@taskforcehq/taskforce 0.3.302 → 0.3.303

package/dist/server/routes.test.js

@@ -236,6 +236,7 @@ vi.mock('../core/Taskforce', () => {
             setSystemRole = vi.fn().mockReturnValue(true);
             setUserDisabledGlobal = vi.fn().mockReturnValue(true);
             setUserBetaAccessGlobal = vi.fn().mockReturnValue(true);
+            purgeSystemUser = vi.fn();
             updateWorkspaceUserRole = vi.fn();
             inviteWorkspaceUser = vi.fn();
             updateWorkspaceProfile = vi.fn().mockImplementation((workspaceId, input) => ({
@@ -262,17 +263,16 @@ vi.mock('../core/Taskforce', () => {
             revokeInviteAcceptanceForUser = vi.fn().mockReturnValue({ revoked: 1 });
             getWorkspacePlanMode = vi.fn().mockReturnValue('team');
             setWorkspacePlanMode = vi.fn().mockImplementation((_workspaceId, mode) => mode);
-            getSignupMonetizationSettings = vi.fn().mockReturnValue({
-                strategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: null
+            getOnboardingPolicy = vi.fn().mockReturnValue({
+                mode: 'require_plan_selection',
+                planVersionId: null
             });
-            validateSignupMonetizationSettings = vi.fn().mockReturnValue({ valid: true });
+            validateOnboardingPolicy = vi.fn().mockReturnValue({ valid: true });
             getAccountAccessStatus = vi.fn().mockReturnValue({
                 gate: 'ok',
                 hasEntitlement: true,
                 canAccessApp: true,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'auto_assign_default',
                 planSelectionRequired: false,
                 message: null,
                 entitlement: {
@@ -3673,7 +3673,7 @@ describe('Server Routes', () => {
                     process.env.VITE_TASKFORCE_API_BASE_URL = previousApiBaseUrl;
             }
         });
-        it('POST /api/taskforce/auth/register should create account and set session cookie', async () => {
+        it('POST /api/taskforce/auth/register should create account without a session cookie when verification is required', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3706,6 +3706,7 @@ describe('Server Routes', () => {
                 email: 'owner@example.com',
                 role: 'owner'
             }));
+            expect(res.setHeader).not.toHaveBeenCalledWith('Set-Cookie', expect.any(String));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"verificationRequired":true'));
         });
@@ -3741,7 +3742,7 @@ describe('Server Routes', () => {
                 workspaceId: undefined,
                 role: 'member'
             }));
-            expect(res.setHeader).toHaveBeenCalledWith('Set-Cookie', expect.stringContaining('taskforce_session='));
+            expect(res.setHeader).not.toHaveBeenCalledWith('Set-Cookie', expect.any(String));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"workspaceSetupRequired":true'));
         });
@@ -3780,6 +3781,7 @@ describe('Server Routes', () => {
             const res = createMockRes();
             await match?.handler(req, res, {});
             expect(core.requestEmailVerification).not.toHaveBeenCalled();
+            expect(res.setHeader).toHaveBeenCalledWith('Set-Cookie', expect.stringContaining('taskforce_session='));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"verificationRequired":false'));
         });
@@ -3854,7 +3856,7 @@ describe('Server Routes', () => {
                 code: 'EMAIL_ALREADY_EXISTS'
             }));
         });
-        it('POST /api/taskforce/auth/register should fail when signup monetization is misconfigured', async () => {
+        it('POST /api/taskforce/auth/register should fail when the onboarding policy is misconfigured', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3867,7 +3869,7 @@ describe('Server Routes', () => {
                 sessionTtlSeconds: 3600
             };
             routes = createRoutes(core, { authConfig });
-            const error = new Error('Configured default signup plan version "missing-v9" was not found.');
+            const error = new Error('Configured onboarding plan version "missing-v9" was not found.');
             error.statusCode = 500;
             error.code = 'SIGNUP_PLAN_VERSION_NOT_FOUND';
             core.registerPasswordUser.mockImplementationOnce(() => {
@@ -3883,7 +3885,7 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(500, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
                 success: false,
-                error: 'Configured default signup plan version "missing-v9" was not found.',
+                error: 'Configured onboarding plan version "missing-v9" was not found.',
                 code: 'SIGNUP_PLAN_VERSION_NOT_FOUND'
             }));
         });
@@ -3900,12 +3902,19 @@ describe('Server Routes', () => {
