@taskforcehq/taskforce 0.3.302 → 0.3.304

package/dist/mcp/taskAttachmentTypes.d.ts

@@ -0,0 +1,37 @@
+import type { WorkspaceAssetKind } from '../storage/workspaceAssetStore.js';
+export type TaskAttachmentRecord = {
+    path: string;
+    fsPath?: string;
+    caption?: string;
+    displayName?: string;
+    originalFilename?: string;
+    timestamp?: string;
+    assetId?: string;
+    referenceNumber?: number | null;
+    referenceLabel?: string | null;
+    taskId?: string | null;
+};
+export type McpTaskAttachmentDescriptor = {
+    attachmentId: string;
+    assetId?: string;
+    referenceNumber?: number | null;
+    referenceLabel?: string | null;
+    documentId?: string | null;
+    path: string;
+    fsPath?: string;
+    caption?: string;
+    displayName?: string;
+    originalFilename?: string;
+    kind: WorkspaceAssetKind;
+    mimeType: string;
+    sizeBytes: number | null;
+    timestamp?: string;
+    source: 'canonical' | 'external';
+    readableAsText: boolean;
+    preferredNextTool?: string;
+    preferredWorkflow?: string;
+    suggestedArgs?: {
+        documentId: string;
+    };
+    guidance?: string;
+};

package/dist/mcp/taskAttachmentTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/migrations/billingSchemaParity.test.js

@@ -25,6 +25,7 @@ describe('billing schema parity', () => {
             expect(names.has('user_billing')).toBe(true);
             expect(names.has('stripe_webhook_events')).toBe(true);
             expect(names.has('stripe_webhook_failures')).toBe(true);
+            expect(names.has('billing_checkout_attempts')).toBe(true);
             expect(names.has('billing_config')).toBe(true);
             expect(names.has('billing_price_mappings')).toBe(true);
         }
@@ -101,9 +102,11 @@ describe('billing schema parity', () => {
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS user_billing');
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS stripe_webhook_events');
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS stripe_webhook_failures');
+        expect(sql).toContain('CREATE TABLE IF NOT EXISTS billing_checkout_attempts');
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS billing_config');
         expect(sql).toContain('CREATE TABLE IF NOT EXISTS billing_price_mappings');
         expect(sql).toContain('CREATE INDEX IF NOT EXISTS idx_stripe_webhook_failures_purge_after');
+        expect(sql).toContain('CREATE INDEX IF NOT EXISTS idx_billing_checkout_attempts_user_status');
         expect(sql).toContain('CREATE INDEX IF NOT EXISTS idx_billing_price_mappings_plan');
         expect(sql).toContain('CREATE UNIQUE INDEX IF NOT EXISTS idx_billing_price_mappings_active_interval');
     });

package/dist/migrations/taskSchemaMigrations.js

@@ -493,6 +493,18 @@ export function ensureBillingSchema(db) {
             created_at TEXT NOT NULL
         );
 
+        CREATE TABLE IF NOT EXISTS billing_checkout_attempts (
+            session_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            user_id TEXT NOT NULL,
+            plan_version_id TEXT NOT NULL,
+            billing_interval TEXT,
+            status TEXT NOT NULL DEFAULT 'open',
+            expires_at TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+        );
+
         CREATE TABLE IF NOT EXISTS billing_config (
             tenant_id TEXT PRIMARY KEY,
             config_json TEXT NOT NULL DEFAULT '{}',
@@ -520,6 +532,8 @@ export function ensureBillingSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_stripe_webhook_failures_tenant ON stripe_webhook_failures(tenant_id);
         CREATE INDEX IF NOT EXISTS idx_stripe_webhook_failures_event ON stripe_webhook_failures(event_id);
         CREATE INDEX IF NOT EXISTS idx_stripe_webhook_failures_purge_after ON stripe_webhook_failures(purge_after);
+        CREATE INDEX IF NOT EXISTS idx_billing_checkout_attempts_user_status ON billing_checkout_attempts(tenant_id, user_id, status, created_at);
+        CREATE INDEX IF NOT EXISTS idx_billing_checkout_attempts_plan_status ON billing_checkout_attempts(tenant_id, plan_version_id, status, created_at);
         CREATE INDEX IF NOT EXISTS idx_billing_price_mappings_plan ON billing_price_mappings(tenant_id, plan_version_id);
         CREATE INDEX IF NOT EXISTS idx_billing_price_mappings_active ON billing_price_mappings(tenant_id, active);
     `);
@@ -723,6 +737,7 @@ export function ensureEntitlementsSchema(db) {
             updated_by TEXT,
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL,
+            FOREIGN KEY (account_id) REFERENCES users(id) ON DELETE CASCADE,
             FOREIGN KEY (plan_version_id) REFERENCES plan_versions(plan_version_id)
         );
 

