@taskforcehq/taskforce 0.3.302 → 0.3.304

package/dist/core/Taskforce.d.ts

@@ -3,6 +3,8 @@ import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 import { type SyncEventInput } from './SyncReconciliationService.js';
 import { type FirstClassTaxonomyDisplayLabels, type WorkspaceTaxonomyState } from '../shared/taxonomyState.js';
 import { type AiProfileSurfaceType } from '../shared/aiProfileSurfaceType.js';
+import type { TaskActor } from '../shared/taskActor.js';
+export type { TaskActor } from '../shared/taskActor.js';
 export type { WorkspaceDeletedAssetRecord, WorkspaceDeleteSummary } from './types.js';
 import type { GlobalTaskforceSettings, UserGlobalSyncSettings, WorkspaceDeleteSummary } from './types.js';
 import type { AnnotatedAttachmentAnnotation, AnnotatedAttachmentPayload, AnnotatedAttachmentSession, AnnotatedAttachmentSessionRecord } from '../annotatedAttachments/types.js';
@@ -73,16 +75,6 @@ export interface DeletedTaskRecord {
 }
 export type TaskStatus = 'task' | 'on-hold' | 'in-progress' | 'review' | 'done' | 'cancelled';
 export type TaskAssignee = string;
-export interface TaskActor {
-    id: string;
-    kind: 'human' | 'ai';
-    label: string;
-    username: string;
-    icon: string;
-    color: string;
-    isNamed: boolean;
-    meta?: Record<string, unknown>;
-}
 export interface TaskItem {
     id: string;
     referenceNumber?: number | null;
@@ -343,14 +335,10 @@ export interface InitiativeTemplate {
     milestones: InitiativeTemplateMilestone[];
 }
 type WorkspaceSyncSettingsPayload = Record<string, Record<string, unknown>>;
-type SignupMonetizationStrategy = 'auto_assign_default' | 'plan_selection_required';
-interface SignupMonetizationSettings {
-    strategy: SignupMonetizationStrategy;
-    defaultSignupPlanVersionId: string | null;
-}
 type AccessRole = 'owner' | 'admin' | 'member' | 'read-only';
 export type SystemRole = 'system_admin' | 'user';
 type PermissionMode = 'read-only' | 'read-write';
+type AuthTokenPurpose = 'email_verification' | 'password_reset' | 'invite_accept';
 export type McpAccessTokenScope = 'tasks:read' | 'tasks:write' | 'workspace:read';
 type McpAccessTokenStatus = 'active' | 'revoked' | 'expired';
 export type McpOAuthProvider = 'chatgpt' | 'claude';
@@ -453,6 +441,24 @@ interface SystemUserRecord {
     updatedAt?: string | null;
     emailVerifiedAt?: string | null;
 }
+export interface PurgedSystemUserSummary {
+    targetUserId: string;
+    email: string;
+    unassignedTaskCount: number;
+    clearedInitiativeOwnerCount: number;
+    clearedWorkstreamOwnerCount: number;
+    deletedWorkspaceMembershipCount: number;
+    deletedAuthTokenCount: number;
+    deletedAvatarDraftCount: number;
+    deletedMcpAccessTokenCount: number;
+    deletedMcpOauthAuthCodeCount: number;
+    deletedMcpOauthConnectorGrantCount: number;
+    deletedUiStateCount: number;
+    deletedUserPreferenceCount: number;
+    deletedEntitlementCount: number;
+    deletedUserBillingCount: number;
+    deletedUserCount: number;
+}
 export type SetupState = 'present' | 'missing' | 'unreadable';
 export type RuntimeMode = 'local' | 'cloud';
 export type WorkspaceMode = 'core' | 'operations';
@@ -529,7 +535,7 @@ interface McpAuditLogRecord {
     reasonCode: string | null;
     details: Record<string, unknown>;
 }
-export type EntitlementState = 'active' | 'trialing' | 'grace' | 'suspended' | 'canceled';
+export type EntitlementState = 'pending_plan_selection' | 'checkout_pending' | 'active' | 'trialing' | 'grace' | 'suspended' | 'canceled';
 export type PlanFeatureAccess = 'enabled' | 'disabled' | 'limited';
 export interface PlanFeatureSnapshot {
     featureKey: string;
@@ -591,6 +597,11 @@ interface PasswordAuthResult {
     };
     code?: 'INVALID_CREDENTIALS' | 'EMAIL_NOT_VERIFIED';
 }
+interface AuthTokenInspection {
+    state: 'valid' | 'expired' | 'used' | 'missing' | 'revoked';
+    userId?: string;
+    workspaceId?: string;
+}
 export interface McpAccessTokenRecord {
