@taskforcehq/taskforce 0.3.302 → 0.3.304

package/dist/server/routes.test.js

@@ -10,6 +10,7 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import * as mcpRuntime from '../mcp/runtime';
 import { createDatabaseAdapter } from '../storage/createDatabaseAdapter.js';
 import { ensureDocumentReferenceSchema, ensureTaskAssetsSchema, ensureWorkspaceAssetsSchema } from '../migrations/taskSchemaMigrations.js';
+import { ObjectStorageClient } from '../storage/objectStorageClient.js';
 import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 // Mock TaskforceCore
 vi.mock('../core/Taskforce', () => {
@@ -159,10 +160,13 @@ vi.mock('../core/Taskforce', () => {
             listDocumentReviewSessionsForSync = vi.fn().mockReturnValue([]);
             listDocumentReviewCommentsForSync = vi.fn().mockReturnValue([]);
             listAnnotatedAttachmentSessionsForSync = vi.fn().mockReturnValue([]);
+            listTaskEventsForSync = vi.fn().mockReturnValue([]);
+            listTaskEvents = vi.fn().mockReturnValue([]);
             getDocumentReviewSession = vi.fn().mockReturnValue(null);
             upsertAiProfileForSync = vi.fn();
             upsertDocumentReviewSessionForSync = vi.fn();
             upsertDocumentReviewCommentForSync = vi.fn();
+            upsertTaskEventForSync = vi.fn();
             deleteDocumentReviewSessionForSync = vi.fn().mockReturnValue(true);
             deleteDocumentReviewCommentForSync = vi.fn().mockReturnValue(true);
             deleteAnnotatedAttachmentSessionForSync = vi.fn().mockReturnValue(true);
@@ -236,6 +240,7 @@ vi.mock('../core/Taskforce', () => {
             setSystemRole = vi.fn().mockReturnValue(true);
             setUserDisabledGlobal = vi.fn().mockReturnValue(true);
             setUserBetaAccessGlobal = vi.fn().mockReturnValue(true);
+            purgeSystemUser = vi.fn();
             updateWorkspaceUserRole = vi.fn();
             inviteWorkspaceUser = vi.fn();
             updateWorkspaceProfile = vi.fn().mockImplementation((workspaceId, input) => ({
@@ -262,17 +267,16 @@ vi.mock('../core/Taskforce', () => {
             revokeInviteAcceptanceForUser = vi.fn().mockReturnValue({ revoked: 1 });
             getWorkspacePlanMode = vi.fn().mockReturnValue('team');
             setWorkspacePlanMode = vi.fn().mockImplementation((_workspaceId, mode) => mode);
-            getSignupMonetizationSettings = vi.fn().mockReturnValue({
-                strategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: null
+            getOnboardingPolicy = vi.fn().mockReturnValue({
+                mode: 'require_plan_selection',
+                planVersionId: null
             });
-            validateSignupMonetizationSettings = vi.fn().mockReturnValue({ valid: true });
+            validateOnboardingPolicy = vi.fn().mockReturnValue({ valid: true });
             getAccountAccessStatus = vi.fn().mockReturnValue({
                 gate: 'ok',
                 hasEntitlement: true,
                 canAccessApp: true,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'auto_assign_default',
                 planSelectionRequired: false,
                 message: null,
                 entitlement: {
@@ -434,6 +438,7 @@ vi.mock('../core/Taskforce', () => {
             ]);
             hasWorkspaceAdmin = vi.fn().mockReturnValue(true);
             registerPasswordUser = vi.fn();
+            isEmailVerified = vi.fn().mockReturnValue(false);
             requestEmailVerification = vi.fn().mockReturnValue({});
             verifyEmailWithToken = vi.fn().mockReturnValue(false);
             markEmailVerified = vi.fn().mockReturnValue(true);
@@ -892,6 +897,8 @@ describe('Server Routes', () => {
                 auth: expect.objectContaining({
                     aiProfileName: 'Automation Codex',
                     aiProfileToken: 'tfp_automation_codex',
+                    aiProfileIcon: 'Code2',
+                    aiProfileColor: '#10a37f',
                     aiProfileDescription: 'OpenAI Codex coding agent connected through MCP.',
                     aiProfileRole: 'Coding Agent',
                     aiProfileProvider: 'OpenAI',
@@ -1600,6 +1607,17 @@ describe('Server Routes', () => {
             });
             expect(core.updateUiState).not.toHaveBeenCalledWith('workspace-denied', expect.anything(), expect.anything());
         });
+        it('POST /api/taskforce/ui-state should stamp debug response headers', async () => {
+            const match = matchRoute('POST', '/api/taskforce/ui-state', routes);
+            const req = createMockReq('POST', '/api/taskforce/ui-state', {
+                stateKey: 'app',
+                patch: { activeWorkspaceModule: 'tasks' }
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.setHeader).toHaveBeenCalledWith('x-taskforce-ui-state-route', 'tasks');
+            expect(res.setHeader).toHaveBeenCalledWith('x-taskforce-ui-state-request-id', expect.stringMatching(/^ui-/));
+        });
         it('POST /api/taskforce/workspace-profile should persist workspace name and description', async () => {
             const match = matchRoute('POST', '/api/taskforce/workspace-profile', routes);
             const req = createMockReq('POST', '/api/taskforce/workspace-profile', { workspaceId: 'default', name: 'Acme Project', description: 'Customer onboarding' }, { 'x-taskforce-workspace-id': 'default' });
@@ -3673,7 +3691,7 @@ describe('Server Routes', () => {
                     process.env.VITE_TASKFORCE_API_BASE_URL = previousApiBaseUrl;
             }
         });
-        it('POST /api/taskforce/auth/register should create account and set session cookie', async () => {
