@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/TaskforceCore.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import React, { useCallback, useEffect, useMemo, useState } from 'react';
+import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { MemoryRouter, Navigate, useInRouterContext, useLocation, useNavigate } from 'react-router-dom';
 import { useTaskforce } from './hooks/useTaskforce';
 import { WidgetView } from './components/views/WidgetView';
@@ -15,6 +15,7 @@ import logoDark from './assets/branding/logos/logo_dark.svg';
 import taskforceBg from './assets/images/taskforce.png';
 import { isLightThemeFamily } from './utils/theme';
 import { Cloud, LaptopMinimal } from 'lucide-react';
+import { getPasswordPolicyGuidance, validatePasswordPolicy } from './shared/passwordPolicy';
 function isDebugModeEnabled() {
     const runtimeOverride = globalThis.__DEBUG_MODE__;
     if (typeof runtimeOverride === 'boolean')
@@ -58,18 +59,21 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const [loginEmail, setLoginEmail] = useState('');
     const [loginDisplayName, setLoginDisplayName] = useState('');
     const [loginPassword, setLoginPassword] = useState('');
+    const [loginPasswordConfirm, setLoginPasswordConfirm] = useState('');
     const [authMode, setAuthMode] = useState('login');
     const [verificationToken, setVerificationToken] = useState('');
     const [pendingVerificationWorkspaceSetupRequired, setPendingVerificationWorkspaceSetupRequired] = useState(false);
     const [pendingVerificationCommercialState, setPendingVerificationCommercialState] = useState(null);
     const [pendingVerificationRedirectPath, setPendingVerificationRedirectPath] = useState(null);
     const [pendingPostAuthRedirect, setPendingPostAuthRedirect] = useState(null);
+    const [commercialOnboardingRedirectActive, setCommercialOnboardingRedirectActive] = useState(false);
     const [resetToken, setResetToken] = useState('');
     const [inviteToken, setInviteToken] = useState('');
     const [inviteEmail, setInviteEmail] = useState(null);
     const [inviteWorkspaceId, setInviteWorkspaceId] = useState(null);
     const [inviteResolution, setInviteResolution] = useState('unknown');
     const [invitePasswordRequired, setInvitePasswordRequired] = useState(false);
+    const [inviteOAuthProviders, setInviteOAuthProviders] = useState([]);
     const [loginNotice, setLoginNotice] = useState(null);
     const [loginError, setLoginError] = useState(null);
     const [loginErrorCode, setLoginErrorCode] = useState(null);
@@ -92,6 +96,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const [syncNewLocalWorkspaceToCloud, setSyncNewLocalWorkspaceToCloud] = useState(false);
     const [pendingCloudWorkspaceImport, setPendingCloudWorkspaceImport] = useState(null);
     const [cloudWorkspaceImportFinalizing, setCloudWorkspaceImportFinalizing] = useState(false);
+    const cloudWorkspaceImportFinalizingRef = useRef(false);
     const fallbackSetupLibraryPacks = useMemo(() => listBuiltInTaxonomyLibraryPacks(), []);
     const [setupLibraryPacks, setSetupLibraryPacks] = useState(fallbackSetupLibraryPacks);
     const [selectedSetupPackId, setSelectedSetupPackId] = useState(() => (fallbackSetupLibraryPacks.find((pack) => pack.isDefaultStarter)?.id || fallbackSetupLibraryPacks[0]?.id || ''));
@@ -108,7 +113,24 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         onTaskCountChange,
         onClose
     });
-    const { runtimeMode, workspaceSwitchingEnabled, currentWorkspaceId, configLoaded, cloudAuthConfigured, authRequiredForApi, authBlocked, isAuthenticated, hasBetaAccess, authSessionResolved, workspaceBootstrapPending, bootstrapPhase, bootstrapError, setupState, runtimeCapabilities, refreshSetupContext, retryBootstrapChecks, createWorkspace, saveWorkspaceProfile, fetchWorkspaces, applyWorkspaceSyncStateSnapshot, workspaceCloudSyncEnabled, workspaceSyncPhase, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncBusy, workspaceLastErrorMessage, retryWorkspaceCloudSync, settingsModel, fetchTasks, loginWithCredentials, registerWithCredentials, requestEmailVerification, confirmEmailVerification, requestPasswordReset, confirmPasswordReset, inspectInviteAcceptance, acceptInviteWithToken, joinInviteWithToken, authUserEmail, currentTheme, logout } = taskforceState;
+    const { runtimeMode, workspaceSwitchingEnabled, currentWorkspaceId, cloudAuthConfigured, authRequiredForApi, authBlocked, isAuthenticated, hasBetaAccess, authSessionResolved, setupState, runtimeCapabilities, refreshSetupContext, retryBootstrapChecks, createWorkspace, saveWorkspaceProfile, fetchWorkspaces, applyWorkspaceSyncStateSnapshot, workspaceCloudSyncEnabled, workspaceSyncPhase, workspaceSyncSetupIntent, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncBusy, workspaceLastErrorMessage, retryWorkspaceCloudSync, settingsModel, fetchTasks, bootstrapState, loginWithCredentials, beginOAuthLogin, availableAuthProviders, registerWithCredentials, requestEmailVerification, confirmEmailVerification, requestPasswordReset, confirmPasswordReset, inspectInviteAcceptance, acceptInviteWithToken, joinInviteWithToken, authUserEmail, currentTheme, logout } = taskforceState;
+    const persistWorkspaceSyncStatePatch = useCallback(async (workspaceId, patch) => {
+        const response = await fetch('/api/taskforce/ui-state', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            credentials: 'include',
+            body: JSON.stringify({
+                workspaceId,
+                stateKey: 'workspace-sync',
+                patch
+            })
+        });
+        const payload = await response.json().catch(() => ({}));
+        if (!response.ok || payload?.success === false) {
+            throw new Error(payload?.error || `Failed to configure workspace sync (${response.status})`);
+        }
+        return payload;
+    }, []);
     const selectedSetupPack = useMemo(() => {
         return setupLibraryPacks.find((pack) => pack.id === selectedSetupPackId)
             || setupLibraryPacks.find((pack) => pack.isDefaultStarter)
@@ -131,20 +153,35 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const isLoginRoute = location.pathname === '/login';
     const isSetupRoute = location.pathname === '/setup';
     const isComingSoonRoute = location.pathname === '/coming-soon';
+    const cloudWorkspaceSelectionPath = '/setup?step=workspace&source=cloud&postAuth=select-cloud-workspace';
     const wantsCloudWorkspaceSetup = !isCloudRuntime && workspaceSetupSource === 'cloud';
     const isCloudWorkspaceSetupFlow = wantsCloudWorkspaceSetup && canUseCloudWorkspaceSetup;
-    const cloudWorkspaceImportMatchesCurrentWorkspace = Boolean(pendingCloudWorkspaceImport
-        && currentWorkspaceId === pendingCloudWorkspaceImport.workspaceId);
-    const isCloudWorkspaceImportErrored = Boolean(pendingCloudWorkspaceImport
+    const activeCloudWorkspaceImport = useMemo(() => {
+        if (pendingCloudWorkspaceImport)
+            return pendingCloudWorkspaceImport;
+        if (workspaceSyncSetupIntent !== 'attach-cloud-import')
+            return null;
+        const workspaceId = String(currentWorkspaceId || '').trim();
+        if (!workspaceId || workspaceId.toLowerCase() === 'default')
+            return null;
+        const matchingWorkspace = cloudWorkspaceOptions.find((workspace) => workspace.id === workspaceId);
+        return {
+            workspaceId,
+            name: matchingWorkspace?.name || workspaceId
+        };
+    }, [cloudWorkspaceOptions, currentWorkspaceId, pendingCloudWorkspaceImport, workspaceSyncSetupIntent]);
+    const cloudWorkspaceImportMatchesCurrentWorkspace = Boolean(activeCloudWorkspaceImport
+        && currentWorkspaceId === activeCloudWorkspaceImport.workspaceId);
+    const isCloudWorkspaceImportErrored = Boolean(activeCloudWorkspaceImport
         && cloudWorkspaceImportMatchesCurrentWorkspace
         && workspaceSyncPhase === 'error');
-    const isCloudWorkspaceImportReady = Boolean(pendingCloudWorkspaceImport
+    const isCloudWorkspaceImportReady = Boolean(activeCloudWorkspaceImport
         && cloudWorkspaceImportMatchesCurrentWorkspace
         && workspaceCloudSyncEnabled
         && workspaceSyncPhase === 'active'
         && !workspaceSyncBusy);
     const cloudWorkspaceImportProgressLines = useMemo(() => {
-        if (!pendingCloudWorkspaceImport)
+        if (!activeCloudWorkspaceImport)
             return [];
         const connectingState = setupBusy ? 'In progress' : 'Complete';
         const importingState = isCloudWorkspaceImportErrored
@@ -163,7 +200,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             `Open local workspace: ${finishingState}`
         ];
     }, [
-        pendingCloudWorkspaceImport,
+        activeCloudWorkspaceImport,
         setupBusy,
         isCloudWorkspaceImportErrored,
         workspaceSyncBusy,
@@ -183,6 +220,9 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         && !isPricingRoute
         && !isPlansRoute
         && !isPlansScreen;
+    const cloudAccountAccessPending = runtimeMode === 'cloud'
+        && isAuthenticated
+        && (!authSessionResolved || !accountAccessGateResolved);
     const directRegistrationEnabled = cloudAuthConfigured;
     const authPageTitle = useMemo(() => {
         switch (authMode) {
@@ -205,7 +245,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const setupIntent = useMemo(() => String(new URLSearchParams(location.search).get('intent') || '').trim().toLowerCase(), [location.search]);
     const isCreateWorkspaceIntent = isSetupRoute && setupStep === 'workspace' && setupIntent === 'create-workspace';
     const shouldHoldForAuthBootstrap = mode !== 'widget'
-        && !authSessionResolved
+        && bootstrapState.authPending
         && !isLoginRoute
         && !isSetupRoute
         && !isPricingRoute
@@ -233,23 +273,47 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const needsWorkspaceSetup = workspaceLifecycle.needsWorkspaceSetup;
     const hasSetupReadError = workspaceLifecycle.hasSetupReadError;
     const shouldHoldForSetupBootstrap = mode !== 'widget'
-        && authSessionResolved
+        && bootstrapState.auth.resolved
         && !shouldForceLogin
         && !shouldForceComingSoon
         && !isPricingRoute
         && !isPlansRoute
         && !isPlansScreen
-        && (!configLoaded || workspaceBootstrapPending || bootstrapPhase === 'stalled')
