@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/core/TaskAttachmentsCanonical.test.js

@@ -91,6 +91,56 @@ describe('TaskforceCore canonical task attachments', () => {
             })
         ]);
     });
+    it('starts cleanly with legacy workspace asset links that predate target_type', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const created = core.createTask({
+            title: 'Legacy attachment startup task'
+        }, { workspaceId: 'default' });
+        const db = core.getDatabaseAdapter();
+        const now = new Date().toISOString();
+        const storageKey = 'workspaces/default/assets/documents/asset-legacy-doc-1-spec.md';
+        db.exec(`
+            DROP TABLE IF EXISTS workspace_asset_links;
+            CREATE TABLE workspace_asset_links (
+                tenant_id TEXT NOT NULL DEFAULT 'default',
+                workspace_id TEXT NOT NULL,
+                asset_id TEXT NOT NULL,
+                task_id TEXT NOT NULL,
+                role TEXT NOT NULL,
+                display_name TEXT,
+                sort_order INTEGER,
+                created_at TEXT NOT NULL,
+                updated_at TEXT NOT NULL,
+                deleted_at TEXT,
+                PRIMARY KEY (tenant_id, workspace_id, asset_id, task_id, role)
+            );
+        `);
+        db.prepare(`
+            INSERT INTO workspace_assets (
+                asset_id, tenant_id, workspace_id, kind, logical_name, original_filename, mime_type,
+                storage_provider, storage_key, content_sha256, size_bytes, document_id, reference_number, version,
+                is_latest, scan_status, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run('asset-legacy-doc-1', 'default', 'default', 'document', 'Legacy Spec', 'spec.md', 'text/markdown', 'r2', storageKey, 'sha-legacy-doc-1', 120, 'doc-legacy-1', 1, 1, 1, 'clean', now, now);
+        db.prepare(`
+            INSERT INTO workspace_asset_links (
+                tenant_id, workspace_id, asset_id, task_id, role, display_name, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        `).run('default', 'default', 'asset-legacy-doc-1', created.id, 'attachment', 'Legacy Spec', now, now);
+        core.close();
+        const repairedCore = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const tasks = repairedCore.listTasks('default').tasks;
+        const task = tasks.find((entry) => entry.id === created.id);
+        expect(task?.attachments).toEqual([
+            expect.objectContaining({
+                path: '/api/taskforce/documents/asset-legacy-doc-1/content',
+                fsPath: storageKey,
+                caption: 'Legacy Spec',
+                assetId: 'asset-legacy-doc-1'
+            })
+        ]);
+    });
     it('renders canonical image attachments through the unified context route', () => {
         const projectRoot = createProjectRoot();
         const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
@@ -246,7 +296,7 @@ describe('TaskforceCore canonical task attachments', () => {
             taskId: created.id,
             imageAssetId: 'asset-image-repair',
             includeDeleted: true,
-        });
+        }).filter((session) => session.taskId === created.id);
         const unattachedSessions = repairedCore.listAnnotatedAttachmentSessions({
             workspaceId: 'default',
             imageAssetId: 'asset-image-repair',

package/dist/core/TaskTaxonomyValidation.test.js

@@ -348,6 +348,59 @@ describe('TaskforceCore taxonomy validation', () => {
         core.close();
         fs.rmSync(projectRoot, { recursive: true, force: true });
     });
+    it('migrates legacy config-backed taxonomy data once and no longer depends on config for runtime state', () => {
+        const projectRoot = makeTempProjectRoot();
+        fs.mkdirSync(path.join(projectRoot, '.taskforce'), { recursive: true });
+        const configPath = path.join(projectRoot, '.taskforce', 'config.json');
+        fs.writeFileSync(configPath, JSON.stringify({
