@taskforcehq/taskforce 0.3.302 → 0.3.304

package/dist/server/routes/sync.js

@@ -5,15 +5,14 @@ import { WorkspaceAssetStore, } from '../../storage/workspaceAssetStore.js';
 import { resolveSessionCookieAttributesForRequest } from '../auth.js';
 import { decryptDocument, ENCRYPTION_PREFIX } from '../../sync/encryptionService.js';
 import { isAiProfileSurfaceType } from '../../shared/aiProfileSurfaceType.js';
-import { getTaskMutationTieBreak, getTaskMutationWatermark } from '../../sync/workspaceSyncSurface.js';
-import { normalizeTaskSyncPayload, taskSyncPayloadToCoreTask } from '../../sync/taskSyncPayload.js';
-import { normalizeBinaryAssetDeleteSyncPayload, normalizeBinaryAssetSyncPayload, normalizeDocumentDeleteSyncPayload, normalizeDocumentSyncPayload, serializeBinaryAssetSyncPayload, serializeDocumentSyncPayload } from '../../sync/contentSyncPayload.js';
+import { serializeTaskForSync, } from '../../sync/taskSyncPayload.js';
+import { serializeBinaryAssetSyncPayload, serializeDocumentSyncPayload, } from '../../sync/contentSyncPayload.js';
 import { createContentSyncState } from '../../sync/contentSyncState.js';
-import { normalizeAiProfileSyncPayload, normalizeAnnotatedAttachmentSessionSyncPayload, normalizeDeleteSyncPayload, normalizeDocumentReviewCommentSyncPayload, normalizeDocumentReviewSessionSyncPayload, } from '../../sync/collaborationSyncPayload.js';
+import { normalizeAiProfileSyncPayload, normalizeAnnotatedAttachmentSessionSyncPayload, normalizeDocumentReviewCommentSyncPayload, normalizeDocumentReviewSessionSyncPayload, } from '../../sync/collaborationSyncPayload.js';
 import { createCollaborationSyncState } from '../../sync/collaborationSyncState.js';
 import { buildWorkspacePullFeed } from '../../sync/workspacePullFeed.js';
 import { normalizeInitiativeSyncPayload, normalizeTaxonomySyncPayload, normalizeWorkstreamSyncPayload, } from '../../sync/planningSyncPayload.js';
-import { applyAiProfileAndMemberSyncChanges, applyCollaborationSyncChanges, applyContentSyncChanges, applyPlanningSyncChanges, resolveSyncConflictOrdering, } from '../../sync/syncApplyHandlers.js';
+import { applyAiProfileAndMemberSyncChanges, applyCollaborationSyncChanges, applyContentSyncChanges, applyPlanningSyncChanges, applyPreparedTaskSyncSnapshot, applyTaskActivitySyncChanges, applyTaskSyncDeletes, classifyWorkspaceSyncChanges, prepareTaskSyncSnapshotApply, } from '../../sync/syncApplyHandlers.js';
 import { applyWorkspaceRepair } from '../../sync/workspaceRepair.js';
 function decodeWorkspaceSyncCursor(raw) {
     const value = String(raw || '').trim();
@@ -60,6 +59,40 @@ function normalizeIncomingAiProfileSurfaceType(value, context) {
     }
     return normalized;
 }
+function normalizeTaskEventSyncPayload(raw, workspaceId, sourceWatermark) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const source = raw;
+    const id = String(source.id || '').trim();
+    const taskId = String(source.taskId || source.task_id || '').trim();
+    const action = String(source.action || '').trim();
+    const actor = String(source.actor || 'system').trim() || 'system';
+    const createdAt = String(source.createdAt || source.created_at || sourceWatermark || '').trim();
+    if (!id || !taskId || !action || !Number.isFinite(Date.parse(createdAt)))
+        return null;
+    const actorType = source.actorType === 'ai' || source.actorType === 'human' || source.actorType === 'system'
+        ? source.actorType
+        : source.actor_type === 'ai' || source.actor_type === 'human' || source.actor_type === 'system'
+            ? source.actor_type
+            : actor.startsWith('ai-profile-')
+                ? 'ai'
+                : actor === 'system'
+                    ? 'system'
+                    : 'human';
+    const details = source.details && typeof source.details === 'object' && !Array.isArray(source.details)
+        ? source.details
+        : {};
+    return {
+        id,
+        taskId,
+        workspaceId,
+        action,
+        actor,
+        actorType,
+        details,
+        createdAt
+    };
+}
 export function registerSyncRoutes(deps) {
     const { addRoute, core, context, auditAuthAction, resolveErrorStatusCode, requestWorkspaceId, resolveRequestAccess, isReservedWorkspaceId, createSessionTokenCookie } = deps;
     const readPushIdempotency = (workspaceId, key) => {
@@ -190,32 +223,7 @@ export function registerSyncRoutes(deps) {