     id: string;
     workspaceId: string;
@@ -736,6 +747,9 @@ export interface TaskforceSyncCapable {
         workspaceId?: string | null;
         includeDeleted?: boolean;
     }): AnnotatedAttachmentSessionRecord[];
+    listTaskEventsForSync(input: {
+        workspaceId?: string | null;
+    }): TaskEvent[];
     upsertAiProfileForSync(profile: AiProfileRecord): AiProfileRecord;
     replaceWorkspaceUsersForSync(input: {
         workspaceId: string;
@@ -746,6 +760,7 @@ export interface TaskforceSyncCapable {
     upsertDocumentReviewSessionForSync(session: DocumentReviewSessionRecord): DocumentReviewSessionRecord;
     upsertDocumentReviewCommentForSync(comment: DocumentReviewCommentSyncRecord): DocumentReviewCommentSyncRecord;
     upsertAnnotatedAttachmentSessionForSync(session: AnnotatedAttachmentSessionRecord): AnnotatedAttachmentSessionRecord;
+    upsertTaskEventForSync(event: TaskEvent): TaskEvent;
     deleteDocumentReviewSessionForSync(input: {
         workspaceId?: string | null;
         sessionId: string;
@@ -828,6 +843,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     private areTaskEventValuesEqual;
     private normalizeTaskEventValue;
     private buildTaskUpdateChanges;
+    private filterAutosaveTaskEventChanges;
     private normalizeTaxonomyToken;
     private normalizeStatusValue;
     private sanitizeAssignee;
@@ -867,11 +883,25 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     getWorkspaceAssetStore(): WorkspaceAssetStore;
     private normalizeEntitlementState;
     private upsertCanonicalEntitlementRecord;
+    transitionCanonicalCommercialState(input: {
+        accountId: string;
+        planVersionId?: string | null;
+        state: EntitlementState;
+        effectiveAt?: string | null;
+        effectiveUntil?: string | null;
+        billingMirrorPlanId?: string | null;
+        source: 'registration' | 'invite-accept' | 'checkout-start' | 'checkout-confirm' | 'stripe-webhook' | 'backfill' | 'legacy-plan-mode' | 'admin' | 'system';
+        updatedBy: string;
+        createdAt?: string | null;
+        updatedAt?: string | null;
+    }): import("./types.js").AccountEntitlementSnapshot;
     private resolveWorkspaceLimitForUser;
-    private resolveRegistrationPlanAssignment;
+    private resolveRegistrationOnboardingOutcome;
+    private ensureDefaultOnboardingEntitlement;
     createUserBillingRecord(userId: string, options?: {
         entitlementState?: string;
         planId?: string | null;
+        effectiveUntil?: string | null;
     }): void;
     getUserEntitlement(userId: string): {
         entitlementState: string;
@@ -958,8 +988,11 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     hasProjectThemeOverride(workspaceId?: string, userId?: string): boolean;
     getEffectiveTheme(workspaceId?: string, userId?: string): TaskforceTheme;
     hasProjectJsonBackupOverride(workspaceId?: string, userId?: string): boolean;
-    getSignupMonetizationSettings(): import("./types.js").SignupMonetizationSettings;
-    validateSignupMonetizationSettings(input?: Partial<SignupMonetizationSettings>): import("./types.js").SignupMonetizationValidationResult;
+    getOnboardingPolicy(): import("./types.js").OnboardingPolicy;
+    validateOnboardingPolicy(input?: {
+        mode?: 'require_plan_selection' | 'auto_grant_free' | 'auto_start_trial';
+        planVersionId?: string | null;
+    }): import("./types.js").OnboardingPolicyValidationResult;
     updateGlobalSettings(settings: GlobalTaskforceSettings): void;
     private sanitizeUserGlobalSyncSettings;
     getUserGlobalSyncSettings(userId: string): {
@@ -1137,6 +1170,11 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     setSystemRole(userId: string, role: SystemRole): boolean;
     setUserDisabledGlobal(userId: string, disabled: boolean): boolean;
     setUserBetaAccessGlobal(userId: string, enabled: boolean): boolean;
+    purgeSystemUser(input: {
+        targetUserId: string;
+        actorUserId: string;