package/dist/plugins/vite.js

@@ -190,7 +190,7 @@ export function taskforcePlugin(options) {
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="icon" type="image/svg+xml" href="/src/assets/favicon/favicon.svg" />
     <link rel="icon" type="image/x-icon" href="/src/assets/favicon/favicon.ico" />
-    <title>Taskforce Dashboard</title>
+    <title>Taskforce</title>
     <style>
         body { margin: 0; background: #0f0f1a; color: white; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; }
         #root { height: 100vh; overflow: hidden; }

package/dist/runtime/appGateDefinitions.d.ts

@@ -12,7 +12,7 @@ export declare const APP_GATE_DEFINITIONS: {
         readonly removalMilestone: "Document Manager GA";
     };
     readonly 'workflows.workspace_access': {
-        readonly enabled: true;
+        readonly enabled: false;
         readonly description: "Workflow workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Workflow workspace GA";

package/dist/runtime/appGateDefinitions.js

@@ -12,7 +12,7 @@ export const APP_GATE_DEFINITIONS = {
         removalMilestone: 'Document Manager GA'
     },
     'workflows.workspace_access': {
-        enabled: true,
+        enabled: false,
         description: 'Workflow workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Workflow workspace GA'

package/dist/server/index.cookieProxy.test.js

@@ -22,6 +22,7 @@ describe('proxy cookie rewrite helpers', () => {
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/version')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/account/entitlements')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/account/profile-summary')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/account/team-management-access')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/admin/mcp-audit-logs')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/billing/status')).toBe(true);

package/dist/server/index.d.ts

@@ -28,6 +28,7 @@ export declare function shouldRewriteSetCookieForLocalDevHost(hostHeader: string
 export declare function writeJsonErrorIfPossible(res: http.ServerResponse, statusCode: number, payload: Record<string, unknown>): boolean;
 export declare function applyCloudProxyForwardedHeaders(headers: Headers, req: http.IncomingMessage): void;
 export declare function rewriteProxySetCookieForLocalHost(cookie: string): string;
+export declare function shouldRewriteProxySetCookieDomain(cookie: string, hostHeader: string | undefined): boolean;
 export declare function shouldApplyAuthRateLimitForPath(pathname: string): boolean;
 export declare function resolveCloudProxyBaseUrl(env?: NodeJS.ProcessEnv): string;
 export declare function ensureBillingWebhookAuthExclusion(excludedPaths: string[]): string[];