                 sessionTtlSeconds: 3600
             };
             routes = createRoutes(core, { authConfig });
+            core.inspectOneTimeAuthToken = vi.fn().mockReturnValueOnce({
+                state: 'valid',
+                userId: 'u-verify',
+                workspaceId: 'workspace-1'
+            });
             core.verifyEmailWithToken.mockReturnValueOnce(true);
             const match = matchRoute('POST', '/api/taskforce/auth/verify-email/confirm', routes);
             const req = createMockReq('POST', '/api/taskforce/auth/verify-email/confirm', { token: 'tok1' });
             const res = createMockRes();
             await match?.handler(req, res, {});
+            expect(core.inspectOneTimeAuthToken).toHaveBeenCalledWith('tok1', 'email_verification');
             expect(core.verifyEmailWithToken).toHaveBeenCalledWith('tok1');
+            expect(res.setHeader).toHaveBeenCalledWith('Set-Cookie', expect.stringContaining('taskforce_session='));
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/auth/password-reset/confirm should set new password', async () => {
@@ -4779,10 +4788,10 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
-                archived: [{ id: 'task-2', title: 'Task 2', isArchived: true }]
-            }, 'workspace-1');
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
+                archived: [expect.objectContaining({ id: 'task-2', title: 'Task 2', isArchived: true })]
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"success":true'));
             expect(core.addAdminAuditLog).toHaveBeenCalledWith(expect.objectContaining({
@@ -6427,10 +6436,10 @@ describe('Server Routes', () => {
             const res = createMockRes();
             await match?.handler(req, res, {});
             expect(core.deleteTaskForSync).toHaveBeenCalledWith('task-2', 'workspace-local', { persistBackup: false });
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
                 archived: []
-            }, 'workspace-local');
+            }), 'workspace-local');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/apply-local should apply document review session upserts and deletes', async () => {
@@ -6868,10 +6877,10 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-shared-1', title: 'Shared task' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-shared-1', title: 'Shared task' })],
                 archived: []
-            }, 'workspace-shared-local');
+            }), 'workspace-shared-local');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/apply-local should route archived upserts and preserve canceledReason', async () => {
@@ -6898,17 +6907,17 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
                 tasks: [],
-                archived: [{
+                archived: [expect.objectContaining({
                         id: 'task-archived-cancelled',
                         title: 'Cancelled + Archived',
                         status: 'cancelled',
                         canceledReason: 'Scope changed',
                         workstreamId: 'workstream-archived-1',
                         isArchived: true
-                    }]
-            }, 'workspace-local');
+                    })]
+            }), 'workspace-local');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/apply-local should prioritize delete over same-task upsert', async () => {
@@ -7575,10 +7584,10 @@ describe('Server Routes', () => {
             }, { cookie });
             const res1 = createMockRes();
             await match?.handler(req1, res1, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
                 archived: []
-            }, 'workspace-1');
+            }), 'workspace-1');
             expect(res1.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             const firstPayload = JSON.parse(String(res1.end.mock.calls.at(-1)?.[0] || '{}'));
             expect(Array.isArray(firstPayload.emittedEventIds)).toBe(true);
@@ -7780,10 +7789,10 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
                 archived: []
-            }, 'workspace-local-active');
+            }), 'workspace-local-active');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(core.listUserWorkspaces).toHaveBeenCalledWith('user-1');
         });
@@ -8060,15 +8069,15 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({
                         id: 'task-cancelled-1',
                         title: 'Cancelled Task',
                         status: 'cancelled',
                         canceledReason: 'No longer needed'
-                    }],
+                    })],
                 archived: []
-            }, 'workspace-1');
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/push should preserve workstreamId in upsert payload', async () => {
@@ -8109,15 +8118,15 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({