+        && bootstrapState.appPending
         && (isSetupRoute || runtimeMode === 'cloud' || isLikelyCloudAppHost);
-    const bootstrapSubtitle = useMemo(() => {
-        if (bootstrapPhase === 'auth')
-            return 'Verifying session...';
-        if (bootstrapPhase === 'workspace')
-            return 'Resolving workspace access...';
-        if (bootstrapPhase === 'config')
-            return 'Loading configuration...';
-        return 'Checking account, workspace access, and setup status...';
-    }, [bootstrapPhase]);
+    const shouldHoldForCommercialOnboardingRedirect = runtimeMode === 'cloud'
+        && commercialOnboardingRedirectActive
+        && !isPlansScreen;
+    const bootstrapSubtitle = bootstrapState.subtitle;
+    const showGuidedWorkspaceSetup = isCreateWorkspaceIntent
+        || (isSetupRoute && Boolean(activeCloudWorkspaceImport))
+        || (isSetupRoute && setupGateActive && (hasSetupReadError || needsGlobalSetup || needsWorkspaceSetup));
+    const shellRenderState = useMemo(() => {
+        if (shouldHoldForAuthBootstrap)
+            return 'auth-bootstrap';
+        if (shouldHoldForCommercialOnboardingRedirect)
+            return 'app-bootstrap';
+        if (shouldHoldForSetupBootstrap)
+            return 'app-bootstrap';
+        if (isLoginRoute)
+            return 'login';
+        if (shouldForceLogin && !isLoginRoute)
+            return 'login-redirect';
+        if (isComingSoonRoute && shouldForceComingSoon)
+            return 'coming-soon';
+        if (showGuidedWorkspaceSetup)
+            return 'guided-setup';
+        return 'app';
+    }, [
+        isComingSoonRoute,
+        isLoginRoute,
+        shouldForceComingSoon,
+        shouldForceLogin,
+        shouldHoldForCommercialOnboardingRedirect,
+        shouldHoldForAuthBootstrap,
+        shouldHoldForSetupBootstrap,
+        showGuidedWorkspaceSetup
+    ]);
     const isPlaceholderWorkspaceName = useCallback((name, workspaceId, _description) => {
         const normalizedName = String(name || '').trim().toLowerCase();
         const normalizedWorkspaceId = String(workspaceId || '').trim().toLowerCase();
@@ -266,7 +330,12 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         setSetupModeChoice(modeValue);
     }, [setupState?.mode]);
     useEffect(() => {
-        if (runtimeMode !== 'cloud' || !isAuthenticated || !authSessionResolved) {
+        if (runtimeMode !== 'cloud' || !isAuthenticated) {
+            setAccountAccessGate(null);
+            setAccountAccessGateResolved(false);
+            return;
+        }
+        if (!authSessionResolved) {
             setAccountAccessGate(null);
             setAccountAccessGateResolved(false);
             return;
@@ -340,6 +409,11 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         if (!isSetupRoute || setupStep !== 'workspace')
             return;
         setWorkspaceSetupPage('details');
+        if (activeCloudWorkspaceImport && canUseCloudWorkspaceSetup) {
+            setWorkspaceSetupSource('cloud');
+            setSyncNewLocalWorkspaceToCloud(false);
+            return;
+        }
         const source = String(new URLSearchParams(location.search).get('source') || '').trim().toLowerCase();
         if (source === 'cloud' && canUseCloudWorkspaceSetup) {
             setWorkspaceSetupSource('cloud');
@@ -347,7 +421,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             return;
         }
         setWorkspaceSetupSource('local');
-    }, [canUseCloudWorkspaceSetup, isSetupRoute, location.search, setupStep]);
+    }, [activeCloudWorkspaceImport, canUseCloudWorkspaceSetup, isSetupRoute, location.search, setupStep]);
     const fetchCloudWorkspaceOptions = useCallback(async () => {
         if (!canUseCloudWorkspaceSetup || !isAuthenticated) {
             setCloudWorkspaceOptions([]);
@@ -410,7 +484,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         })
             .then(async (res) => {
             if (!res.ok)
-                throw new Error(`Failed to load starter libraries (${res.status})`);
+                throw new Error(`Failed to load setup libraries (${res.status})`);
             const payload = await res.json().catch(() => ({}));
             const nextPacks = Array.isArray(payload?.packs) ? payload.packs : [];
             if (cancelled || nextPacks.length === 0)
@@ -424,7 +498,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             if (cancelled)
                 return;
             setSetupLibraryPacks(fallbackSetupLibraryPacks);
-            setSetupLibraryError(error instanceof Error ? error.message : 'Failed to load starter libraries.');
+            setSetupLibraryError(error instanceof Error ? error.message : 'Failed to load setup libraries.');
         })
             .finally(() => {
             if (!cancelled)
@@ -446,22 +520,24 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         if (!isCloudWorkspaceSetupFlow) {
             setPendingCloudWorkspaceImport(null);
             setCloudWorkspaceImportFinalizing(false);
+            cloudWorkspaceImportFinalizingRef.current = false;
         }
     }, [isCloudWorkspaceSetupFlow]);
     useEffect(() => {
-        if (!isCloudWorkspaceImportErrored || !pendingCloudWorkspaceImport)
+        if (!isCloudWorkspaceImportErrored || !activeCloudWorkspaceImport)
             return;
         setSetupNotice(null);
         setSetupError(workspaceLastErrorMessage
-            || `Failed to import "${pendingCloudWorkspaceImport.name}" from cloud. Retry import to continue.`);
-    }, [isCloudWorkspaceImportErrored, pendingCloudWorkspaceImport, workspaceLastErrorMessage]);
+            || `Failed to import "${activeCloudWorkspaceImport.name}" from cloud. Retry import to continue.`);
+    }, [activeCloudWorkspaceImport, isCloudWorkspaceImportErrored, workspaceLastErrorMessage]);
     useEffect(() => {
-        if (!isCloudWorkspaceImportReady || !pendingCloudWorkspaceImport || cloudWorkspaceImportFinalizing)
+        if (!isCloudWorkspaceImportReady || !activeCloudWorkspaceImport || cloudWorkspaceImportFinalizingRef.current)
             return;
         let cancelled = false;
+        cloudWorkspaceImportFinalizingRef.current = true;
         setCloudWorkspaceImportFinalizing(true);
         setSetupError(null);
-        setSetupNotice(`Workspace import complete. Opening ${pendingCloudWorkspaceImport.name}...`);
+        setSetupNotice(`Workspace import complete. Opening ${activeCloudWorkspaceImport.name}...`);
         void (async () => {
             try {
                 await refreshSetupContext();
@@ -471,6 +547,12 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                 ]);
                 if (cancelled)
                     return;
+                await persistWorkspaceSyncStatePatch(activeCloudWorkspaceImport.workspaceId, { setupIntent: null });
+                applyWorkspaceSyncStateSnapshot({
+                    enabled: workspaceCloudSyncEnabled,
+                    phase: workspaceSyncPhase,
+                    setupIntent: null
+                });
                 setPendingCloudWorkspaceImport(null);
                 navigate('/', { replace: true });
             }
@@ -478,20 +560,22 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                 if (cancelled)
                     return;
                 setSetupNotice(null);
-                setSetupError(`Imported "${pendingCloudWorkspaceImport.name}" but failed to finish opening it.`);
+                setSetupError(`Imported "${activeCloudWorkspaceImport.name}" but failed to finish opening it.`);
                 setCloudWorkspaceImportFinalizing(false);
+                cloudWorkspaceImportFinalizingRef.current = false;
             }
         })();
         return () => {
             cancelled = true;
         };
     }, [
-        cloudWorkspaceImportFinalizing,
+        activeCloudWorkspaceImport,
+        applyWorkspaceSyncStateSnapshot,
         fetchTasks,
         fetchWorkspaces,
         isCloudWorkspaceImportReady,
         navigate,
-        pendingCloudWorkspaceImport,
+        persistWorkspaceSyncStatePatch,
         refreshSetupContext
     ]);
     const nextPath = useMemo(() => {
@@ -502,7 +586,6 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             return '/';
         return raw;
     }, [location.search]);
-    const cloudWorkspaceSelectionPath = '/setup?step=workspace&source=cloud&postAuth=select-cloud-workspace';
     const shouldReturnToCloudWorkspaceSelection = useMemo(() => {
         try {
             const parsed = new URL(nextPath, 'https://taskforce.local');
@@ -590,27 +673,95 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         setPendingVerificationRedirectPath(null);
     }, [authMode, isLoginRoute, loginRouteMode]);
     useEffect(() => {
-        if (!isLoginRoute || !pendingPostAuthRedirect || !authSessionResolved || !isAuthenticated)
+        if (authMode === 'register')
+            return;
+        setLoginPasswordConfirm('');
+    }, [authMode]);
+    useEffect(() => {
+        if (!pendingPostAuthRedirect || !isAuthenticated)
             return;
-        if (runtimeMode === 'cloud' && !pendingPostAuthRedirect.commercialOnboardingGate && !accountAccessGateResolved) {
+        if (!pendingPostAuthRedirect.commercialOnboardingGate && (!authSessionResolved || cloudAccountAccessPending)) {
             return;
         }
-        if (!pendingPostAuthRedirect.commercialOnboardingGate && pendingPostAuthRedirect.workspaceSetupRequired) {
-            navigate(resolveWorkspaceSetupPath(), { replace: true });
+        const destination = !pendingPostAuthRedirect.commercialOnboardingGate && pendingPostAuthRedirect.workspaceSetupRequired
+            ? resolveWorkspaceSetupPath()
+            : pendingPostAuthRedirect.path;
+        const currentRoute = `${location.pathname}${location.search}${location.hash || ''}`;
+        if (currentRoute !== destination) {
+            navigate(destination, { replace: true });
         }
-        else {
-            navigate(pendingPostAuthRedirect.path, { replace: true });
+    }, [
+        authSessionResolved,
+        cloudAccountAccessPending,
+        isAuthenticated,
+        location.hash,
+        location.pathname,
+        location.search,
+        navigate,
+        pendingPostAuthRedirect,