         workspaceDocumentSnapshotCache,
     });
     const collaborationSyncState = createCollaborationSyncState({ core });
-    const hasTaskReferenceNumberDrift = (workspaceId, task) => {
-        const taskId = String(task?.id || '').trim();
-        const incomingReferenceNumber = Number.isFinite(Number(task?.referenceNumber))
-            ? Math.max(1, Math.floor(Number(task?.referenceNumber)))
-            : null;
-        if (!incomingReferenceNumber)
-            return false;
-        const existingTask = core.resolveTaskIdentifier(`T-${incomingReferenceNumber}`, workspaceId);
-        if (!existingTask || existingTask.id === taskId)
-            return false;
-        recordSyncDiagnostic(workspaceId, 'apply', 'Detected task reference number mismatch during normal sync.', {
-            source: 'tasks.referenceNumber.mismatch',
-            taskId: taskId || null,
-            taskTitle: typeof task?.title === 'string' ? task.title.trim() || null : null,
-            existingTaskId: existingTask.id,
-            existingTaskTitle: existingTask.title || null,
-            referenceLabel: `T-${incomingReferenceNumber}`,
-            existingReferenceNumber: existingTask.referenceNumber ?? incomingReferenceNumber,
-            incomingReferenceNumber
-        });
-        return true;
-    };
     const dispatchWorkspaceSyncChanges = async (workspaceId, incomingChanges, options) => {
-        const tasks = [];
-        const archived = [];
-        const incomingTaskDeletes = new Map();
         const emittedEventIds = new Set();
         const unsubscribeRealtime = core.onRealtimeMutation((event) => {
             const eventWorkspaceId = String(event?.workspaceId || '').trim();
@@ -225,224 +233,63 @@ export function registerSyncRoutes(deps) {
             if (eventId)
                 emittedEventIds.add(eventId);
         });
-        let incomingTaxonomies = null;
-        let incomingTaxonomyState = null;
-        let incomingTaxonomiesUpdatedAt = '';
-        const incomingInitiatives = new Map();
-        const incomingWorkstreams = new Map();
-        const incomingAiProfiles = new Map();
-        const incomingDocuments = [];
-        const incomingDocumentDeletes = new Map();
-        const incomingDocumentReviewSessions = new Map();
-        const incomingDocumentReviewSessionDeletes = new Map();
-        const incomingDocumentReviewComments = new Map();
-        const incomingDocumentReviewCommentDeletes = new Map();
-        const incomingAnnotatedAttachmentSessions = new Map();
-        const incomingAnnotatedAttachmentSessionDeletes = new Map();
-        const incomingAssets = [];
-        const incomingAssetDeletes = new Map();
         try {
-            for (const change of incomingChanges) {
-                const raw = change;
-                const op = String(raw.op || '').trim().toLowerCase();
-                if (op === 'taxonomy-upsert') {
-                    const taxonomy = normalizeTaxonomySyncPayload(raw);
-                    if (taxonomy?.taxonomyState)
-                        incomingTaxonomyState = taxonomy.taxonomyState;
-                    if (Array.isArray(taxonomy?.taxonomies))
-                        incomingTaxonomies = taxonomy.taxonomies;
-                    if (taxonomy?.updatedAt)
-                        incomingTaxonomiesUpdatedAt = taxonomy.updatedAt;
-                    continue;
-                }
-                if (op === 'initiative-upsert') {
-                    const initiative = normalizeInitiativeSyncPayload(raw.initiative, String(raw.updatedAt || raw.watermark || '').trim());
-                    if (initiative)
-                        incomingInitiatives.set(initiative.id, initiative);
-                    continue;
-                }
-                if (op === 'workstream-upsert') {
-                    const workstream = normalizeWorkstreamSyncPayload(raw.workstream, String(raw.updatedAt || raw.watermark || '').trim());
-                    if (workstream)
-                        incomingWorkstreams.set(workstream.id, workstream);
-                    continue;
-                }
-                if (op === 'ai-profile-upsert') {
-                    const profile = normalizeAiProfileSyncPayload(raw.profile, workspaceId, normalizeIncomingAiProfileSurfaceType, 'apply.aiProfileUpsert');
