@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/core/Taskforce.listTasksSlim.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/Taskforce.listTasksSlim.test.js

@@ -0,0 +1,91 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { TaskforceCore } from './Taskforce';
+const createdRoots = [];
+const originalHome = process.env.HOME;
+function createProjectRoot(prefix = 'taskforce-list-tasks-slim-') {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    process.env.HOME = root;
+    createdRoots.push(root);
+    return root;
+}
+afterEach(() => {
+    process.env.HOME = originalHome;
+    while (createdRoots.length > 0) {
+        const root = createdRoots.pop();
+        if (root && fs.existsSync(root)) {
+            fs.rmSync(root, { recursive: true, force: true });
+        }
+    }
+});
+describe('TaskforceCore.listTasksSlim', () => {
+    it('does not hydrate comments, task events, attachments, or checklist items', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const task = core.createTask({ title: 'Heavy task' }, { workspaceId: 'default' });
+        core.addComment(task.id, 'note from reviewer', 'user', 'default');
+        core.replaceChecklistItems(task.id, [{ title: 'step one', isCompleted: false }], 'default');
+        const slim = core.listTasksSlim('default');
+        const entry = slim.find((t) => t.id === task.id);
+        expect(entry).toBeDefined();
+        expect(entry).not.toHaveProperty('comments');
+        expect(entry).not.toHaveProperty('taskEvents');
+        expect(entry).not.toHaveProperty('activity');
+        expect(entry).not.toHaveProperty('attachments');
+        expect(entry).not.toHaveProperty('checklistItems');
+        expect(entry).not.toHaveProperty('description');
+        expect(entry).not.toHaveProperty('createdByActor');
+        expect(entry).not.toHaveProperty('assigneeActor');
+        expect(entry).toMatchObject({
+            id: task.id,
+            title: 'Heavy task',
+        });
+    });
+    it('pushes assignee, status, openOnly, type, and priority filters into the query', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const mine = core.createTask({ title: 'Mine open', status: 'in-progress', assignee: 'user-a', priority: 3, type: 'issue' }, { workspaceId: 'default' });
+        core.createTask({ title: 'Other assigned', status: 'task', assignee: 'user-b', priority: 3 }, { workspaceId: 'default' });
+        const mineDone = core.createTask({ title: 'Mine done', status: 'done', assignee: 'user-a', priority: 1 }, { workspaceId: 'default' });
+        core.createTask({ title: 'Mine unassigned' }, { workspaceId: 'default' });
+        const byAssignee = core.listTasksSlim('default', { assignee: 'user-a' }).map((t) => t.id);
+        expect(byAssignee).toEqual(expect.arrayContaining([mine.id, mineDone.id]));
+        expect(byAssignee).toHaveLength(2);
+        const openOnly = core.listTasksSlim('default', { assignee: 'user-a', openOnly: true }).map((t) => t.id);
+        expect(openOnly).toEqual([mine.id]);
+        const byStatus = core.listTasksSlim('default', { status: 'done' }).map((t) => t.id);
+        expect(byStatus).toEqual([mineDone.id]);
+        const byType = core.listTasksSlim('default', { type: 'issue' }).map((t) => t.id);
+        expect(byType).toEqual([mine.id]);
+        const byPriority = core.listTasksSlim('default', { priority: 3 }).map((t) => t.id).sort();
+        expect(byPriority).toHaveLength(2);
+        const byCategory = core.listTasksSlim('default', { category: 'default' }).map((t) => t.id);
+        expect(byCategory).toHaveLength(4);
+    });
+    it('matches unassigned filter against null, empty-string, and "unassigned" values', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const unassigned = core.createTask({ title: 'no one' }, { workspaceId: 'default' });
+        const assigned = core.createTask({ title: 'someone', assignee: 'user-x' }, { workspaceId: 'default' });
+        const db = core.getDatabaseAdapter();
+        // Inject a row with assignee stored as empty string to exercise the fallback branch.
+        db.prepare(`UPDATE tasks SET assignee = '' WHERE id = ?`).run(unassigned.id);
+        const results = core.listTasksSlim('default', { assignee: 'unassigned' }).map((t) => t.id);
+        expect(results).toContain(unassigned.id);
+        expect(results).not.toContain(assigned.id);
+    });
+    it('applies sort, order, and limit in SQL', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const low = core.createTask({ title: 'low', priority: 1 }, { workspaceId: 'default' });
+        const mid = core.createTask({ title: 'mid', priority: 2 }, { workspaceId: 'default' });
+        const high = core.createTask({ title: 'high', priority: 4 }, { workspaceId: 'default' });
+        const byPriorityDesc = core.listTasksSlim('default', { sort: 'priority', order: 'desc' }).map((t) => t.id);
+        expect(byPriorityDesc.slice(0, 3)).toEqual([high.id, mid.id, low.id]);
+        const limited = core.listTasksSlim('default', { sort: 'priority', order: 'desc', limit: 1 });
+        expect(limited).toHaveLength(1);
+        expect(limited[0]?.id).toBe(high.id);
+    });
+});