+            categories: [{ value: 'legacy', label: 'Legacy' }],
+            types: [{ value: 'legacy-type', label: 'Legacy Type' }],
+            priorities: [{ value: 9, label: 'Legacy Priority', color: 'red-500', icon: 'AlertTriangle' }],
+            taxonomies: [{ id: 'legacy-taxonomy', label: 'Legacy Taxonomy', widgetType: 'select', isSystem: false, multiSelect: false, options: [] }]
+        }, null, 2));
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const migratedState = core.getTaxonomyState('default');
+        expect((migratedState.categories || []).map((category) => (typeof category === 'string' ? category : category.value))).toEqual(['default', 'legacy']);
+        expect((migratedState.types || []).map((type) => type.value)).toEqual(['legacy-type']);
+        expect((migratedState.priorities || []).map((priority) => priority.value)).toEqual([9]);
+        expect((migratedState.taxonomies || []).map((taxonomy) => taxonomy.id)).toEqual(['legacy-taxonomy']);
+        core.close();
+        fs.writeFileSync(configPath, JSON.stringify({ checklistDropdownEnabled: true }, null, 2));
+        const reopened = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const persistedState = reopened.getTaxonomyState('default');
+        expect((persistedState.categories || []).map((category) => (typeof category === 'string' ? category : category.value))).toEqual(['default', 'legacy']);
+        expect((persistedState.types || []).map((type) => type.value)).toEqual(['legacy-type']);
+        expect((persistedState.priorities || []).map((priority) => priority.value)).toEqual([9]);
+        expect((persistedState.taxonomies || []).map((taxonomy) => taxonomy.id)).toEqual(['legacy-taxonomy']);
+        reopened.close();
+        fs.rmSync(projectRoot, { recursive: true, force: true });
+    });
+    it('does not seed new workspaces from legacy config-backed taxonomy definitions', () => {
+        const projectRoot = makeTempProjectRoot();
+        fs.mkdirSync(path.join(projectRoot, '.taskforce'), { recursive: true });
+        const configPath = path.join(projectRoot, '.taskforce', 'config.json');
+        fs.writeFileSync(configPath, JSON.stringify({
+            categories: [{ value: 'legacy', label: 'Legacy' }],
+            types: [{ value: 'legacy-type', label: 'Legacy Type' }],
+            priorities: [{ value: 9, label: 'Legacy Priority' }],
+            taxonomies: [{ id: 'legacy-taxonomy', label: 'Legacy Taxonomy' }]
+        }, null, 2));
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-new', name: 'New Workspace' });
+        const state = core.getTaxonomyState('workspace-new');
+        expect((state.categories || []).map((category) => (typeof category === 'string' ? category : category.value))).toEqual(['default']);
+        expect((state.types || []).map((type) => type.value)).toEqual([
+            'task',
+            'deliverable',
+            'issue',
+            'idea',
+            'review'
+        ]);
+        expect((state.priorities || []).map((priority) => priority.value)).toEqual([1, 2, 3]);
+        expect(state.taxonomies || []).toEqual([]);
+        core.close();
+        fs.rmSync(projectRoot, { recursive: true, force: true });
+    });
     it('preserves existing first-class taxonomy sections when taxonomy state updates are partial', () => {
         const projectRoot = makeTempProjectRoot();
         const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });

package/dist/core/Taskforce.d.ts

@@ -3,10 +3,22 @@ import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 import { type SyncEventInput } from './SyncReconciliationService.js';
 import { type FirstClassTaxonomyDisplayLabels, type WorkspaceTaxonomyState } from '../shared/taxonomyState.js';
 import { type AiProfileSurfaceType } from '../shared/aiProfileSurfaceType.js';
+import { type AiProfileSeatScope } from '../shared/aiProfileSeatScope.js';
+import type { PlanningBootstrapPayload } from '../types.js';
 import type { TaskActor } from '../shared/taskActor.js';