                         id: 'task-workstream-1',
                         title: 'Linked task',
                         status: 'task',
                         workstreamId: 'workstream-1'
-                    }],
+                    })],
                 archived: []
-            }, 'workspace-1');
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/push should route archived upserts into archived snapshot list', async () => {
@@ -8158,15 +8167,15 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
                 tasks: [],
-                archived: [{
+                archived: [expect.objectContaining({
                         id: 'task-archived-1',
                         title: 'Archived Task',
                         workstreamId: 'workstream-archived-1',
                         isArchived: true
-                    }]
-            }, 'workspace-1');
+                    })]
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('GET /api/taskforce/sync/workspace/pull should include canceledReason and archived marker in response payload', async () => {
@@ -8292,7 +8301,7 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             const response = JSON.parse(String(res.end.mock.calls[0]?.[0] || '{}'));
             const changes = Array.isArray(response?.changes) ? response.changes : [];
-            expect(changes).toContainEqual({
+            expect(changes).toContainEqual(expect.objectContaining({
                 op: 'taxonomy-upsert',
                 taxonomyState: {
                     categories: [{ value: 'default', label: 'General' }],
@@ -8328,8 +8337,9 @@ describe('Server Routes', () => {
                         filterEnabled: true,
                         sortEnabled: true
                     }],
+                updatedAt: '2026-02-22T10:00:00.000Z',
                 watermark: '2026-02-22T10:00:00.000Z'
-            });
+            }));
         });
         it('POST /api/taskforce/workspaces should create workspace for authenticated user', async () => {
             const authConfig = {
@@ -9014,13 +9024,68 @@ describe('Server Routes', () => {
                 allowed: true
             });
         });
+        it('GET /api/taskforce/account/team-management-access should still resolve access when billing tables are unavailable', async () => {
+            core.resolveUserAccess.mockReturnValueOnce({
+                userId: 'u1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                disabled: false,
+                betaAccess: true
+            });
+            core.getAccountAccessStatus.mockReturnValueOnce({
+                gate: 'ok',
+                hasEntitlement: true,
+                canAccessApp: true,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: null,
+                entitlement: {
+                    state: 'active',
+                    planId: 'collab',
+                    planVersionId: 'collab-v1'
+                }
+            });
+            core.getAccountEntitlementsPayload.mockReturnValueOnce({
+                state: 'active',
+                planId: 'collab',
+                features: {
+                    'collaboration.team_management': { allowed: true }
+                }
+            });
+            const baseDb = core.getDatabaseAdapter();
+            core.getDatabaseAdapter = vi.fn().mockReturnValue({
+                ...baseDb,
+                prepare: vi.fn((sql) => {
+                    if (sql.includes('FROM user_billing') || sql.includes('FROM plan_catalog')) {
+                        throw new Error('no such table');
+                    }
+                    return baseDb.prepare(sql);
+                })
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/team-management-access', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/team-management-access?workspaceId=workspace-1', undefined, {
+                'x-taskforce-user-id': 'u1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'team',
+                allowed: true,
+                gate: 'ok',
+                planSelectionRequired: false
+            });
+        });
         it('GET /api/taskforce/account/access-status should return pending plan-selection gate', async () => {
             core.getAccountAccessStatus.mockReturnValueOnce({
                 gate: 'plan_selection_required',
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'plan_selection_required',
                 planSelectionRequired: true,
                 message: 'Choose a plan to continue.',
                 entitlement: null
@@ -9046,7 +9111,6 @@ describe('Server Routes', () => {
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'plan_selection_required',
                 planSelectionRequired: true,
                 message: 'Choose a plan to continue.',
                 entitlement: null