+        emailConfirmation: string;
+    }): PurgedSystemUserSummary;
     private clearActiveAssignmentsForUnavailableActor;
     listWorkspaceUsers(workspaceId: string): WorkspaceUserRecord[];
     replaceWorkspaceUsersForSync(input: {
@@ -1229,6 +1267,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     upsertDocumentReviewSessionForSync(session: DocumentReviewSessionRecord): DocumentReviewSessionRecord;
     upsertDocumentReviewCommentForSync(comment: DocumentReviewCommentSyncRecord): DocumentReviewCommentSyncRecord;
     upsertAnnotatedAttachmentSessionForSync(session: AnnotatedAttachmentSessionRecord): AnnotatedAttachmentSessionRecord;
+    upsertTaskEventForSync(event: TaskEvent): TaskEvent;
     deleteDocumentReviewSessionForSync(input: {
         workspaceId?: string | null;
         sessionId: string;
@@ -1471,10 +1510,12 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         workspaceId: string | null;
         role: AccessRole;
         planSelectionRequired: boolean;
+        checkoutPending: boolean;
+        commercialState: EntitlementState;
     };
     private createOneTimeAuthToken;
     private consumeOneTimeAuthToken;
-    private inspectOneTimeAuthToken;
+    inspectOneTimeAuthToken(token: string, purpose: AuthTokenPurpose): AuthTokenInspection;
     revokeMcpCredentialsForUserWorkspace(userId: string, workspaceId: string, revokedByUserId?: string | null): void;
     private revokeMcpCredentialsForWorkspace;
     listMcpAccessTokens(input: {
@@ -1627,6 +1668,9 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     updateWorkspaceUserRole(userId: string, workspaceId: string, role: AccessRole): boolean;
     getTask(id: string, workspaceId?: string): TaskItem | null;
     listTaskEvents(taskId: string, workspaceId?: string): TaskEvent[];
+    listTaskEventsForSync(input: {
+        workspaceId?: string | null;
+    }): TaskEvent[];
     getScheduleBoard(weekKey: string, showWeekends?: boolean, workspaceId?: string): ScheduleBoardResult;
     updateTaskSchedule(id: string, input: {
         scheduledDate: string | null;
@@ -1658,6 +1702,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         syncUpdatedAt?: string;
         actorRef?: string;
         skipTaskEvents?: boolean;
+        saveSource?: 'manual' | 'autosave';
     }): TaskItem | null;
     addComment(id: string, text: string, author: string, workspaceId?: string, options?: {
         persistBackup?: boolean;

package/dist/core/Taskforce.js

@@ -9,7 +9,7 @@ import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 import { AuthTokenService } from './AuthTokenService.js';
 import { getAiProfileByTokenService, listAiProfilesService, mergeAiProfilesService, resolveAiProfileService, upsertAiProfileForSyncService, } from './AiProfileService.js';
 import { syncCanonicalTaskAttachmentLinksService, } from './AttachmentLinkService.js';
-import { addTaskEventService, buildTaskActivityService, listTaskEventsInternalService, replaceTaskCommentsService, replaceTaskEventsService, } from './TaskActivityService.js';
+import { addTaskEventService, buildTaskActivityService, listTaskEventsInternalService, listWorkspaceTaskEventsService, replaceTaskCommentsService, replaceTaskEventsService, upsertTaskEventForSyncService, } from './TaskActivityService.js';
 import { addDeletedTaskRecordService, getDeletedTaskService, listDeletedTasksService, mapDeletedTaskRowService, normalizeTaskSnapshotForRestoreService, pruneDeletedTasksService, purgeExpiredDeletedTasksService, } from './DeletedTaskLifecycleService.js';
 import { applyWorkspaceSyncSnapshotService, deleteDocumentWatermarkService, getDocumentWatermarkService, listTasksForSyncService, listWorkspaceSyncDeletesSinceService, readPushIdempotencyService, recordSyncEventService, upsertDocumentWatermarkService, writePushIdempotencyService, } from './SyncReconciliationService.js';
 import { getGlobalSettingsService, hasPersistedGlobalSettingsService, readGlobalConfigService, updateGlobalSettingsService, writeGlobalConfigService, } from './GlobalSettingsService.js';