 export type { TaskActor } from '../shared/taskActor.js';
 export type { WorkspaceDeletedAssetRecord, WorkspaceDeleteSummary } from './types.js';
-import type { GlobalTaskforceSettings, UserGlobalSyncSettings, WorkspaceDeleteSummary } from './types.js';
+import type { GlobalTaskforceSettings, UserGlobalSyncSettings, WorkspaceDeleteSummary, UserAuthProvider } from './types.js';
+export interface PlanningBootstrapDiagnostics {
+    initiativeCount?: number;
+    workstreamCount?: number;
+    workstreamLinkedTaskCount?: number;
+    workstreamTaskSummaryCount?: number;
+    initiativeLoadMs?: number;
+    workstreamLoadMs?: number;
+    taskSummaryQueryMs?: number;
+    taskSummaryBuildMs?: number;
+}
 import type { AnnotatedAttachmentAnnotation, AnnotatedAttachmentPayload, AnnotatedAttachmentSession, AnnotatedAttachmentSessionRecord } from '../annotatedAttachments/types.js';
 import type { DocumentReviewAnchor, DocumentReviewCommentSyncRecord, DocumentReviewSession, DocumentReviewSessionRecord, DocumentReviewSessionStatus } from '../documentReviews/types.js';
 import { type TaskforceTheme } from '../utils/theme.js';
@@ -350,6 +362,8 @@ interface UserAccessRecord {
     role: AccessRole;
     permissionMode: PermissionMode;
     disabled: boolean;
+    accountDisabled?: boolean;
+    workspaceDisabled?: boolean;
     betaAccess: boolean;
 }
 interface UserIdentityRecord {
@@ -378,6 +392,7 @@ interface WorkspaceUserRecord {
     userId: string;
     email: string;
     displayName?: string | null;
+    avatarUrl?: string | null;
     role: AccessRole;
     permissionMode: PermissionMode;
     betaAccess: boolean;
@@ -395,12 +410,20 @@ export interface AiProfileRecord {
     username: string;
     icon: string;
     color: string;
+    avatarUrl?: string | null;
+    avatarSourceUrl?: string | null;
     description?: string | null;
     role?: string | null;
     provider?: string | null;
     model?: string | null;
     surfaceType?: AiProfileSurfaceType | null;
+    seatScope?: AiProfileSeatScope | null;
     providerMetadata?: Record<string, unknown> | null;
+    archivedAt?: string | null;
+    archivedBy?: string | null;
+    archivedReason?: string | null;
+    mergedIntoProfileId?: string | null;
+    rosterStateUpdatedAt?: string | null;
     createdAt: string;
     updatedAt: string;
     lastActiveAt?: string | null;
@@ -418,6 +441,9 @@ export interface ResolveAiProfileInput {
     profileToken?: string | null;
     providerMetadata?: Record<string, unknown> | null;
 }
+export interface ResolveAiProfileOptions {
+    trustedSeatScope?: AiProfileSeatScope | null;
+}
 export interface ResolveAiProfileResult {
     created: boolean;
     profile: AiProfileRecord;
@@ -563,6 +589,7 @@ export interface PlanVersionSnapshot {
 export interface PlanCatalogSnapshot {
     planId: string;
     displayName: string;
+    description: string | null;
     status: 'active' | 'archived';
     createdAt: string;
     updatedAt: string;
@@ -594,6 +621,7 @@ interface PasswordAuthResult {
         userId: string;
         workspaceId: string;
         role: AccessRole;
+        identityId?: string;
     };
     code?: 'INVALID_CREDENTIALS' | 'EMAIL_NOT_VERIFIED';
 }
@@ -733,7 +761,9 @@ export interface TaskforceSyncCapable {
     };
     listInitiatives(workspaceId?: string): InitiativeItem[];
     listWorkstreams(workspaceId?: string): WorkstreamItem[];
-    listAiProfiles(workspaceId: string): AiProfileRecord[];
+    listAiProfiles(workspaceId: string, options?: {
+        includeArchived?: boolean;
+    }): AiProfileRecord[];
     listWorkspaceUsers(workspaceId: string): WorkspaceUserRecord[];
     listDocumentReviewSessionsForSync(input: {
         workspaceId?: string | null;
@@ -781,6 +811,18 @@ export interface TaskforceSyncCapable {
         keepId: string;
         mergeId: string;
     }): AiProfileRecord;
+    archiveAiProfile(input: {
+        workspaceId: string;
+        profileId: string;
+        archivedBy?: string | null;
+        reason?: string | null;
+    }): AiProfileRecord;
