@taskforcehq/taskforce 0.3.305 → 0.3.306

package/dist/core/Taskforce.js

@@ -7,7 +7,8 @@ import { TemplateEngine } from '../services/templateEngine.js';
 import { createDatabaseAdapter } from '../storage/createDatabaseAdapter.js';
 import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 import { AuthTokenService } from './AuthTokenService.js';
-import { getAiProfileByTokenService, listAiProfilesService, mergeAiProfilesService, resolveAiProfileService, upsertAiProfileForSyncService, } from './AiProfileService.js';
+import { AuthIdentityService } from './AuthIdentityService.js';
+import { archiveAiProfileService, getAiProfileByTokenService, listAiProfilesService, mergeAiProfilesService, resolveAiProfileService, updateAiProfileAvatarService, upsertAiProfileForSyncService, } from './AiProfileService.js';
 import { syncCanonicalTaskAttachmentLinksService, } from './AttachmentLinkService.js';
 import { addTaskEventService, buildTaskActivityService, listTaskEventsInternalService, listWorkspaceTaskEventsService, replaceTaskCommentsService, replaceTaskEventsService, upsertTaskEventForSyncService, } from './TaskActivityService.js';
 import { addDeletedTaskRecordService, getDeletedTaskService, listDeletedTasksService, mapDeletedTaskRowService, normalizeTaskSnapshotForRestoreService, pruneDeletedTasksService, purgeExpiredDeletedTasksService, } from './DeletedTaskLifecycleService.js';
@@ -16,6 +17,8 @@ import { getGlobalSettingsService, hasPersistedGlobalSettingsService, readGlobal
 import { getWorkspaceTaxonomyStateService, upsertWorkspaceTaxonomyStateService, } from './TaxonomySettingsService.js';
 import { normalizeWorkspaceTaxonomyStatePayload, } from '../shared/taxonomyState.js';
 import { parseAiProfileSurfaceType } from '../shared/aiProfileSurfaceType.js';
+import { parseAiProfileSeatScope } from '../shared/aiProfileSeatScope.js';
+import { validatePasswordPolicy } from '../shared/passwordPolicy.js';
 import { normalizeTaskforceTheme } from '../utils/theme.js';
 import { McpTokenService } from './McpTokenService.js';
 import { PlanEntitlementService } from './PlanEntitlementService.js';
@@ -38,7 +41,7 @@ import { getDocumentReferenceLabel } from '../utils/documentReferences.js';
 import { getImageReferenceLabel } from '../utils/imageReferences.js';
 import { getCanonicalDocumentName } from '../utils/documentNames.js';
 import { DEFAULT_TASKFORCE_THEME } from '../utils/theme.js';
-import { ensureAssigneeTaskSchema, ensureAnnotatedAttachmentSessionsSchema, ensureBillingSchema, ensureDocumentReviewSessionsSchema, ensureDocumentReferenceSchema, ensureEntitlementsSchema, ensureParentTaskSchema, ensureScheduleTaskSchema, ensureTaskAssetsSchema, ensureTaskReferenceSchema, ensureTenantSchema, ensureWorkspaceAssetsSchema, ensureWorkspaceSchema } from '../migrations/taskSchemaMigrations.js';
+import { ensureAssigneeTaskSchema, ensureAnnotatedAttachmentSessionsSchema, ensureAuthIdentitySchema, ensureBillingSchema, ensureDocumentReviewSessionsSchema, ensureDocumentReferenceSchema, ensureEntitlementsSchema, ensureScheduleTaskSchema, ensureTaskAssetsSchema, ensureTaskReferenceSchema, ensureTenantSchema, ensureWorkspaceAssetsSchema, ensureWorkspaceSchema } from '../migrations/taskSchemaMigrations.js';
 export class TaskforceRuleError extends Error {
     statusCode;
     code;
@@ -54,52 +57,7 @@ export class TaskforceRuleError extends Error {
 const WORKSPACE_SYNC_SETTINGS_KEY_ALLOWLIST = new Set([]);
 const GENERIC_AI_ACTOR_COLOR = '#6B7280';
 const GENERIC_AI_ACTOR_ICON = 'Bot';
-const DOCUMENT_CLOUD_STORAGE_FEATURE_KEY = 'context.uploads';
-const LEGACY_REMOVED_PLAN_FEATURE_KEYS = Object.freeze([
-    'documents.workspace_access'
-]);
-const WORKSPACES_FEATURE_KEY = 'workspace.switching';
-const DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY = 'storageLimitMb';
-const WORKSPACES_LIMIT_CONFIG_KEY = 'maxWorkspaces';
-const MCP_ACCESS_TOKEN_MAX_ACTIVE_PER_USER_WORKSPACE = 10;
-const MCP_ACCESS_TOKEN_DEFAULT_PAGE_SIZE = 20;
-const MCP_ACCESS_TOKEN_MAX_PAGE_SIZE = 100;