+        resolveWorkspaceSetupPath
+    ]);
+    useEffect(() => {
+        if (!commercialOnboardingRedirectActive)
+            return;
+        if (!authSessionResolved) {
+            return;
+        }
+        if (!isAuthenticated) {
+            setCommercialOnboardingRedirectActive(false);
+            setPendingPostAuthRedirect(null);
+            return;
         }
+        if (accountAccessGateResolved && accountAccessGate?.canAccessApp === true) {
+            setLoginEmail('');
+            setLoginDisplayName('');
+            setLoginPassword('');
+            setLoginPasswordConfirm('');
+            setPendingPostAuthRedirect(null);
+            setCommercialOnboardingRedirectActive(false);
+            return;
+        }
+        const destination = pendingPostAuthRedirect?.commercialOnboardingGate
+            ? pendingPostAuthRedirect.path
+            : planSelectionPath;
+        const currentRoute = `${location.pathname}${location.search}${location.hash || ''}`;
+        if (currentRoute !== destination) {
+            navigate(destination, { replace: true });
+        }
+    }, [
+        accountAccessGate?.canAccessApp,
+        accountAccessGateResolved,
+        authSessionResolved,
+        commercialOnboardingRedirectActive,
+        isAuthenticated,
+        location.hash,
+        location.pathname,
+        location.search,
+        navigate,
+        pendingPostAuthRedirect,
+        planSelectionPath
+    ]);
+    useEffect(() => {
+        if (!pendingPostAuthRedirect || !isAuthenticated)
+            return;
+        const destination = !pendingPostAuthRedirect.commercialOnboardingGate && pendingPostAuthRedirect.workspaceSetupRequired
+            ? resolveWorkspaceSetupPath()
+            : pendingPostAuthRedirect.path;
+        const currentRoute = `${location.pathname}${location.search}${location.hash || ''}`;
+        if (currentRoute !== destination)
+            return;
+        if (pendingPostAuthRedirect.commercialOnboardingGate)
+            return;
         setLoginEmail('');
         setLoginDisplayName('');
         setLoginPassword('');
+        setLoginPasswordConfirm('');
         setPendingPostAuthRedirect(null);
     }, [
-        accountAccessGateResolved,
-        authSessionResolved,
+        location.hash,
+        location.pathname,
+        location.search,
         isAuthenticated,
-        isLoginRoute,
-        navigate,
         pendingPostAuthRedirect,
         resolveWorkspaceSetupPath,
         runtimeMode
@@ -632,6 +783,9 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                 setInviteEmail(inspected.email || null);
                 setInviteWorkspaceId(inspected.workspaceId || null);
                 setInvitePasswordRequired(inspected.passwordRequired === true);
+                // Capture OAuth providers available for invite-claim (pending_setup only)
+                const oauthMethods = (inspected.availableMethods || []).filter(m => m === 'google' || m === 'github' || m === 'apple');
+                setInviteOAuthProviders(inspected.inviteeState === 'pending_setup' ? oauthMethods : []);
                 const inviteMatchesAuthenticatedUser = Boolean(isAuthenticated
                     && authUserEmail
                     && inspected.email
@@ -657,6 +811,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                 setInviteWorkspaceId(null);
                 setInviteResolution('invalid');
                 setInvitePasswordRequired(false);
+                setInviteOAuthProviders([]);
                 setLoginError(formatAuthError(inspected));
                 setLoginErrorCode(inspected.code || inspected.state || null);
             }
@@ -683,15 +838,42 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const resetCooldownSeconds = Math.max(0, Math.ceil((resetCooldownUntil - cooldownNow) / 1000));
     const verifyCooldownActive = verifyCooldownSeconds > 0;
     const resetCooldownActive = resetCooldownSeconds > 0;
+    const registerPasswordGuidance = useMemo(() => getPasswordPolicyGuidance(), []);
     const formatAuthError = (result) => {
         const message = result.error || 'Request failed.';
         const code = result.code || result.state;
         return code ? `[${code}] ${message}` : message;
     };
+    const buildVerificationRequestNotice = (input) => {
+        if (input?.deliveryAttempted === false) {
+            return input?.intro || 'If that account exists and still needs verification, we sent an email.';
+        }
+        if (input?.emailSent === false) {
+            return `Verification email failed to send. ${input?.emailError || 'Try Resend Verification again.'}`;
+        }
+        return 'Verification email resent.';
+    };
+    const buildPasswordResetNotice = (input) => {
+        if (input?.deliveryAttempted === false) {
+            return 'If that account exists, we sent password reset instructions.';
+        }
+        if (input?.emailSent === false) {
+            return `Password reset email failed to send. ${input?.emailError || 'Try again in a minute.'}`;
+        }
+        return 'Password reset instructions sent.';
+    };
     useEffect(() => {
         if (mode === 'widget')
             return;
-        if (workspaceBootstrapPending)
+        if (isLoginRoute && loginBusy) {
+            return;
+        }
+        const shouldBypassWorkspacePendingForAccessGate = runtimeMode === 'cloud'
+            && isAuthenticated
+            && accountAccessGateResolved
+            && accountAccessGate?.canAccessApp === false
+            && accountAccessGate?.canAccessPlans !== false;
+        if (bootstrapState.workspace.pending && !shouldBypassWorkspacePendingForAccessGate)
             return;
         if (shouldForceComingSoon) {
             if (!isComingSoonRoute)
@@ -710,10 +892,11 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                 && isAuthenticated
                 && !shouldStayOnInviteRoute
                 && (Boolean(pendingPostAuthRedirect)
-                    || workspaceBootstrapPending
+                    || bootstrapState.workspace.pending
                     || authMode === 'register'
                     || authMode === 'verify'
-                    || (runtimeMode === 'cloud' && (!configLoaded || !accountAccessGateResolved)));
+                    || !bootstrapState.config.loaded
+                    || cloudAccountAccessPending);
             if (shouldDelayAuthenticatedLoginRedirect) {
                 return;
             }
@@ -731,6 +914,23 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         if (isLoginRoute && !isAuthenticated) {
             return;
         }
+        if (pendingPostAuthRedirect && isAuthenticated) {
+            return;
+        }
+        const shouldHoldAuthenticatedAuthRoute = isLoginRoute
+            && isAuthenticated
+            && (authMode === 'register'
+                || authMode === 'verify'
+                || (authMode === 'invite' && inviteToken.trim().length > 0));
+        if (shouldHoldAuthenticatedAuthRoute) {
+            return;
+        }
+        if (commercialOnboardingRedirectActive) {
+            return;
+        }
+        if (isPlansScreen) {
+            return;
+        }
         if (shouldForceAccountAccessGate) {
             if (!isPlansScreen) {
                 const gate = encodeURIComponent(String(accountAccessGate?.gate || 'plan_selection_required'));
@@ -738,7 +938,23 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             }
             return;
         }
-        if (isSetupRoute && pendingCloudWorkspaceImport) {
+        if (activeCloudWorkspaceImport) {
+            const isCloudImportRoute = isSetupRoute
+                && setupStep === 'workspace'
+                && new URLSearchParams(location.search).get('source') === 'cloud';
+            if (!isCloudImportRoute) {
+                navigate(cloudWorkspaceSelectionPath, { replace: true });
+            }
+            return;
+        }
+        if (isPlansScreen && cloudAccountAccessPending) {
+            return;
+        }
+        if (isPlansScreen
+            && runtimeMode === 'cloud'
+            && accountAccessGateResolved
+            && accountAccessGate?.canAccessApp === false
+            && accountAccessGate?.canAccessPlans !== false) {
             return;
         }
         if (setupGateActive) {
@@ -778,34 +994,40 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         isComingSoonRoute,
         isPlansRoute,
         isPlansScreen,
+        accountAccessGate,
         accountAccessGate?.gate,
         accountAccessGateResolved,
         authMode,
+        commercialOnboardingRedirectActive,
+        cloudAccountAccessPending,
         setupGateActive,
         setupState,
         hasSetupReadError,
         isCreateWorkspaceIntent,
-        pendingCloudWorkspaceImport,
+        activeCloudWorkspaceImport,
         needsGlobalSetup,
         needsWorkspaceSetup,
         setupStep,
-        workspaceBootstrapPending,
-        configLoaded,
+        bootstrapState,
         runtimeMode,
+        loginBusy,
+        isAuthenticated,
+        accountAccessGateResolved,
         inviteToken,
         location.pathname,
         location.search,
         location.hash,
         navigate,
         nextPath,
-        pendingPostAuthRedirect
+        pendingPostAuthRedirect,
+        cloudWorkspaceSelectionPath
     ]);
     useEffect(() => {
         if (mode === 'widget')
             return;
         if (runtimeMode !== 'local')
             return;
-        if (!configLoaded)
+        if (!bootstrapState.config.loaded)
             return;
         if (isLoginRoute || isSetupRoute)
             return;
@@ -813,7 +1035,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         if (!workspaceId || workspaceId === 'default') {
             navigate('/setup?step=workspace', { replace: true });
         }
-    }, [mode, runtimeMode, configLoaded, isLoginRoute, isSetupRoute, currentWorkspaceId, navigate]);
+    }, [mode, runtimeMode, bootstrapState.config.loaded, isLoginRoute, isSetupRoute, currentWorkspaceId, navigate]);
     const handleRetryBootstrap = useCallback(async () => {
         setBootstrapRetryBusy(true);
         try {
@@ -841,13 +1063,13 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         params.set('screen', 'plans');
