupMonetizationSettings();
+        const onboardingPolicy = core.getOnboardingPolicy();
         return {
             allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
             requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
@@ -98,8 +214,8 @@ export function registerAuthRoutes(deps) {
             authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
                 ? Math.floor(authRateLimitWindowMsRaw)
                 : 15 * 60_000,
-            signupMonetizationStrategy: signupSettings.strategy,
-            defaultSignupPlanVersionId: signupSettings.defaultSignupPlanVersionId
+            onboardingPolicyMode: onboardingPolicy.mode,
+            onboardingPlanVersionId: onboardingPolicy.planVersionId
         };
     };
     const getSiteBehavior = () => {
@@ -110,6 +226,23 @@ export function registerAuthRoutes(deps) {
             pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
         };
     };
+    const buildPasswordSessionCookieForUser = (req, authConfig, userIdRaw, options) => {
+        const userId = String(userIdRaw || '').trim();
+        const fallbackRole = String(options?.fallbackRole || authConfig.defaultRole || 'member').trim() || 'member';
+        const resolvedWorkspaceId = core.resolvePreferredUserWorkspaceId(userId, {
+            preferredWorkspaceId: options?.preferredWorkspaceId || null,
+            persistedWorkspaceId: options?.persistedWorkspaceId || null
+        });
+        const access = resolvedWorkspaceId
+            ? core.resolveUserAccess(userId, resolvedWorkspaceId, fallbackRole)
+            : null;
+        return createSessionTokenCookie(`pwd:${userId}`, authConfig, {
+            role: (access?.role || fallbackRole),
+            workspaceId: access?.workspaceId || '',
+            userId,
+            ...resolveSessionCookieAttributesForRequest(req, authConfig)
+        });
+    };
     const AVATAR_DRAFT_RETENTION_MS = 24 * 60 * 60 * 1000;
     const MAX_AVATAR_UPLOAD_BYTES = 5 * 1024 * 1024;
     const AVATAR_MIME_EXTENSION = {
@@ -643,7 +776,7 @@ export function registerAuthRoutes(deps) {
         res.writeHead(400, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: false, error: 'Email and password are required.' }));
     });
-    // POST /api/taskforce/auth/register - Create account and exchange for secure session cookie
+    // POST /api/taskforce/auth/register - Create account and optionally start a session
     addRoute('POST', '/api/taskforce/auth/register', async (req, res) => {
         if (!requireCloudRuntime(res, 'Authentication'))
             return;
@@ -693,13 +826,6 @@ export function registerAuthRoutes(deps) {
                 role,
                 betaAccess: authBehavior.defaultNewUserBetaAccess
             });
-            const sessionWorkspaceId = created.workspaceId || '';
-            const cookie = createSessionTokenCookie(`pwd:${created.userId}`, authConfig, {
-                role: created.role,
-                workspaceId: sessionWorkspaceId,
-                userId: created.userId,
-                ...resolveSessionCookieAttributesForRequest(req, authConfig)
-            });
             let emailSent = true;
             let emailError;
             let verificationToken;
@@ -719,7 +845,13 @@ export function registerAuthRoutes(deps) {
                 role: created.role,
                 emailSent
             });
-            res.setHeader('Set-Cookie', cookie);
+            if (!authBehavior.requireVerifiedEmail) {
+                res.setHeader('Set-Cookie', buildPasswordSessionCookieForUser(req, authConfig, created.userId, {
+                    preferredWorkspaceId: created.workspaceId || null,
+                    persistedWorkspaceId: created.workspaceId || null,
+                    fallbackRole: created.role
+                }));
+            }
             res.writeHead(201, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
                 success: true,
@@ -727,6 +859,8 @@ export function registerAuthRoutes(deps) {
                 role: created.role,
                 workspaceSetupRequired: !created.workspaceId,
                 planSelectionRequired: created.planSelectionRequired === true,
+                checkoutPending: created.checkoutPending === true,
+                commercialState: created.commercialState,
                 verificationRequired: authBehavior.requireVerifiedEmail,
                 emailSent,
                 emailError,
@@ -794,6 +928,12 @@ export function registerAuthRoutes(deps) {
     addRoute('POST', '/api/taskforce/auth/verify-email/confirm', async (req, res) => {
         if (!requireCloudRuntime(res, 'Authentication'))
             return;
+        const authConfig = context.authConfig;
+        if (!authConfig?.enabled) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication is not configured.' }));
+            return;
+        }
         const body = await parseJsonBody(req);
         const token = String(body?.token || '').trim();
         if (!token) {
@@ -801,6 +941,15 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: 'Token is required.' }));
             return;
         }
+        const inspection = core.inspectOneTimeAuthToken(token, 'email_verification');
+        if (!inspection.userId) {
+            auditAuthAction(req, 'auth-verify-confirm-failed', {
+                tokenProvided: true
+            });
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Invalid or expired token.' }));
+            return;
+        }
         const verified = core.verifyEmailWithToken(token);
         if (!verified) {
             auditAuthAction(req, 'auth-verify-confirm-failed', {
@@ -813,6 +962,11 @@ export function registerAuthRoutes(deps) {
         auditAuthAction(req, 'auth-verify-confirm-success', {
             tokenProvided: true
         });
+        const cookie = buildPasswordSessionCookieForUser(req, authConfig, inspection.userId, {
+            preferredWorkspaceId: inspection.workspaceId || null,
+            persistedWorkspaceId: inspection.workspaceId || null
+        });
+        res.setHeader('Set-Cookie', cookie);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
     });
@@ -1098,6 +1252,24 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve account access status'), code: error?.code, details: error?.details }));
         }
     });
+    // GET /api/taskforce/account/profile-summary - Fast authoritative summary for the visible account surface.
