@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/core/SystemAdmin.test.js

@@ -16,29 +16,42 @@ function insertFreePriceMapping(core, planVersionId) {
     `).run(core.getTenantId(), planVersionId, 'month', `free:${planVersionId}:month`, 'free', 1, 0, null, now, now);
 }
 function seedPlanCatalog(core) {
-    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'active' });
-    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'basic', displayName: 'Basic', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'team-5', displayName: 'Team 5', status: 'active' });
     core.updatePlanVersion({
-        planId: 'collab',
+        planId: 'basic',
+        versionNumber: 1,
+        seatLimit: null
+    });
+    core.updatePlanVersion({
+        planId: 'team-5',
         versionNumber: 1,
         seatLimit: 5
     });
     core.updatePlanVersionFeatures({
-        planVersionId: 'starter-v1',
+        planVersionId: 'free-v1',
+        features: [
+            { featureKey: 'workspace.workspaces', access: 'enabled' }
+        ]
+    });
+    core.updatePlanVersionFeatures({
+        planVersionId: 'basic-v1',
         features: [
-            { featureKey: 'workspace.switching', access: 'enabled' }
+            { featureKey: 'context.uploads', access: 'enabled' },
+            { featureKey: 'workspace.workspaces', access: 'enabled' }
         ]
     });
     core.updatePlanVersionFeatures({
-        planVersionId: 'collab-v1',
+        planVersionId: 'team-5-v1',
         features: [
             { featureKey: 'collaboration.invites', access: 'enabled' },
             { featureKey: 'collaboration.team_management', access: 'enabled' },
             { featureKey: 'context.uploads', access: 'enabled' },
-            { featureKey: 'workspace.switching', access: 'enabled' }
+            { featureKey: 'workspace.workspaces', access: 'enabled' }
         ]
     });
-    insertFreePriceMapping(core, 'starter-v1');
+    insertFreePriceMapping(core, 'free-v1');
 }
 function seedPlans(core) {
     seedPlanCatalog(core);
@@ -46,7 +59,7 @@ function seedPlans(core) {
         billing: {
             onboardingPolicy: {
                 mode: 'auto_grant_free',
-                planVersionId: 'starter-v1'
+                planId: 'free'
             }
         }
     });
@@ -68,7 +81,7 @@ describe('TaskforceCore system admin model', () => {
         try {
             const created = core.registerPasswordUser({
                 email: 'billing-noworkspace@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const db = core.db;
             const row = db.prepare(`
@@ -78,7 +91,7 @@ describe('TaskforceCore system admin model', () => {
                 LIMIT 1
             `).get('default', created.userId);
             expect(row?.user_id).toBe(created.userId);
-            expect(row?.tier).toBe('starter');
+            expect(row?.tier).toBe('free');
             expect(row?.entitlement_state).toBe('active');
         }
         finally {
@@ -93,7 +106,7 @@ describe('TaskforceCore system admin model', () => {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
             const created = core.registerPasswordUser({
                 email: 'billing-workspace@example.com',
-                password: 'password123',
+                password: 'ValidPassphrase123!',
                 workspaceId: 'workspace-1',
                 role: 'member'
             });
@@ -105,7 +118,7 @@ describe('TaskforceCore system admin model', () => {
                 LIMIT 1
             `).get('default', created.userId);
             expect(row?.user_id).toBe(created.userId);
-            expect(row?.tier).toBe('starter');
+            expect(row?.tier).toBe('free');
             expect(row?.entitlement_state).toBe('active');
         }
         finally {
@@ -118,23 +131,23 @@ describe('TaskforceCore system admin model', () => {
         const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             core.createPlanVersion({
-                planId: 'collab',
+                planId: 'team-5',
                 versionNumber: 2,
                 isDefault: true,
                 seatLimit: 10,
                 trialDays: 14
             });
             core.updatePlanVersionFeatures({
-                planVersionId: 'collab-v2',
+                planVersionId: 'team-5-v2',
                 features: [
                     { featureKey: 'collaboration.invites', access: 'enabled' },
                     { featureKey: 'collaboration.team_management', access: 'enabled' },
                     { featureKey: 'context.uploads', access: 'enabled' },
-                    { featureKey: 'workspace.switching', access: 'enabled' }
+                    { featureKey: 'workspace.workspaces', access: 'enabled' }
                 ]
             });
             core.createPlanVersion({
-                planId: 'starter',
+                planId: 'free',
                 versionNumber: 2,
                 isDefault: false,
                 seatLimit: null
@@ -143,13 +156,13 @@ describe('TaskforceCore system admin model', () => {
                 billing: {
                     onboardingPolicy: {
                         mode: 'auto_start_trial',
-                        planVersionId: 'collab-v2'
+                        planId: 'team-5'
                     }
                 }
             });
             const created = core.registerPasswordUser({
                 email: 'configured-signup@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const entitlement = core.getAccountEntitlement(created.userId);
             const db = core.db;
@@ -159,10 +172,10 @@ describe('TaskforceCore system admin model', () => {
                 WHERE tenant_id = ? AND user_id = ?