-const MCP_OAUTH_AUTH_CODE_TTL_MS = 10 * 60 * 1000;
-const MCP_ACCESS_TOKEN_ALLOWED_SCOPES = ['tasks:read', 'tasks:write', 'workspace:read'];
 const DELETED_TASK_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
-const DEFAULT_PLAN_FEATURE_CATALOG = [
-    {
-        featureKey: 'collaboration.team_management',
-        label: 'Team Management',
-        description: 'Allow managing members, invites, roles, and collaboration settings.',
-        allowedAccessModes: ['enabled', 'disabled'],
-        configTemplate: {}
-    },
-    {
-        featureKey: DOCUMENT_CLOUD_STORAGE_FEATURE_KEY,
-        label: 'Document Cloud Storage',
-        description: 'Allow cloud document storage with an optional storage allowance in MB.',
-        allowedAccessModes: ['enabled', 'limited', 'disabled'],
-        configTemplate: {
-            [DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY]: 1024
-        }
-    },
-    {
-        featureKey: WORKSPACES_FEATURE_KEY,
-        label: 'Workspaces',
-        description: 'Allow multiple workspaces with a configurable workspace limit.',
-        allowedAccessModes: ['enabled', 'disabled'],
-        configTemplate: {
-            [WORKSPACES_LIMIT_CONFIG_KEY]: 1
-        }
-    }
-];
-const PLAN_FEATURE_DEPENDENCIES = Object.freeze(DEFAULT_PLAN_FEATURE_CATALOG.reduce((acc, feature) => {
-    if (Array.isArray(feature.dependsOn) && feature.dependsOn.length > 0) {
-        acc[feature.featureKey] = [...feature.dependsOn];
-    }
-    return acc;
-}, {}));
 function hashPassword(password) {
     const iterations = 120000;
     const salt = randomBytes(16).toString('hex');
@@ -121,6 +79,12 @@ function verifyPassword(password, encoded) {
         return false;
     return timingSafeEqual(actual, expected);
 }
+function assertPasswordPolicy(password, context) {
+    const validation = validatePasswordPolicy(password, context);
+    if (!validation.ok) {
+        throw new TaskforceRuleError(validation.message || 'Password does not meet the password policy.', 400, validation.code || 'PASSWORD_TOO_SHORT');
+    }
+}
 function hashAuthToken(token) {
     return createHash('sha256').update(token).digest('hex');
 }
@@ -179,6 +143,7 @@ export class TaskforceCore {
     db;
     globalSettingsDb = null;
     authTokenService;
+    identityService;
     mcpTokenService;
     planEntitlementService;
     realtimeMutationListeners = new Set();
@@ -408,12 +373,22 @@ export class TaskforceCore {
             username: String(row.username || '').trim() || this.normalizeAiProfileUsername(row.name, 'ai'),
             icon: this.normalizeAiProfileIcon(row.icon),
             color: this.normalizeAiProfileColor(row.color),
+            avatarUrl: typeof row.avatar_url === 'string' && row.avatar_url.trim().length > 0 ? row.avatar_url.trim() : null,
+            avatarSourceUrl: typeof row.avatar_source_url === 'string' && row.avatar_source_url.trim().length > 0 ? row.avatar_source_url.trim() : null,
             description: typeof row.description === 'string' && row.description.trim().length > 0 ? row.description.trim() : null,
             role: typeof row.role === 'string' && row.role.trim().length > 0 ? row.role.trim() : null,
             provider: typeof row.provider === 'string' && row.provider.trim().length > 0 ? row.provider.trim() : null,
             model: typeof row.model === 'string' && row.model.trim().length > 0 ? row.model.trim() : null,
             surfaceType: parseAiProfileSurfaceType(row.surface_type),
+            seatScope: parseAiProfileSeatScope(row.seat_scope),
             providerMetadata,
+            archivedAt: typeof row.archived_at === 'string' ? row.archived_at : null,
+            archivedBy: typeof row.archived_by === 'string' && row.archived_by.trim().length > 0 ? row.archived_by.trim() : null,
+            archivedReason: typeof row.archived_reason === 'string' && row.archived_reason.trim().length > 0 ? row.archived_reason.trim() : null,
