@taskforcehq/taskforce 0.3.305 → 0.3.306

package/dist/core/Taskforce.d.ts

@@ -3,10 +3,22 @@ import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 import { type SyncEventInput } from './SyncReconciliationService.js';
 import { type FirstClassTaxonomyDisplayLabels, type WorkspaceTaxonomyState } from '../shared/taxonomyState.js';
 import { type AiProfileSurfaceType } from '../shared/aiProfileSurfaceType.js';
+import { type AiProfileSeatScope } from '../shared/aiProfileSeatScope.js';
+import type { PlanningBootstrapPayload } from '../types.js';
 import type { TaskActor } from '../shared/taskActor.js';
 export type { TaskActor } from '../shared/taskActor.js';
 export type { WorkspaceDeletedAssetRecord, WorkspaceDeleteSummary } from './types.js';
-import type { GlobalTaskforceSettings, UserGlobalSyncSettings, WorkspaceDeleteSummary } from './types.js';
+import type { GlobalTaskforceSettings, UserGlobalSyncSettings, WorkspaceDeleteSummary, UserAuthProvider } from './types.js';
+export interface PlanningBootstrapDiagnostics {
+    initiativeCount?: number;
+    workstreamCount?: number;
+    workstreamLinkedTaskCount?: number;
+    workstreamTaskSummaryCount?: number;
+    initiativeLoadMs?: number;
+    workstreamLoadMs?: number;
+    taskSummaryQueryMs?: number;
+    taskSummaryBuildMs?: number;
+}
 import type { AnnotatedAttachmentAnnotation, AnnotatedAttachmentPayload, AnnotatedAttachmentSession, AnnotatedAttachmentSessionRecord } from '../annotatedAttachments/types.js';
 import type { DocumentReviewAnchor, DocumentReviewCommentSyncRecord, DocumentReviewSession, DocumentReviewSessionRecord, DocumentReviewSessionStatus } from '../documentReviews/types.js';
 import { type TaskforceTheme } from '../utils/theme.js';
@@ -350,6 +362,8 @@ interface UserAccessRecord {
     role: AccessRole;
     permissionMode: PermissionMode;
     disabled: boolean;
+    accountDisabled?: boolean;
+    workspaceDisabled?: boolean;
     betaAccess: boolean;
 }
 interface UserIdentityRecord {
@@ -378,6 +392,7 @@ interface WorkspaceUserRecord {
     userId: string;
     email: string;
     displayName?: string | null;
+    avatarUrl?: string | null;
     role: AccessRole;
     permissionMode: PermissionMode;
     betaAccess: boolean;
@@ -395,12 +410,20 @@ export interface AiProfileRecord {
     username: string;
     icon: string;
     color: string;
+    avatarUrl?: string | null;
+    avatarSourceUrl?: string | null;
     description?: string | null;
     role?: string | null;
     provider?: string | null;
     model?: string | null;
     surfaceType?: AiProfileSurfaceType | null;
+    seatScope?: AiProfileSeatScope | null;
     providerMetadata?: Record<string, unknown> | null;
+    archivedAt?: string | null;
+    archivedBy?: string | null;
+    archivedReason?: string | null;
+    mergedIntoProfileId?: string | null;
+    rosterStateUpdatedAt?: string | null;
     createdAt: string;
     updatedAt: string;
     lastActiveAt?: string | null;
@@ -418,6 +441,9 @@ export interface ResolveAiProfileInput {
     profileToken?: string | null;
     providerMetadata?: Record<string, unknown> | null;
 }
+export interface ResolveAiProfileOptions {
+    trustedSeatScope?: AiProfileSeatScope | null;
+}
 export interface ResolveAiProfileResult {
     created: boolean;
     profile: AiProfileRecord;
@@ -563,6 +589,7 @@ export interface PlanVersionSnapshot {
 export interface PlanCatalogSnapshot {
     planId: string;
     displayName: string;
+    description: string | null;
     status: 'active' | 'archived';
     createdAt: string;
     updatedAt: string;
@@ -594,6 +621,7 @@ interface PasswordAuthResult {
         userId: string;
         workspaceId: string;
         role: AccessRole;
+        identityId?: string;
     };
     code?: 'INVALID_CREDENTIALS' | 'EMAIL_NOT_VERIFIED';
 }