                 LIMIT 1
             `).get(core.getTenantId(), created.userId);
-            expect(entitlement.planVersionId).toBe('collab-v2');
-            expect(entitlement.planId).toBe('collab');
+            expect(entitlement.planVersionId).toBe('team-5-v2');
+            expect(entitlement.planId).toBe('team-5');
             expect(entitlement.state).toBe('trialing');
-            expect(billing?.tier).toBe('collab');
+            expect(billing?.tier).toBe('team-5');
             expect(billing?.entitlement_state).toBe('trialing');
         }
         finally {
@@ -178,13 +191,13 @@ describe('TaskforceCore system admin model', () => {
                 billing: {
                     onboardingPolicy: {
                         mode: 'auto_grant_free',
-                        planVersionId: 'missing-v9'
+                        planId: 'missing'
                     }
                 }
             });
             expect(() => core.registerPasswordUser({
                 email: 'fallback-signup@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             })).toThrowError(/was not found/i);
         }
         finally {
@@ -200,13 +213,13 @@ describe('TaskforceCore system admin model', () => {
                 billing: {
                     onboardingPolicy: {
                         mode: 'require_plan_selection',
-                        planVersionId: null
+                        planId: null
                     }
                 }
             });
             const created = core.registerPasswordUser({
                 email: 'pending-plan@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             expect(created.planSelectionRequired).toBe(true);
             expect(core.hasAccountEntitlement(created.userId)).toBe(true);
@@ -244,7 +257,7 @@ describe('TaskforceCore system admin model', () => {
                     access = excluded.access,
                     config_json = excluded.config_json,
                     updated_at = excluded.updated_at
-            `).run('default', 'collab-v1', 'documents.workspace_access', 'enabled', '{}', now, now);
+            `).run('default', 'team-5-v1', 'documents.workspace_access', 'enabled', '{}', now, now);
         }
         finally {
             core.close();
@@ -257,9 +270,9 @@ describe('TaskforceCore system admin model', () => {
                 FROM plan_feature_matrix
                 WHERE tenant_id = ? AND plan_version_id = ? AND feature_key = ?