+        it('POST /api/taskforce/auth/register should create account without a session cookie when verification is required', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3706,6 +3724,7 @@ describe('Server Routes', () => {
                 email: 'owner@example.com',
                 role: 'owner'
             }));
+            expect(res.setHeader).not.toHaveBeenCalledWith('Set-Cookie', expect.any(String));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"verificationRequired":true'));
         });
@@ -3741,7 +3760,7 @@ describe('Server Routes', () => {
                 workspaceId: undefined,
                 role: 'member'
             }));
-            expect(res.setHeader).toHaveBeenCalledWith('Set-Cookie', expect.stringContaining('taskforce_session='));
+            expect(res.setHeader).not.toHaveBeenCalledWith('Set-Cookie', expect.any(String));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"workspaceSetupRequired":true'));
         });
@@ -3780,6 +3799,7 @@ describe('Server Routes', () => {
             const res = createMockRes();
             await match?.handler(req, res, {});
             expect(core.requestEmailVerification).not.toHaveBeenCalled();
+            expect(res.setHeader).toHaveBeenCalledWith('Set-Cookie', expect.stringContaining('taskforce_session='));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"verificationRequired":false'));
         });
@@ -3819,7 +3839,49 @@ describe('Server Routes', () => {
             }));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
         });
-        it('POST /api/taskforce/auth/register should return conflict when email exists', async () => {
+        it('POST /api/taskforce/auth/register should route duplicate unverified email into verification recovery', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.hasWorkspaceAdmin.mockReturnValueOnce(true);
+            core.isEmailVerified.mockReturnValueOnce(false);
+            core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-existing' });
+            const error = new Error('Email is already registered');
+            error.statusCode = 409;
+            error.code = 'EMAIL_ALREADY_EXISTS';
+            core.registerPasswordUser.mockImplementationOnce(() => {
+                throw error;
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/register', {
+                email: 'owner@example.com',
+                password: 'password123',
+                workspaceId: 'workspace-1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.isEmailVerified).toHaveBeenCalledWith('owner@example.com');
+            expect(core.requestEmailVerification).toHaveBeenCalledWith({ email: 'owner@example.com' });
+            expect(res.writeHead).toHaveBeenCalledWith(409, expect.any(Object));
+            const responsePayload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+            expect(responsePayload).toEqual(expect.objectContaining({
+                success: false,
+                code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                verificationRequired: true,
+                emailSent: true,
+                verificationToken: 'verify-token-existing'
+            }));
+        });
+        it('POST /api/taskforce/auth/register should return conflict when verified email exists', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3833,6 +3895,7 @@ describe('Server Routes', () => {
             };
             routes = createRoutes(core, { authConfig });
             core.hasWorkspaceAdmin.mockReturnValueOnce(true);
+            core.isEmailVerified.mockReturnValueOnce(true);
             const error = new Error('Email is already registered');
             error.statusCode = 409;
             error.code = 'EMAIL_ALREADY_EXISTS';
@@ -3847,6 +3910,8 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             await match?.handler(req, res, {});
+            expect(core.isEmailVerified).toHaveBeenCalledWith('owner@example.com');
+            expect(core.requestEmailVerification).not.toHaveBeenCalled();
             expect(res.writeHead).toHaveBeenCalledWith(409, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
                 success: false,
@@ -3854,7 +3919,7 @@ describe('Server Routes', () => {
                 code: 'EMAIL_ALREADY_EXISTS'
             }));
         });
-        it('POST /api/taskforce/auth/register should fail when signup monetization is misconfigured', async () => {
+        it('POST /api/taskforce/auth/register should fail when the onboarding policy is misconfigured', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3867,7 +3932,7 @@ describe('Server Routes', () => {
                 sessionTtlSeconds: 3600
             };
             routes = createRoutes(core, { authConfig });
-            const error = new Error('Configured default signup plan version "missing-v9" was not found.');
+            const error = new Error('Configured onboarding plan version "missing-v9" was not found.');
             error.statusCode = 500;
             error.code = 'SIGNUP_PLAN_VERSION_NOT_FOUND';
             core.registerPasswordUser.mockImplementationOnce(() => {
@@ -3883,7 +3948,7 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(500, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
                 success: false,
-                error: 'Configured default signup plan version "missing-v9" was not found.',
+                error: 'Configured onboarding plan version "missing-v9" was not found.',
                 code: 'SIGNUP_PLAN_VERSION_NOT_FOUND'
             }));
         });