-                    const profileId = String(profile?.id || '').trim();
-                    if (profileId && profile) {
-                        const profileWorkspaceId = String(profile.workspaceId || '').trim();
-                        if (profileWorkspaceId && profileWorkspaceId !== workspaceId) {
-                            recordSyncDiagnostic(workspaceId, 'apply', `Rejected ai-profile-upsert for profile ${profileId}: workspace mismatch (expected ${workspaceId}, got ${profileWorkspaceId}).`, {
-                                source: 'apply.aiProfileWorkspaceMismatch',
-                                workspaceId,
-                                profileId,
-                                expectedWorkspaceId: workspaceId,
-                                receivedWorkspaceId: profileWorkspaceId
-                            });
-                            continue;
-                        }
-                        incomingAiProfiles.set(profileId, {
-                            ...profile,
-                            workspaceId,
-                            createdAt: profile.createdAt || String(raw.updatedAt || raw.watermark || '').trim(),
-                            updatedAt: profile.updatedAt || String(raw.updatedAt || raw.watermark || '').trim(),
-                        });
-                    }
-                    continue;
-                }
-                if (op === 'document-upsert') {
-                    const document = normalizeDocumentSyncPayload(raw, normalizeWorkspaceSyncDocumentPath);
-                    if (document)
-                        incomingDocuments.push(document);
-                    continue;
-                }
-                if (op === 'document-delete') {
-                    const deletedDocument = normalizeDocumentDeleteSyncPayload(raw, normalizeWorkspaceSyncDocumentPath);
-                    if (deletedDocument)
-                        incomingDocumentDeletes.set(deletedDocument.path, deletedDocument.deletedAt);
-                    continue;
-                }
-                if (op === 'asset-upsert') {
-                    const asset = normalizeBinaryAssetSyncPayload(raw, (rawPath) => normalizeTaskDataRelativePath(String(rawPath || '').trim()));
-                    if (asset)
-                        incomingAssets.push(asset);
-                    continue;
-                }
-                if (op === 'asset-delete') {
-                    const deletedAsset = normalizeBinaryAssetDeleteSyncPayload(raw, (rawPath) => normalizeTaskDataRelativePath(String(rawPath || '').trim()));
-                    if (deletedAsset)
-                        incomingAssetDeletes.set(deletedAsset.path, deletedAsset.deletedAt);
-                    continue;
-                }
-                if (op === 'document-review-session-upsert') {
-                    const session = normalizeDocumentReviewSessionSyncPayload(raw.session, String(raw.updatedAt || raw.watermark || '').trim());
-                    if (session)
-                        incomingDocumentReviewSessions.set(session.id, session);
-                    continue;
-                }
-                if (op === 'document-review-session-delete') {
-                    const deletedSession = normalizeDeleteSyncPayload(raw, 'sessionId');
-                    if (deletedSession)
-                        incomingDocumentReviewSessionDeletes.set(deletedSession.id, deletedSession.deletedAt);
-                    continue;
-                }
-                if (op === 'document-review-comment-upsert') {
-                    const comment = normalizeDocumentReviewCommentSyncPayload(raw.comment, { sourceWatermark: String(raw.updatedAt || raw.watermark || '').trim() });
-                    if (comment)
-                        incomingDocumentReviewComments.set(comment.id, comment);
-                    continue;
-                }
-                if (op === 'document-review-comment-delete') {
-                    const deletedComment = normalizeDeleteSyncPayload(raw, 'commentId');
-                    if (deletedComment)
-                        incomingDocumentReviewCommentDeletes.set(deletedComment.id, deletedComment.deletedAt);
-                    continue;
-                }
-                if (op === 'annotated-attachment-session-upsert') {
-                    const session = normalizeAnnotatedAttachmentSessionSyncPayload(raw.session, workspaceId, String(raw.updatedAt || raw.watermark || '').trim());