@@ -733,7 +761,9 @@ export interface TaskforceSyncCapable {
     };
     listInitiatives(workspaceId?: string): InitiativeItem[];
     listWorkstreams(workspaceId?: string): WorkstreamItem[];
-    listAiProfiles(workspaceId: string): AiProfileRecord[];
+    listAiProfiles(workspaceId: string, options?: {
+        includeArchived?: boolean;
+    }): AiProfileRecord[];
     listWorkspaceUsers(workspaceId: string): WorkspaceUserRecord[];
     listDocumentReviewSessionsForSync(input: {
         workspaceId?: string | null;
@@ -781,6 +811,18 @@ export interface TaskforceSyncCapable {
         keepId: string;
         mergeId: string;
     }): AiProfileRecord;
+    archiveAiProfile(input: {
+        workspaceId: string;
+        profileId: string;
+        archivedBy?: string | null;
+        reason?: string | null;
+    }): AiProfileRecord;
+    updateAiProfileAvatar(input: {
+        workspaceId: string;
+        profileId: string;
+        avatarUrl?: string | null;
+        avatarSourceUrl?: string | null;
+    }): AiProfileRecord;
     resolveWorkspaceActor(workspaceId: string, actorRef: unknown): TaskActor | null;
 }
 export declare class TaskforceCore implements TaskforceSyncCapable {
@@ -798,6 +840,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     private db;
     private globalSettingsDb;
     private authTokenService;
+    private identityService;
     private mcpTokenService;
     private planEntitlementService;
     private realtimeMutationListeners;
@@ -935,6 +978,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     };
     private ensureDirectories;
     private migrateLegacyGlobalSettingsDbIfNeeded;
+    private supportsWorkspaceAssetLinkTargetType;
     private initializeSchema;
     private performMigrationIfNeeded;
     private backfillMcpAuditLogMetadataColumns;
@@ -992,9 +1036,10 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     getEffectiveTheme(workspaceId?: string, userId?: string): TaskforceTheme;
     hasProjectJsonBackupOverride(workspaceId?: string, userId?: string): boolean;
     getOnboardingPolicy(): import("./types.js").OnboardingPolicy;
+    listOnboardingPlanOptions(): import("./types.js").OnboardingPlanOption[];
     validateOnboardingPolicy(input?: {
         mode?: 'require_plan_selection' | 'auto_grant_free' | 'auto_start_trial';
-        planVersionId?: string | null;
+        planId?: string | null;
     }): import("./types.js").OnboardingPolicyValidationResult;
     updateGlobalSettings(settings: GlobalTaskforceSettings): void;
     private sanitizeUserGlobalSyncSettings;
@@ -1037,6 +1082,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     unarchiveInitiative(id: string, workspaceId?: string): InitiativeItem;
     getWorkstream(id: string, workspaceId?: string): WorkstreamItem | null;
     listWorkstreams(workspaceId?: string): WorkstreamItem[];
+    listPlanningBootstrap(workspaceId?: string, diagnostics?: PlanningBootstrapDiagnostics): PlanningBootstrapPayload;
     createWorkstream(input: Partial<WorkstreamItem>, workspaceId?: string): WorkstreamItem;
     updateWorkstream(id: string, patch: Partial<WorkstreamItem>, workspaceId?: string): WorkstreamItem;
     archiveWorkstream(id: string, workspaceId?: string): WorkstreamItem;
@@ -1112,6 +1158,24 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     private getSyncReconciliationServiceDeps;
     private getWorkspaceLifecycleServiceDeps;
     listTasks(workspaceId?: string): TaskFile;
+    /**
+     * Filter-pushdown listing used by read-only surfaces that don't need the
+     * full task graph (MCP list_tasks, CLI summaries). Avoids the per-task
+     * comments/events/attachments/checklist subqueries and actor resolution
+     * that rowToTask performs, and applies filters + sort + limit at the SQL
+     * layer so hot polls don't load the entire workspace.