                 LIMIT 1
-            `).get('default', 'collab-v1', 'documents.workspace_access');
+            `).get('default', 'team-5-v1', 'documents.workspace_access');
             expect(row).toBeUndefined();
-            const snapshot = core.listPlanVersions('collab').find((version) => version.planVersionId === 'collab-v1');
+            const snapshot = core.listPlanVersions('team-5').find((version) => version.planVersionId === 'team-5-v1');
             expect(snapshot).toBeDefined();
             expect(snapshot.features['documents.workspace_access']).toBeUndefined();
         }
@@ -268,34 +281,120 @@ describe('TaskforceCore system admin model', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
-    it('assigns the explicitly selected plan version instead of the configured onboarding plan', () => {
+    it('keeps configured auto-grant onboarding plan when registration includes a selected plan version', () => {
         const projectRoot = makeProjectRoot();
         const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
-            core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
             core.updatePlanVersion({
-                planId: 'free',
+                planId: 'basic',
                 versionNumber: 1,
-                seatLimit: 1
+                seatLimit: null
             });
-            insertFreePriceMapping(core, 'free-v1');
-            core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'archived' });
             core.updateGlobalSettings({
                 billing: {
                     onboardingPolicy: {
                         mode: 'auto_grant_free',
-                        planVersionId: 'starter-v1'
+                        planId: 'free'
                     }
                 }
             });
             const created = core.registerPasswordUser({
                 email: 'selected-plan@example.com',
-                password: 'password123',
-                planVersionId: 'free-v1'
+                password: 'ValidPassphrase123!',
+                planVersionId: 'basic-v1'
+            });
+            expect(created.planSelectionRequired).toBe(false);
+            expect(core.getAccountEntitlement(created.userId)).toMatchObject({
+                planVersionId: 'free-v1',
+                planId: 'free',
+                state: 'active'
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('uses the explicitly selected plan version when onboarding requires plan selection', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            core.updatePlanVersion({
+                planId: 'basic',
+                versionNumber: 1,
+                seatLimit: null
+            });
+            core.updateGlobalSettings({
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'require_plan_selection',
+                        planId: null
+                    }
+                }
+            });
+            const created = core.registerPasswordUser({
+                email: 'selected-plan-required@example.com',
+                password: 'ValidPassphrase123!',
+                planVersionId: 'basic-v1'
             });
             expect(created.planSelectionRequired).toBe(false);
             expect(core.getAccountEntitlement(created.userId)).toMatchObject({
+                planVersionId: 'basic-v1',
+                planId: 'basic',
+                state: 'checkout_pending'
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('auto-heals stranded legacy personal free entitlements onto the active default free version', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
+            insertFreePriceMapping(core, 'free-v1');
+            core.createPlanVersion({
+                planId: 'free',
+                versionNumber: 2,
+                isDefault: true,
+                seatLimit: 1
+            });
+            insertFreePriceMapping(core, 'free-v2');
+            core.updateGlobalSettings({
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'require_plan_selection',
+                        planId: null
+                    }
+                }
+            });
+            const created = core.registerPasswordUser({
+                email: 'legacy-free@example.com',
+                password: 'ValidPassphrase123!',
+                planVersionId: 'free-v1'
+            });
+            core.updateAccountEntitlement({
+                accountId: created.userId,
                 planVersionId: 'free-v1',
+                entitlementState: 'canceled',
+                actorUserId: created.userId,
+                actorRole: 'user',
+                reason: 'legacy-free-v1-canceled'
+            });
+            expect(core.getAccountAccessStatus(created.userId)).toMatchObject({
+                gate: 'ok',
+                hasEntitlement: true,
+                canAccessApp: true,
+                entitlement: {
+                    planVersionId: 'free-v2',
+                    planId: 'free',
+                    state: 'active'
+                }
+            });
+            expect(core.getAccountEntitlement(created.userId)).toMatchObject({
+                planVersionId: 'free-v2',
                 planId: 'free',
                 state: 'active'
             });
@@ -305,6 +404,61 @@ describe('TaskforceCore system admin model', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('does not auto-heal canceled accounts already on the current default free version', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot, { seedDefaultPlans: true });
+        try {
+            core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
+            insertFreePriceMapping(core, 'free-v1');
+            core.createPlanVersion({
+                planId: 'free',
+                versionNumber: 2,
+                isDefault: true,
+                seatLimit: 1
+            });
+            insertFreePriceMapping(core, 'free-v2');
+            core.updateGlobalSettings({
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'require_plan_selection',
+                        planId: null
+                    }
+                }
+            });
+            const created = core.registerPasswordUser({
+                email: 'current-default-free@example.com',
+                password: 'ValidPassphrase123!',
+                planVersionId: 'free-v2'
+            });
+            core.updateAccountEntitlement({
+                accountId: created.userId,
+                planVersionId: 'free-v2',
+                entitlementState: 'canceled',
+                actorUserId: created.userId,
+                actorRole: 'user',
+                reason: 'intentional-free-v2-cancel'
+            });
+            expect(core.getAccountAccessStatus(created.userId)).toMatchObject({
+                gate: 'missing_entitlement',
+                hasEntitlement: true,
+                canAccessApp: false,
+                entitlement: {
+                    planVersionId: 'free-v2',
+                    planId: 'free',
+                    state: 'canceled'
+                }
+            });
+            expect(core.getAccountEntitlement(created.userId)).toMatchObject({
+                planVersionId: 'free-v2',
+                planId: 'free',
+                state: 'canceled'
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('treats accounts without an entitlement or pending-selection marker as missing entitlement', () => {
         const projectRoot = makeProjectRoot();
         const core = openCore(projectRoot, { seedDefaultPlans: true });
@@ -313,16 +467,16 @@ describe('TaskforceCore system admin model', () => {
                 billing: {
                     onboardingPolicy: {
                         mode: 'require_plan_selection',
-                        planVersionId: null
+                        planId: null
                     }
                 }
             });
             const now = new Date().toISOString();
             const db = core.db;
             db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, password_hash, system_role, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, 'user', 1, 0, ?, ?)