@@ -3900,12 +3965,19 @@ describe('Server Routes', () => {
                 sessionTtlSeconds: 3600
             };
             routes = createRoutes(core, { authConfig });
+            core.inspectOneTimeAuthToken = vi.fn().mockReturnValueOnce({
+                state: 'valid',
+                userId: 'u-verify',
+                workspaceId: 'workspace-1'
+            });
             core.verifyEmailWithToken.mockReturnValueOnce(true);
             const match = matchRoute('POST', '/api/taskforce/auth/verify-email/confirm', routes);
             const req = createMockReq('POST', '/api/taskforce/auth/verify-email/confirm', { token: 'tok1' });
             const res = createMockRes();
             await match?.handler(req, res, {});
+            expect(core.inspectOneTimeAuthToken).toHaveBeenCalledWith('tok1', 'email_verification');
             expect(core.verifyEmailWithToken).toHaveBeenCalledWith('tok1');
+            expect(res.setHeader).toHaveBeenCalledWith('Set-Cookie', expect.stringContaining('taskforce_session='));
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/auth/password-reset/confirm should set new password', async () => {
@@ -4779,10 +4851,10 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
-                archived: [{ id: 'task-2', title: 'Task 2', isArchived: true }]
-            }, 'workspace-1');
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
+                archived: [expect.objectContaining({ id: 'task-2', title: 'Task 2', isArchived: true })]
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"success":true'));
             expect(core.addAdminAuditLog).toHaveBeenCalledWith(expect.objectContaining({
@@ -6427,10 +6499,10 @@ describe('Server Routes', () => {
             const res = createMockRes();
             await match?.handler(req, res, {});
             expect(core.deleteTaskForSync).toHaveBeenCalledWith('task-2', 'workspace-local', { persistBackup: false });
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
                 archived: []
-            }, 'workspace-local');
+            }), 'workspace-local');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/apply-local should apply document review session upserts and deletes', async () => {
@@ -6522,6 +6594,77 @@ describe('Server Routes', () => {
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
+        it('POST /api/taskforce/sync/workspace/apply-local should apply task event upserts after task snapshots', async () => {
+            core.resolvePreferredWorkspaceId.mockReturnValue('workspace-local');
+            core.getTask.mockImplementation((taskId) => (taskId === 'task-sync-activity-1'
+                ? {
+                    id: 'task-sync-activity-1',
+                    title: 'Synced task',
+                    status: 'done',
+                    category: 'general',
+                    type: 'task',
+                    createdAt: '2026-03-24T10:00:00.000Z',
+                    updatedAt: '2026-03-24T10:05:00.000Z',
+                    taskEvents: []
+                }
+                : null));
+            routes = createRoutes(core, { authConfig: { runtimeMode: 'local', enabled: false } });
+            const match = matchRoute('POST', '/api/taskforce/sync/workspace/apply-local', routes);
+            const req = createMockReq('POST', '/api/taskforce/sync/workspace/apply-local', {
+                changes: [
+                    {
+                        op: 'upsert',
+                        archived: false,
+                        task: {
+                            id: 'task-sync-activity-1',
+                            title: 'Synced task',
+                            status: 'done',
+                            category: 'general',
+                            type: 'task',
+                            updatedAt: '2026-03-24T10:05:00.000Z'
+                        }
+                    },
+                    {
+                        op: 'task-event-upsert',
+                        event: {
+                            id: 'task-event-sync-1',
+                            taskId: 'task-sync-activity-1',
+                            workspaceId: 'workspace-local',
+                            action: 'task-status-changed',
+                            actor: 'ai-profile-1',
+                            actorType: 'ai',
+                            createdAt: '2026-03-24T10:05:00.000Z',
+                            details: {
+                                changes: {
+                                    status: {
+                                        from: 'in-progress',
+                                        to: 'done'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                ]
+            }, {
+                'x-taskforce-workspace-id': 'workspace-local'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-sync-activity-1' })],
+                archived: []
+            }), 'workspace-local');
+            expect(core.upsertTaskEventForSync).toHaveBeenCalledWith(expect.objectContaining({
+                id: 'task-event-sync-1',
+                taskId: 'task-sync-activity-1',
+                workspaceId: 'workspace-local',
+                action: 'task-status-changed',
+                actor: 'ai-profile-1',
+                actorType: 'ai',
+                createdAt: '2026-03-24T10:05:00.000Z'
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+        });
         it('POST /api/taskforce/sync/workspace/apply-local should fail when document review session persistence fails', async () => {
             core.resolvePreferredWorkspaceId.mockReturnValue('workspace-local');