@@ -9061,6 +9125,87 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"code":"PLAN_SELECTION_REQUIRED"'));
         });
+        it('GET /api/taskforce/account/profile-summary should return checkout-pending recovery context', async () => {
+            core.resolveUserAccess.mockReturnValueOnce({
+                userId: 'u1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                disabled: false,
+                betaAccess: true
+            });
+            core.getAccountAccessStatus.mockReturnValueOnce({
+                gate: 'checkout_pending',
+                hasEntitlement: true,
+                canAccessApp: false,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: 'Complete checkout to continue.',
+                entitlement: {
+                    accountId: 'u1',
+                    planId: 'pro',
+                    planVersionId: 'pro-v1',
+                    state: 'checkout_pending'
+                }
+            });
+            core.getAccountEntitlementsPayload.mockImplementationOnce(() => {
+                const error = new Error('Entitlement not found');
+                error.code = 'ENTITLEMENT_NOT_FOUND';
+                throw error;
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/profile-summary', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/profile-summary?workspaceId=workspace-1', undefined, {
+                'x-taskforce-user-id': 'u1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                planId: 'pro',
+                planVersionId: 'pro-v1',
+                entitlementState: 'checkout_pending',
+                gate: 'checkout_pending',
+                message: 'Complete checkout to continue.',
+                billingConflictCode: null,
+                planSelectionRequired: false,
+                workspaceId: 'workspace-1',
+                workspaceRole: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'personal',
+                teamManagementAllowed: false
+            });
+        });
+        it('GET /api/taskforce/account/entitlements should surface checkout-pending gate when billing is not complete', async () => {
+            core.getAccountEntitlementsPayload.mockImplementationOnce(() => {
+                const error = new Error('Entitlement not found');
+                error.code = 'ENTITLEMENT_NOT_FOUND';
+                throw error;
+            });
+            core.getAccountAccessStatus.mockReturnValueOnce({
+                gate: 'checkout_pending',
+                hasEntitlement: true,
+                canAccessApp: false,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: 'Complete checkout to continue.',
+                entitlement: {
+                    accountId: 'u1',
+                    planId: 'pro',
+                    planVersionId: 'pro-v1',
+                    state: 'checkout_pending'
+                }
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/entitlements', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/entitlements', undefined, {
+                'x-taskforce-user-id': 'u1',
+                'x-taskforce-workspace-id': 'workspace-1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"code":"CHECKOUT_PENDING"'));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"gate":"checkout_pending"'));
+        });
         it('GET /api/taskforce/config should block authenticated users who must select a plan first', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -9084,7 +9229,6 @@ describe('Server Routes', () => {
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'plan_selection_required',
                 planSelectionRequired: true,
                 message: 'Choose a plan to continue.',
                 entitlement: null
@@ -9123,7 +9267,6 @@ describe('Server Routes', () => {
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'auto_assign_default',
                 planSelectionRequired: false,
                 message: 'No entitlement is linked to this account.',
                 entitlement: null
@@ -9716,6 +9859,64 @@ describe('Server Routes', () => {
             }));
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
+        it('DELETE /api/taskforce/admin/system-users/:id should purge a user in allowed cloud environments', async () => {
+            const authConfig = { runtimeMode: 'cloud', enabled: false };
+            routes = createRoutes(core, { authConfig });
+            core.purgeSystemUser.mockReturnValue({
+                targetUserId: 'u1',
+                email: 'u1@example.com',
+                unassignedTaskCount: 2,
+                clearedInitiativeOwnerCount: 0,
+                clearedWorkstreamOwnerCount: 0,
+                deletedWorkspaceMembershipCount: 1,
+                deletedAuthTokenCount: 1,
+                deletedAvatarDraftCount: 0,
+                deletedMcpAccessTokenCount: 1,