-                    if (session)
-                        incomingAnnotatedAttachmentSessions.set(session.id, session);
-                    continue;
-                }
-                if (op === 'annotated-attachment-session-delete') {
-                    const deletedSession = normalizeDeleteSyncPayload(raw, 'sessionId');
-                    if (deletedSession)
-                        incomingAnnotatedAttachmentSessionDeletes.set(deletedSession.id, deletedSession.deletedAt);
-                    continue;
-                }
-                if (op !== 'delete')
-                    continue;
-                const task = normalizeTaskSyncPayload(raw.task);
-                const deleteTaskId = String(raw.taskId || raw.id || task?.id || '').trim();
-                if (deleteTaskId) {
-                    incomingTaskDeletes.set(deleteTaskId, String(raw.deletedAt || raw.watermark || new Date().toISOString()).trim());
-                }
-            }
-            for (const change of incomingChanges) {
-                const raw = change;
-                const op = String(raw.op || '').trim().toLowerCase();
-                if (op === 'delete'
-                    || op === 'initiative-upsert'
-                    || op === 'workstream-upsert'
-                    || op === 'document-upsert'
-                    || op === 'document-delete'
-                    || op === 'asset-upsert'
-                    || op === 'asset-delete'
-                    || op === 'document-review-session-upsert'
-                    || op === 'document-review-session-delete'
-                    || op === 'document-review-comment-upsert'
-                    || op === 'document-review-comment-delete'
-                    || op === 'annotated-attachment-session-upsert'
-                    || op === 'annotated-attachment-session-delete')
-                    continue;
-                const task = normalizeTaskSyncPayload(raw.task);
-                if (!task)
-                    continue;
-                const taskId = String(task.id || '').trim();
-                hasTaskReferenceNumberDrift(workspaceId, task);
-                const deleteWatermark = taskId ? String(incomingTaskDeletes.get(taskId) || '').trim() : '';
-                if (taskId && deleteWatermark) {
-                    const compareAgainstDelete = resolveSyncConflictOrdering(deleteWatermark, String(task.updatedAt || task.createdAt || '').trim(), `delete:${taskId}`, getTaskMutationTieBreak(task, raw.archived === true || task?.isArchived === true));
-                    if (compareAgainstDelete >= 0)
-                        continue;
-                }
-                const markedArchived = raw.archived === true || task?.isArchived === true;
-                if (markedArchived)
-                    archived.push(task);
-                else
-                    tasks.push(task);
-            }
-            for (const [taskId, deleteWatermark] of incomingTaskDeletes.entries()) {
-                try {
-                    const existingTask = core.getTask(taskId, workspaceId);
-                    if (existingTask) {
-                        const compareAgainstExisting = resolveSyncConflictOrdering(deleteWatermark, getTaskMutationWatermark(existingTask), `delete:${taskId}`, getTaskMutationTieBreak(existingTask, Boolean(existingTask.isArchived)));
-                        if (compareAgainstExisting < 0)
-                            continue;
-                    }
-                    core.deleteTaskForSync(taskId, workspaceId, { persistBackup: false });
-                }
-                catch (error) {
-                    recordSyncDiagnostic(workspaceId, 'apply', 'Failed to delete task during sync apply.', {
-                        source: 'apply.deleteTask',
-                        taskId,
-                        error: String(error?.message || error || '')
-                    });
-                }
-            }
+            const applyModel = classifyWorkspaceSyncChanges({
+                workspaceId,
+                incomingChanges,
+                normalizeWorkspaceSyncDocumentPath,
+                normalizeTaskAssetPath: (rawPath) => normalizeTaskDataRelativePath(String(rawPath || '').trim()),
+                normalizeIncomingAiProfileSurfaceType,
+                normalizeTaskEventSyncPayload,