package/dist/server/index.js

@@ -109,6 +109,8 @@ export function shouldProxyCloudPath(pathname) {
         || pathname === PUBLIC_SITE_CONFIG_SCRIPT_PATH
         || pathname === '/api/taskforce/version'
         || pathname === '/api/taskforce/account/entitlements'
+        || pathname === '/api/taskforce/account/profile-summary'
+        || pathname === '/api/taskforce/account/team-management-access'
         || pathname.startsWith('/api/taskforce/admin/')
         || pathname.startsWith('/api/taskforce/billing/')
         || pathname.startsWith('/api/taskforce/auth/')
@@ -203,6 +205,43 @@ export function rewriteProxySetCookieForLocalHost(cookie) {
     const filteredAttrs = attrs.filter((attr) => !attr.toLowerCase().startsWith('domain='));
     return [nameValue, ...filteredAttrs].join('; ');
 }
+function normalizeHostHeaderHost(hostHeader) {
+    const raw = String(hostHeader || '').trim().toLowerCase();
+    if (!raw)
+        return '';
+    if (raw.startsWith('[')) {
+        const closing = raw.indexOf(']');
+        if (closing >= 0)
+            return raw.slice(1, closing);
+    }
+    const portSeparator = raw.lastIndexOf(':');
+    if (portSeparator <= 0)
+        return raw;
+    const maybePort = raw.slice(portSeparator + 1);
+    if (/^\d+$/.test(maybePort)) {
+        return raw.slice(0, portSeparator);
+    }
+    return raw;
+}
+function parseSetCookieDomain(cookie) {
+    const parts = String(cookie || '').split(';').map((part) => part.trim()).filter(Boolean);
+    for (const part of parts.slice(1)) {
+        const lower = part.toLowerCase();
+        if (!lower.startsWith('domain='))
+            continue;
+        return part.slice('domain='.length).trim().replace(/^\.+/, '').toLowerCase();
+    }
+    return '';
+}
+export function shouldRewriteProxySetCookieDomain(cookie, hostHeader) {
+    const requestHost = normalizeHostHeaderHost(hostHeader);
+    const cookieDomain = parseSetCookieDomain(cookie);
+    if (!requestHost || !cookieDomain)
+        return false;
+    if (requestHost === cookieDomain)
+        return false;
+    return !requestHost.endsWith(`.${cookieDomain}`);
+}
 async function readRequestBody(req, maxBytes) {
     const chunks = [];
     let total = 0;
@@ -548,9 +587,15 @@ export function createStandaloneServer(options) {
                 }
                 const setCookies = upstream.headers.getSetCookie?.();
                 if (Array.isArray(setCookies) && setCookies.length > 0) {
-                    const normalizedSetCookies = shouldRewriteSetCookieForLocalDevHost(String(req.headers.host || '').trim())
-                        ? setCookies.map((cookie) => rewriteProxySetCookieForLocalHost(cookie))
-                        : setCookies;
+                    const requestHost = String(req.headers.host || '').trim();
+                    const normalizedSetCookies = setCookies.map((cookie) => {
+                        if (shouldRewriteSetCookieForLocalDevHost(requestHost)) {
+                            return rewriteProxySetCookieForLocalHost(cookie);
+                        }
+                        return shouldRewriteProxySetCookieDomain(cookie, requestHost)
+                            ? rewriteProxySetCookieForLocalHost(cookie)
+                            : cookie;
+                    });
                     res.setHeader('Set-Cookie', normalizedSetCookies);
                 }
                 res.writeHead(upstream.status, outgoingHeaders);

package/dist/server/index.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
-import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
+import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, rewriteProxySetCookieForLocalHost, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldRewriteProxySetCookieDomain, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
 describe('server index helper policies', () => {
     it('adds webhook path to auth exclusions without duplicates', () => {
         const base = ['/api/taskforce/health', '/api/taskforce/auth'];
@@ -86,11 +86,23 @@ describe('shouldProxyCloudPath', () => {
         expect(shouldProxyCloudPath('/api/taskforce/admin/users')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/billing/plans')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/auth/login')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/account/team-management-access')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/account/profile-summary')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/account/team-management-access')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
     });
 });
+describe('proxy cookie helpers', () => {
+    it('rewrites mismatched cookie domains for non-loopback local hosts', () => {
+        const cookie = 'taskforce_session=abc; Path=/; HttpOnly; SameSite=Lax; Domain=taskforcehq.ai';
+        expect(shouldRewriteProxySetCookieDomain(cookie, 'taskforce.localtest.me:3847')).toBe(true);
+        expect(rewriteProxySetCookieForLocalHost(cookie)).not.toContain('Domain=');
+    });
+    it('preserves cookie domains that already match the request host', () => {
+        const cookie = 'taskforce_session=abc; Path=/; HttpOnly; SameSite=Lax; Domain=taskforcehq.ai';
+        expect(shouldRewriteProxySetCookieDomain(cookie, 'app.taskforcehq.ai')).toBe(false);
+    });
+});
 describe('resolveAuthorizedWorkspaceAccess', () => {
     it('prefers an explicitly requested workspace when the user is authorized for it', () => {
         const core = {