+                deletedMcpOauthAuthCodeCount: 0,
+                deletedMcpOauthConnectorGrantCount: 0,
+                deletedUiStateCount: 1,
+                deletedUserPreferenceCount: 1,
+                deletedEntitlementCount: 1,
+                deletedUserBillingCount: 1,
+                deletedUserCount: 1
+            });
+            const match = matchRoute('DELETE', '/api/taskforce/admin/system-users/u1', routes);
+            const req = createMockReq('DELETE', '/api/taskforce/admin/system-users/u1', { emailConfirmation: 'u1@example.com' }, {
+                'x-taskforce-system-role': 'system_admin',
+                'x-taskforce-user-id': 'admin-user',
+                host: 'performance-app.taskforcehq.ai',
+                'x-forwarded-proto': 'https'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: 'u1' });
+            expect(core.purgeSystemUser).toHaveBeenCalledWith({
+                targetUserId: 'u1',
+                actorUserId: 'admin-user',
+                emailConfirmation: 'u1@example.com'
+            });
+            expect(core.addAdminAuditLog).toHaveBeenCalledWith(expect.objectContaining({
+                action: 'purge-system-user',
+                actorRole: 'system_admin',
+                workspaceId: 'system'
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+        });
+        it('DELETE /api/taskforce/admin/system-users/:id should reject production environment purges', async () => {
+            const authConfig = { runtimeMode: 'cloud', enabled: false };
+            routes = createRoutes(core, { authConfig });
+            const match = matchRoute('DELETE', '/api/taskforce/admin/system-users/u1', routes);
+            const req = createMockReq('DELETE', '/api/taskforce/admin/system-users/u1', { emailConfirmation: 'u1@example.com' }, {
+                'x-taskforce-system-role': 'system_admin',
+                'x-taskforce-user-id': 'admin-user',
+                host: 'app.taskforcehq.ai',
+                'x-forwarded-proto': 'https'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: 'u1' });
+            expect(core.purgeSystemUser).not.toHaveBeenCalled();
+            expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"code":"SYSTEM_USER_PURGE_ENVIRONMENT_FORBIDDEN"'));
+        });
         it('removed workspace-based plan route should not match', () => {
             expect(matchRoute('PATCH', '/api/taskforce/admin/workspace/plan', routes)).toBeNull();
             expect(matchRoute('GET', '/api/taskforce/workspace/assignee-options', routes)).not.toBeNull();
@@ -10033,7 +10234,7 @@ describe('Server Routes', () => {
             await match?.handler(req, res, {});
             expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
         });
-        it('GET /api/taskforce/admin/system-settings should include signup monetization fields', async () => {
+        it('GET /api/taskforce/admin/system-settings should include onboarding policy fields', async () => {
             core.getGlobalSettings.mockReturnValue({
                 auth: {
                     allowSelfRegistration: true,
@@ -10041,26 +10242,30 @@ describe('Server Routes', () => {
                     defaultNewUserBetaAccess: false,
                     authRateLimitEnabled: true,
                     authRateLimitMaxRequests: 10,
-                    authRateLimitWindowMs: 900000,
-                    signupMonetizationStrategy: 'auto_assign_default',
-                    defaultSignupPlanVersionId: 'starter-v1'
+                    authRateLimitWindowMs: 900000
+                },
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'auto_grant_free',
+                        planVersionId: 'starter-v1'
+                    }
                 }
             });
-            core.getSignupMonetizationSettings.mockReturnValue({
-                strategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: 'starter-v1'
+            core.getOnboardingPolicy.mockReturnValue({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
             });
             const match = matchRoute('GET', '/api/taskforce/admin/system-settings', routes);
             const req = createMockReq('GET', '/api/taskforce/admin/system-settings', undefined, { 'x-taskforce-role': 'admin' });
             const res = createMockRes();
             await match?.handler(req, res, {});
             const payload = JSON.parse(res.end.mock.calls[0][0]);
-            expect(payload.status.signupMonetizationStrategy).toBe('auto_assign_default');
-            expect(payload.status.defaultSignupPlanVersionId).toBe('starter-v1');
-            expect(payload.settings.signupMonetizationStrategy).toBe('auto_assign_default');
-            expect(payload.settings.defaultSignupPlanVersionId).toBe('starter-v1');