+    updateAiProfileAvatar(input: {
+        workspaceId: string;
+        profileId: string;
+        avatarUrl?: string | null;
+        avatarSourceUrl?: string | null;
+    }): AiProfileRecord;
     resolveWorkspaceActor(workspaceId: string, actorRef: unknown): TaskActor | null;
 }
 export declare class TaskforceCore implements TaskforceSyncCapable {
@@ -798,6 +840,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     private db;
     private globalSettingsDb;
     private authTokenService;
+    private identityService;
     private mcpTokenService;
     private planEntitlementService;
     private realtimeMutationListeners;
@@ -911,6 +954,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     getAccountAccessStatus(accountId: string): import("./types.js").AccountAccessStatus;
     getEffectivePlanVersion(accountId: string): import("./types.js").PlanVersionSnapshot;
     getAccountEntitlement(accountId: string): import("./types.js").AccountEntitlementSnapshot;
+    countAiProfileUsage(workspaceId: string): import("./types.js").SeatUsageSnapshot;
     countWorkspaceSeatUsage(workspaceId: string, options?: {
         includeInvited?: boolean;
     }): import("./types.js").SeatUsageSnapshot;
@@ -934,6 +978,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     };
     private ensureDirectories;
     private migrateLegacyGlobalSettingsDbIfNeeded;
+    private supportsWorkspaceAssetLinkTargetType;
     private initializeSchema;
     private performMigrationIfNeeded;
     private backfillMcpAuditLogMetadataColumns;
@@ -968,6 +1013,8 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     private resolveDefaultTypeValue;
     private getLegacyTaxonomiesConfig;
     private getLegacyPrioritiesConfig;
+    private readLegacyWorkspaceTaxonomyStateFromConfig;
+    private migrateLegacyWorkspaceTaxonomyStateIfNeeded;
     private buildEmergencyWorkspaceTaxonomyState;
     private getConfiguredDefaultStarterTaxonomyPackId;
     private getResolvedStarterWorkspaceTaxonomyState;
@@ -989,9 +1036,10 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     getEffectiveTheme(workspaceId?: string, userId?: string): TaskforceTheme;
     hasProjectJsonBackupOverride(workspaceId?: string, userId?: string): boolean;
     getOnboardingPolicy(): import("./types.js").OnboardingPolicy;
+    listOnboardingPlanOptions(): import("./types.js").OnboardingPlanOption[];
     validateOnboardingPolicy(input?: {
         mode?: 'require_plan_selection' | 'auto_grant_free' | 'auto_start_trial';
-        planVersionId?: string | null;
+        planId?: string | null;
     }): import("./types.js").OnboardingPolicyValidationResult;
     updateGlobalSettings(settings: GlobalTaskforceSettings): void;
     private sanitizeUserGlobalSyncSettings;
@@ -1034,6 +1082,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     unarchiveInitiative(id: string, workspaceId?: string): InitiativeItem;
     getWorkstream(id: string, workspaceId?: string): WorkstreamItem | null;
     listWorkstreams(workspaceId?: string): WorkstreamItem[];
+    listPlanningBootstrap(workspaceId?: string, diagnostics?: PlanningBootstrapDiagnostics): PlanningBootstrapPayload;
     createWorkstream(input: Partial<WorkstreamItem>, workspaceId?: string): WorkstreamItem;
     updateWorkstream(id: string, patch: Partial<WorkstreamItem>, workspaceId?: string): WorkstreamItem;
     archiveWorkstream(id: string, workspaceId?: string): WorkstreamItem;
@@ -1109,6 +1158,24 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     private getSyncReconciliationServiceDeps;
     private getWorkspaceLifecycleServiceDeps;
     listTasks(workspaceId?: string): TaskFile;
+    /**
+     * Filter-pushdown listing used by read-only surfaces that don't need the
+     * full task graph (MCP list_tasks, CLI summaries). Avoids the per-task
+     * comments/events/attachments/checklist subqueries and actor resolution
+     * that rowToTask performs, and applies filters + sort + limit at the SQL
+     * layer so hot polls don't load the entire workspace.