-            `).run('user-missing-entitlement', 'default', 'broken@example.com', 'Broken', 'password', 'broken@example.com', 'hash', now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, system_role, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, 'user', 1, 0, ?, ?)
+            `).run('user-missing-entitlement', 'default', 'broken@example.com', 'Broken', now, now);
             expect(core.getAccountAccessStatus('user-missing-entitlement')).toMatchObject({
                 gate: 'missing_entitlement',
                 hasEntitlement: false,
@@ -344,7 +498,7 @@ describe('TaskforceCore system admin model', () => {
                 UPDATE plan_versions
                 SET is_default = 0
                 WHERE tenant_id = ? AND plan_id = ?
-            `).run('default', 'starter');
+            `).run('default', 'free');
         }
         finally {
             initial.close();
@@ -357,10 +511,10 @@ describe('TaskforceCore system admin model', () => {
                 FROM plan_versions
                 WHERE tenant_id = ? AND plan_id = ? AND plan_version_id = ?
                 LIMIT 1
-            `).get('default', 'starter', 'starter-v1');
-            expect(row?.plan_version_id).toBe('starter-v1');
+            `).get('default', 'free', 'free-v1');
+            expect(row?.plan_version_id).toBe('free-v1');
             expect(row?.is_default).toBe(1);
-            expect(reopened.getRequiredDefaultPlanVersionId('starter')).toBe('starter-v1');
+            expect(reopened.getRequiredDefaultPlanVersionId('free')).toBe('free-v1');
         }
         finally {
             reopened.close();
@@ -375,7 +529,7 @@ describe('TaskforceCore system admin model', () => {
                 billing: {
                     onboardingPolicy: {
                         mode: 'require_plan_selection',
-                        planVersionId: null
+                        planId: null
                     }
                 }
             });
@@ -387,7 +541,7 @@ describe('TaskforceCore system admin model', () => {
         try {
             expect(reopened.getOnboardingPolicy()).toEqual({
                 mode: 'require_plan_selection',
-                planVersionId: null
+                planId: null
             });
         }
         finally {
@@ -405,7 +559,7 @@ describe('TaskforceCore system admin model', () => {
                 UPDATE plan_versions
                 SET seat_limit = NULL, updated_at = ?
                 WHERE tenant_id = ? AND plan_version_id = ?
-            `).run(now, 'default', 'collab-v1');
+            `).run(now, 'default', 'team-5-v1');
             db.prepare(`
                 INSERT INTO plan_feature_matrix (tenant_id, plan_version_id, feature_key, access, config_json, created_at, updated_at)
                 VALUES (?, ?, 'collaboration.seat_limit', 'limited', ?, ?, ?)