             const error = new Error('document review session write failed');
@@ -6868,10 +7011,10 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-shared-1', title: 'Shared task' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-shared-1', title: 'Shared task' })],
                 archived: []
-            }, 'workspace-shared-local');
+            }), 'workspace-shared-local');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/apply-local should route archived upserts and preserve canceledReason', async () => {
@@ -6898,17 +7041,17 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
                 tasks: [],
-                archived: [{
+                archived: [expect.objectContaining({
                         id: 'task-archived-cancelled',
                         title: 'Cancelled + Archived',
                         status: 'cancelled',
                         canceledReason: 'Scope changed',
                         workstreamId: 'workstream-archived-1',
                         isArchived: true
-                    }]
-            }, 'workspace-local');
+                    })]
+            }), 'workspace-local');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/apply-local should prioritize delete over same-task upsert', async () => {
@@ -7575,10 +7718,10 @@ describe('Server Routes', () => {
             }, { cookie });
             const res1 = createMockRes();
             await match?.handler(req1, res1, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
                 archived: []
-            }, 'workspace-1');
+            }), 'workspace-1');
             expect(res1.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             const firstPayload = JSON.parse(String(res1.end.mock.calls.at(-1)?.[0] || '{}'));
             expect(Array.isArray(firstPayload.emittedEventIds)).toBe(true);
@@ -7780,10 +7923,10 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
                 archived: []
-            }, 'workspace-local-active');
+            }), 'workspace-local-active');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(core.listUserWorkspaces).toHaveBeenCalledWith('user-1');
         });
@@ -8060,15 +8203,15 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({
                         id: 'task-cancelled-1',
                         title: 'Cancelled Task',
                         status: 'cancelled',
                         canceledReason: 'No longer needed'
-                    }],
+                    })],
                 archived: []
-            }, 'workspace-1');
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/push should preserve workstreamId in upsert payload', async () => {
@@ -8109,15 +8252,15 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({
                         id: 'task-workstream-1',
                         title: 'Linked task',
                         status: 'task',
                         workstreamId: 'workstream-1'
-                    }],
+                    })],
                 archived: []
-            }, 'workspace-1');
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/push should route archived upserts into archived snapshot list', async () => {
@@ -8158,15 +8301,15 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
                 tasks: [],
-                archived: [{
+                archived: [expect.objectContaining({
                         id: 'task-archived-1',
                         title: 'Archived Task',
                         workstreamId: 'workstream-archived-1',
                         isArchived: true
-                    }]
-            }, 'workspace-1');
+                    })]
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('GET /api/taskforce/sync/workspace/pull should include canceledReason and archived marker in response payload', async () => {
@@ -8292,7 +8435,7 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             const response = JSON.parse(String(res.end.mock.calls[0]?.[0] || '{}'));
             const changes = Array.isArray(response?.changes) ? response.changes : [];
-            expect(changes).toContainEqual({
+            expect(changes).toContainEqual(expect.objectContaining({
                 op: 'taxonomy-upsert',
                 taxonomyState: {
                     categories: [{ value: 'default', label: 'General' }],
@@ -8328,8 +8471,9 @@ describe('Server Routes', () => {
                         filterEnabled: true,
                         sortEnabled: true
                     }],
+                updatedAt: '2026-02-22T10:00:00.000Z',
                 watermark: '2026-02-22T10:00:00.000Z'
-            });
+            }));
         });
         it('POST /api/taskforce/workspaces should create workspace for authenticated user', async () => {
             const authConfig = {
@@ -8761,6 +8905,73 @@ describe('Server Routes', () => {
             expect(payload.authenticated).toBe(true);
             expect(payload.avatarUrl).toBe('/api/taskforce/context/users%2Fu-avatar%2Fprofile%2Favatar%2Fdraft.png');
         });
+        it('GET /api/taskforce/auth/session should not wait for avatar cleanup before responding', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            const deleteObjectCompletion = { resolve: null };
+            const deleteObjectSpy = vi.spyOn(ObjectStorageClient.prototype, 'deleteObject').mockImplementation(() => new Promise((resolve) => {
+                deleteObjectCompletion.resolve = resolve;
+            }));
+            routes = createRoutes(core, {
+                authConfig,