+     */
+    listTasksSlim(workspaceId: string | undefined, filters?: {
+        category?: string;
+        status?: TaskStatus;
+        openOnly?: boolean;
+        assignee?: string;
+        priority?: number;
+        type?: string;
+        sort?: 'created' | 'priority' | 'updated';
+        order?: 'asc' | 'desc';
+        limit?: number;
+    }): Array<Record<string, unknown>>;
     getDataVersion(): number;
     getDatabaseProvider(): DatabaseProvider;
     isDatabaseHealthy(): boolean;
@@ -1169,7 +1233,15 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     getUserBetaAccess(userId: string): boolean;
     countSystemAdmins(): number;
     hasAnySystemAdmin(): boolean;
-    listSystemUsers(): SystemUserRecord[];
+    countSystemUsers(input?: {
+        query?: string | null;
+    }): number;
+    listSystemUsers(input?: {
+        query?: string | null;
+        sort?: 'newest' | 'oldest' | null;
+        limit?: number | null;
+        offset?: number | null;
+    }): SystemUserRecord[];
     setSystemRole(userId: string, role: SystemRole): boolean;
     setUserDisabledGlobal(userId: string, disabled: boolean): boolean;
     setUserBetaAccessGlobal(userId: string, enabled: boolean): boolean;
@@ -1185,10 +1257,17 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         users: WorkspaceUserRecord[];
         pruneMissing?: boolean;
     }): WorkspaceUserRecord[];
-    listAiProfiles(workspaceId: string): AiProfileRecord[];
+    listAiProfiles(workspaceId: string, options?: {
+        includeArchived?: boolean;
+        diagnostics?: {
+            metadataBackfillCount?: number;
+        };
+    }): AiProfileRecord[];
     getAiProfileByToken(input: {
         workspaceId: string;
         profileToken: string;
+        includeArchived?: boolean;
+        seatScope?: AiProfileSeatScope | null;
     }): AiProfileRecord | null;
     upsertAiProfileForSync(profile: AiProfileRecord): AiProfileRecord;
     mergeAiProfiles(input: {
@@ -1196,7 +1275,19 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         keepId: string;
         mergeId: string;
     }): AiProfileRecord;
-    resolveAiProfile(input: ResolveAiProfileInput): ResolveAiProfileResult;
+    archiveAiProfile(input: {
+        workspaceId: string;
+        profileId: string;
+        archivedBy?: string | null;
+        reason?: string | null;
+    }): AiProfileRecord;
+    updateAiProfileAvatar(input: {
+        workspaceId: string;
+        profileId: string;
+        avatarUrl?: string | null;
+        avatarSourceUrl?: string | null;
+    }): AiProfileRecord;
+    resolveAiProfile(input: ResolveAiProfileInput, options?: ResolveAiProfileOptions): ResolveAiProfileResult;
     listAnnotatedAttachmentSessions(input: {
         workspaceId?: string | null;
         taskId?: string | null;
@@ -1385,6 +1476,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     upsertPlanCatalog(input: {
         planId: string;
         displayName: string;
+        description?: string | null;
         status?: 'active' | 'archived';
         initialMode?: 'personal' | 'team';
         initialSeatLimit?: number | null;
@@ -1392,10 +1484,17 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     }): {
         planId: string;
         displayName: string;
+        description: string | null;
         status: "active" | "archived";
     };
     listPlanCatalog(): import("./types.js").PlanCatalogSnapshot[];
     listPlanFeatureCatalog(): import("./types.js").PlanFeatureCatalogItem[];
+    updatePlanFeatureCatalogMarketingCopy(input: {
+        featureKey: string;
+        publicLabel?: string | null;
+        publicDescription?: string | null;
+        publicDisplayOrder?: number | null;
+    }): import("./types.js").PlanFeatureCatalogItem;
     listPlanVersions(planId: string): import("./types.js").PlanVersionSnapshot[];
     getPlanVersionFeatures(planId: string, versionId: string): import("./types.js").PlanVersionSnapshot;
     searchAccountsByEmail(query: string, limit?: number): {
@@ -1516,6 +1615,99 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         checkoutPending: boolean;
         commercialState: EntitlementState;
     };
+    /**
+     * Creates an OAuth state record and returns the state token + PKCE materials.
+     * Delegates to AuthIdentityService.createOAuthState.
+     */
+    createOAuthLoginState(input: {
+        provider: string;
+        flowMode: string;
+        userId?: string | null;
+        inviteToken?: string | null;
+        returnTo?: string | null;
+        createdIp?: string | null;
+    }): {
+        state: string;
+        codeVerifier: string;
+        codeChallenge: string;
+        nonce: string;
+    };
+    /**
+     * Atomically consumes an OAuth state token and returns the row.
+     * Returns null if invalid, expired, or already consumed.
+     */
+    consumeOAuthLoginState(state: string): import('./AuthIdentityService.js').OAuthStateRecord | null;
+    /**
+     * Finds the Taskforce user associated with a provider identity.