package/dist/core/UserProfileAvatarDrafts.test.js

@@ -24,7 +24,7 @@ function seedPlans(core) {
         billing: {
             onboardingPolicy: {
                 mode: 'auto_grant_free',
-                planVersionId: 'starter-v1'
+                planId: 'starter'
             }
         }
     });
@@ -44,7 +44,7 @@ describe('TaskforceCore user profile avatar drafts', () => {
         try {
             const created = core.registerPasswordUser({
                 email: 'avatar-user@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const updated = core.updateUserProfile(created.userId, {
                 displayName: 'Avatar User',
@@ -62,13 +62,40 @@ describe('TaskforceCore user profile avatar drafts', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('exposes cloud-owned user avatarUrl on live workspace member records', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            const created = core.registerPasswordUser({
+                email: 'member-avatar@example.com',
+                password: 'ValidPassphrase123!',
+                workspaceId: 'workspace-1'
+            });
+            const avatarUrl = `/api/taskforce/context/${encodeURIComponent(`users/${created.userId}/profile/avatar/headshot.webp`)}`;
+            core.updateUserProfile(created.userId, {
+                displayName: 'Member Avatar',
+                avatarUrl
+            });
+            const members = core.listWorkspaceUsers('workspace-1');
+            expect(members.find((member) => member.userId === created.userId)).toEqual(expect.objectContaining({
+                userId: created.userId,
+                displayName: 'Member Avatar',
+                avatarUrl
+            }));
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('tracks, finalizes, discards, and cleans up stale avatar upload drafts', () => {
         const projectRoot = makeProjectRoot();
         const core = openCore(projectRoot);
         try {
             const created = core.registerPasswordUser({
                 email: 'draft-user@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const draft = core.createUserAvatarUploadDraft({
                 userId: created.userId,

package/dist/core/WorkspaceLifecycleService.js

@@ -55,11 +55,6 @@ export function deleteWorkspaceService(deps, input) {
             const result = deps.db.prepare(sql).run(...params);
             counts[tableName] = Number(result?.changes || 0);
         };
-        deps.db.prepare(`
-            UPDATE tasks
-            SET parent_task_id = NULL
-            WHERE tenant_id = ? AND workspace_id = ? AND parent_task_id IS NOT NULL
-        `).run(deps.tenantId, normalizedWorkspaceId);
         runDelete('comments', 'DELETE FROM comments WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
         runDelete('task_events', 'DELETE FROM task_events WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
         runDelete('deleted_tasks', 'DELETE FROM deleted_tasks WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);