+            expect(payload.status.onboardingPolicyMode).toBe('auto_grant_free');
+            expect(payload.status.onboardingPlanVersionId).toBe('starter-v1');
+            expect(payload.settings.onboardingPolicyMode).toBe('auto_grant_free');
+            expect(payload.settings.onboardingPlanVersionId).toBe('starter-v1');
         });
-        it('POST /api/taskforce/admin/system-settings should persist signup monetization fields', async () => {
+        it('POST /api/taskforce/admin/system-settings should persist onboarding policy fields', async () => {
             const match = matchRoute('POST', '/api/taskforce/admin/system-settings', routes);
             const req = createMockReq('POST', '/api/taskforce/admin/system-settings', {
                 allowSelfRegistration: true,
@@ -10069,14 +10274,14 @@ describe('Server Routes', () => {
                 authRateLimitEnabled: true,
                 authRateLimitMaxRequests: 10,
                 authRateLimitWindowMs: 900000,
-                signupMonetizationStrategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: 'starter-v1'
+                onboardingPolicyMode: 'auto_grant_free',
+                onboardingPlanVersionId: 'starter-v1'
             }, { 'x-taskforce-role': 'admin' });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.validateSignupMonetizationSettings).toHaveBeenCalledWith({
-                strategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: 'starter-v1'
+            expect(core.validateOnboardingPolicy).toHaveBeenCalledWith({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
             });
             expect(core.updateGlobalSettings).toHaveBeenCalledWith({
                 auth: {
@@ -10085,9 +10290,13 @@ describe('Server Routes', () => {
                     defaultNewUserBetaAccess: false,
                     authRateLimitEnabled: true,
                     authRateLimitMaxRequests: 10,
-                    authRateLimitWindowMs: 900000,
-                    signupMonetizationStrategy: 'auto_assign_default',
-                    defaultSignupPlanVersionId: 'starter-v1'
+                    authRateLimitWindowMs: 900000
+                },
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'auto_grant_free',
+                        planVersionId: 'starter-v1'
+                    }
                 }
             });
         });
@@ -10196,23 +10405,25 @@ describe('Server Routes', () => {
             expect(res.end.mock.calls[0][0]).toContain('window.__TASKFORCE_SITE_CONFIG__ = ');
             expect(res.end.mock.calls[0][0]).toContain('"pricingPageEnabled":false');
         });
-        it('POST /api/taskforce/admin/system-settings should reject invalid signup monetization settings', async () => {
-            core.validateSignupMonetizationSettings.mockReturnValueOnce({
+        it('POST /api/taskforce/admin/system-settings should reject invalid onboarding settings', async () => {
+            core.validateOnboardingPolicy.mockReturnValueOnce({
                 valid: false,
-                code: 'SIGNUP_PLAN_VERSION_REQUIRED',
-                message: 'Default signup plan version is required when signup strategy is auto-assign default.'
+                code: 'ONBOARDING_PLAN_VERSION_REQUIRED',
+                message: 'An onboarding plan version is required for the selected onboarding mode.'
             });
             const match = matchRoute('POST', '/api/taskforce/admin/system-settings', routes);
             const req = createMockReq('POST', '/api/taskforce/admin/system-settings', {
-                signupMonetizationStrategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: null
+                onboardingPolicyMode: 'auto_grant_free',
+                onboardingPlanVersionId: null
             }, { 'x-taskforce-role': 'admin' });
             const res = createMockRes();
             await match?.handler(req, res, {});
             expect(res.writeHead).toHaveBeenCalledWith(400, expect.any(Object));
             expect(core.updateGlobalSettings).not.toHaveBeenCalledWith(expect.objectContaining({
-                auth: expect.objectContaining({
-                    signupMonetizationStrategy: 'auto_assign_default'
+                billing: expect.objectContaining({
+                    onboardingPolicy: expect.objectContaining({
+                        mode: 'auto_grant_free'
+                    })
                 })
             }));
         });

package/dist/sync/cloudSyncApi.d.ts

@@ -25,6 +25,7 @@ export declare function pullWorkspaceChanges(resolveCloudAuthUrl: (path: string)
     nextCursor?: string | null;
     hasMore?: boolean;
     workspaceMembers?: WorkspaceSyncWorkspaceMemberSnapshot[];
+    diagnostics?: Record<string, unknown>;
 }>>;
 export declare function pushWorkspaceChanges(resolveCloudAuthUrl: (path: string) => string, input: {
     workspaceId: string;