@@ -666,6 +666,9 @@ export class TaskforceCore {
         }
         return changes;
     }
+    filterAutosaveTaskEventChanges(changes) {
+        return Object.fromEntries(Object.entries(changes).filter(([field]) => field !== 'title' && field !== 'description'));
+    }
     normalizeTaxonomyToken(value) {
         return String(value || '')
             .trim()
@@ -1175,7 +1178,6 @@ export class TaskforceCore {
             writeGlobalConfig: (config) => this.writeGlobalConfig(config),
         });
         this.planEntitlementService.repairPlanCatalogDefaultsIfNeeded();
-        this.planEntitlementService.repairSignupMonetizationSettingsIfNeeded();
         this.planEntitlementService.normalizeLegacyPlanDataIfNeeded();
         this.planEntitlementService.backfillAccountEntitlements();
         this.repairDetachedAnnotatedAttachmentSessions();
@@ -1209,11 +1211,37 @@ export class TaskforceCore {
     upsertCanonicalEntitlementRecord(input) {
         return this.planEntitlementService.upsertCanonicalEntitlementRecord(input);
     }
+    transitionCanonicalCommercialState(input) {
+        return this.planEntitlementService.transitionCanonicalCommercialState(input);
+    }
     resolveWorkspaceLimitForUser(userId) {
         return this.planEntitlementService.resolveWorkspaceLimitForUser(userId);
     }
-    resolveRegistrationPlanAssignment(selectedPlanVersionIdRaw) {
-        return this.planEntitlementService.resolveRegistrationPlanAssignment(selectedPlanVersionIdRaw);
+    resolveRegistrationOnboardingOutcome(selectedPlanVersionIdRaw) {
+        return this.planEntitlementService.resolveRegistrationOnboardingOutcome(selectedPlanVersionIdRaw);
+    }
+    ensureDefaultOnboardingEntitlement(accountIdRaw, options) {
+        const accountId = String(accountIdRaw || '').trim();
+        if (!accountId) {
+            throw new TaskforceRuleError('accountId is required', 400, 'ACCOUNT_ID_REQUIRED');
+        }
+        if (this.hasAccountEntitlement(accountId)) {
+            return this.getAccountEntitlement(accountId);
+        }
+        const now = options?.now || new Date().toISOString();
+        const onboardingOutcome = this.resolveRegistrationOnboardingOutcome();
+        this.transitionCanonicalCommercialState({
+            accountId,
+            planVersionId: onboardingOutcome.planVersionId,
+            state: onboardingOutcome.commercialState,
+            effectiveAt: now,
+            billingMirrorPlanId: onboardingOutcome.planId,
+            source: options?.source || 'registration',
+            updatedBy: options?.updatedBy || 'registration',
+            createdAt: now,
+            updatedAt: now
+        });
+        return this.getAccountEntitlement(accountId);
     }
     createUserBillingRecord(userId, options) {
         return this.planEntitlementService.createUserBillingRecord(userId, options);
@@ -2598,11 +2626,11 @@ export class TaskforceCore {
         const config = this.readConfig(workspaceId, userId) || {};
         return typeof config.jsonBackupEnabled === 'boolean';
     }
-    getSignupMonetizationSettings() {
-        return this.planEntitlementService.getSignupMonetizationSettings();
+    getOnboardingPolicy() {
+        return this.planEntitlementService.getOnboardingPolicy();
     }
-    validateSignupMonetizationSettings(input) {
-        return this.planEntitlementService.validateSignupMonetizationSettings(input);
+    validateOnboardingPolicy(input) {
+        return this.planEntitlementService.validateOnboardingPolicy(input);
     }
     updateGlobalSettings(settings) {
         updateGlobalSettingsService(this.getGlobalSettingsServiceDeps(), settings);
@@ -4375,6 +4403,193 @@ export class TaskforceCore {
         `).run(enabled ? 1 : 0, new Date().toISOString(), this.tenantId, normalizedUserId);
         return Number(result?.changes || 0) > 0;
     }
+    purgeSystemUser(input) {