+     */
+    listTasksSlim(workspaceId: string | undefined, filters?: {
+        category?: string;
+        status?: TaskStatus;
+        openOnly?: boolean;
+        assignee?: string;
+        priority?: number;
+        type?: string;
+        sort?: 'created' | 'priority' | 'updated';
+        order?: 'asc' | 'desc';
+        limit?: number;
+    }): Array<Record<string, unknown>>;
     getDataVersion(): number;
     getDatabaseProvider(): DatabaseProvider;
     isDatabaseHealthy(): boolean;
@@ -1166,7 +1233,15 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     getUserBetaAccess(userId: string): boolean;
     countSystemAdmins(): number;
     hasAnySystemAdmin(): boolean;
-    listSystemUsers(): SystemUserRecord[];
+    countSystemUsers(input?: {
+        query?: string | null;
+    }): number;
+    listSystemUsers(input?: {
+        query?: string | null;
+        sort?: 'newest' | 'oldest' | null;
+        limit?: number | null;
+        offset?: number | null;
+    }): SystemUserRecord[];
     setSystemRole(userId: string, role: SystemRole): boolean;
     setUserDisabledGlobal(userId: string, disabled: boolean): boolean;
     setUserBetaAccessGlobal(userId: string, enabled: boolean): boolean;
@@ -1182,10 +1257,17 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         users: WorkspaceUserRecord[];
         pruneMissing?: boolean;
     }): WorkspaceUserRecord[];
-    listAiProfiles(workspaceId: string): AiProfileRecord[];
+    listAiProfiles(workspaceId: string, options?: {
+        includeArchived?: boolean;
+        diagnostics?: {
+            metadataBackfillCount?: number;
+        };
+    }): AiProfileRecord[];
     getAiProfileByToken(input: {
         workspaceId: string;
         profileToken: string;
+        includeArchived?: boolean;
+        seatScope?: AiProfileSeatScope | null;
     }): AiProfileRecord | null;
     upsertAiProfileForSync(profile: AiProfileRecord): AiProfileRecord;
     mergeAiProfiles(input: {
@@ -1193,7 +1275,19 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         keepId: string;
         mergeId: string;
     }): AiProfileRecord;
-    resolveAiProfile(input: ResolveAiProfileInput): ResolveAiProfileResult;
+    archiveAiProfile(input: {
+        workspaceId: string;
+        profileId: string;
+        archivedBy?: string | null;
+        reason?: string | null;
+    }): AiProfileRecord;
+    updateAiProfileAvatar(input: {
+        workspaceId: string;
+        profileId: string;
+        avatarUrl?: string | null;
+        avatarSourceUrl?: string | null;
+    }): AiProfileRecord;
+    resolveAiProfile(input: ResolveAiProfileInput, options?: ResolveAiProfileOptions): ResolveAiProfileResult;
     listAnnotatedAttachmentSessions(input: {
         workspaceId?: string | null;
         taskId?: string | null;
@@ -1382,6 +1476,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     upsertPlanCatalog(input: {
         planId: string;
         displayName: string;
+        description?: string | null;
         status?: 'active' | 'archived';
         initialMode?: 'personal' | 'team';
         initialSeatLimit?: number | null;
@@ -1389,10 +1484,17 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     }): {
         planId: string;
         displayName: string;
+        description: string | null;
         status: "active" | "archived";
     };
     listPlanCatalog(): import("./types.js").PlanCatalogSnapshot[];
     listPlanFeatureCatalog(): import("./types.js").PlanFeatureCatalogItem[];
+    updatePlanFeatureCatalogMarketingCopy(input: {
+        featureKey: string;
+        publicLabel?: string | null;
+        publicDescription?: string | null;
+        publicDisplayOrder?: number | null;
+    }): import("./types.js").PlanFeatureCatalogItem;
     listPlanVersions(planId: string): import("./types.js").PlanVersionSnapshot[];
     getPlanVersionFeatures(planId: string, versionId: string): import("./types.js").PlanVersionSnapshot;
     searchAccountsByEmail(query: string, limit?: number): {
@@ -1513,6 +1615,99 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         checkoutPending: boolean;
         commercialState: EntitlementState;
     };
+    /**
+     * Creates an OAuth state record and returns the state token + PKCE materials.
+     * Delegates to AuthIdentityService.createOAuthState.
+     */
+    createOAuthLoginState(input: {
+        provider: string;
+        flowMode: string;
+        userId?: string | null;
+        inviteToken?: string | null;
+        returnTo?: string | null;
+        createdIp?: string | null;
+    }): {
+        state: string;
+        codeVerifier: string;
+        codeChallenge: string;
+        nonce: string;
+    };
+    /**
+     * Atomically consumes an OAuth state token and returns the row.
+     * Returns null if invalid, expired, or already consumed.
+     */
+    consumeOAuthLoginState(state: string): import('./AuthIdentityService.js').OAuthStateRecord | null;
+    /**
+     * Finds the Taskforce user associated with a provider identity.
+     * Returns { userId, identityId } or null if not yet linked.