         return _jsx(Navigate, { to: `/?${params.toString()}${location.hash || ''}`, replace: true });
     }
-    if (shouldHoldForAuthBootstrap) {
+    if (shellRenderState === 'auth-bootstrap') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: "Checking your session..." })] }) }) }));
     }
-    if (shouldHoldForSetupBootstrap) {
-        return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: bootstrapSubtitle }), bootstrapPhase === 'stalled' && (_jsxs(_Fragment, { children: [_jsx("p", { className: authStyles.loginError, children: bootstrapError || 'Startup checks timed out.' }), _jsx("button", { className: styles.submitBtn, disabled: bootstrapRetryBusy, onClick: handleRetryBootstrap, children: bootstrapRetryBusy ? 'Retrying...' : 'Retry checks' }), isCloudRuntime && (_jsx("button", { className: styles.cancelBtn, disabled: bootstrapRetryBusy, onClick: handleGoToSignIn, children: "Go to sign-in" }))] }))] }) }) }));
+    if (shellRenderState === 'app-bootstrap') {
+        return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: bootstrapSubtitle }), bootstrapState.stalled && (_jsxs(_Fragment, { children: [_jsx("p", { className: authStyles.loginError, children: bootstrapState.error || 'Startup checks timed out.' }), _jsx("button", { className: styles.submitBtn, disabled: bootstrapRetryBusy, onClick: handleRetryBootstrap, children: bootstrapRetryBusy ? 'Retrying...' : 'Retry checks' }), isCloudRuntime && (_jsx("button", { className: styles.cancelBtn, disabled: bootstrapRetryBusy, onClick: handleGoToSignIn, children: "Go to sign-in" }))] }))] }) }) }));
     }
-    if (isLoginRoute) {
+    if (shellRenderState === 'login') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, style: {
                     backgroundImage: `linear-gradient(rgba(15, 15, 26, 0.88), rgba(15, 15, 26, 0.9)), url(${taskforceBg})`
                 }, children: _jsxs("div", { className: authStyles.loginCard, children: [!isCloudRuntime && !shouldForceLogin && (_jsx("button", { className: authStyles.loginCloseBtn, "aria-label": "Close sign in", "data-testid": "auth-close-button", onClick: () => navigate(nextPath, { replace: true }), children: "\u00D7" })), _jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsxs("h1", { className: authStyles.loginTitle, children: ["TASKFORCE ", _jsx("span", { className: authStyles.loginTitleAccent, children: "HQ" })] })] }), _jsxs("p", { className: authStyles.loginSubtitle, children: [authMode === 'login' && 'Sign in with your account credentials.', authMode === 'register' && 'Create your Taskforce account.', authMode === 'verify' && 'Enter your verification token.', authMode === 'forgot' && 'Request a password reset link.', authMode === 'reset' && 'Set a new password using your reset token.', authMode === 'invite' && (inviteResolution === 'existing_user_ready'
@@ -869,7 +1091,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                             ? (invitePasswordRequired ? 'Create password' : 'Password')
                                             : 'Password'), autoComplete: authMode === 'register' || authMode === 'reset' || (authMode === 'invite' && invitePasswordRequired)
                                         ? 'new-password'
-                                        : 'current-password', "data-testid": "auth-password-input", onChange: (event) => setLoginPassword(event.target.value) })] })), authMode === 'verify' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Verification token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: verificationToken, placeholder: "Verification token", autoComplete: "one-time-code", "data-testid": "auth-verification-token-input", onChange: (event) => setVerificationToken(event.target.value) })] })), authMode === 'reset' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Reset token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: resetToken, placeholder: "Reset token", autoComplete: "one-time-code", "data-testid": "auth-reset-token-input", onChange: (event) => setResetToken(event.target.value) })] })), authMode === 'invite' && (_jsxs(_Fragment, { children: [_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Invite token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: inviteToken, placeholder: "Invite token", "data-testid": "auth-invite-token-input", onChange: (event) => setInviteToken(event.target.value) })] }), inviteEmail && (_jsxs("p", { className: authStyles.loginSubtitle, children: ["Invite for: ", _jsx("strong", { children: inviteEmail }), inviteWorkspaceId ? ` · Workspace: ${inviteWorkspaceId}` : ''] }))] })), loginNotice && _jsx("p", { className: authStyles.loginSubtitle, children: loginNotice }), loginError && _jsx("p", { className: authStyles.loginError, children: loginError }), authMode === 'login' && loginErrorCode === 'EMAIL_NOT_VERIFIED' && loginEmail.trim() && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive, onClick: async () => {
+                                        : 'current-password', "data-testid": "auth-password-input", onChange: (event) => setLoginPassword(event.target.value) })] })), (authMode === 'register' || (authMode === 'invite' && invitePasswordRequired)) && (_jsx(_Fragment, { children: _jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Confirm password" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "password", value: loginPasswordConfirm, placeholder: "Confirm password", autoComplete: "new-password", "data-testid": "auth-confirm-password-input", onChange: (event) => setLoginPasswordConfirm(event.target.value) })] }) })), (authMode === 'register' || (authMode === 'invite' && invitePasswordRequired)) && (_jsx("p", { className: authStyles.loginSubtitle, children: registerPasswordGuidance.join(' ') })), authMode === 'verify' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Verification token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: verificationToken, placeholder: "Verification token", autoComplete: "one-time-code", "data-testid": "auth-verification-token-input", onChange: (event) => setVerificationToken(event.target.value) })] })), authMode === 'reset' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Reset token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: resetToken, placeholder: "Reset token", autoComplete: "one-time-code", "data-testid": "auth-reset-token-input", onChange: (event) => setResetToken(event.target.value) })] })), authMode === 'invite' && (_jsxs(_Fragment, { children: [_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Invite token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: inviteToken, placeholder: "Invite token", "data-testid": "auth-invite-token-input", onChange: (event) => setInviteToken(event.target.value) })] }), inviteEmail && (_jsxs("p", { className: authStyles.loginSubtitle, children: ["Invite for: ", _jsx("strong", { children: inviteEmail }), inviteWorkspaceId ? ` · Workspace: ${inviteWorkspaceId}` : ''] }))] })), loginNotice && _jsx("p", { className: authStyles.loginSubtitle, children: loginNotice }), loginError && _jsx("p", { className: authStyles.loginError, children: loginError }), authMode === 'login' && loginErrorCode === 'EMAIL_NOT_VERIFIED' && loginEmail.trim() && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive, onClick: async () => {
                                 setLoginBusy(true);
                                 setLoginNotice(null);
                                 const sent = await requestEmailVerification(loginEmail);
@@ -878,7 +1100,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                     setLoginMode('verify');
                                     if (sent.verificationToken)
                                         setVerificationToken(sent.verificationToken);
-                                    setLoginNotice('Verification email resent.');
+                                    setLoginNotice(buildVerificationRequestNotice(sent));
                                     setLoginError(null);
                                     setLoginErrorCode(null);
                                 }
@@ -896,6 +1118,24 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         setLoginBusy(false);
                                         return;
                                     }
+                                    if (authMode === 'register') {
+                                        const validation = validatePasswordPolicy(loginPassword, {
+                                            email: loginEmail,
+                                            displayName: loginDisplayName
+                                        });
+                                        if (!validation.ok) {
+                                            setLoginError(validation.message || 'Password does not meet the password policy.');
+                                            setLoginErrorCode(validation.code || null);
+                                            setLoginBusy(false);
+                                            return;
+                                        }
+                                        if (loginPassword !== loginPasswordConfirm) {
+                                            setLoginError('Passwords do not match.');
+                                            setLoginErrorCode('PASSWORD_CONFIRMATION_MISMATCH');
+                                            setLoginBusy(false);
+                                            return;
+                                        }
+                                    }
                                     let result = { success: false };
                                     if (authMode === 'login') {
                                         result = await loginWithCredentials(loginEmail, loginPassword);
@@ -950,7 +1190,10 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                 setLoginMode('verify');
                                                 if (sent.verificationToken)
                                                     setVerificationToken(sent.verificationToken);
-                                                setLoginNotice('Email not verified. A verification token was sent.');
+                                                setLoginNotice(buildVerificationRequestNotice({
+                                                    ...sent,
+                                                    intro: 'If that account exists and still needs verification, we sent an email.'