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'test-account',
+                        bucket: 'taskforce-test',
+                        endpoint: 'https://example.com',
+                        accessKeyId: 'test-key',
+                        secretAccessKey: 'test-secret',
+                        keyPrefix: '',
+                        signedUploadTtlSeconds: 60,
+                        signedDownloadTtlSeconds: 60
+                    }
+                }
+            });
+            core.cleanupStaleUserAvatarUploadDrafts.mockReturnValueOnce([{
+                    draftId: 'avatar-draft-stale',
+                    userId: 'u-avatar',
+                    storageKey: 'users/u-avatar/profile/avatar/avatar-draft-stale.png',
+                    discardedAt: null,
+                    consumedAt: null,
+                    finalizedAt: null,
+                    createdAt: '2026-04-14T00:00:00.000Z',
+                    updatedAt: '2026-04-14T00:00:00.000Z'
+                }]);
+            const cookie = createSessionTokenCookie('session-avatar-cleanup', authConfig, {
+                userId: 'u-avatar',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('GET', '/api/taskforce/auth/session', routes);
+            const req = createMockReq('GET', '/api/taskforce/auth/session', undefined, { cookie });
+            const res = createMockRes();
+            try {
+                const outcome = await Promise.race([
+                    match?.handler(req, res, {}).then(() => 'completed'),
+                    new Promise((resolve) => setTimeout(() => resolve('timeout'), 25))
+                ]);
+                expect(outcome).toBe('completed');
+                const payload = JSON.parse(res.end.mock.calls[0][0]);
+                expect(payload.authenticated).toBe(true);
+                expect(deleteObjectSpy).toHaveBeenCalledWith('users/u-avatar/profile/avatar/avatar-draft-stale.png');
+            }
+            finally {
+                if (deleteObjectCompletion.resolve) {
+                    deleteObjectCompletion.resolve(true);
+                }
+                deleteObjectSpy.mockRestore();
+            }
+        });
         it('POST /api/taskforce/auth/profile should save avatar by validated draft id', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -9014,13 +9225,68 @@ describe('Server Routes', () => {
                 allowed: true
             });
         });
+        it('GET /api/taskforce/account/team-management-access should still resolve access when billing tables are unavailable', async () => {
+            core.resolveUserAccess.mockReturnValueOnce({
+                userId: 'u1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                disabled: false,
+                betaAccess: true
+            });
+            core.getAccountAccessStatus.mockReturnValueOnce({
+                gate: 'ok',
+                hasEntitlement: true,
+                canAccessApp: true,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: null,
+                entitlement: {
+                    state: 'active',
+                    planId: 'collab',
+                    planVersionId: 'collab-v1'
+                }
+            });
+            core.getAccountEntitlementsPayload.mockReturnValueOnce({
+                state: 'active',
+                planId: 'collab',
+                features: {
+                    'collaboration.team_management': { allowed: true }
+                }
+            });
+            const baseDb = core.getDatabaseAdapter();
+            core.getDatabaseAdapter = vi.fn().mockReturnValue({
+                ...baseDb,
+                prepare: vi.fn((sql) => {
+                    if (sql.includes('FROM user_billing') || sql.includes('FROM plan_catalog')) {
+                        throw new Error('no such table');
+                    }
+                    return baseDb.prepare(sql);
+                })
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/team-management-access', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/team-management-access?workspaceId=workspace-1', undefined, {
+                'x-taskforce-user-id': 'u1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'team',
+                allowed: true,
+                gate: 'ok',
+                planSelectionRequired: false
+            });
+        });
         it('GET /api/taskforce/account/access-status should return pending plan-selection gate', async () => {
             core.getAccountAccessStatus.mockReturnValueOnce({
                 gate: 'plan_selection_required',
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'plan_selection_required',
                 planSelectionRequired: true,
                 message: 'Choose a plan to continue.',
                 entitlement: null
@@ -9046,7 +9312,6 @@ describe('Server Routes', () => {
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'plan_selection_required',
                 planSelectionRequired: true,
                 message: 'Choose a plan to continue.',
                 entitlement: null
@@ -9061,6 +9326,87 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"code":"PLAN_SELECTION_REQUIRED"'));
         });
+        it('GET /api/taskforce/account/profile-summary should return checkout-pending recovery context', async () => {
+            core.resolveUserAccess.mockReturnValueOnce({
+                userId: 'u1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                disabled: false,
+                betaAccess: true
+            });
+            core.getAccountAccessStatus.mockReturnValueOnce({
+                gate: 'checkout_pending',