+        const targetUserId = String(input.targetUserId || '').trim();
+        const actorUserId = String(input.actorUserId || '').trim();
+        const emailConfirmation = String(input.emailConfirmation || '').trim().toLowerCase();
+        if (!targetUserId) {
+            throw new TaskforceRuleError('targetUserId is required', 400, 'TARGET_USER_ID_REQUIRED');
+        }
+        if (!actorUserId || actorUserId === 'anonymous') {
+            throw new TaskforceRuleError('actorUserId is required', 400, 'ACTOR_USER_ID_REQUIRED');
+        }
+        if (!emailConfirmation) {
+            throw new TaskforceRuleError('Email confirmation is required', 400, 'EMAIL_CONFIRMATION_REQUIRED');
+        }
+        if (targetUserId === actorUserId) {
+            throw new TaskforceRuleError('Cannot purge the current system admin session user', 400, 'CURRENT_SYSTEM_USER_PURGE_FORBIDDEN');
+        }
+        return this.db.transaction(() => {
+            const user = this.db.prepare(`
+                SELECT
+                    id,
+                    email,
+                    COALESCE(system_role, 'user') AS system_role,
+                    COALESCE(is_disabled, 0) AS is_disabled
+                FROM users
+                WHERE tenant_id = ? AND id = ?
+                LIMIT 1
+            `).get(this.tenantId, targetUserId);
+            if (!user?.id || !user.email) {
+                throw new TaskforceRuleError('User not found', 404, 'USER_NOT_FOUND');
+            }
+            const normalizedEmail = String(user.email).trim().toLowerCase();
+            if (normalizedEmail !== emailConfirmation) {
+                throw new TaskforceRuleError('Email confirmation did not match the target user', 400, 'EMAIL_CONFIRMATION_MISMATCH');
+            }
+            const currentRole = this.normalizeSystemRole(user.system_role, 'user');
+            const isDisabled = Boolean(user.is_disabled);
+            if (currentRole === 'system_admin' && !isDisabled && this.countSystemAdmins() <= 1) {
+                throw new TaskforceRuleError('Cannot purge the last enabled system admin', 400, 'LAST_SYSTEM_ADMIN_REQUIRED');
+            }
+            const elevatedWorkspaceMemberships = this.db.prepare(`
+                SELECT
+                    m.workspace_id AS workspace_id,
+                    COALESCE(m.role, 'member') AS role,
+                    w.name AS workspace_name
+                FROM workspace_memberships m
+                LEFT JOIN workspaces w
+                  ON w.tenant_id = m.tenant_id
+                 AND w.id = m.workspace_id
+                WHERE m.tenant_id = ?
+                  AND m.user_id = ?
+                  AND COALESCE(m.status, 'active') = 'active'
+                  AND COALESCE(m.role, 'member') IN ('owner', 'admin')
+                ORDER BY COALESCE(w.updated_at, w.created_at) DESC, w.name ASC
+                LIMIT 10
+            `).all(this.tenantId, targetUserId);
+            if (elevatedWorkspaceMemberships.length > 0) {
+                throw new TaskforceRuleError('Cannot purge a user with active owner/admin workspace memberships', 409, 'SYSTEM_USER_PURGE_BLOCKED_ACTIVE_WORKSPACE_ROLE', {
+                    memberships: elevatedWorkspaceMemberships.map((membership) => ({
+                        workspaceId: membership.workspace_id ? String(membership.workspace_id) : null,
+                        workspaceName: membership.workspace_name ? String(membership.workspace_name) : null,
+                        role: membership.role ? String(membership.role) : null
+                    }))
+                });
+            }
+            const billingRow = this.db.prepare(`
+                SELECT
+                    stripe_customer_id,
+                    stripe_subscription_id,
+                    stripe_price_id,
+                    stripe_status,
+                    billing_interval
+                FROM user_billing
+                WHERE tenant_id = ? AND user_id = ?