package/dist/server/mockStripe.d.ts

@@ -11,6 +11,7 @@ type MockStripeCheckoutSessionRecord = {
     successUrl: string;
     cancelUrl: string;
     subscriptionId: string | null;
+    expiresAt: number;
     paymentStatus: 'unpaid' | 'paid';
     status: 'open' | 'complete' | 'expired';
 };

package/dist/server/mockStripe.js

@@ -122,6 +122,7 @@ function formatMockCheckoutSession(record, expandSubscription = false) {
         metadata: { ...record.metadata },
         payment_status: record.paymentStatus,
         status: record.status,
+        expires_at: record.expiresAt,
         subscription: record.subscriptionId
             ? (expandSubscription ? formatMockSubscription(getMockStripeSubscription(record.subscriptionId)) : record.subscriptionId)
             : null
@@ -243,6 +244,7 @@ export function createMockStripeClient() {
                         successUrl: String(params.success_url || '').trim(),
                         cancelUrl: String(params.cancel_url || '').trim(),
                         subscriptionId: null,
+                        expiresAt: Math.floor(Date.now() / 1000) + (24 * 60 * 60),
                         paymentStatus: 'unpaid',
                         status: 'open'
                     };

package/dist/server/routes/admin.js

@@ -65,7 +65,7 @@ import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { randomUUID } from 'crypto';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
 import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl } from '../../config/cloudEnvironment.js';
-import { resolveErrorStatusCode } from './shared.js';
+import { buildCloudMcpRuntimeAuth, resolveErrorStatusCode } from './shared.js';
 import { applyWorkspaceRepair, scanWorkspaceRepair } from '../../sync/workspaceRepair.js';
 // === SECTION: Registration ===
 export function registerAdminRoutes(deps) {
@@ -101,7 +101,7 @@ export function registerAdminRoutes(deps) {
         const authSettings = globalSettings.auth || {};
         const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
         const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const signupSettings = core.getSignupMonetizationSettings();
+        const onboardingPolicy = core.getOnboardingPolicy();
         return {
             allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
             requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
@@ -113,8 +113,8 @@ export function registerAdminRoutes(deps) {
             authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
                 ? Math.floor(authRateLimitWindowMsRaw)
                 : 15 * 60_000,
-            signupMonetizationStrategy: signupSettings.strategy,
-            defaultSignupPlanVersionId: signupSettings.defaultSignupPlanVersionId
+            onboardingPolicyMode: onboardingPolicy.mode,
+            onboardingPlanVersionId: onboardingPolicy.planVersionId
         };
     };
     const getSiteBehavior = () => {
@@ -163,6 +163,10 @@ export function registerAdminRoutes(deps) {
         }
         return String(configured || resolvePublicAuthBaseUrl(req)).replace(/\/+$/, '');
     };
+    const resolveAdminCloudEnvironment = (req) => {
+        return resolveTaskforceCloudEnvironmentFromBaseUrl(resolveRuntimeConfigBaseUrl(req))
+            || resolveTaskforceCloudEnvironmentFromBaseUrl(resolveCloudLoginBaseUrl(req));
+    };
     const resolveMcpOauthAuthorizeUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/authorize`;
     const resolveMcpOauthTokenUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/token`;
     const resolveMcpOauthRegisterUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/register`;
@@ -470,22 +474,13 @@ export function registerAdminRoutes(deps) {
                 serverName: 'taskforce-cloud',
                 logStartup: false,
                 runtimeMode: 'cloud',
-                auth: {
-                    scopes: authScopes,
-                    userId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || null,
-                    tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
-                    aiProfileToken: auth.aiProfileToken,
-                    aiProfileName: auth.aiProfileName,
-                    aiProfileDescription: auth.aiProfileDescription,
-                    aiProfileRole: auth.aiProfileRole,
-                    aiProfileProvider: auth.aiProfileProvider,
-                    aiProfileModel: auth.aiProfileModel,