@@ -413,14 +567,14 @@ describe('TaskforceCore system admin model', () => {
                     access = excluded.access,
                     config_json = excluded.config_json,
                     updated_at = excluded.updated_at
-            `).run('default', 'collab-v1', JSON.stringify({ seat_limit: 7 }), now, now);
+            `).run('default', 'team-5-v1', JSON.stringify({ seat_limit: 7 }), now, now);
         }
         finally {
             initial.close();
         }
         const reopened = openCore(projectRoot, { seedDefaultPlans: false });
         try {
-            const version = reopened.getPlanVersionFeatures('collab', 'collab-v1');
+            const version = reopened.getPlanVersionFeatures('team-5', 'team-5-v1');
             expect(version.seatLimit).toBe(7);
             expect(version.features['collaboration.seat_limit']?.config || {}).toEqual({});
         }
@@ -436,7 +590,7 @@ describe('TaskforceCore system admin model', () => {
         try {
             const created = initial.registerPasswordUser({
                 email: 'legacy-billing@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             legacyUserId = created.userId;
             const db = initial.db;
@@ -453,13 +607,15 @@ describe('TaskforceCore system admin model', () => {
         const reopened = openCore(projectRoot, { seedDefaultPlans: false });
         try {
             const db = reopened.db;
+            const normalizedPersonalVersionId = reopened.getDefaultPlanVersionIdByMode('personal');
+            const normalizedBillingMirror = reopened.getBillingMirrorProfileForPlanVersion(normalizedPersonalVersionId);
             const row = db.prepare(`
                 SELECT tier, entitlement_state
                 FROM user_billing
                 WHERE tenant_id = ? AND user_id = ?
                 LIMIT 1
             `).get('default', legacyUserId);
-            expect(row?.tier).toBe('starter');
+            expect(row?.tier).toBe(normalizedBillingMirror.planId);
             expect(row?.entitlement_state).toBe('active');
         }
         finally {
@@ -490,11 +646,11 @@ describe('TaskforceCore system admin model', () => {
             db.prepare(`
                 INSERT INTO plan_catalog (plan_id, tenant_id, display_name, status, created_at, updated_at)
                 VALUES (?, ?, ?, 'active', ?, ?)
-            `).run('enterprise', 'default', 'Enterprise', now, now);
+            `).run('agency', 'default', 'Agency', now, now);
             db.prepare(`
                 INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, seat_limit, metadata_json, created_at, updated_at)
                 VALUES (?, ?, ?, 1, 1, 25, '{}', ?, ?)
-            `).run('enterprise-v1', 'default', 'enterprise', now, now);
+            `).run('agency-v1', 'default', 'agency', now, now);
         }
         finally {
             initial.close();
@@ -502,8 +658,8 @@ describe('TaskforceCore system admin model', () => {
         const reopened = openCore(projectRoot, { seedDefaultPlans: false });
         try {
             const plans = reopened.listPlanCatalog();
-            expect(plans.map((plan) => plan.planId)).toEqual(['enterprise']);
-            expect(reopened.getDefaultPlanVersionIdByMode('personal')).toBe('enterprise-v1');
+            expect(plans.map((plan) => plan.planId)).toEqual(['agency']);
+            expect(reopened.getDefaultPlanVersionIdByMode('personal')).toBe('agency-v1');
         }
         finally {
             reopened.close();
@@ -516,11 +672,11 @@ describe('TaskforceCore system admin model', () => {
         try {
             const first = core.registerPasswordUser({
                 email: 'first@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const second = core.registerPasswordUser({
                 email: 'second@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             expect(core.getSystemRole(first.userId)).toBe('system_admin');
             expect(core.getSystemRole(second.userId)).toBe('user');
@@ -538,11 +694,11 @@ describe('TaskforceCore system admin model', () => {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
             core.registerPasswordUser({
                 email: 'bootstrap-admin@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const user = core.registerPasswordUser({
                 email: 'beta-off@example.com',
-                password: 'password123',
+                password: 'ValidPassphrase123!',
                 workspaceId: 'workspace-1',
                 role: 'owner',
                 betaAccess: false
@@ -562,7 +718,7 @@ describe('TaskforceCore system admin model', () => {
         try {
             const first = core.registerPasswordUser({
                 email: 'first@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             expect(() => core.setSystemRole(first.userId, 'user')).toThrowError(/last system admin/i);
             expect(() => core.setUserDisabledGlobal(first.userId, true)).toThrowError(/last system admin/i);
@@ -578,11 +734,11 @@ describe('TaskforceCore system admin model', () => {
         try {
             const first = core.registerPasswordUser({
                 email: 'first@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const second = core.registerPasswordUser({