+                                                }));
                                                 setLoginError(null);
                                                 setLoginErrorCode(null);
                                             }
@@ -985,6 +1228,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                 : 'Account created. Check your email for verification instructions.');
                                         }
                                         else {
+                                            setCommercialOnboardingRedirectActive(commercialOnboardingGate);
                                             setPendingPostAuthRedirect({
                                                 path: postRegistrationPath,
                                                 workspaceSetupRequired: Boolean(result.workspaceSetupRequired),
@@ -996,6 +1240,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         await retryBootstrapChecks();
                                         const commercialOnboardingGate = pendingVerificationCommercialState === 'pending_plan_selection'
                                             || pendingVerificationCommercialState === 'checkout_pending';
+                                        setCommercialOnboardingRedirectActive(commercialOnboardingGate);
                                         setPendingPostAuthRedirect({
                                             path: pendingVerificationRedirectPath || nextPath,
                                             workspaceSetupRequired: pendingVerificationWorkspaceSetupRequired,
@@ -1003,13 +1248,14 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         });
                                     }
                                     else if (authMode === 'forgot') {
+                                        const passwordResetDeliveryFailed = result.deliveryAttempted === true && result.emailSent === false;
                                         if (result.resetToken)
                                             setResetToken(result.resetToken);
-                                        setResetCooldownUntil(Date.now() + 30_000);
-                                        setLoginMode('reset');
-                                        setLoginNotice(result.emailSent === false
-                                            ? `Password reset email failed to send. ${result.emailError || 'Try again in a minute.'}`
-                                            : 'Password reset instructions sent.');
+                                        setLoginNotice(buildPasswordResetNotice(result));
+                                        if (!passwordResetDeliveryFailed) {
+                                            setResetCooldownUntil(Date.now() + 30_000);
+                                            setLoginMode('reset');
+                                        }
                                     }
                                     else if (authMode === 'reset') {
                                         setLoginMode('login');
@@ -1017,9 +1263,33 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                     }
                                     else if (authMode === 'invite') {
                                         if (inviteResolution === 'existing_user_signed_out') {
-                                            setAuthMode('invite');
+                                            const normalizedInviteEmail = String(inviteEmail || '').trim().toLowerCase();
+                                            const normalizedLoginEmail = loginEmail.trim().toLowerCase();
+                                            // Make the invite flow deterministically join-ready as soon as
+                                            // the invited account signs in successfully, instead of waiting
+                                            // for a later invite inspection effect to catch up.
+                                            if (normalizedInviteEmail && normalizedLoginEmail === normalizedInviteEmail) {
+                                                setAuthMode('invite');
+                                                setInviteResolution('existing_user_ready');
+                                                setLoginPassword('');
+                                                setLoginPasswordConfirm('');
+                                                setLoginNotice('Signed in. Review the invite details to continue.');
+                                                setLoginError(null);
+                                                setLoginErrorCode(null);
+                                                setLoginBusy(false);
+                                                return;
+                                            }
+                                            if (normalizedInviteEmail) {
+                                                setLoginEmail(inviteEmail || '');
+                                            }
+                                            setInviteResolution('existing_user_signed_out');
                                             setLoginPassword('');
-                                            setLoginNotice('Signed in. Review the invite details to continue.');
+                                            setLoginPasswordConfirm('');
+                                            setLoginNotice(normalizedInviteEmail
+                                                ? `Signed in, but this invite is for ${inviteEmail}. Sign in with that account to continue.`
+                                                : 'Signed in, but this invite requires the invited account. Sign in with that account to continue.');
+                                            setLoginError('Sign in with the invited account to join this workspace.');
+                                            setLoginErrorCode('INVITE_ACCOUNT_MISMATCH');
                                             setLoginBusy(false);
                                             return;
                                         }
@@ -1034,6 +1304,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         if (inviteToken.trim()) {
                                             setAuthMode('invite');
                                             setLoginPassword('');
+                                            setLoginPasswordConfirm('');
                                             setLoginNotice('Signed in. Review the invite details to continue.');
                                             setLoginBusy(false);
                                             return;
@@ -1046,12 +1317,14 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         setLoginEmail('');
                                         setLoginDisplayName('');
                                         setLoginPassword('');
+                                        setLoginPasswordConfirm('');
                                         navigate(nextPath, { replace: true });
                                     }
                                     else {
                                         setLoginEmail('');
                                         setLoginDisplayName('');
                                         setLoginPassword('');
+                                        setLoginPasswordConfirm('');
                                         navigate(nextPath, { replace: true });
                                     }
                                     setLoginBusy(false);
@@ -1064,7 +1337,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                     ? 'Reset Password'
                                                     : (inviteResolution === 'existing_user_signed_out'
                                                         ? 'Sign In to Continue'
-                                                        : (invitePasswordRequired ? 'Create Account and Join' : 'Join Workspace'))) }) }), authMode === 'register' && (_jsxs("p", { className: authStyles.registerConsent, children: ["By creating an account, you agree to the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.com/legal/terms", target: "_blank", rel: "noopener noreferrer", children: "Terms of Service" }), ' ', "and acknowledge the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.com/legal/privacy", target: "_blank", rel: "noopener noreferrer", children: "Privacy Policy" }), "."] })), _jsxs("div", { className: authStyles.authSecondaryActions, role: "group", "aria-label": "Authentication navigation", children: [directRegistrationEnabled && (authMode === 'login' || authMode === 'register') && (_jsxs("p", { className: authStyles.authModeSwitch, children: [authMode === 'login' ? 'Need an account?' : 'Already have an account?', ' ', _jsx("button", { className: authStyles.authModeSwitchLink, disabled: loginBusy, "data-testid": "auth-switch-mode-button", onClick: () => {
+                                                        : (invitePasswordRequired ? 'Create Account and Join' : 'Join Workspace'))) }) }), (authMode === 'login' || authMode === 'register') && availableAuthProviders.length > 0 && (_jsxs("div", { className: authStyles.oauthProviders, children: [_jsx("div", { className: authStyles.oauthDivider, children: _jsx("span", { children: "or continue with" }) }), _jsxs("div", { className: authStyles.oauthButtons, children: [availableAuthProviders.includes('google') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('google', location.pathname !== '/login' ? location.pathname : '/'), "aria-label": "Continue with Google", children: "Google" })), availableAuthProviders.includes('github') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('github', location.pathname !== '/login' ? location.pathname : '/'), "aria-label": "Continue with GitHub", children: "GitHub" })), availableAuthProviders.includes('apple') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('apple', location.pathname !== '/login' ? location.pathname : '/'), "aria-label": "Continue with Apple", children: "Apple" }))] })] })), authMode === 'invite' && inviteResolution === 'new_user' && inviteOAuthProviders.length > 0 && (_jsxs("div", { className: authStyles.oauthProviders, children: [_jsx("div", { className: authStyles.oauthDivider, children: _jsx("span", { children: "or join with" }) }), _jsxs("div", { className: authStyles.oauthButtons, children: [inviteOAuthProviders.includes('google') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('google', '/', inviteToken), "aria-label": "Join with Google", children: "Google" })), inviteOAuthProviders.includes('github') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('github', '/', inviteToken), "aria-label": "Join with GitHub", children: "GitHub" })), inviteOAuthProviders.includes('apple') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('apple', '/', inviteToken), "aria-label": "Join with Apple", children: "Apple" }))] })] })), authMode === 'register' && (_jsxs("p", { className: authStyles.registerConsent, children: ["By creating an account, you agree to the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.com/legal/terms", target: "_blank", rel: "noopener noreferrer", children: "Terms of Service" }), ' ', "and acknowledge the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.com/legal/privacy", target: "_blank", rel: "noopener noreferrer", children: "Privacy Policy" }), "."] })), _jsxs("div", { className: authStyles.authSecondaryActions, role: "group", "aria-label": "Authentication navigation", children: [directRegistrationEnabled && (authMode === 'login' || authMode === 'register') && (_jsxs("p", { className: authStyles.authModeSwitch, children: [authMode === 'login' ? 'Need an account?' : 'Already have an account?', ' ', _jsx("button", { className: authStyles.authModeSwitchLink, disabled: loginBusy, "data-testid": "auth-switch-mode-button", onClick: () => {