-                    aiProfileSurfaceType: auth.aiProfileSurfaceType,
-                    actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                auth: buildCloudMcpRuntimeAuth({
+                    req,
+                    auth,
+                    requestHeader,
                     requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
-                    ip: req.socket?.remoteAddress || null,
-                    userAgent: requestHeader(req, 'user-agent', '') || null,
-                },
+                    authScopes,
+                }),
             });
             const transport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,
@@ -964,6 +959,51 @@ export function registerAdminRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
     });
+    // DELETE /api/taskforce/admin/system-users/:id - Purge a test user in non-production cloud environments
+    addRoute('DELETE', '/api/taskforce/admin/system-users/:id', async (req, res, params) => {
+        if (!requireCloudRuntime(res, 'System user purge'))
+            return;
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
+            return;
+        }
+        const environment = resolveAdminCloudEnvironment(req);
+        if (environment !== 'staging' && environment !== 'performance') {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: 'System user purge is only available in staging and performance.',
+                code: 'SYSTEM_USER_PURGE_ENVIRONMENT_FORBIDDEN'
+            }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const actor = resolveAdminRequestActor(req);
+        try {
+            const summary = core.purgeSystemUser({
+                targetUserId: params.id,
+                actorUserId: actor.userId,
+                emailConfirmation: String(body?.emailConfirmation || '')
+            });
+            auditAdminAction(req, 'purge-system-user', {
+                targetUserId: params.id,
+                targetEmail: summary.email,
+                environment,
+                summary
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, environment, summary }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: String(error?.message || 'Unable to purge system user'),
+                code: error?.code,
+                details: error?.details || null
+            }));
+        }
+    });
     // === SECTION: Admin email settings ===
     // GET /api/taskforce/admin/email-settings - Read email provider settings
     addRoute('GET', '/api/taskforce/admin/email-settings', async (req, res) => {
@@ -1036,7 +1076,9 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
             return;
         }
-        const authSettings = core.getGlobalSettings().auth || {};
+        const globalSettings = core.getGlobalSettings();
+        const authSettings = globalSettings.auth || {};
+        const billingSettings = globalSettings.billing || {};
         const effective = getAuthBehavior();
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
@@ -1047,11 +1089,13 @@ export function registerAdminRoutes(deps) {
                 ...(typeof authSettings.authRateLimitEnabled === 'boolean' ? { authRateLimitEnabled: authSettings.authRateLimitEnabled } : {}),
                 ...(typeof authSettings.authRateLimitMaxRequests === 'number' ? { authRateLimitMaxRequests: authSettings.authRateLimitMaxRequests } : {}),
                 ...(typeof authSettings.authRateLimitWindowMs === 'number' ? { authRateLimitWindowMs: authSettings.authRateLimitWindowMs } : {}),
-                ...((authSettings.signupMonetizationStrategy === 'auto_assign_default' || authSettings.signupMonetizationStrategy === 'plan_selection_required')
-                    ? { signupMonetizationStrategy: authSettings.signupMonetizationStrategy }
+                ...((billingSettings.onboardingPolicy?.mode === 'require_plan_selection'
+                    || billingSettings.onboardingPolicy?.mode === 'auto_grant_free'
+                    || billingSettings.onboardingPolicy?.mode === 'auto_start_trial')
+                    ? { onboardingPolicyMode: billingSettings.onboardingPolicy.mode }
                     : {}),
-                ...(typeof authSettings.defaultSignupPlanVersionId === 'string' || authSettings.defaultSignupPlanVersionId === null
-                    ? { defaultSignupPlanVersionId: authSettings.defaultSignupPlanVersionId ?? null }