package/dist/core/WorkspacePermissions.test.js

@@ -124,10 +124,11 @@ describe('TaskforceCore workspace permission invariants', () => {
             cleanup();
         }
     });
-    it('marks deactivated users as disabled in access resolution immediately', () => {
+    it('marks deactivated workspace memberships as disabled without disabling the global account', () => {
         const { core, cleanup } = makeCore();
         try {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.createWorkspace({ workspaceId: 'workspace-home', name: 'Workspace Home' });
             core.ensureBootstrapUserAccess({
                 userId: 'owner-1',
                 workspaceId: 'workspace-1',
@@ -140,9 +141,32 @@ describe('TaskforceCore workspace permission invariants', () => {
                 role: 'member',
                 email: 'member@example.com'
             });
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-home',
+                role: 'owner',
+                email: 'member@example.com'
+            });
             expect(core.setWorkspaceUserDisabled('member-1', 'workspace-1', true)).toBe(true);
             const access = core.resolveUserAccess('member-1', 'workspace-1', 'member');
             expect(access?.disabled).toBe(true);
+            expect(access?.accountDisabled).toBe(false);
+            expect(access?.workspaceDisabled).toBe(true);
+            expect(core.resolveUserAccess('member-1', 'workspace-home', 'owner')).toEqual(expect.objectContaining({
+                role: 'owner',
+                disabled: false,
+                accountDisabled: false,
+                workspaceDisabled: false
+            }));
+            expect(core.listUserWorkspaces('member-1').map((workspace) => workspace.id)).toEqual(['workspace-home']);
+            expect(core.listWorkspaceUsers('workspace-1').find((user) => user.userId === 'member-1')).toEqual(expect.objectContaining({
+                status: 'disabled',
+                disabled: true
+            }));
+            const row = core.db.prepare(`
+                SELECT is_disabled FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+            `).get('default', 'member-1');
+            expect(Boolean(row?.is_disabled)).toBe(false);
         }
         finally {
             cleanup();