                                                 setLoginError(null);
                                                 setLoginErrorCode(null);
                                                 setLoginNotice(null);
@@ -1079,7 +1352,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                             setVerifyCooldownUntil(Date.now() + 30_000);
                                                             if (sent.verificationToken)
                                                                 setVerificationToken(sent.verificationToken);
-                                                            setLoginNotice('Verification email resent.');
+                                                            setLoginNotice(buildVerificationRequestNotice(sent));
                                                         }
                                                         else {
                                                             setLoginError(formatAuthError(sent));
@@ -1087,18 +1360,15 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                         setLoginBusy(false);
                                                     }, children: verifyCooldownActive ? `Resend Verification (${verifyCooldownSeconds}s)` : 'Resend Verification' })), _jsx("button", { className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-return-sign-in-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('login'); }, children: authMode === 'verify' ? 'Back to Sign In' : 'Sign In' }), directRegistrationEnabled && authMode !== 'verify' && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-return-register-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('register'); }, children: "Register" })), authMode === 'reset' && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || resetCooldownActive, "data-testid": "auth-return-forgot-password-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('forgot'); }, children: resetCooldownActive ? `Forgot Password (${resetCooldownSeconds}s)` : 'Forgot Password' }))] }))] })] })] }) }) }));
     }
-    if (shouldForceLogin && !isLoginRoute) {
+    if (shellRenderState === 'login-redirect') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: "Redirecting to sign in..." })] }) }) }));
     }
-    if (isComingSoonRoute && shouldForceComingSoon) {
+    if (shellRenderState === 'coming-soon') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, style: {
                     backgroundImage: `linear-gradient(rgba(15, 15, 26, 0.88), rgba(15, 15, 26, 0.9)), url(${taskforceBg})`
                 }, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Private Beta" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: "You are signed in, but your account is not in the beta allowlist yet." }), _jsx("p", { className: authStyles.loginSubtitle, children: "You will see the full app as soon as beta access is enabled." }), _jsx("button", { className: styles.cancelBtn, onClick: async () => { await taskforceState.logout(); navigate('/login', { replace: true }); }, children: "Sign Out" })] }) }) }));
     }
-    const showGuidedWorkspaceSetup = isCreateWorkspaceIntent
-        || (isSetupRoute && Boolean(pendingCloudWorkspaceImport))
-        || (isSetupRoute && setupGateActive && (hasSetupReadError || needsGlobalSetup || needsWorkspaceSetup));
-    if (showGuidedWorkspaceSetup) {
+    if (shellRenderState === 'guided-setup') {
         const isError = !isCreateWorkspaceIntent && (hasSetupReadError || setupStep === 'error');
         const isGlobal = !isCreateWorkspaceIntent && !isError && (needsGlobalSetup || setupStep === 'global');
         const heading = isError
@@ -1114,11 +1384,11 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         const workspaceLabel = 'Workspace';
         const isLocalWorkspaceSetup = isCloudRuntime || workspaceSetupSource !== 'cloud';
         const isWorkspaceDetailsPage = isLocalWorkspaceSetup && workspaceSetupPage === 'details';
-        const isWorkspaceStarterPage = isLocalWorkspaceSetup && workspaceSetupPage === 'starter';
+        const isWorkspaceLibraryPage = isLocalWorkspaceSetup && workspaceSetupPage === 'library';
         const showWorkspaceSourceSelector = !isCloudRuntime
             && canUseCloudWorkspaceSetup
             && isWorkspaceDetailsPage
-            && !pendingCloudWorkspaceImport;
+            && !activeCloudWorkspaceImport;
         const runtimeIcon = runtimeCapabilities?.runtimeMode === 'cloud' ? Cloud : LaptopMinimal;
         const starterCategoryItems = selectedSetupPack ? formatStarterSectionItems(selectedSetupPack.categories) : '';
         const starterTypeItems = selectedSetupPack ? formatStarterSectionItems(selectedSetupPack.types) : '';
@@ -1126,23 +1396,23 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         const setupPrimaryActionLabel = setupBusy
             ? t('setup.saving')
             : wantsCloudWorkspaceSetup
-                ? (pendingCloudWorkspaceImport
+                ? (activeCloudWorkspaceImport
                     ? (isCloudWorkspaceImportErrored ? 'Retry Import' : 'Importing Workspace...')
                     : 'Connect Workspace')
                 : isWorkspaceDetailsPage
                     ? 'Continue'
-                    : isWorkspaceStarterPage
+                    : isWorkspaceLibraryPage
                         ? 'Create Workspace'
                         : 'Connect Workspace';
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, style: {
                     backgroundImage: `linear-gradient(rgba(15, 15, 26, 0.88), rgba(15, 15, 26, 0.9)), url(${taskforceBg})`
-                }, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.setupHeaderRow, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsxs("h1", { className: authStyles.loginTitle, children: ["TASKFORCE ", _jsx("span", { className: authStyles.loginTitleAccent, children: "HQ" })] })] }), runtimeCapabilities && (_jsx("span", { className: authStyles.runtimeIconBadge, title: runtimeCapabilities.runtimeMode === 'cloud' ? 'Cloud runtime' : 'Local runtime', "aria-label": runtimeCapabilities.runtimeMode === 'cloud' ? 'Cloud runtime' : 'Local runtime', children: React.createElement(runtimeIcon, { size: 16, 'aria-hidden': true }) }))] }), _jsx("p", { className: authStyles.loginSubtitle, children: _jsx("strong", { children: heading }) }), subtitle ? _jsx("p", { className: authStyles.loginSubtitle, children: subtitle }) : null, setupNotice && _jsx("p", { className: authStyles.loginSubtitle, children: setupNotice }), setupError && _jsx("p", { className: authStyles.loginError, children: setupError }), isGlobal && (_jsxs("div", { className: authStyles.optionGrid, children: [_jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "radio", name: "setup-mode", value: "core", checked: setupModeChoice === 'core', onChange: () => setSetupModeChoice('core'), disabled: setupBusy }), _jsx("span", { children: t('setup.coreModeOption', { workspaceLabel }) })] }), _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "radio", name: "setup-mode", value: "operations", checked: setupModeChoice === 'operations', onChange: () => setSetupModeChoice('operations'), disabled: setupBusy }), _jsx("span", { children: t('setup.operationsModeOption') })] })] })), !isError && !isGlobal && (_jsxs("div", { className: authStyles.optionGrid, children: [showWorkspaceSourceSelector && (_jsxs("div", { className: authStyles.optionGroup, children: [_jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "radio", name: "workspace-setup-source", value: "local", checked: workspaceSetupSource === 'local', onChange: () => setWorkspaceSetupSource('local'), disabled: setupBusy }), _jsxs("span", { children: ["Create new local ", workspaceLabel.toLowerCase()] })] }), _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "radio", name: "workspace-setup-source", value: "cloud", checked: workspaceSetupSource === 'cloud', onChange: () => setWorkspaceSetupSource('cloud'), disabled: setupBusy }), _jsxs("span", { children: ["Sync existing cloud ", workspaceLabel.toLowerCase()] })] })] })), wantsCloudWorkspaceSetup ? (_jsxs("div", { className: authStyles.optionGroup, children: [!pendingCloudWorkspaceImport && !canUseCloudWorkspaceSetup && (_jsx("p", { className: authStyles.loginError, children: "Cloud workspace sync is unavailable right now. Switch back to local setup or refresh runtime configuration." })), !pendingCloudWorkspaceImport && canUseCloudWorkspaceSetup && !isAuthenticated && (_jsxs(_Fragment, { children: [_jsx("p", { className: authStyles.inlineHint, children: "Sign in to choose one of your cloud projects." }), _jsxs("div", { className: authStyles.actionRowEnd, children: [_jsx("button", { className: styles.cancelBtn, disabled: setupBusy, onClick: () => {
+                }, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.setupHeaderRow, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsxs("h1", { className: authStyles.loginTitle, children: ["TASKFORCE ", _jsx("span", { className: authStyles.loginTitleAccent, children: "HQ" })] })] }), runtimeCapabilities && (_jsx("span", { className: authStyles.runtimeIconBadge, title: runtimeCapabilities.runtimeMode === 'cloud' ? 'Cloud runtime' : 'Local runtime', "aria-label": runtimeCapabilities.runtimeMode === 'cloud' ? 'Cloud runtime' : 'Local runtime', children: React.createElement(runtimeIcon, { size: 16, 'aria-hidden': true }) }))] }), _jsx("p", { className: authStyles.loginSubtitle, children: _jsx("strong", { children: heading }) }), subtitle ? _jsx("p", { className: authStyles.loginSubtitle, children: subtitle }) : null, setupNotice && _jsx("p", { className: authStyles.loginSubtitle, children: setupNotice }), setupError && _jsx("p", { className: authStyles.loginError, children: setupError }), isGlobal && (_jsxs("div", { className: authStyles.optionGrid, children: [_jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "radio", name: "setup-mode", value: "core", checked: setupModeChoice === 'core', onChange: () => setSetupModeChoice('core'), disabled: setupBusy }), _jsx("span", { children: t('setup.coreModeOption', { workspaceLabel }) })] }), _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "radio", name: "setup-mode", value: "operations", checked: setupModeChoice === 'operations', onChange: () => setSetupModeChoice('operations'), disabled: setupBusy }), _jsx("span", { children: t('setup.operationsModeOption') })] })] })), !isError && !isGlobal && (_jsxs("div", { className: authStyles.optionGrid, children: [showWorkspaceSourceSelector && (_jsxs("div", { className: authStyles.optionGroup, children: [_jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "radio", name: "workspace-setup-source", value: "local", checked: workspaceSetupSource === 'local', onChange: () => setWorkspaceSetupSource('local'), disabled: setupBusy }), _jsxs("span", { children: ["Create new local ", workspaceLabel.toLowerCase()] })] }), _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "radio", name: "workspace-setup-source", value: "cloud", checked: workspaceSetupSource === 'cloud', onChange: () => setWorkspaceSetupSource('cloud'), disabled: setupBusy }), _jsxs("span", { children: ["Sync existing cloud ", workspaceLabel.toLowerCase()] })] })] })), wantsCloudWorkspaceSetup ? (_jsxs("div", { className: authStyles.optionGroup, children: [!activeCloudWorkspaceImport && !canUseCloudWorkspaceSetup && (_jsx("p", { className: authStyles.loginError, children: "Cloud workspace sync is unavailable right now. Switch back to local setup or refresh runtime configuration." })), !activeCloudWorkspaceImport && canUseCloudWorkspaceSetup && !isAuthenticated && (_jsxs(_Fragment, { children: [_jsx("p", { className: authStyles.inlineHint, children: "Sign in to choose one of your cloud projects." }), _jsxs("div", { className: authStyles.actionRowEnd, children: [_jsx("button", { className: styles.cancelBtn, disabled: setupBusy, onClick: () => {