+                recordSyncDiagnostic,
+            });
             applyPlanningSyncChanges({
                 core,
                 workspaceId,
-                incomingInitiatives,
-                incomingWorkstreams,
-                incomingTaxonomies,
-                incomingTaxonomyState,
-                incomingTaxonomiesUpdatedAt,
+                incomingInitiatives: applyModel.planning.incomingInitiatives,
+                incomingWorkstreams: applyModel.planning.incomingWorkstreams,
+                incomingTaxonomies: applyModel.planning.incomingTaxonomies,
+                incomingTaxonomyState: applyModel.planning.incomingTaxonomyState,
+                incomingTaxonomiesUpdatedAt: applyModel.planning.incomingTaxonomiesUpdatedAt,
                 workspaceTaxonomySyncMeta,
                 recordSyncDiagnostic,
             });
             applyAiProfileAndMemberSyncChanges({
                 core,
                 workspaceId,
-                incomingAiProfiles,
+                incomingAiProfiles: applyModel.profiles.incomingAiProfiles,
                 workspaceMembers: options?.workspaceMembers,
                 recordSyncDiagnostic,
                 assertSyncedAiProfilesPersisted,
                 createSyncRouteError,
             });
-            validateTaskActorAssignments(workspaceId, tasks, archived);
+            const preparedTaskSnapshot = prepareTaskSyncSnapshotApply({
+                core,
+                workspaceId,
+                taskMutations: applyModel.taskMutations,
+                recordSyncDiagnostic,
+            });
+            validateTaskActorAssignments(workspaceId, preparedTaskSnapshot.tasks, preparedTaskSnapshot.archived);
             await applyContentSyncChanges({
                 core,
                 workspaceId,
-                incomingDocuments,
-                incomingDocumentDeletes,
-                incomingAssets,
-                incomingAssetDeletes,
+                incomingDocuments: applyModel.content.incomingDocuments,
+                incomingDocumentDeletes: applyModel.content.incomingDocumentDeletes,
+                incomingAssets: applyModel.content.incomingAssets,
+                incomingAssetDeletes: applyModel.content.incomingAssetDeletes,
                 basePath: core.getPaths().basePath,
                 hasObjectStorageClient: () => Boolean(getObjectStorageClient()),
                 hasDocumentSyncMetadataDrift: contentSyncState.hasDocumentSyncMetadataDrift,
                 hasBinaryAssetSyncMetadataDrift: contentSyncState.hasBinaryAssetSyncMetadataDrift,
+                getExistingDocument: (docPath, targetWorkspaceId) => {
+                    const asset = workspaceAssetStore?.getByStorageKey(docPath, targetWorkspaceId) || null;
+                    return asset
+                        ? {
+                            updatedAt: asset.updatedAt,
+                            contentHash: asset.contentSha256
+                        }
+                        : null;
+                },
                 writeWorkspaceSyncDocument: contentSyncState.writeWorkspaceSyncDocument,
                 deleteWorkspaceSyncDocument: contentSyncState.deleteWorkspaceSyncDocument,
                 writeWorkspaceSyncBinaryAsset: contentSyncState.writeWorkspaceSyncBinaryAsset,
@@ -454,20 +301,34 @@ export function registerSyncRoutes(deps) {
             applyCollaborationSyncChanges({
                 core,
                 workspaceId,
-                incomingDocumentReviewSessions,
-                incomingDocumentReviewSessionDeletes,
-                incomingDocumentReviewComments,
-                incomingDocumentReviewCommentDeletes,
-                incomingAnnotatedAttachmentSessions,
-                incomingAnnotatedAttachmentSessionDeletes,
+                incomingDocumentReviewSessions: applyModel.collaboration.incomingDocumentReviewSessions,
+                incomingDocumentReviewSessionDeletes: applyModel.collaboration.incomingDocumentReviewSessionDeletes,
+                incomingDocumentReviewComments: applyModel.collaboration.incomingDocumentReviewComments,
+                incomingDocumentReviewCommentDeletes: applyModel.collaboration.incomingDocumentReviewCommentDeletes,
+                incomingAnnotatedAttachmentSessions: applyModel.collaboration.incomingAnnotatedAttachmentSessions,