+                LIMIT 1
+            `).get(this.tenantId, targetUserId);
+            const hasCommercialBillingState = [
+                billingRow?.stripe_customer_id,
+                billingRow?.stripe_subscription_id,
+                billingRow?.stripe_price_id,
+                billingRow?.stripe_status,
+                billingRow?.billing_interval
+            ].some((value) => String(value || '').trim().length > 0);
+            if (hasCommercialBillingState) {
+                throw new TaskforceRuleError('Cannot purge a user with active commercial billing state', 409, 'SYSTEM_USER_PURGE_BLOCKED_BILLING_STATE');
+            }
+            const now = new Date().toISOString();
+            const runCount = (sql, ...params) => Number(this.db.prepare(sql).run(...params)?.changes || 0);
+            const unassignedTaskCount = runCount(`
+                UPDATE tasks
+                SET assignee = 'unassigned',
+                    updated_at = ?
+                WHERE tenant_id = ?
+                  AND assignee = ?
+                  AND is_archived = 0
+            `, now, this.tenantId, targetUserId);
+            const clearedInitiativeOwnerCount = runCount(`
+                UPDATE initiatives
+                SET owner_id = NULL,
+                    updated_at = ?
+                WHERE tenant_id = ?
+                  AND owner_id = ?
+            `, now, this.tenantId, targetUserId);
+            const clearedWorkstreamOwnerCount = runCount(`
+                UPDATE workstreams
+                SET owner_id = NULL,
+                    updated_at = ?
+                WHERE tenant_id = ?
+                  AND owner_id = ?
+            `, now, this.tenantId, targetUserId);
+            const deletedEntitlementCount = runCount(`
+                DELETE FROM account_entitlements
+                WHERE tenant_id = ?
+                  AND account_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedWorkspaceMembershipCount = runCount(`
+                DELETE FROM workspace_memberships
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedAuthTokenCount = runCount(`
+                DELETE FROM auth_tokens
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedAvatarDraftCount = runCount(`
+                DELETE FROM user_avatar_upload_drafts
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedMcpAccessTokenCount = runCount(`
+                DELETE FROM mcp_access_tokens
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedMcpOauthAuthCodeCount = runCount(`
+                DELETE FROM mcp_oauth_auth_codes
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedMcpOauthConnectorGrantCount = runCount(`
+                DELETE FROM mcp_oauth_connector_grants
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedUiStateCount = runCount(`
+                DELETE FROM ui_state
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedUserPreferenceCount = runCount(`
+                DELETE FROM user_preferences
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedUserBillingCount = runCount(`
+                DELETE FROM user_billing
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
+            const deletedUserCount = runCount(`
+                DELETE FROM users
+                WHERE tenant_id = ?
+                  AND id = ?