package/dist/core/WorkspacePlanMode.test.js

@@ -20,30 +20,30 @@ function openCore(projectRoot) {
             ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         `).run('default', planVersionId, 'month', `free:${planVersionId}:month`, 'free', 1, 0, null, now, now);
     };
-    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter' });
-    addFreeMapping('starter-v1');
-    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'free', displayName: 'Free' });
+    addFreeMapping('free-v1');
+    core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
     core.updatePlanVersion({
-        planId: 'starter',
+        planId: 'free',
         versionNumber: 1,
         seatLimit: 1
     });
     core.updatePlanVersionFeatures({
-        planVersionId: 'starter-v1',
+        planVersionId: 'free-v1',
         features: [
-            { featureKey: 'workspace.switching', access: 'enabled' }
+            { featureKey: 'workspace.workspaces', access: 'enabled' }
         ]
     });
-    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab' });
-    addFreeMapping('collab-v1');
-    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'team-5', displayName: 'Team 5' });
+    addFreeMapping('team-5-v1');
+    core.upsertPlanCatalog({ planId: 'team-5', displayName: 'Team 5', status: 'active' });
     core.updatePlanVersion({
-        planId: 'collab',
+        planId: 'team-5',
         versionNumber: 1,
         seatLimit: 5
     });
     core.updatePlanVersionFeatures({
-        planVersionId: 'collab-v1',
+        planVersionId: 'team-5-v1',
         features: [
             { featureKey: 'collaboration.invites', access: 'enabled' },
             { featureKey: 'collaboration.team_management', access: 'enabled' }
@@ -71,17 +71,17 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
                 VALUES (?, ?, ?, ?, ?, ?)
             `).run('workspace-u1-second', 'default', 'workspace-u1-second', 'Second U1 Workspace', now, now);
             db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
-            `).run('u1', 'default', 'u1@example.com', 'U1', 'token', 'u1', now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, 0, ?, ?)
+            `).run('u1', 'default', 'u1@example.com', 'U1', now, now);
             db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
-            `).run('u2', 'default', 'u2@example.com', 'U2', 'token', 'u2', now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, 0, ?, ?)
+            `).run('u2', 'default', 'u2@example.com', 'U2', now, now);
             db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
-            `).run('u3', 'default', 'u3@example.com', 'U3', 'token', 'u3', now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, 0, ?, ?)
+            `).run('u3', 'default', 'u3@example.com', 'U3', now, now);
             db.prepare(`
                 INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -153,7 +153,7 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
             });
             core.ensurePasswordUser({
                 email: 'existing@example.com',
-                password: 'Password123!',
+                password: 'HarborLanternOrbit!2026',
                 workspaceId: 'workspace-invite',
                 role: 'member'
             });
@@ -190,7 +190,7 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
             core.setUserAccountPlanMode('owner-user', 'team');
             const existing = core.ensurePasswordUser({
                 email: 'existing@example.com',
-                password: 'Password123!',
+                password: 'HarborLanternOrbit!2026',
                 workspaceId: 'workspace-invite',
                 role: 'member'
             });
@@ -202,7 +202,8 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
                 WHERE tenant_id = ? AND user_id = ? AND workspace_id = ?
             `).run('default', existing.userId, 'workspace-invite');
             const before = db.prepare(`
-                SELECT password_hash FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+                SELECT password_hash FROM user_auth_identities
+                WHERE tenant_id = ? AND user_id = ? AND provider = 'password' LIMIT 1
             `).get('default', existing.userId);
             const invite = core.requestInviteAcceptance({ userId: existing.userId, workspaceId: 'workspace-invite' });
             const accepted = core.joinInviteWithAuthenticatedUser({
@@ -210,7 +211,8 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
                 userId: existing.userId
             });
             const after = db.prepare(`
-                SELECT password_hash FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+                SELECT password_hash FROM user_auth_identities
+                WHERE tenant_id = ? AND user_id = ? AND provider = 'password' LIMIT 1
             `).get('default', existing.userId);
             const membership = db.prepare(`
                 SELECT status FROM workspace_memberships WHERE tenant_id = ? AND user_id = ? AND workspace_id = ? LIMIT 1
@@ -233,7 +235,7 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