+                ...(typeof billingSettings.onboardingPolicy?.planVersionId === 'string' || billingSettings.onboardingPolicy?.planVersionId === null
+                    ? { onboardingPlanVersionId: billingSettings.onboardingPolicy?.planVersionId ?? null }
                     : {})
             },
             status: {
@@ -1061,8 +1105,8 @@ export function registerAdminRoutes(deps) {
                 authRateLimitEnabled: effective.authRateLimitEnabled,
                 authRateLimitMaxRequests: effective.authRateLimitMaxRequests,
                 authRateLimitWindowMs: effective.authRateLimitWindowMs,
-                signupMonetizationStrategy: effective.signupMonetizationStrategy,
-                defaultSignupPlanVersionId: effective.defaultSignupPlanVersionId
+                onboardingPolicyMode: effective.onboardingPolicyMode,
+                onboardingPlanVersionId: effective.onboardingPlanVersionId
             }
         }));
     });
@@ -1688,21 +1732,24 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const body = await parseJsonBody(req);
-        const signupMonetizationStrategy = body?.signupMonetizationStrategy === 'plan_selection_required'
-            ? 'plan_selection_required'
-            : 'auto_assign_default';
-        const defaultSignupPlanVersionId = typeof body?.defaultSignupPlanVersionId === 'string'
-            ? body.defaultSignupPlanVersionId.trim() || null
-            : body?.defaultSignupPlanVersionId === null
+        const currentOnboardingPolicy = core.getOnboardingPolicy();
+        const onboardingPolicyMode = body?.onboardingPolicyMode === 'auto_grant_free' || body?.onboardingPolicyMode === 'auto_start_trial'
+            ? body.onboardingPolicyMode
+            : body?.onboardingPolicyMode === 'require_plan_selection'
+                ? 'require_plan_selection'
+                : currentOnboardingPolicy.mode;
+        const onboardingPlanVersionId = typeof body?.onboardingPlanVersionId === 'string'
+            ? body.onboardingPlanVersionId.trim() || null
+            : body?.onboardingPlanVersionId === null
                 ? null
-                : undefined;
-        const validation = core.validateSignupMonetizationSettings({
-            strategy: signupMonetizationStrategy,
-            ...(defaultSignupPlanVersionId !== undefined ? { defaultSignupPlanVersionId } : {})
+                : currentOnboardingPolicy.planVersionId;
+        const validation = core.validateOnboardingPolicy({
+            mode: onboardingPolicyMode,
+            planVersionId: onboardingPlanVersionId
         });
         if (!validation.valid) {
             res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: validation.message || 'Invalid signup monetization settings.', code: validation.code, details: validation.details }));
+            res.end(JSON.stringify({ error: validation.message || 'Invalid onboarding policy.', code: validation.code, details: validation.details }));
             return;
         }
         core.updateGlobalSettings({
@@ -1714,9 +1761,13 @@ export function registerAdminRoutes(deps) {
                 ...(typeof body?.authRateLimitMaxRequests === 'number' && Number.isFinite(body.authRateLimitMaxRequests)
                     ? { authRateLimitMaxRequests: Math.max(1, Math.floor(body.authRateLimitMaxRequests)) } : {}),
                 ...(typeof body?.authRateLimitWindowMs === 'number' && Number.isFinite(body.authRateLimitWindowMs)
-                    ? { authRateLimitWindowMs: Math.max(1000, Math.floor(body.authRateLimitWindowMs)) } : {}),
-                signupMonetizationStrategy,
-                ...(defaultSignupPlanVersionId !== undefined ? { defaultSignupPlanVersionId } : {})
+                    ? { authRateLimitWindowMs: Math.max(1000, Math.floor(body.authRateLimitWindowMs)) } : {})
+            },
+            billing: {
+                onboardingPolicy: {
+                    mode: onboardingPolicyMode,
+                    planVersionId: onboardingPlanVersionId ?? null
+                }
             }
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });

package/dist/server/routes/auth.d.ts

@@ -20,6 +20,7 @@
  *   POST /api/taskforce/auth/invite/join
  *   POST /api/taskforce/auth/logout
  *   GET  /api/taskforce/account/access-status
+ *   GET  /api/taskforce/account/profile-summary
  *   GET  /api/taskforce/account/entitlements
  *   GET  /api/taskforce/account/team-management-access
  *   GET  /api/taskforce/account/plan-preview