+                hasEntitlement: true,
+                canAccessApp: false,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: 'Complete checkout to continue.',
+                entitlement: {
+                    accountId: 'u1',
+                    planId: 'pro',
+                    planVersionId: 'pro-v1',
+                    state: 'checkout_pending'
+                }
+            });
+            core.getAccountEntitlementsPayload.mockImplementationOnce(() => {
+                const error = new Error('Entitlement not found');
+                error.code = 'ENTITLEMENT_NOT_FOUND';
+                throw error;
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/profile-summary', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/profile-summary?workspaceId=workspace-1', undefined, {
+                'x-taskforce-user-id': 'u1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                planId: 'pro',
+                planVersionId: 'pro-v1',
+                entitlementState: 'checkout_pending',
+                gate: 'checkout_pending',
+                message: 'Complete checkout to continue.',
+                billingConflictCode: null,
+                planSelectionRequired: false,
+                workspaceId: 'workspace-1',
+                workspaceRole: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'personal',
+                teamManagementAllowed: false
+            });
+        });
+        it('GET /api/taskforce/account/entitlements should surface checkout-pending gate when billing is not complete', async () => {
+            core.getAccountEntitlementsPayload.mockImplementationOnce(() => {
+                const error = new Error('Entitlement not found');
+                error.code = 'ENTITLEMENT_NOT_FOUND';
+                throw error;
+            });
+            core.getAccountAccessStatus.mockReturnValueOnce({
+                gate: 'checkout_pending',
+                hasEntitlement: true,
+                canAccessApp: false,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: 'Complete checkout to continue.',
+                entitlement: {
+                    accountId: 'u1',
+                    planId: 'pro',
+                    planVersionId: 'pro-v1',
+                    state: 'checkout_pending'
+                }
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/entitlements', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/entitlements', undefined, {
+                'x-taskforce-user-id': 'u1',
+                'x-taskforce-workspace-id': 'workspace-1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"code":"CHECKOUT_PENDING"'));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"gate":"checkout_pending"'));
+        });
         it('GET /api/taskforce/config should block authenticated users who must select a plan first', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -9084,7 +9430,6 @@ describe('Server Routes', () => {
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'plan_selection_required',
                 planSelectionRequired: true,
                 message: 'Choose a plan to continue.',
                 entitlement: null
@@ -9123,7 +9468,6 @@ describe('Server Routes', () => {
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'auto_assign_default',
                 planSelectionRequired: false,
                 message: 'No entitlement is linked to this account.',
                 entitlement: null
@@ -9716,6 +10060,64 @@ describe('Server Routes', () => {
             }));
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
+        it('DELETE /api/taskforce/admin/system-users/:id should purge a user in allowed cloud environments', async () => {
+            const authConfig = { runtimeMode: 'cloud', enabled: false };
+            routes = createRoutes(core, { authConfig });
+            core.purgeSystemUser.mockReturnValue({
+                targetUserId: 'u1',
+                email: 'u1@example.com',
+                unassignedTaskCount: 2,
+                clearedInitiativeOwnerCount: 0,
+                clearedWorkstreamOwnerCount: 0,
+                deletedWorkspaceMembershipCount: 1,
+                deletedAuthTokenCount: 1,
+                deletedAvatarDraftCount: 0,
+                deletedMcpAccessTokenCount: 1,
+                deletedMcpOauthAuthCodeCount: 0,
+                deletedMcpOauthConnectorGrantCount: 0,
+                deletedUiStateCount: 1,
+                deletedUserPreferenceCount: 1,
+                deletedEntitlementCount: 1,
+                deletedUserBillingCount: 1,
+                deletedUserCount: 1
+            });
+            const match = matchRoute('DELETE', '/api/taskforce/admin/system-users/u1', routes);
+            const req = createMockReq('DELETE', '/api/taskforce/admin/system-users/u1', { emailConfirmation: 'u1@example.com' }, {
+                'x-taskforce-system-role': 'system_admin',
+                'x-taskforce-user-id': 'admin-user',
+                host: 'performance-app.taskforcehq.ai',
+                'x-forwarded-proto': 'https'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: 'u1' });
+            expect(core.purgeSystemUser).toHaveBeenCalledWith({
+                targetUserId: 'u1',
+                actorUserId: 'admin-user',
+                emailConfirmation: 'u1@example.com'
+            });
+            expect(core.addAdminAuditLog).toHaveBeenCalledWith(expect.objectContaining({
+                action: 'purge-system-user',
+                actorRole: 'system_admin',
+                workspaceId: 'system'