+            mergedIntoProfileId: typeof row.merged_into_profile_id === 'string' && row.merged_into_profile_id.trim().length > 0 ? row.merged_into_profile_id.trim() : null,
+            rosterStateUpdatedAt: typeof row.roster_state_updated_at === 'string' && row.roster_state_updated_at.trim().length > 0
+                ? row.roster_state_updated_at.trim()
+                : null,
             createdAt: String(row.created_at || '').trim(),
             updatedAt: String(row.updated_at || '').trim(),
             lastActiveAt: typeof row.last_active_at === 'string' ? row.last_active_at : null
@@ -431,12 +406,20 @@ export class TaskforceCore {
             meta: {
                 profileToken: profile.profileToken,
                 workspaceId: profile.workspaceId,
+                avatarUrl: profile.avatarUrl ?? null,
+                avatarSourceUrl: profile.avatarSourceUrl ?? null,
                 lastActiveAt: profile.lastActiveAt ?? null,
                 description: profile.description ?? null,
                 role: profile.role ?? null,
                 provider: profile.provider ?? null,
                 model: profile.model ?? null,
-                surfaceType: profile.surfaceType ?? null
+                surfaceType: profile.surfaceType ?? null,
+                seatScope: profile.seatScope ?? null,
+                archivedAt: profile.archivedAt ?? null,
+                archivedBy: profile.archivedBy ?? null,
+                archivedReason: profile.archivedReason ?? null,
+                mergedIntoProfileId: profile.mergedIntoProfileId ?? null,
+                rosterStateUpdatedAt: profile.rosterStateUpdatedAt ?? null
             }
         };
     }
@@ -1160,7 +1143,6 @@ export class TaskforceCore {
         this.initializeSchema();
         ensureTenantSchema(this.db);
         ensureWorkspaceSchema(this.db);
-        ensureParentTaskSchema(this.db);
         ensureScheduleTaskSchema(this.db);
         ensureAssigneeTaskSchema(this.db);
         ensureTaskReferenceSchema(this.db);
@@ -1171,6 +1153,7 @@ export class TaskforceCore {
         ensureAnnotatedAttachmentSessionsSchema(this.db);
         ensureBillingSchema(this.db);
         ensureEntitlementsSchema(this.db);
+        ensureAuthIdentitySchema(this.db);
         this.performMigrationIfNeeded();
         this.planEntitlementService = new PlanEntitlementService(this.db, this.tenantId, {
             getWorkspaceOwnerUserId: (wid) => this.getWorkspaceOwnerUserId(wid),
@@ -1182,6 +1165,8 @@ export class TaskforceCore {
         this.planEntitlementService.backfillAccountEntitlements();
         this.repairDetachedAnnotatedAttachmentSessions();
         this.authTokenService = new AuthTokenService(this.db, this.tenantId);
+        this.identityService = new AuthIdentityService(this.db, this.tenantId);
+        this.authTokenService.setIdentityService(this.identityService);
         this.mcpTokenService = new McpTokenService(this.db, this.tenantId, {
             getAccountAccessStatus: (userId) => this.getAccountAccessStatus(userId),
         });
@@ -1225,11 +1210,23 @@ export class TaskforceCore {
         if (!accountId) {
             throw new TaskforceRuleError('accountId is required', 400, 'ACCOUNT_ID_REQUIRED');
         }
-        if (this.hasAccountEntitlement(accountId)) {
-            return this.getAccountEntitlement(accountId);
+        const existingEntitlement = this.hasAccountEntitlement(accountId)
+            ? this.getAccountEntitlement(accountId)
+            : null;
+        if (existingEntitlement) {
+            if (options?.source !== 'invite-accept') {
+                return existingEntitlement;
+            }
+            const existingAccess = this.getAccountAccessStatus(accountId);
+            if (existingAccess.canAccessApp) {
+                return existingAccess.entitlement || existingEntitlement;
+            }
         }
         const now = options?.now || new Date().toISOString();
-        const onboardingOutcome = this.resolveRegistrationOnboardingOutcome();
+        const inviteOutcome = options?.source === 'invite-accept'