+            `, this.tenantId, targetUserId);
+            if (deletedUserCount !== 1) {
+                throw new TaskforceRuleError('User not found', 404, 'USER_NOT_FOUND');
+            }
+            return {
+                targetUserId,
+                email: String(user.email),
+                unassignedTaskCount,
+                clearedInitiativeOwnerCount,
+                clearedWorkstreamOwnerCount,
+                deletedWorkspaceMembershipCount,
+                deletedAuthTokenCount,
+                deletedAvatarDraftCount,
+                deletedMcpAccessTokenCount,
+                deletedMcpOauthAuthCodeCount,
+                deletedMcpOauthConnectorGrantCount,
+                deletedUiStateCount,
+                deletedUserPreferenceCount,
+                deletedEntitlementCount,
+                deletedUserBillingCount,
+                deletedUserCount
+            };
+        })();
+    }
     clearActiveAssignmentsForUnavailableActor(actorId, workspaceId, updatedAt) {
         const normalizedActorId = String(actorId || '').trim();
         const normalizedWorkspaceId = String(workspaceId || 'default').trim() || 'default';
@@ -4652,6 +4867,9 @@ export class TaskforceCore {
             deletedAt: session.deletedAt,
         });
     }
+    upsertTaskEventForSync(event) {
+        return upsertTaskEventForSyncService(this.getTaskActivityServiceDeps(), event);
+    }
     deleteDocumentReviewSessionForSync(input) {
         const deps = this.getDocumentReviewServiceDeps();
         return deps.sessionStore.softDelete(input.sessionId, deps.normalizeWorkspaceId(input.workspaceId), input.deletedAt || undefined);
@@ -5329,7 +5547,20 @@ export class TaskforceCore {
         const assignFirstSystemAdmin = !this.hasAnySystemAdmin();
         const betaAccess = input.betaAccess !== false;
         const requestedWorkspaceId = String(input.workspaceId || '').trim();
-        const registrationPlanAssignment = this.resolveRegistrationPlanAssignment(input.planVersionId);
+        const onboardingOutcome = this.resolveRegistrationOnboardingOutcome(input.planVersionId);
+        const applyRegistrationCommercialState = (accountId, now) => {
+            this.transitionCanonicalCommercialState({
+                accountId,
+                planVersionId: onboardingOutcome.planVersionId,
+                state: onboardingOutcome.commercialState,
+                effectiveAt: now,
+                billingMirrorPlanId: onboardingOutcome.planId,
+                source: 'registration',
+                updatedBy: 'registration',
+                createdAt: now,
+                updatedAt: now
+            });
+        };
         if (!requestedWorkspaceId || requestedWorkspaceId.toLowerCase() === 'default') {
             const now = new Date().toISOString();
             const userId = this.generateEntityId('user');
@@ -5338,32 +5569,14 @@ export class TaskforceCore {
                 INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, password_hash, system_role, beta_access, is_disabled, created_at, updated_at)
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?)
             `).run(userId, this.tenantId, email, displayName, 'password', email, hashPassword(password), assignFirstSystemAdmin ? 'system_admin' : 'user', betaAccess ? 1 : 0, now, now);
-            if (registrationPlanAssignment.requiresPlanSelection) {
-                this.createUserBillingRecord(userId, {
-                    entitlementState: 'pending_plan_selection',
-                    planId: null
-                });
-            }
-            if (!registrationPlanAssignment.requiresPlanSelection && registrationPlanAssignment.planVersionId && registrationPlanAssignment.planId) {
-                this.createUserBillingRecord(userId, {
-                    entitlementState: 'active',
-                    planId: registrationPlanAssignment.planId
-                });
-                this.upsertCanonicalEntitlementRecord({
-                    accountId: userId,
-                    planVersionId: registrationPlanAssignment.planVersionId,
-                    state: 'active',
-                    effectiveAt: now,
-                    updatedBy: 'registration',
-                    createdAt: now,
-                    updatedAt: now
-                });
-            }
+            applyRegistrationCommercialState(userId, now);
             return {
                 userId,
                 workspaceId: null,
                 role: 'member',
-                planSelectionRequired: registrationPlanAssignment.requiresPlanSelection
+                planSelectionRequired: onboardingOutcome.requiresPlanSelection,
+                checkoutPending: onboardingOutcome.checkoutPending,
+                commercialState: onboardingOutcome.commercialState
             };
         }
         const workspaceId = requestedWorkspaceId;
@@ -5381,27 +5594,12 @@ export class TaskforceCore {
                 WHERE tenant_id = ? AND id = ?