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+        });
+        it('DELETE /api/taskforce/admin/system-users/:id should reject production environment purges', async () => {
+            const authConfig = { runtimeMode: 'cloud', enabled: false };
+            routes = createRoutes(core, { authConfig });
+            const match = matchRoute('DELETE', '/api/taskforce/admin/system-users/u1', routes);
+            const req = createMockReq('DELETE', '/api/taskforce/admin/system-users/u1', { emailConfirmation: 'u1@example.com' }, {
+                'x-taskforce-system-role': 'system_admin',
+                'x-taskforce-user-id': 'admin-user',
+                host: 'app.taskforcehq.ai',
+                'x-forwarded-proto': 'https'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: 'u1' });
+            expect(core.purgeSystemUser).not.toHaveBeenCalled();
+            expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"code":"SYSTEM_USER_PURGE_ENVIRONMENT_FORBIDDEN"'));
+        });
         it('removed workspace-based plan route should not match', () => {
             expect(matchRoute('PATCH', '/api/taskforce/admin/workspace/plan', routes)).toBeNull();
             expect(matchRoute('GET', '/api/taskforce/workspace/assignee-options', routes)).not.toBeNull();
@@ -10033,7 +10435,7 @@ describe('Server Routes', () => {
             await match?.handler(req, res, {});
             expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
         });
-        it('GET /api/taskforce/admin/system-settings should include signup monetization fields', async () => {
+        it('GET /api/taskforce/admin/system-settings should include onboarding policy fields', async () => {
             core.getGlobalSettings.mockReturnValue({
                 auth: {
                     allowSelfRegistration: true,
@@ -10041,26 +10443,30 @@ describe('Server Routes', () => {
                     defaultNewUserBetaAccess: false,
                     authRateLimitEnabled: true,
                     authRateLimitMaxRequests: 10,
-                    authRateLimitWindowMs: 900000,
-                    signupMonetizationStrategy: 'auto_assign_default',
-                    defaultSignupPlanVersionId: 'starter-v1'
+                    authRateLimitWindowMs: 900000
+                },
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'auto_grant_free',
+                        planVersionId: 'starter-v1'
+                    }
                 }
             });
-            core.getSignupMonetizationSettings.mockReturnValue({
-                strategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: 'starter-v1'
+            core.getOnboardingPolicy.mockReturnValue({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
             });
             const match = matchRoute('GET', '/api/taskforce/admin/system-settings', routes);
             const req = createMockReq('GET', '/api/taskforce/admin/system-settings', undefined, { 'x-taskforce-role': 'admin' });
             const res = createMockRes();
             await match?.handler(req, res, {});
             const payload = JSON.parse(res.end.mock.calls[0][0]);
-            expect(payload.status.signupMonetizationStrategy).toBe('auto_assign_default');
-            expect(payload.status.defaultSignupPlanVersionId).toBe('starter-v1');
-            expect(payload.settings.signupMonetizationStrategy).toBe('auto_assign_default');
-            expect(payload.settings.defaultSignupPlanVersionId).toBe('starter-v1');
+            expect(payload.status.onboardingPolicyMode).toBe('auto_grant_free');
+            expect(payload.status.onboardingPlanVersionId).toBe('starter-v1');
+            expect(payload.settings.onboardingPolicyMode).toBe('auto_grant_free');
+            expect(payload.settings.onboardingPlanVersionId).toBe('starter-v1');
         });
-        it('POST /api/taskforce/admin/system-settings should persist signup monetization fields', async () => {
+        it('POST /api/taskforce/admin/system-settings should persist onboarding policy fields', async () => {
             const match = matchRoute('POST', '/api/taskforce/admin/system-settings', routes);
             const req = createMockReq('POST', '/api/taskforce/admin/system-settings', {
                 allowSelfRegistration: true,
@@ -10069,14 +10475,14 @@ describe('Server Routes', () => {
                 authRateLimitEnabled: true,
                 authRateLimitMaxRequests: 10,
                 authRateLimitWindowMs: 900000,
-                signupMonetizationStrategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: 'starter-v1'
+                onboardingPolicyMode: 'auto_grant_free',
+                onboardingPlanVersionId: 'starter-v1'
             }, { 'x-taskforce-role': 'admin' });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.validateSignupMonetizationSettings).toHaveBeenCalledWith({
-                strategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: 'starter-v1'
+            expect(core.validateOnboardingPolicy).toHaveBeenCalledWith({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
             });
             expect(core.updateGlobalSettings).toHaveBeenCalledWith({
                 auth: {
@@ -10085,9 +10491,50 @@ describe('Server Routes', () => {
                     defaultNewUserBetaAccess: false,
                     authRateLimitEnabled: true,
                     authRateLimitMaxRequests: 10,
-                    authRateLimitWindowMs: 900000,
-                    signupMonetizationStrategy: 'auto_assign_default',
-                    defaultSignupPlanVersionId: 'starter-v1'
+                    authRateLimitWindowMs: 900000