                 billing: {
                     onboardingPolicy: {
                         mode: 'auto_grant_free',
-                        planVersionId: 'starter-v1'
+                        planId: 'free'
                     }
                 }
             });
@@ -261,12 +263,111 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
             const invite = core.requestInviteAcceptance({ userId: 'invited-user', workspaceId: 'workspace-invite' });
             const accepted = core.acceptInviteWithToken({
                 token: String(invite.token),
-                password: 'Password123!'
+                password: 'LanternHarborOrbit!2026'
             });
             expect(accepted.workspaceId).toBe('workspace-invite');
             expect(core.hasAccountEntitlement('invited-user')).toBe(true);
             expect(core.getAccountEntitlement('invited-user')).toEqual(expect.objectContaining({
-                planVersionId: 'starter-v1',
+                planVersionId: 'free-v1',
+                state: 'active'
+            }));
+            expect(core.getAccountAccessStatus('invited-user')).toEqual(expect.objectContaining({
+                gate: 'ok',
+                canAccessApp: true
+            }));
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('grants the free personal entitlement to newly accepted invited accounts even without explicit self-serve onboarding policy', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-invite', name: 'Invite Workspace' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-user',
+                workspaceId: 'workspace-invite',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.setUserAccountPlanMode('owner-user', 'team');
+            core.ensureBootstrapUserAccess({
+                userId: 'invited-user',
+                workspaceId: 'workspace-invite',
+                role: 'member',
+                email: 'invited-no-policy@example.com'
+            });
+            core.setWorkspaceUserDisabled('invited-user', 'workspace-invite', true);
+            const db = core.db;
+            db.prepare(`
+                UPDATE workspace_memberships
+                SET status = 'invited'
+                WHERE tenant_id = ? AND user_id = ? AND workspace_id = ?
+            `).run('default', 'invited-user', 'workspace-invite');
+            const invite = core.requestInviteAcceptance({ userId: 'invited-user', workspaceId: 'workspace-invite' });
+            const accepted = core.acceptInviteWithToken({
+                token: String(invite.token),
+                password: 'LanternHarborOrbit!2026'
+            });
+            expect(accepted.workspaceId).toBe('workspace-invite');
+            expect(core.hasAccountEntitlement('invited-user')).toBe(true);
+            expect(core.getAccountEntitlement('invited-user')).toEqual(expect.objectContaining({
+                planVersionId: 'free-v1',
+                state: 'active'
+            }));
+            expect(core.getAccountAccessStatus('invited-user')).toEqual(expect.objectContaining({
+                gate: 'ok',
+                canAccessApp: true
+            }));
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('reactivates blocked placeholder entitlements when a new invited user accepts a reused seat', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-invite', name: 'Invite Workspace' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-user',
+                workspaceId: 'workspace-invite',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.setUserAccountPlanMode('owner-user', 'team');
+            core.ensureBootstrapUserAccess({
+                userId: 'invited-user',
+                workspaceId: 'workspace-invite',
+                role: 'member',
+                email: 'invited@example.com'
+            });
+            core.setWorkspaceUserDisabled('invited-user', 'workspace-invite', true);
+            const db = core.db;
+            db.prepare(`
+                UPDATE workspace_memberships
+                SET status = 'invited'
+                WHERE tenant_id = ? AND user_id = ? AND workspace_id = ?
+            `).run('default', 'invited-user', 'workspace-invite');
+            core.updateAccountEntitlement({
+                accountId: 'invited-user',
+                planVersionId: 'free-v1',
+                entitlementState: 'canceled',
+                actorUserId: 'system-admin',
+                actorRole: 'system_admin',
+                reason: 'invite-reaccept-regression'
+            });
+            const invite = core.requestInviteAcceptance({ userId: 'invited-user', workspaceId: 'workspace-invite' });
+            const accepted = core.acceptInviteWithToken({
+                token: String(invite.token),
+                password: 'LanternHarborOrbit!2026'
+            });
+            expect(accepted.workspaceId).toBe('workspace-invite');
+            expect(core.getAccountEntitlement('invited-user')).toEqual(expect.objectContaining({
+                planVersionId: 'free-v1',
                 state: 'active'
             }));
             expect(core.getAccountAccessStatus('invited-user')).toEqual(expect.objectContaining({