+     */
+    findUserByOAuthProvider(provider: UserAuthProvider, providerSubject: string): {
+        userId: string;
+        identityId: string;
+    } | null;
+    /**
+     * Links an OAuth provider identity to an existing user.
+     * Throws IDENTITY_ALREADY_EXISTS if the user already has an identity for this provider.
+     */
+    linkOAuthProviderToUser(input: {
+        userId: string;
+        provider: UserAuthProvider;
+        providerSubject: string;
+        providerEmail?: string | null;
+        providerEmailVerified?: boolean | null;
+        displayNameSnapshot?: string | null;
+        avatarUrlSnapshot?: string | null;
+    }): string;
+    /**
+     * Lists all active login identities for a user.
+     * Used by the Account Hub "Login methods" section.
+     */
+    listLoginMethodsForUser(userId: string): import('./types.js').UserAuthIdentity[];
+    /**
+     * Unlinks a provider identity from a user.
+     * Throws LAST_IDENTITY_REQUIRED if it would be the last active method.
+     */
+    unlinkLoginMethod(userId: string, provider: UserAuthProvider): boolean;
+    /**
+     * Adds or replaces a password identity for a user that signed up via OAuth.
+     * Uses upsert semantics (safe to call on accounts that already have a password).
+     */
+    addPasswordToAccount(userId: string, password: string): string;
+    /**
+     * Registers a new user account via an OAuth provider (no password).
+     *
+     * Creates the user row, applies commercial onboarding, and links the
+     * provider identity — all in a single transaction.
+     *
+     * Returns the same shape as `registerPasswordUser` so callers can use
+     * the same session-issuance path.
+     */
+    registerOAuthUser(input: {
+        email: string | null;
+        emailVerified?: boolean;
+        provider: UserAuthProvider;
+        providerSubject: string;
+        displayName?: string | null;
+        avatarUrl?: string | null;
+        planVersionId?: string;
+        betaAccess?: boolean;
+    }): {
+        userId: string;
+        workspaceId: string | null;
+        role: AccessRole;
+        identityId: string;
+        planSelectionRequired: boolean;
+        checkoutPending: boolean;
+        commercialState: EntitlementState;
+    };
+    /**
+     * Looks up a user by email address (exact, case-insensitive).
+     * Returns { userId, email } or null.
+     */
+    findUserByEmail(email: string): {
+        userId: string;
+        email: string;
+    } | null;
     private createOneTimeAuthToken;
     private consumeOneTimeAuthToken;
     inspectOneTimeAuthToken(token: string, purpose: AuthTokenPurpose): AuthTokenInspection;
@@ -1617,15 +1812,33 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     revokeInviteAcceptanceForUser(userId: string): {
         revoked: number;
     };
-    inspectInviteAcceptance(token: string): {
-        state: 'valid' | 'expired' | 'used' | 'missing' | 'revoked';
-        email?: string;
-        userId?: string;
-        workspaceId?: string;
-        inviteeKind?: 'existing_user' | 'new_user';
-        passwordRequired?: boolean;
-    };
+    inspectInviteAcceptance(token: string): import('./types.js').InviteAcceptanceDetails;
     private completeInviteWorkspaceActivation;
+    /**
+     * Claims an invite by linking an OAuth provider identity to the invited user.
+     *
+     * Used when an invited user with `inviteeState: 'pending_setup'` completes an
+     * OAuth flow with `flow_mode: 'invite_claim'`.  The invite token must still be
+     * valid and the user must have zero active identities (pending setup).
+     *
+     * Returns the same shape as `acceptInviteWithToken` so callers can issue a
+     * session cookie on the same path.
+     */
+    claimInviteWithOAuthProvider(input: {
+        token: string;
+        provider: UserAuthProvider;
+        providerSubject: string;
+        providerEmail?: string | null;
+        providerEmailVerified?: boolean | null;
+        displayNameSnapshot?: string | null;
+        avatarUrlSnapshot?: string | null;
+    }): {
+        userId: string;
+        email: string;
+        workspaceId: string;
+        role: AccessRole;
+        identityId: string;
+    };
     acceptInviteWithToken(input: {
         token: string;
         password: string;
@@ -1634,6 +1847,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         email: string;
         workspaceId: string;
         role: AccessRole;
+        identityId: string;
     };
     joinInviteWithAuthenticatedUser(input: {
         token: string;