+            ? this.planEntitlementService.resolveInviteAcceptanceDefaultEntitlement()
+            : null;
+        const onboardingOutcome = inviteOutcome || this.resolveRegistrationOnboardingOutcome();
         this.transitionCanonicalCommercialState({
             accountId,
             planVersionId: onboardingOutcome.planVersionId,
@@ -1315,6 +1312,26 @@ export class TaskforceCore {
             }
         }
     }
+    supportsWorkspaceAssetLinkTargetType() {
+        try {
+            if (this.db.provider === 'postgres') {
+                const row = this.db.prepare(`
+                    SELECT 1
+                    FROM information_schema.columns
+                    WHERE table_schema = current_schema()
+                      AND table_name = 'workspace_asset_links'
+                      AND column_name = 'target_type'
+                    LIMIT 1
+                `).get();
+                return Boolean(row);
+            }
+            const columns = this.db.prepare(`PRAGMA table_info(workspace_asset_links)`).all();
+            return columns.some((column) => String(column.name || '').trim() === 'target_type');
+        }
+        catch {
+            return false;
+        }
+    }
     initializeSchema() {
         const syncEventsIdColumnSql = this.db.provider === 'postgres'
             ? 'id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY'
@@ -1350,10 +1367,7 @@ export class TaskforceCore {
                 scheduled_week_key TEXT,
                 order_in_day INTEGER,
                 workstream_id TEXT,
-                parent_task_id TEXT,
-                child_display_order INTEGER,
-                FOREIGN KEY(workstream_id) REFERENCES workstreams(id) ON DELETE SET NULL,
-                FOREIGN KEY(parent_task_id) REFERENCES tasks(id) ON DELETE RESTRICT
+                FOREIGN KEY(workstream_id) REFERENCES workstreams(id) ON DELETE SET NULL
             );
 
             CREATE TABLE IF NOT EXISTS workspace_task_reference_sequences (
@@ -1640,12 +1654,20 @@ export class TaskforceCore {
                 username TEXT NOT NULL,
                 icon TEXT NOT NULL,
                 color TEXT NOT NULL,
+                avatar_url TEXT,
+                avatar_source_url TEXT,
                 description TEXT,
                 role TEXT,
                 provider TEXT,
                 model TEXT,
                 surface_type TEXT,
+                seat_scope TEXT,
                 provider_metadata_json TEXT,
+                archived_at TEXT,
+                archived_by TEXT,
+                archived_reason TEXT,
+                merged_into_profile_id TEXT,
+                roster_state_updated_at TEXT,
                 created_at TEXT NOT NULL,
                 updated_at TEXT NOT NULL,
                 last_active_at TEXT
@@ -1765,6 +1787,7 @@ export class TaskforceCore {
             }
         }
         this.db.exec(`CREATE INDEX IF NOT EXISTS idx_tasks_workstream ON tasks(tenant_id, workspace_id, workstream_id)`);
+        this.db.exec(`CREATE INDEX IF NOT EXISTS idx_tasks_assignee ON tasks(tenant_id, workspace_id, assignee, is_archived)`);
         this.db.exec(`CREATE INDEX IF NOT EXISTS idx_workstreams_initiative ON workstreams(tenant_id, workspace_id, initiative_id)`);
         this.db.exec(`CREATE INDEX IF NOT EXISTS idx_checklist_items_task_order ON checklist_items(tenant_id, workspace_id, task_id, sort_order)`);
         if (this.db.provider === 'sqlite') {
@@ -1881,12 +1904,20 @@ export class TaskforceCore {
                 { name: 'username', ddl: `ALTER TABLE ai_profiles ADD COLUMN username TEXT NOT NULL DEFAULT 'ai'` },
                 { name: 'icon', ddl: `ALTER TABLE ai_profiles ADD COLUMN icon TEXT NOT NULL DEFAULT 'Bot'` },
                 { name: 'color', ddl: `ALTER TABLE ai_profiles ADD COLUMN color TEXT NOT NULL DEFAULT '#64748b'` },
+                { name: 'avatar_url', ddl: `ALTER TABLE ai_profiles ADD COLUMN avatar_url TEXT` },