package/dist/core/shared.d.ts

@@ -16,9 +16,11 @@
  */
 import type { McpAccessTokenScope, PlanFeatureCatalogItem } from './types.js';
 export declare const DOCUMENT_CLOUD_STORAGE_FEATURE_KEY = "context.uploads";
-export declare const WORKSPACES_FEATURE_KEY = "workspace.switching";
+export declare const WORKSPACES_FEATURE_KEY = "workspace.workspaces";
+export declare const AI_PROFILES_FEATURE_KEY = "collaboration.ai_profiles";
 export declare const DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY = "storageLimitMb";
 export declare const WORKSPACES_LIMIT_CONFIG_KEY = "maxWorkspaces";
+export declare const AI_PROFILES_LIMIT_CONFIG_KEY = "maxAiProfiles";
 export declare const MCP_ACCESS_TOKEN_MAX_ACTIVE_PER_USER_WORKSPACE = 10;
 export declare const MCP_ACCESS_TOKEN_DEFAULT_PAGE_SIZE = 20;
 export declare const MCP_ACCESS_TOKEN_MAX_PAGE_SIZE = 100;

package/dist/core/shared.js

@@ -17,9 +17,11 @@
 import { createHash, pbkdf2Sync, randomBytes, timingSafeEqual } from 'crypto';
 // === SECTION: Constants ===
 export const DOCUMENT_CLOUD_STORAGE_FEATURE_KEY = 'context.uploads';
-export const WORKSPACES_FEATURE_KEY = 'workspace.switching';
+export const WORKSPACES_FEATURE_KEY = 'workspace.workspaces';
+export const AI_PROFILES_FEATURE_KEY = 'collaboration.ai_profiles';
 export const DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY = 'storageLimitMb';
 export const WORKSPACES_LIMIT_CONFIG_KEY = 'maxWorkspaces';
+export const AI_PROFILES_LIMIT_CONFIG_KEY = 'maxAiProfiles';
 export const MCP_ACCESS_TOKEN_MAX_ACTIVE_PER_USER_WORKSPACE = 10;
 export const MCP_ACCESS_TOKEN_DEFAULT_PAGE_SIZE = 20;
 export const MCP_ACCESS_TOKEN_MAX_PAGE_SIZE = 100;
@@ -30,6 +32,7 @@ export const DEFAULT_PLAN_FEATURE_CATALOG = [
         featureKey: 'collaboration.team_management',
         label: 'Team Management',
         description: 'Allow managing members, invites, roles, and collaboration settings.',
+        publicDisplayOrder: 40,
         allowedAccessModes: ['enabled', 'disabled'],
         configTemplate: {}
     },
@@ -37,6 +40,7 @@ export const DEFAULT_PLAN_FEATURE_CATALOG = [
         featureKey: DOCUMENT_CLOUD_STORAGE_FEATURE_KEY,
         label: 'Document Cloud Storage',
         description: 'Allow cloud document storage with an optional storage allowance in MB.',
+        publicDisplayOrder: 30,
         allowedAccessModes: ['enabled', 'disabled'],
         configTemplate: {
             [DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY]: 1024
@@ -46,10 +50,21 @@ export const DEFAULT_PLAN_FEATURE_CATALOG = [
         featureKey: WORKSPACES_FEATURE_KEY,
         label: 'Workspaces',
         description: 'Allow multiple workspaces with a configurable workspace limit.',
+        publicDisplayOrder: 10,
         allowedAccessModes: ['enabled', 'disabled'],
         configTemplate: {
             [WORKSPACES_LIMIT_CONFIG_KEY]: 1
         }
+    },
+    {
+        featureKey: AI_PROFILES_FEATURE_KEY,
+        label: 'AI Profiles',
+        description: 'Allow registered AI collaborator profiles with an optional per-workspace limit.',
+        publicDisplayOrder: 20,
+        allowedAccessModes: ['enabled', 'limited', 'disabled'],
+        configTemplate: {
+            [AI_PROFILES_LIMIT_CONFIG_KEY]: 1
+        }
     }
 ];
 export const PLAN_FEATURE_DEPENDENCIES = Object.freeze(DEFAULT_PLAN_FEATURE_CATALOG.reduce((acc, feature) => {