+                incomingAnnotatedAttachmentSessionDeletes: applyModel.collaboration.incomingAnnotatedAttachmentSessionDeletes,
                 recordSyncDiagnostic,
                 createSyncRouteError,
             });
-            const result = core.applyWorkspaceSyncSnapshot({
-                tasks: tasks.map(taskSyncPayloadToCoreTask),
-                archived: archived.map(taskSyncPayloadToCoreTask)
-            }, workspaceId);
-            return { result, deleteCount: incomingTaskDeletes.size, emittedEventIds: Array.from(emittedEventIds) };
+            const deleteCount = applyTaskSyncDeletes({
+                core,
+                workspaceId,
+                taskMutations: applyModel.taskMutations,
+                recordSyncDiagnostic,
+            });
+            const result = applyPreparedTaskSyncSnapshot({
+                core,
+                workspaceId,
+                prepared: preparedTaskSnapshot,
+            });
+            applyTaskActivitySyncChanges({
+                core,
+                workspaceId,
+                incomingTaskEvents: applyModel.taskActivity.incomingTaskEvents,
+                recordSyncDiagnostic,
+                createSyncRouteError,
+            });
+            return { result, deleteCount, emittedEventIds: Array.from(emittedEventIds) };
         }
         finally {
             unsubscribeRealtime();
@@ -771,10 +632,18 @@ export function registerSyncRoutes(deps) {
                 })),
                 ...incomingDocuments
                     .map((doc) => serializeDocumentSyncPayload(doc))
-                    .filter((doc) => Boolean(doc && doc.path.length > 0)),
+                    .filter((doc) => Boolean(doc && doc.path.length > 0))
+                    .map((doc) => ({
+                    op: 'document-upsert',
+                    ...doc
+                })),
                 ...incomingAssets
                     .map((asset) => serializeBinaryAssetSyncPayload(asset))
-                    .filter((asset) => Boolean(asset && asset.path.length > 0 && asset.contentBase64.length > 0)),
+                    .filter((asset) => Boolean(asset && asset.path.length > 0 && asset.contentBase64.length > 0))
+                    .map((asset) => ({
+                    op: 'asset-upsert',
+                    ...asset
+                })),
                 ...incomingDocumentReviewSessions
                     .map((session) => normalizeDocumentReviewSessionSyncPayload(session))
                     .filter((session) => Boolean(session && session.id.length > 0 && session.assetId.length > 0))
@@ -1060,7 +929,7 @@ export function registerSyncRoutes(deps) {
         const pageSize = Number.isFinite(requestedLimit) && requestedLimit > 0
             ? Math.max(1, Math.min(500, Math.floor(requestedLimit)))
             : 200;
-        const { workspaceMembers, changes, nextCursor, hasMore } = await buildWorkspacePullFeed({
+        const { workspaceMembers, changes, nextCursor, hasMore, diagnostics } = await buildWorkspacePullFeed({
             core,
             workspaceId: targetWorkspaceId,
             cursor,
@@ -1076,12 +945,14 @@ export function registerSyncRoutes(deps) {
             workspaceMembers,
             changes,
             nextCursor,
-            hasMore
+            hasMore,
+            diagnostics
         }));
         auditAuthAction(req, 'sync-workspace-pull-success', {
             workspaceId: targetWorkspaceId,
             returnedChanges: changes.length,
-            hasMore
+            hasMore,
+            diagnostics
         });
     });
     // POST /api/taskforce/sync/workspace/apply-local - Apply pulled cloud deltas into local workspace store
@@ -1247,6 +1118,10 @@ export function registerSyncRoutes(deps) {
             }
         }
         let incomingChanges = Array.isArray(body?.changes) ? body.changes : [];
+        const incomingTaskUpsertIds = incomingChanges
+            .filter((change) => change?.op === 'upsert')
+            .map((change) => String(change.task?.id || '').trim())
+            .filter((taskId) => taskId.length > 0);
         const allowReferenceNumberReassignment = body?.repair === true;
         // Decrypt asset and document content if TASKFORCE_SYNC_KEY is configured on this server.
         // The local runtime encrypts content before pushing; the cloud must decrypt before writing to storage.