+                },
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'auto_grant_free',
+                        planVersionId: 'starter-v1'
+                    }
+                }
+            });
+        });
+        it('POST /api/taskforce/admin/system-settings should preserve onboarding policy when onboarding fields are omitted', async () => {
+            core.getOnboardingPolicy.mockReturnValue({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
+            });
+            const match = matchRoute('POST', '/api/taskforce/admin/system-settings', routes);
+            const req = createMockReq('POST', '/api/taskforce/admin/system-settings', {
+                allowSelfRegistration: false,
+                requireVerifiedEmail: true,
+                defaultNewUserBetaAccess: false,
+                authRateLimitEnabled: true,
+                authRateLimitMaxRequests: 10,
+                authRateLimitWindowMs: 900000
+            }, { 'x-taskforce-role': 'admin' });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.validateOnboardingPolicy).toHaveBeenCalledWith({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
+            });
+            expect(core.updateGlobalSettings).toHaveBeenCalledWith({
+                auth: {
+                    allowSelfRegistration: false,
+                    requireVerifiedEmail: true,
+                    defaultNewUserBetaAccess: false,
+                    authRateLimitEnabled: true,
+                    authRateLimitMaxRequests: 10,
+                    authRateLimitWindowMs: 900000
+                },
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'auto_grant_free',
+                        planVersionId: 'starter-v1'
+                    }
                 }
             });
         });
@@ -10196,23 +10643,25 @@ describe('Server Routes', () => {
             expect(res.end.mock.calls[0][0]).toContain('window.__TASKFORCE_SITE_CONFIG__ = ');
             expect(res.end.mock.calls[0][0]).toContain('"pricingPageEnabled":false');
         });
-        it('POST /api/taskforce/admin/system-settings should reject invalid signup monetization settings', async () => {
-            core.validateSignupMonetizationSettings.mockReturnValueOnce({
+        it('POST /api/taskforce/admin/system-settings should reject invalid onboarding settings', async () => {
+            core.validateOnboardingPolicy.mockReturnValueOnce({
                 valid: false,
-                code: 'SIGNUP_PLAN_VERSION_REQUIRED',
-                message: 'Default signup plan version is required when signup strategy is auto-assign default.'
+                code: 'ONBOARDING_PLAN_VERSION_REQUIRED',
+                message: 'An onboarding plan version is required for the selected onboarding mode.'
             });
             const match = matchRoute('POST', '/api/taskforce/admin/system-settings', routes);
             const req = createMockReq('POST', '/api/taskforce/admin/system-settings', {
-                signupMonetizationStrategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: null
+                onboardingPolicyMode: 'auto_grant_free',
+                onboardingPlanVersionId: null
             }, { 'x-taskforce-role': 'admin' });
             const res = createMockRes();
             await match?.handler(req, res, {});
             expect(res.writeHead).toHaveBeenCalledWith(400, expect.any(Object));
             expect(core.updateGlobalSettings).not.toHaveBeenCalledWith(expect.objectContaining({
-                auth: expect.objectContaining({
-                    signupMonetizationStrategy: 'auto_assign_default'
+                billing: expect.objectContaining({
+                    onboardingPolicy: expect.objectContaining({
+                        mode: 'auto_grant_free'
+                    })
                 })
             }));
         });
@@ -11360,7 +11809,7 @@ describe('Server Routes', () => {
                 errors: []
             }));
         });
-        it('PATCH /api/taskforce/task/:id should pass autosave updates through as non-audited route metadata', async () => {
+        it('PATCH /api/taskforce/task/:id should pass autosave metadata through to core.updateTask', async () => {
             const updatedTask = { id: '123', description: 'Draft body' };
             core.updateTask.mockReturnValue(updatedTask);
             const url = '/api/taskforce/task/123';
@@ -11370,12 +11819,12 @@ describe('Server Routes', () => {
             await match?.handler(req, res, { id: '123' });
             expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Draft body' }, 'default', {
                 actorRef: 'user',
-                skipTaskEvents: true
+                saveSource: 'autosave'
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));
         });
-        it('PATCH /api/taskforce/task/:id should keep manual updates on the audited path', async () => {
+        it('PATCH /api/taskforce/task/:id should pass manual save metadata through to core.updateTask', async () => {
             const updatedTask = { id: '123', description: 'Manual body' };
             core.updateTask.mockReturnValue(updatedTask);
             const url = '/api/taskforce/task/123';
@@ -11385,7 +11834,7 @@ describe('Server Routes', () => {
             await match?.handler(req, res, { id: '123' });
             expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Manual body' }, 'default', {
                 actorRef: 'user',
-                skipTaskEvents: false
+                saveSource: 'manual'
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));