                                                                 navigate(`/login?mode=login&next=${encodeURIComponent(cloudWorkspaceSelectionPath)}`, { replace: true });
                                                             }, children: "Sign In" }), directRegistrationEnabled && (_jsx("button", { className: styles.submitBtn, disabled: setupBusy, onClick: () => {
                                                                 navigate(`/login?mode=register&next=${encodeURIComponent(cloudWorkspaceSelectionPath)}`, { replace: true });
-                                                            }, children: "Register" }))] })] })), !pendingCloudWorkspaceImport && canUseCloudWorkspaceSetup && isAuthenticated && (_jsxs(_Fragment, { children: [_jsxs("select", { className: styles.input, value: cloudWorkspaceSelection, onChange: (event) => setCloudWorkspaceSelection(event.target.value), disabled: setupBusy || cloudWorkspaceLoading || cloudWorkspaceOptions.length === 0, children: [cloudWorkspaceOptions.length === 0 && (_jsx("option", { value: "", children: cloudWorkspaceLoading ? 'Loading cloud projects...' : 'No cloud projects found' })), cloudWorkspaceOptions.map((workspace) => (_jsxs("option", { value: workspace.id, children: [workspace.name, " (", workspace.id, ")"] }, workspace.id)))] }), _jsx("div", { className: authStyles.actionRowEnd, children: _jsx("button", { className: styles.cancelBtn, disabled: setupBusy || cloudWorkspaceLoading, onClick: () => void fetchCloudWorkspaceOptions(), children: "Refresh Cloud Projects" }) }), cloudWorkspaceError && _jsx("p", { className: authStyles.loginError, children: cloudWorkspaceError })] })), pendingCloudWorkspaceImport && (_jsxs(_Fragment, { children: [_jsxs("p", { className: authStyles.inlineHint, children: ["Importing \"", pendingCloudWorkspaceImport.name, "\" from cloud into local."] }), _jsx("div", { className: authStyles.optionGroup, children: cloudWorkspaceImportProgressLines.map((line) => (_jsx("p", { className: authStyles.inlineHint, children: line }, line))) }), _jsx("p", { className: authStyles.inlineHint, children: cloudWorkspaceImportFinalizing
+                                                            }, children: "Register" }))] })] })), !activeCloudWorkspaceImport && canUseCloudWorkspaceSetup && isAuthenticated && (_jsxs(_Fragment, { children: [_jsxs("select", { className: styles.input, value: cloudWorkspaceSelection, onChange: (event) => setCloudWorkspaceSelection(event.target.value), disabled: setupBusy || cloudWorkspaceLoading || cloudWorkspaceOptions.length === 0, children: [cloudWorkspaceOptions.length === 0 && (_jsx("option", { value: "", children: cloudWorkspaceLoading ? 'Loading cloud projects...' : 'No cloud projects found' })), cloudWorkspaceOptions.map((workspace) => (_jsxs("option", { value: workspace.id, children: [workspace.name, " (", workspace.id, ")"] }, workspace.id)))] }), _jsx("div", { className: authStyles.actionRowEnd, children: _jsx("button", { className: styles.cancelBtn, disabled: setupBusy || cloudWorkspaceLoading, onClick: () => void fetchCloudWorkspaceOptions(), children: "Refresh Cloud Projects" }) }), cloudWorkspaceError && _jsx("p", { className: authStyles.loginError, children: cloudWorkspaceError })] })), activeCloudWorkspaceImport && (_jsxs(_Fragment, { children: [_jsxs("p", { className: authStyles.inlineHint, children: ["Importing \"", activeCloudWorkspaceImport.name, "\" from cloud into local."] }), _jsx("div", { className: authStyles.optionGroup, children: cloudWorkspaceImportProgressLines.map((line) => (_jsx("p", { className: authStyles.inlineHint, children: line }, line))) }), _jsx("p", { className: authStyles.inlineHint, children: cloudWorkspaceImportFinalizing
                                                         ? 'Finishing setup and opening your workspace.'
-                                                        : (workspaceSyncSummary || 'Pulling tasks, taxonomies, and settings into local.') }), !cloudWorkspaceImportFinalizing && workspaceSyncRecommendedAction && (_jsx("p", { className: authStyles.inlineHint, children: workspaceSyncRecommendedAction }))] }))] })) : (_jsxs(_Fragment, { children: [isWorkspaceDetailsPage && (_jsxs(_Fragment, { children: [_jsx("p", { className: authStyles.loginSubtitle, children: "Workspace name" }), _jsx("input", { className: styles.input, type: "text", value: workspaceNameInput, placeholder: "Workspace name", onChange: (event) => setWorkspaceNameInput(event.target.value), disabled: setupBusy }), _jsx("p", { className: authStyles.loginSubtitle, children: "Workspace description" }), _jsx("textarea", { className: styles.textarea, value: workspaceDescriptionInput, placeholder: "Workspace description (optional)", onChange: (event) => setWorkspaceDescriptionInput(event.target.value), disabled: setupBusy, rows: 4 })] })), isWorkspaceStarterPage && (_jsxs("div", { className: authStyles.optionGroup, children: [_jsx("p", { className: authStyles.loginSubtitle, children: "What are you working on?" }), _jsxs("select", { className: styles.input, value: selectedSetupPackId, onChange: (event) => setSelectedSetupPackId(event.target.value), disabled: setupBusy || setupLibraryLoading || setupLibraryPacks.length === 0, children: [setupLibraryPacks.length === 0 && (_jsx("option", { value: "", children: setupLibraryLoading ? 'Loading starter options...' : 'No starter options available' })), setupLibraryPacks.map((pack) => (_jsx("option", { value: pack.id, children: pack.label }, pack.id)))] }), selectedSetupPack ? (_jsx(_Fragment, { children: selectedSetupPack.description ? (_jsx("p", { className: authStyles.inlineHint, children: selectedSetupPack.description })) : null })) : null, _jsxs("div", { className: authStyles.optionGroup, children: [_jsx("p", { className: authStyles.loginSubtitle, children: "Apply Starter Sections" }), _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "checkbox", checked: setupTaxonomySections.categories, onChange: () => setSetupTaxonomySections((current) => ({ ...current, categories: !current.categories })), disabled: setupBusy || !selectedSetupPack?.categories.length }), _jsx("span", { children: "Categories" })] }), starterCategoryItems ? (_jsx("p", { className: authStyles.inlineHint, children: starterCategoryItems })) : null, _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "checkbox", checked: setupTaxonomySections.types, onChange: () => setSetupTaxonomySections((current) => ({ ...current, types: !current.types })), disabled: setupBusy || !selectedSetupPack?.types.length }), _jsx("span", { children: "Task Types" })] }), starterTypeItems ? (_jsx("p", { className: authStyles.inlineHint, children: starterTypeItems })) : null, _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "checkbox", checked: setupTaxonomySections.priorities, onChange: () => setSetupTaxonomySections((current) => ({ ...current, priorities: !current.priorities })), disabled: setupBusy || !selectedSetupPack?.priorities.length }), _jsx("span", { children: "Priorities" })] }), starterPriorityItems ? (_jsx("p", { className: authStyles.inlineHint, children: starterPriorityItems })) : null] }), setupLibraryLoading ? (_jsx("p", { className: authStyles.inlineHint, children: "Loading starter options\u2026" })) : null, setupLibraryError ? (_jsx("p", { className: authStyles.loginError, children: setupLibraryError })) : null] })), !isCloudRuntime && canUseCloudWorkspaceSetup && isAuthenticated && isWorkspaceDetailsPage && (_jsxs("div", { className: authStyles.optionGroup, children: [_jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "checkbox", checked: syncNewLocalWorkspaceToCloud, onChange: (event) => setSyncNewLocalWorkspaceToCloud(event.target.checked), disabled: setupBusy }), _jsx("span", { children: "Sync to cloud after setup" })] }), _jsx("p", { className: authStyles.inlineHint, children: "When enabled, this project will connect to cloud sync as soon as setup finishes." })] }))] }))] })), _jsxs("div", { className: authStyles.authModeLinks, children: [isWorkspaceStarterPage ? (_jsx("button", { className: styles.cancelBtn, onClick: () => {
+                                                        : (workspaceSyncSummary || 'Pulling tasks, taxonomies, and settings into local.') }), !cloudWorkspaceImportFinalizing && workspaceSyncRecommendedAction && (_jsx("p", { className: authStyles.inlineHint, children: workspaceSyncRecommendedAction }))] }))] })) : (_jsxs(_Fragment, { children: [isWorkspaceDetailsPage && (_jsxs(_Fragment, { children: [_jsx("p", { className: authStyles.loginSubtitle, children: "Workspace name" }), _jsx("input", { className: styles.input, type: "text", value: workspaceNameInput, placeholder: "Workspace name", onChange: (event) => setWorkspaceNameInput(event.target.value), disabled: setupBusy }), _jsx("p", { className: authStyles.loginSubtitle, children: "Workspace description" }), _jsx("textarea", { className: styles.textarea, value: workspaceDescriptionInput, placeholder: "Workspace description (optional)", onChange: (event) => setWorkspaceDescriptionInput(event.target.value), disabled: setupBusy, rows: 4 })] })), isWorkspaceLibraryPage && (_jsxs("div", { className: authStyles.optionGroup, children: [_jsx("p", { className: authStyles.loginSubtitle, children: "What are you working on?" }), _jsxs("select", { className: styles.input, value: selectedSetupPackId, onChange: (event) => setSelectedSetupPackId(event.target.value), disabled: setupBusy || setupLibraryLoading || setupLibraryPacks.length === 0, children: [setupLibraryPacks.length === 0 && (_jsx("option", { value: "", children: setupLibraryLoading ? 'Loading setup options...' : 'No setup options available' })), setupLibraryPacks.map((pack) => (_jsx("option", { value: pack.id, children: pack.label }, pack.id)))] }), selectedSetupPack ? (_jsx(_Fragment, { children: selectedSetupPack.description ? (_jsx("p", { className: authStyles.inlineHint, children: selectedSetupPack.description })) : null })) : null, _jsxs("div", { className: authStyles.optionGroup, children: [_jsx("p", { className: authStyles.loginSubtitle, children: "Apply Setup Sections" }), _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "checkbox", checked: setupTaxonomySections.categories, onChange: () => setSetupTaxonomySections((current) => ({ ...current, categories: !current.categories })), disabled: setupBusy || !selectedSetupPack?.categories.length }), _jsx("span", { children: "Categories" })] }), starterCategoryItems ? (_jsx("p", { className: authStyles.inlineHint, children: starterCategoryItems })) : null, _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "checkbox", checked: setupTaxonomySections.types, onChange: () => setSetupTaxonomySections((current) => ({ ...current, types: !current.types })), disabled: setupBusy || !selectedSetupPack?.types.length }), _jsx("span", { children: "Task Types" })] }), starterTypeItems ? (_jsx("p", { className: authStyles.inlineHint, children: starterTypeItems })) : null, _jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "checkbox", checked: setupTaxonomySections.priorities, onChange: () => setSetupTaxonomySections((current) => ({ ...current, priorities: !current.priorities })), disabled: setupBusy || !selectedSetupPack?.priorities.length }), _jsx("span", { children: "Priorities" })] }), starterPriorityItems ? (_jsx("p", { className: authStyles.inlineHint, children: starterPriorityItems })) : null] }), setupLibraryLoading ? (_jsx("p", { className: authStyles.inlineHint, children: "Loading setup options\u2026" })) : null, setupLibraryError ? (_jsx("p", { className: authStyles.loginError, children: setupLibraryError })) : null] })), !isCloudRuntime && canUseCloudWorkspaceSetup && isAuthenticated && isWorkspaceDetailsPage && (_jsxs("div", { className: authStyles.optionGroup, children: [_jsxs("label", { className: `${authStyles.authModeLink} ${authStyles.optionRow}`, children: [_jsx("input", { type: "checkbox", checked: syncNewLocalWorkspaceToCloud, onChange: (event) => setSyncNewLocalWorkspaceToCloud(event.target.checked), disabled: setupBusy }), _jsx("span", { children: "Sync to cloud after setup" })] }), _jsx("p", { className: authStyles.inlineHint, children: "When enabled, this project will connect to cloud sync as soon as setup finishes." })] }))] }))] })), _jsxs("div", { className: authStyles.authModeLinks, children: [isWorkspaceLibraryPage ? (_jsx("button", { className: styles.cancelBtn, onClick: () => {