@@ -1301,12 +1176,20 @@ export function registerSyncRoutes(deps) {
             const { result, deleteCount, emittedEventIds } = await dispatchWorkspaceSyncChanges(targetWorkspaceId, incomingChanges, {
                 allowReferenceNumberReassignment
             });
+            const appliedTaskUpserts = incomingTaskUpsertIds
+                .map((taskId) => core.getTask(taskId, targetWorkspaceId))
+                .filter((task) => Boolean(task))
+                .map((task) => ({
+                archived: Boolean(task.isArchived),
+                task: serializeTaskForSync(task)
+            }));
             const durationMs = Date.now() - startedAtMs;
             const payload = JSON.stringify({
                 success: true,
                 workspaceId: targetWorkspaceId,
                 idempotencyKey: idempotencyKey || null,
                 emittedEventIds,
+                appliedTaskUpserts,
                 result,
                 durationMs
             });

package/dist/server/routes/tasks.js

@@ -55,10 +55,18 @@ import { getRuntimeCapabilities } from '../../runtime/capabilities.js';
 import { resolveBuildInfo } from '../buildInfo.js';
 import { resolveRealtimeSyncFlag } from '../../sync/realtimeFeature.js';
 import { parseJsonBody } from '../routes.js';
+import { resolveRequestAccess } from '../auth.js';
 import { resolveErrorStatusCode, requestHeader, requestRuntimeMode } from './shared.js';
 import { listBuiltInCustomTaxonomyLibraryPacks } from '../../shared/customTaxonomyLibrary.js';
 import { listBuiltInTaxonomyLibraryPacks } from '../../shared/taxonomyLibrary.js';
 import { shouldUseProvisionalTaskReferences } from '../../utils/taskReferences.js';
+function createUiStateRequestId() {
+    return `ui-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function attachUiStateDebugHeaders(res, requestId) {
+    res.setHeader('x-taskforce-ui-state-route', 'tasks');
+    res.setHeader('x-taskforce-ui-state-request-id', requestId);
+}
 // === SECTION: Registration ===
 export function registerTaskRoutes(deps) {
     const { addRoute, core, context, requestWorkspaceId, ensureAppAccess, resolveEffectiveObjectStorageConfig, buildBatchSummary, CLOUD_SAFE_CONFIG_PATHS, } = deps;
@@ -155,16 +163,31 @@ export function registerTaskRoutes(deps) {
             || ((isLocalRuntime && allowCreate && !explicitWorkspaceId) ? '' : headerWorkspaceId)).trim() || 'default';
         try {
             const workspaceExists = Boolean(core.getWorkspaceProfile(incomingWorkspaceId));
+            const authConfig = context.authConfig;
+            const requestAccess = authConfig?.enabled
+                ? resolveRequestAccess(req, authConfig)
+                : null;
             const shouldCreateWorkspace = Boolean(name
                 && (incomingWorkspaceId === 'default' || !workspaceExists)
                 && (isLocalRuntime || allowCreate));
             const workspace = shouldCreateWorkspace
-                ? core.createWorkspace({
-                    workspaceId: incomingWorkspaceId === 'default' ? undefined : incomingWorkspaceId,
-                    name,
-                    description,
-                    slug
-                })
+                ? (!isLocalRuntime
+                    && requestAccess?.authenticated
+                    && requestAccess.userId
+                    && requestAccess.userId !== 'anonymous'
+                    ? core.createWorkspaceForUser({
+                        userId: requestAccess.userId,
+                        preferredWorkspaceId: incomingWorkspaceId === 'default' ? undefined : incomingWorkspaceId,
+                        name,
+                        description,
+                        role: 'owner'
+                    })
+                    : core.createWorkspace({
+                        workspaceId: incomingWorkspaceId === 'default' ? undefined : incomingWorkspaceId,
+                        name,
+                        description,
+                        slug
+                    }))
                 : core.updateWorkspaceProfile(incomingWorkspaceId, { name, description, slug });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: true, workspace }));
@@ -179,6 +202,9 @@ export function registerTaskRoutes(deps) {
     addRoute('GET', '/api/taskforce/ui-state', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
+        const requestId = createUiStateRequestId();
+        const startedAt = Date.now();
+        attachUiStateDebugHeaders(res, requestId);
         try {
             const url = new URL(req.url || '/', 'http://localhost');
             const requestedWorkspaceId = String(url.searchParams.get('workspaceId') || '').trim();
@@ -194,6 +220,12 @@ export function registerTaskRoutes(deps) {
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error, 400);
+            console.warn('[Taskforce][ui-state] GET failed', {
+                requestId,
+                durationMs: Date.now() - startedAt,
+                error: String(error?.message || 'Failed to read UI state'),
+                path: req.url || '/api/taskforce/ui-state'
+            });
             res.writeHead(statusCode, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: String(error?.message || 'Failed to read UI state') }));
         }
@@ -202,6 +234,9 @@ export function registerTaskRoutes(deps) {
     addRoute('POST', '/api/taskforce/ui-state', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
+        const requestId = createUiStateRequestId();
+        const startedAt = Date.now();
+        attachUiStateDebugHeaders(res, requestId);
         const body = await parseJsonBody(req);