package/dist/core/types.d.ts

@@ -287,6 +287,25 @@ export interface GlobalTaskforceSettings {
         signedUploadTtlSeconds?: number;
         signedDownloadTtlSeconds?: number;
     };
+    oauthProviders?: {
+        google?: {
+            enabled?: boolean;
+            clientId?: string;
+            clientSecret?: string;
+        };
+        github?: {
+            enabled?: boolean;
+            clientId?: string;
+            clientSecret?: string;
+        };
+        apple?: {
+            enabled?: boolean;
+            servicesId?: string;
+            teamId?: string;
+            keyId?: string;
+            privateKeyPem?: string;
+        };
+    };
 }
 export interface SettingsSplitPayload {
     system: GlobalTaskforceSettings;
@@ -303,11 +322,11 @@ export interface UserGlobalSyncSettings {
 export type OnboardingPolicyMode = 'require_plan_selection' | 'auto_grant_free' | 'auto_start_trial';
 export interface OnboardingPolicy {
     mode: OnboardingPolicyMode;
-    planVersionId: string | null;
+    planId: string | null;
 }
 export interface OnboardingPolicyValidationResult {
     valid: boolean;
-    code?: 'ONBOARDING_PLAN_VERSION_REQUIRED' | 'ONBOARDING_PLAN_VERSION_NOT_FOUND' | 'ONBOARDING_PLAN_NOT_ENABLED' | 'ONBOARDING_PLAN_MUST_BE_FREE' | 'ONBOARDING_PLAN_TRIAL_REQUIRED';
+    code?: 'ONBOARDING_PLAN_REQUIRED' | 'ONBOARDING_PLAN_NOT_FOUND' | 'ONBOARDING_PLAN_NOT_ENABLED' | 'ONBOARDING_PLAN_MUST_BE_FREE' | 'ONBOARDING_PLAN_TRIAL_REQUIRED';
     message?: string;
     details?: Record<string, unknown>;
 }
@@ -316,6 +335,36 @@ export type SystemRole = 'system_admin' | 'user';
 export type PermissionMode = 'read-only' | 'read-write';
 export type AuthTokenPurpose = 'email_verification' | 'password_reset' | 'invite_accept';
 export type McpAccessTokenScope = 'tasks:read' | 'tasks:write' | 'workspace:read';
+export type UserAuthProvider = 'password' | 'google' | 'github' | 'apple';
+export interface UserAuthIdentity {
+    id: string;
+    tenantId: string;
+    userId: string;
+    provider: UserAuthProvider;
+    providerSubject: string | null;
+    providerEmail: string | null;
+    providerEmailVerified: boolean | null;
+    displayNameSnapshot: string | null;
+    avatarUrlSnapshot: string | null;
+    createdAt: string;
+    updatedAt: string;
+    lastLoginAt: string | null;
+    linkedAt: string | null;
+    disabledAt: string | null;
+}
+export type InviteeState = 'pending_setup' | 'existing_account';
+export interface InviteAcceptanceDetails {
+    state: 'valid' | 'expired' | 'used' | 'missing' | 'revoked';
+    email?: string;
+    userId?: string;
+    workspaceId?: string;
+    inviteeState?: InviteeState;
+    availableMethods?: UserAuthProvider[];
+    /** @deprecated use inviteeState */
+    inviteeKind?: 'existing_user' | 'new_user';
+    /** @deprecated use availableMethods */
+    passwordRequired?: boolean;
+}
 export type McpAccessTokenStatus = 'active' | 'revoked' | 'expired';
 export type McpOAuthProvider = 'chatgpt' | 'claude';
 export type McpOAuthClientStatus = 'active' | 'revoked';
@@ -326,6 +375,8 @@ export interface UserAccessRecord {
     role: AccessRole;
     permissionMode: PermissionMode;
     disabled: boolean;
+    accountDisabled?: boolean;
+    workspaceDisabled?: boolean;
     betaAccess: boolean;
 }
 export interface UserIdentityRecord {
@@ -340,6 +391,7 @@ export interface WorkspaceUserRecord {
     userId: string;
     email: string;
     displayName?: string | null;
+    avatarUrl?: string | null;
     role: AccessRole;
     permissionMode: PermissionMode;
     betaAccess: boolean;
@@ -453,6 +505,9 @@ export interface PlanFeatureCatalogItem {
     featureKey: string;
     label: string;
     description: string;
+    publicLabel?: string | null;
+    publicDescription?: string | null;
+    publicDisplayOrder?: number | null;
     allowedAccessModes: PlanFeatureAccess[];
     configTemplate: Record<string, unknown>;
     dependsOn?: string[];
@@ -470,10 +525,20 @@ export interface PlanVersionSnapshot {
 export interface PlanCatalogSnapshot {
     planId: string;
     displayName: string;
+    description: string | null;
     status: 'active' | 'archived';
     createdAt: string;
     updatedAt: string;
 }
+export interface OnboardingPlanOption {
+    planId: string;
+    planDisplayName: string;
+    defaultPlanVersionId: string;
+    defaultVersionNumber: number;
+    planStatus: 'active' | 'archived';
+    supportsAutoGrantFree: boolean;
+    supportsAutoStartTrial: boolean;
+}
 export interface AccountEntitlementSnapshot {
     accountId: string;
     planVersionId: string;
@@ -520,6 +585,7 @@ export interface PasswordAuthResult {
         userId: string;
         workspaceId: string;
         role: AccessRole;
+        identityId?: string;
     };
     code?: 'INVALID_CREDENTIALS' | 'EMAIL_NOT_VERIFIED';
 }