+     * Returns { userId, identityId } or null if not yet linked.
+     */
+    findUserByOAuthProvider(provider: UserAuthProvider, providerSubject: string): {
+        userId: string;
+        identityId: string;
+    } | null;
+    /**
+     * Links an OAuth provider identity to an existing user.
+     * Throws IDENTITY_ALREADY_EXISTS if the user already has an identity for this provider.
+     */
+    linkOAuthProviderToUser(input: {
+        userId: string;
+        provider: UserAuthProvider;
+        providerSubject: string;
+        providerEmail?: string | null;
+        providerEmailVerified?: boolean | null;
+        displayNameSnapshot?: string | null;
+        avatarUrlSnapshot?: string | null;
+    }): string;
+    /**
+     * Lists all active login identities for a user.
+     * Used by the Account Hub "Login methods" section.
+     */
+    listLoginMethodsForUser(userId: string): import('./types.js').UserAuthIdentity[];
+    /**
+     * Unlinks a provider identity from a user.
+     * Throws LAST_IDENTITY_REQUIRED if it would be the last active method.
+     */
+    unlinkLoginMethod(userId: string, provider: UserAuthProvider): boolean;
+    /**
+     * Adds or replaces a password identity for a user that signed up via OAuth.
+     * Uses upsert semantics (safe to call on accounts that already have a password).
+     */
+    addPasswordToAccount(userId: string, password: string): string;
+    /**
+     * Registers a new user account via an OAuth provider (no password).
+     *
+     * Creates the user row, applies commercial onboarding, and links the
+     * provider identity — all in a single transaction.
+     *
+     * Returns the same shape as `registerPasswordUser` so callers can use
+     * the same session-issuance path.
+     */
+    registerOAuthUser(input: {
+        email: string | null;
+        emailVerified?: boolean;
+        provider: UserAuthProvider;
+        providerSubject: string;
+        displayName?: string | null;
+        avatarUrl?: string | null;
+        planVersionId?: string;
+        betaAccess?: boolean;
+    }): {
+        userId: string;
+        workspaceId: string | null;
+        role: AccessRole;
+        identityId: string;
+        planSelectionRequired: boolean;
+        checkoutPending: boolean;
+        commercialState: EntitlementState;
+    };
+    /**
+     * Looks up a user by email address (exact, case-insensitive).
+     * Returns { userId, email } or null.
+     */
+    findUserByEmail(email: string): {
+        userId: string;
+        email: string;
+    } | null;
     private createOneTimeAuthToken;
     private consumeOneTimeAuthToken;
     inspectOneTimeAuthToken(token: string, purpose: AuthTokenPurpose): AuthTokenInspection;
@@ -1620,15 +1812,33 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     revokeInviteAcceptanceForUser(userId: string): {
         revoked: number;
     };
-    inspectInviteAcceptance(token: string): {
-        state: 'valid' | 'expired' | 'used' | 'missing' | 'revoked';
-        email?: string;
-        userId?: string;
-        workspaceId?: string;
-        inviteeKind?: 'existing_user' | 'new_user';
-        passwordRequired?: boolean;
-    };
+    inspectInviteAcceptance(token: string): import('./types.js').InviteAcceptanceDetails;
     private completeInviteWorkspaceActivation;
+    /**
+     * Claims an invite by linking an OAuth provider identity to the invited user.
+     *
+     * Used when an invited user with `inviteeState: 'pending_setup'` completes an
+     * OAuth flow with `flow_mode: 'invite_claim'`.  The invite token must still be
+     * valid and the user must have zero active identities (pending setup).
+     *
+     * Returns the same shape as `acceptInviteWithToken` so callers can issue a
+     * session cookie on the same path.
+     */
+    claimInviteWithOAuthProvider(input: {
+        token: string;
+        provider: UserAuthProvider;
+        providerSubject: string;
+        providerEmail?: string | null;
+        providerEmailVerified?: boolean | null;
+        displayNameSnapshot?: string | null;
+        avatarUrlSnapshot?: string | null;
+    }): {
+        userId: string;
+        email: string;
+        workspaceId: string;
+        role: AccessRole;
+        identityId: string;
+    };
     acceptInviteWithToken(input: {
         token: string;
         password: string;
@@ -1637,6 +1847,7 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
         email: string;
         workspaceId: string;
         role: AccessRole;
+        identityId: string;
     };
     joinInviteWithAuthenticatedUser(input: {
         token: string;