+                { name: 'avatar_source_url', ddl: `ALTER TABLE ai_profiles ADD COLUMN avatar_source_url TEXT` },
                 { name: 'description', ddl: `ALTER TABLE ai_profiles ADD COLUMN description TEXT` },
                 { name: 'role', ddl: `ALTER TABLE ai_profiles ADD COLUMN role TEXT` },
                 { name: 'provider', ddl: `ALTER TABLE ai_profiles ADD COLUMN provider TEXT` },
                 { name: 'model', ddl: `ALTER TABLE ai_profiles ADD COLUMN model TEXT` },
                 { name: 'surface_type', ddl: `ALTER TABLE ai_profiles ADD COLUMN surface_type TEXT` },
+                { name: 'seat_scope', ddl: `ALTER TABLE ai_profiles ADD COLUMN seat_scope TEXT` },
                 { name: 'provider_metadata_json', ddl: `ALTER TABLE ai_profiles ADD COLUMN provider_metadata_json TEXT` },
+                { name: 'archived_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN archived_at TEXT` },
+                { name: 'archived_by', ddl: `ALTER TABLE ai_profiles ADD COLUMN archived_by TEXT` },
+                { name: 'archived_reason', ddl: `ALTER TABLE ai_profiles ADD COLUMN archived_reason TEXT` },
+                { name: 'merged_into_profile_id', ddl: `ALTER TABLE ai_profiles ADD COLUMN merged_into_profile_id TEXT` },
+                { name: 'roster_state_updated_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN roster_state_updated_at TEXT` },
                 { name: 'created_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN created_at TEXT NOT NULL DEFAULT ''` },
                 { name: 'updated_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN updated_at TEXT NOT NULL DEFAULT ''` },
                 { name: 'last_active_at', ddl: `ALTER TABLE ai_profiles ADD COLUMN last_active_at TEXT` }
@@ -1905,12 +1936,20 @@ export class TaskforceCore {
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS username TEXT NOT NULL DEFAULT 'ai'`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS icon TEXT NOT NULL DEFAULT 'Bot'`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS color TEXT NOT NULL DEFAULT '#64748b'`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS avatar_url TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS avatar_source_url TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS description TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS role TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS provider TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS model TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS surface_type TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS seat_scope TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS provider_metadata_json TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS archived_at TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS archived_by TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS archived_reason TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS merged_into_profile_id TEXT`,
+                `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS roster_state_updated_at TEXT`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS created_at TEXT NOT NULL DEFAULT ''`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS updated_at TEXT NOT NULL DEFAULT ''`,
                 `ALTER TABLE ai_profiles ADD COLUMN IF NOT EXISTS last_active_at TEXT`
@@ -1924,6 +1963,21 @@ export class TaskforceCore {
                 }
             }
         }
+        this.db.exec(`
+            UPDATE ai_profiles
+            SET roster_state_updated_at = CASE
+                WHEN archived_at IS NOT NULL AND TRIM(archived_at) <> '' THEN archived_at
+                WHEN created_at IS NOT NULL AND TRIM(created_at) <> '' THEN created_at
+                ELSE updated_at
+            END
+            WHERE roster_state_updated_at IS NULL
+               OR TRIM(roster_state_updated_at) = ''
+               OR (
+                    archived_at IS NOT NULL
+                    AND TRIM(archived_at) <> ''
+                    AND roster_state_updated_at < archived_at