+    addRoute('GET', '/api/taskforce/account/profile-summary', async (req, res) => {
+        if (!ensureAuthenticatedUser(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Authentication required.' }));
+            return;
+        }
+        try {
+            const payload = buildAccountProfileSummary(req);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(payload));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve account profile summary'), code: error?.code, details: error?.details }));
+        }
+    });
     // GET /api/taskforce/account/entitlements - Resolve effective plan/features for the active workspace.
     addRoute('GET', '/api/taskforce/account/entitlements', async (req, res) => {
         if (!ensureAuthenticatedUser(req)) {
@@ -1115,11 +1287,11 @@ export function registerAuthRoutes(deps) {
         catch (error) {
             if (error?.code === 'ENTITLEMENT_NOT_FOUND') {
                 const access = core.getAccountAccessStatus(requestUserId(req));
-                if (access.gate === 'plan_selection_required') {
+                if (access.gate === 'plan_selection_required' || access.gate === 'checkout_pending') {
                     res.writeHead(403, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({
                         error: access.message,
-                        code: 'PLAN_SELECTION_REQUIRED',
+                        code: access.gate === 'checkout_pending' ? 'CHECKOUT_PENDING' : 'PLAN_SELECTION_REQUIRED',
                         details: {
                             gate: access.gate,
                             planSelectionRequired: access.planSelectionRequired,
@@ -1141,51 +1313,20 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ error: 'Authentication required.' }));
             return;
         }
-        const wid = requestWorkspaceId(req);
-        const userId = requestUserId(req);
-        const hintedRole = normalizeTeamWorkspaceRole(requestHeader(req, 'x-taskforce-workspace-role', ''));
-        const resolvedAccess = core.resolveUserAccess(userId, wid, 'member');
-        const role = normalizeTeamWorkspaceRole(resolvedAccess?.role || hintedRole || null);
-        const canManageWorkspace = role === 'owner' || role === 'admin';
-        if (!canManageWorkspace) {
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                workspaceId: wid,
-                role,
-                canManageWorkspace: false,
-                teamPlanMode: 'unknown',
-                allowed: false
-            }));
-            return;
-        }
         try {
-            const entitlements = core.getAccountEntitlementsPayload({ userId, workspaceId: wid });
-            const teamPlanMode = resolveTeamPlanModeFromEntitlements(entitlements);
+            const payload = buildAccountProfileSummary(req);
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
-                workspaceId: wid,
-                role,
-                canManageWorkspace: true,
-                teamPlanMode,
-                allowed: teamPlanMode === 'team'
+                workspaceId: payload.workspaceId,
+                role: payload.workspaceRole,
+                canManageWorkspace: payload.canManageWorkspace,
+                teamPlanMode: payload.teamPlanMode,
+                allowed: payload.teamManagementAllowed,
+                gate: payload.gate,
+                planSelectionRequired: payload.planSelectionRequired
             }));
         }
         catch (error) {
-            if (error?.code === 'ENTITLEMENT_NOT_FOUND') {
-                const access = core.getAccountAccessStatus(userId);
-                const teamPlanMode = access.gate === 'plan_selection_required' ? 'personal' : 'unknown';
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({
-                    workspaceId: wid,
-                    role,
-                    canManageWorkspace: true,
-                    teamPlanMode,
-                    allowed: false,
-                    gate: access.gate,
-                    planSelectionRequired: access.planSelectionRequired
-                }));
-                return;
-            }
             const statusCode = resolveErrorStatusCode(error, 400);
             res.writeHead(statusCode, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: String(error?.message || 'Unable to resolve team management access'), code: error?.code, details: error?.details }));