                                         setSetupError(null);
                                         setSetupNotice(null);
                                         setWorkspaceSetupPage('details');
@@ -1150,7 +1420,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         setSetupError(null);
                                         setSetupNotice(null);
                                         navigate('/', { replace: true });
-                                    }, children: "Cancel" })) : runtimeMode === 'cloud' ? (_jsx("button", { className: styles.cancelBtn, onClick: async () => { await taskforceState.logout(); navigate('/login', { replace: true }); }, children: t('setup.signOut') })) : null, isGlobal ? (_jsx("button", { className: styles.submitBtn, disabled: setupBusy || (isCloudWorkspaceSetupFlow && Boolean(pendingCloudWorkspaceImport) && !isCloudWorkspaceImportErrored), onClick: async () => {
+                                    }, children: "Cancel" })) : runtimeMode === 'cloud' ? (_jsx("button", { className: styles.cancelBtn, onClick: async () => { await taskforceState.logout(); navigate('/login', { replace: true }); }, children: t('setup.signOut') })) : null, isGlobal ? (_jsx("button", { className: styles.submitBtn, disabled: setupBusy || (isCloudWorkspaceSetupFlow && Boolean(activeCloudWorkspaceImport) && !isCloudWorkspaceImportErrored), onClick: async () => {
                                         setSetupBusy(true);
                                         setSetupNotice(null);
                                         setSetupError(null);
@@ -1177,19 +1447,19 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                             setSetupBusy(false);
                                         }
                                     }, children: setupBusy ? t('setup.saving') : t('setup.saveGlobalSetup') })) : !isError ? (_jsx("button", { className: styles.submitBtn, disabled: setupBusy
-                                        || (isCloudWorkspaceSetupFlow && !pendingCloudWorkspaceImport && !isAuthenticated), onClick: async () => {
-                                        if (isCloudWorkspaceSetupFlow && pendingCloudWorkspaceImport) {
+                                        || (isCloudWorkspaceSetupFlow && !activeCloudWorkspaceImport && !isAuthenticated), onClick: async () => {
+                                        if (isCloudWorkspaceSetupFlow && activeCloudWorkspaceImport) {
                                             if (!isCloudWorkspaceImportErrored)
                                                 return;
                                             setSetupBusy(true);
-                                            setSetupNotice(`Retrying import for ${pendingCloudWorkspaceImport.name}...`);
+                                            setSetupNotice(`Retrying import for ${activeCloudWorkspaceImport.name}...`);
                                             setSetupError(null);
                                             try {
                                                 await retryWorkspaceCloudSync();
                                             }
                                             catch {
                                                 setSetupNotice(null);
-                                                setSetupError(`Failed to retry import for "${pendingCloudWorkspaceImport.name}".`);
+                                                setSetupError(`Failed to retry import for "${activeCloudWorkspaceImport.name}".`);
                                             }
                                             finally {
                                                 setSetupBusy(false);
@@ -1229,33 +1499,28 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                 setSetupBusy(false);
                                                 return;
                                             }
-                                            const stateRes = await fetch('/api/taskforce/ui-state', {
-                                                method: 'POST',
-                                                headers: { 'Content-Type': 'application/json' },
-                                                credentials: 'include',
-                                                body: JSON.stringify({
-                                                    workspaceId: workspaceIdForSync,
-                                                    stateKey: 'workspace-sync',
-                                                    patch: {
-                                                        version: 2,
-                                                        enabled: true,
-                                                        phase: 'attach-cloud',
-                                                        pullCursor: null,
-                                                        lastPullAt: null,
-                                                        lastPushAt: null,
-                                                        lastSyncedAt: null
-                                                    }
-                                                })
-                                            });
-                                            const statePayload = await stateRes.json().catch(() => ({}));
-                                            if (!stateRes.ok || statePayload?.success === false) {
-                                                setSetupError(statePayload?.error || `Failed to configure workspace sync (${stateRes.status})`);
+                                            try {
+                                                await persistWorkspaceSyncStatePatch(workspaceIdForSync, {
+                                                    version: 2,
+                                                    enabled: true,
+                                                    phase: 'attach-cloud',
+                                                    setupIntent: 'attach-cloud-import',
+                                                    pullCursor: null,
+                                                    lastPullAt: null,
+                                                    lastPushAt: null,
+                                                    lastSyncedAt: null,
+                                                    lastErrorMessage: null
+                                                });
+                                            }
+                                            catch (error) {
+                                                setSetupError(error instanceof Error ? error.message : 'Failed to configure workspace sync.');
                                                 setSetupBusy(false);
                                                 return;
                                             }
                                             applyWorkspaceSyncStateSnapshot({
                                                 enabled: true,
                                                 phase: 'attach-cloud',
+                                                setupIntent: 'attach-cloud-import',
                                                 pullCursor: null
                                             });
                                             await refreshSetupContext();
@@ -1276,10 +1541,10 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                             }
                                             setSetupError(null);
                                             setSetupNotice(null);
-                                            setWorkspaceSetupPage('starter');
+                                            setWorkspaceSetupPage('library');
                                             return;
                                         }
-                                        if (isWorkspaceStarterPage) {
+                                        if (isWorkspaceLibraryPage) {
                                             // fall through to final create/save behavior below
                                         }
                                         setSetupBusy(true);
@@ -1324,7 +1589,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                         workspaceIdOverride: workspaceIdForSetup
                                                     });
                                                     if (!applyResult?.success) {
-                                                        setSetupError(applyResult?.error || 'Failed to apply starter taxonomy library.');
+                                                        setSetupError(applyResult?.error || 'Failed to apply setup library.');
                                                         setSetupBusy(false);
                                                         return;
                                                     }
@@ -1342,6 +1607,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                             version: 2,
                                                             enabled: shouldEnableCloudSync,
                                                             phase: shouldEnableCloudSync ? 'provision-local' : 'idle',
+                                                            setupIntent: null,
                                                             pullCursor: null,
                                                             lastPullAt: null,
                                                             lastPushAt: null,
@@ -1358,6 +1624,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                 applyWorkspaceSyncStateSnapshot({
                                                     enabled: shouldEnableCloudSync,
                                                     phase: shouldEnableCloudSync ? 'provision-local' : 'idle',
+                                                    setupIntent: null,
                                                     pullCursor: null
                                                 });
                                                 if (shouldEnableCloudSync) {