             `).run(new Date().toISOString(), this.tenantId, created.userId);
         }
-        if (registrationPlanAssignment.requiresPlanSelection) {
-            this.createUserBillingRecord(created.userId, {
-                entitlementState: 'pending_plan_selection',
-                planId: null
-            });
-        }
-        if (!registrationPlanAssignment.requiresPlanSelection && registrationPlanAssignment.planVersionId && registrationPlanAssignment.planId) {
-            this.createUserBillingRecord(created.userId, {
-                entitlementState: 'active',
-                planId: registrationPlanAssignment.planId
-            });
-            this.upsertCanonicalEntitlementRecord({
-                accountId: created.userId,
-                planVersionId: registrationPlanAssignment.planVersionId,
-                state: 'active',
-                updatedBy: 'registration'
-            });
-        }
+        applyRegistrationCommercialState(created.userId);
         return {
             ...created,
-            planSelectionRequired: registrationPlanAssignment.requiresPlanSelection
+            planSelectionRequired: onboardingOutcome.requiresPlanSelection,
+            checkoutPending: onboardingOutcome.checkoutPending,
+            commercialState: onboardingOutcome.commercialState
         };
     }
     createOneTimeAuthToken(userId, purpose, ttlSeconds, workspaceId) {
@@ -5626,6 +5824,11 @@ export class TaskforceCore {
                 updated_at = ?
             WHERE tenant_id = ? AND id = ?
         `).run(hashPassword(password), 'password', user.email, now, now, this.tenantId, consumed.userId);
+        this.ensureDefaultOnboardingEntitlement(consumed.userId, {
+            source: 'invite-accept',
+            updatedBy: 'invite-accept',
+            now
+        });
         return this.completeInviteWorkspaceActivation({
             userId: consumed.userId,
             workspaceId: inviteWorkspaceId
@@ -5784,6 +5987,10 @@ export class TaskforceCore {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         return this.listTaskEventsInternal(taskId, normalizedWorkspaceId);
     }
+    listTaskEventsForSync(input) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(input.workspaceId || undefined);
+        return listWorkspaceTaskEventsService(this.getTaskActivityServiceDeps(), normalizedWorkspaceId);
+    }
     getScheduleBoard(weekKey, showWeekends = false, workspaceId) {
         const parsedWeek = this.parseIsoWeekKeyToDates(weekKey);
         if (!parsedWeek) {
@@ -6341,7 +6548,10 @@ export class TaskforceCore {
             if (!nextTask)
                 return null;
             if (options?.skipTaskEvents !== true) {
-                const changes = this.buildTaskUpdateChanges(existing, nextTask, patch);
+                const rawChanges = this.buildTaskUpdateChanges(existing, nextTask, patch);
+                const changes = options?.saveSource === 'autosave'
+                    ? this.filterAutosaveTaskEventChanges(rawChanges)
+                    : rawChanges;
                 if (Object.keys(changes).length > 0) {
                     let action = 'task-updated';
                     if (changes.status) {

package/dist/core/Taskforce.mcpAuth.test.js

@@ -27,7 +27,6 @@ function setupWorkspace(core, userId = 'owner-1', workspaceId = 'workspace-1') {
             hasEntitlement: true,
             canAccessApp: true,
             canAccessPlans: true,
-            signupMonetizationStrategy: 'none',
             planSelectionRequired: false,
             message: null,
             entitlement: null
@@ -328,7 +327,6 @@ describe('TaskforceCore MCP auth invalidation', () => {
                     hasEntitlement: false,
                     canAccessApp: false,
                     canAccessPlans: true,
-                    signupMonetizationStrategy: 'none',
                     planSelectionRequired: false,
                     message: 'Suspended for test',
                     entitlement: null

package/dist/core/UserProfileAvatarDrafts.test.js

@@ -13,10 +13,19 @@ function seedPlans(core) {
         versionNumber: 1,
         seatLimit: 1
     });
+    const db = core.db;
+    const now = new Date().toISOString();
+    db.prepare(`
+        INSERT OR IGNORE INTO billing_price_mappings (
+            tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(core.getTenantId(), 'starter-v1', 'month', 'free:starter-v1:month', 'free', 1, 0, null, now, now);
     core.updateGlobalSettings({
-        auth: {
-            signupMonetizationStrategy: 'auto_assign_default',
-            defaultSignupPlanVersionId: 'starter-v1'
+        billing: {
+            onboardingPolicy: {
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
+            }
         }
     });
 }