         try {
             const requestedWorkspaceId = String(body?.workspaceId || '').trim();
@@ -222,6 +257,13 @@ export function registerTaskRoutes(deps) {
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error, 400);
+            console.warn('[Taskforce][ui-state] POST failed', {
+                requestId,
+                durationMs: Date.now() - startedAt,
+                error: String(error?.message || 'Failed to merge UI state'),
+                path: req.url || '/api/taskforce/ui-state',
+                stateKey: String(body?.stateKey || body?.key || '').trim() || 'default'
+            });
             res.writeHead(statusCode, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: String(error?.message || 'Failed to merge UI state') }));
         }
@@ -398,7 +440,7 @@ export function registerTaskRoutes(deps) {
                 : body;
             const updated = core.updateTask(params.id, updates, workspaceId, {
                 actorRef: 'user',
-                skipTaskEvents: saveSource === 'autosave'
+                saveSource
             });
             if (!updated) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });

package/dist/server/routes.js

@@ -34,7 +34,7 @@ import { registerResourceRoutes } from './routes/resources.js';
 import { registerDocumentRoutes } from './routes/documents.js';
 import { registerDocumentReviewRoutes } from './routes/documentReviews.js';
 import { registerAnnotatedAttachmentRoutes } from './routes/annotatedAttachments.js';
-import { requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, ensureWorkspaceAdminRole, } from './routes/shared.js';
+import { buildCloudMcpRuntimeAuth, requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, ensureWorkspaceAdminRole, } from './routes/shared.js';
 import { resolveDeploymentConfig } from '../config/deployment.js';
 import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl } from '../config/cloudEnvironment.js';
 import { getCanonicalDocumentName } from '../utils/documentNames.js';
@@ -345,7 +345,7 @@ export function createRoutes(core, context = {}) {
         const authSettings = globalSettings.auth || {};
         const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
         const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const signupSettings = core.getSignupMonetizationSettings();
+        const onboardingPolicy = core.getOnboardingPolicy();
         return {
             allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
             requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
@@ -357,8 +357,8 @@ export function createRoutes(core, context = {}) {
             authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
                 ? Math.floor(authRateLimitWindowMsRaw)
                 : 15 * 60_000,
-            signupMonetizationStrategy: signupSettings.strategy,
-            defaultSignupPlanVersionId: signupSettings.defaultSignupPlanVersionId
+            onboardingPolicyMode: onboardingPolicy.mode,
+            onboardingPlanVersionId: onboardingPolicy.planVersionId
         };
     };
     const deliverAuthEmail = async (kind, email, token, req) => {
@@ -372,7 +372,7 @@ export function createRoutes(core, context = {}) {
             ? 'Verify your Taskforce account'
             : 'Reset your Taskforce password';
         const text = kind === 'verify-email'
-            ? `Welcome to Taskforce.\n\nVerify your email by opening this link:\n${link}\n\nIf you did not create an account, you can ignore this message.`
+            ? `Welcome to Taskforce.\n\nYou're almost in. Enter this verification token on the verification screen to activate your account:\n\n${token}\n\nPrefer the faster route? Open the link below to verify your email automatically:\n${link}\n\nIf you didn't create a Taskforce account, you can safely ignore this email.`
             : `Reset your Taskforce password using this link:\n${link}\n\nIf you did not request this reset, you can ignore this message.`;
         const result = await sendEmail({
             to: email,
@@ -1458,24 +1458,13 @@ export function createRoutes(core, context = {}) {
                 serverName: 'taskforce-cloud',
                 logStartup: false,
                 runtimeMode: 'cloud',
-                auth: {
-                    scopes: authScopes,
-                    userId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || null,
-                    tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
-                    aiProfileToken: auth.aiProfileToken,
-                    aiProfileName: auth.aiProfileName,
-                    aiProfileIcon: auth.aiProfileIcon,
-                    aiProfileColor: auth.aiProfileColor,
-                    aiProfileDescription: auth.aiProfileDescription,
-                    aiProfileRole: auth.aiProfileRole,
-                    aiProfileProvider: auth.aiProfileProvider,
-                    aiProfileModel: auth.aiProfileModel,
-                    aiProfileSurfaceType: auth.aiProfileSurfaceType,
-                    actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                auth: buildCloudMcpRuntimeAuth({
+                    req,
+                    auth,
+                    requestHeader,
                     requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
-                    ip: req.socket?.remoteAddress || null,
-                    userAgent: requestHeader(req, 'user-agent', '') || null,
-                },
+                    authScopes,
+                }),
             });
             const transport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,