+               )
+        `);
         this.migrateSystemRoleBackfillIfNeeded();
         this.migrateUserBetaAccessBackfillIfNeeded();
         this.migrateDuplicateAiProfilesIfNeeded();
@@ -2668,6 +2722,9 @@ export class TaskforceCore {
     getOnboardingPolicy() {
         return this.planEntitlementService.getOnboardingPolicy();
     }
+    listOnboardingPlanOptions() {
+        return this.planEntitlementService.listOnboardingPlanOptions();
+    }
     validateOnboardingPolicy(input) {
         return this.planEntitlementService.validateOnboardingPolicy(input);
     }
@@ -2709,31 +2766,58 @@ export class TaskforceCore {
     listCanonicalTaskAttachments(taskId, workspaceId) {
         try {
             const workspaceAssetStore = new WorkspaceAssetStore(this.db, this.tenantId);
-            const rows = this.db.prepare(`
-                SELECT
-                    a.asset_id,
-                    a.kind,
-                    a.reference_number,
-                    a.storage_provider,
-                    a.storage_key,
-                    a.logical_name,
-                    a.original_filename,
-                    a.updated_at,
-                    a.created_at,
-                    l.role,
-                    l.display_name
-                FROM workspace_asset_links l
-                JOIN workspace_assets a
-                  ON a.tenant_id = l.tenant_id
-                 AND a.workspace_id = l.workspace_id
-                 AND a.asset_id = l.asset_id
-                WHERE l.tenant_id = ?
-                  AND l.workspace_id = ?
-                  AND l.task_id = ?
-                  AND l.deleted_at IS NULL
-                  AND a.deleted_at IS NULL
-                ORDER BY COALESCE(l.sort_order, 2147483647) ASC, a.updated_at DESC, a.asset_id ASC
-            `).all(this.tenantId, workspaceId, taskId);
+            const rows = (this.supportsWorkspaceAssetLinkTargetType()
+                ? this.db.prepare(`
+                    SELECT
+                        a.asset_id,
+                        a.kind,
+                        a.reference_number,
+                        a.storage_provider,
+                        a.storage_key,
+                        a.logical_name,
+                        a.original_filename,
+                        a.updated_at,
+                        a.created_at,
+                        l.role,
+                        l.display_name
+                    FROM workspace_asset_links l
+                    JOIN workspace_assets a
+                      ON a.tenant_id = l.tenant_id
+                     AND a.workspace_id = l.workspace_id
+                     AND a.asset_id = l.asset_id
+                    WHERE l.tenant_id = ?
+                      AND l.workspace_id = ?
+                      AND l.target_type = 'task'
+                      AND l.task_id = ?
+                      AND l.deleted_at IS NULL
+                      AND a.deleted_at IS NULL
+                    ORDER BY COALESCE(l.sort_order, 2147483647) ASC, a.updated_at DESC, a.asset_id ASC
+                `).all(this.tenantId, workspaceId, taskId)
+                : this.db.prepare(`
+                    SELECT
+                        a.asset_id,
+                        a.kind,
+                        a.reference_number,
+                        a.storage_provider,
+                        a.storage_key,
+                        a.logical_name,
+                        a.original_filename,
+                        a.updated_at,
+                        a.created_at,
+                        l.role,
+                        l.display_name
+                    FROM workspace_asset_links l
+                    JOIN workspace_assets a
+                      ON a.tenant_id = l.tenant_id
+                     AND a.workspace_id = l.workspace_id
+                     AND a.asset_id = l.asset_id
+                    WHERE l.tenant_id = ?
+                      AND l.workspace_id = ?
+                      AND l.task_id = ?