                 email: 'second@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
             core.ensureBootstrapUserAccess({
@@ -606,20 +762,20 @@ describe('TaskforceCore system admin model', () => {
         try {
             const admin = core.registerPasswordUser({
                 email: 'admin@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const member = core.registerPasswordUser({
                 email: 'member@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             core.createPlanVersion({
-                planId: 'starter',
+                planId: 'free',
                 versionNumber: 2,
                 isDefault: true
             });
             core.updateAccountEntitlement({
                 accountId: member.userId,
-                planVersionId: 'starter-v2',
+                planVersionId: 'free-v2',
                 entitlementState: 'active',
                 actorUserId: admin.userId,
                 actorRole: 'system_admin'
@@ -639,11 +795,11 @@ describe('TaskforceCore system admin model', () => {
         try {
             const admin = core.registerPasswordUser({
                 email: 'admin@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const member = core.registerPasswordUser({
                 email: 'member@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const workspaceId = member.workspaceId || 'default';
             const db = core.db;
@@ -721,11 +877,11 @@ describe('TaskforceCore system admin model', () => {
         try {
             const admin = core.registerPasswordUser({
                 email: 'admin@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const member = core.registerPasswordUser({
                 email: 'member@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const db = core.db;
             const now = new Date().toISOString();
@@ -741,7 +897,7 @@ describe('TaskforceCore system admin model', () => {
                 ON CONFLICT (user_id) DO UPDATE SET
                     stripe_customer_id = excluded.stripe_customer_id,
                     updated_at = excluded.updated_at
-            `).run(member.userId, 'default', 'cus_test_123', 'active', 'starter', now, now);
+            `).run(member.userId, 'default', 'cus_test_123', 'active', 'basic', now, now);
             expect(() => core.purgeSystemUser({
                 targetUserId: member.userId,
                 actorUserId: admin.userId,
@@ -758,16 +914,16 @@ describe('TaskforceCore system admin model', () => {
         const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             const plan = core.upsertPlanCatalog({
-                planId: 'enterprise',
-                displayName: 'Enterprise',
+                planId: 'agency',
+                displayName: 'Agency',
                 status: 'active'
             });
-            expect(plan.planId).toBe('enterprise');
-            const versions = core.listPlanVersions('enterprise');
+            expect(plan.planId).toBe('agency');
+            const versions = core.listPlanVersions('agency');
             expect(versions).toHaveLength(1);
             expect(versions[0]).toMatchObject({
-                planVersionId: 'enterprise-v1',
-                planId: 'enterprise',
+                planVersionId: 'agency-v1',
+                planId: 'agency',
                 versionNumber: 1,
                 isDefault: true,
                 seatLimit: null
@@ -783,24 +939,24 @@ describe('TaskforceCore system admin model', () => {
         const core = openCore(projectRoot, { seedDefaultPlans: true });
         try {
             core.upsertPlanCatalog({
-                planId: 'enterprise',
-                displayName: 'Enterprise',
+                planId: 'agency',
+                displayName: 'Agency',
                 status: 'active'
             });
             core.createPlanVersion({
-                planId: 'enterprise',
+                planId: 'agency',
                 versionNumber: 2,
                 isDefault: true,
                 seatLimit: 25
             });
             core.upsertPlanCatalog({
-                planId: 'enterprise',
-                displayName: 'Enterprise Plus',
+                planId: 'agency',
+                displayName: 'Agency Plus',
                 status: 'archived'
             });
-            const versions = core.listPlanVersions('enterprise');
-            expect(versions.map((version) => version.planVersionId)).toEqual(['enterprise-v2', 'enterprise-v1']);
-            expect(versions.find((version) => version.planVersionId === 'enterprise-v1')).toMatchObject({
+            const versions = core.listPlanVersions('agency');
+            expect(versions.map((version) => version.planVersionId)).toEqual(['agency-v2', 'agency-v1']);
+            expect(versions.find((version) => version.planVersionId === 'agency-v1')).toMatchObject({
                 isDefault: false
             });
         }
@@ -938,7 +1094,7 @@ describe('TaskforceCore system admin model', () => {
         try {
             const created = core.registerPasswordUser({
                 email: 'nomembership@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             expect(core.resolvePreferredUserWorkspaceId(created.userId)).toBeNull();
         }