+                      AND l.deleted_at IS NULL
+                      AND a.deleted_at IS NULL
+                    ORDER BY COALESCE(l.sort_order, 2147483647) ASC, a.updated_at DESC, a.asset_id ASC
+                `).all(this.tenantId, workspaceId, taskId));
             const attachments = rows.map((row) => {
                 const storageKey = String(row.storage_key || '').trim();
                 const storageProvider = String(row.storage_provider || 'local').trim();
@@ -3125,6 +3209,63 @@ export class TaskforceCore {
         `).all(this.tenantId, normalizedWorkspaceId);
         return rows.map((row) => this.rowToWorkstream(row));
     }
+    listPlanningBootstrap(workspaceId, diagnostics) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const startedAt = Date.now();
+        const initiatives = this.listInitiatives(workspaceId);
+        const initiativesLoadedAt = Date.now();
+        const workstreams = this.listWorkstreams(workspaceId);
+        const workstreamsLoadedAt = Date.now();
+        const planningTaskRows = this.db.prepare(`
+            SELECT id, reference_number, title, status, workstream_id
+            FROM tasks
+            WHERE tenant_id = ? AND workspace_id = ? AND is_archived = 0
+              AND workstream_id IS NOT NULL AND TRIM(workstream_id) <> ''
+            ORDER BY created_at DESC
+        `).all(this.tenantId, normalizedWorkspaceId);
+        const taskRowsLoadedAt = Date.now();
+        const workstreamTaskSummaries = new Map();
+        for (const row of planningTaskRows) {
+            const workstreamId = String(row.workstream_id || '').trim();
+            if (!workstreamId)
+                continue;
+            const status = this.normalizeStatusValue(row.status);
+            const referenceNumber = this.sanitizeTaskReferenceNumber(row.reference_number);
+            const current = workstreamTaskSummaries.get(workstreamId) || {
+                workstreamId,
+                taskCount: 0,
+                completedTaskCount: 0,
+                tasks: [],
+            };
+            current.taskCount += 1;
+            if (status === 'done' || status === 'cancelled') {
+                current.completedTaskCount += 1;
+            }
+            current.tasks.push({
+                id: String(row.id || '').trim(),
+                referenceNumber,
+                title: String(row.title || '').trim() || 'Untitled Task',
+                status,
+            });
+            workstreamTaskSummaries.set(workstreamId, current);
+        }
+        const summariesBuiltAt = Date.now();
+        if (diagnostics) {
+            diagnostics.initiativeCount = initiatives.length;
+            diagnostics.workstreamCount = workstreams.length;
+            diagnostics.workstreamLinkedTaskCount = planningTaskRows.length;
+            diagnostics.workstreamTaskSummaryCount = workstreamTaskSummaries.size;
+            diagnostics.initiativeLoadMs = Math.max(0, initiativesLoadedAt - startedAt);
+            diagnostics.workstreamLoadMs = Math.max(0, workstreamsLoadedAt - initiativesLoadedAt);
+            diagnostics.taskSummaryQueryMs = Math.max(0, taskRowsLoadedAt - workstreamsLoadedAt);
+            diagnostics.taskSummaryBuildMs = Math.max(0, summariesBuiltAt - taskRowsLoadedAt);
+        }
+        return {
+            initiatives,
+            workstreams,
+            workstreamTaskSummaries: Array.from(workstreamTaskSummaries.values()),
+        };
+    }
     createWorkstream(input, workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         const id = String(input.id || '').trim() || this.generateEntityId('workstream');
@@ -3899,7 +4040,7 @@ export class TaskforceCore {
     listTasks(workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
         const rows = this.db.prepare(`
-            SELECT * FROM tasks 
+            SELECT * FROM tasks
             WHERE tenant_id = ?
               AND workspace_id = ?
               AND is_archived = 0
@@ -3910,6 +4051,112 @@ export class TaskforceCore {
             config: this.readConfig()
         };
     }
+    /**
+     * Filter-pushdown listing used by read-only surfaces that don't need the
+     * full task graph (MCP list_tasks, CLI summaries). Avoids the per-task
+     * comments/events/attachments/checklist subqueries and actor resolution
+     * that rowToTask performs, and applies filters + sort + limit at the SQL
+     * layer so hot polls don't load the entire workspace.
+     */
+    listTasksSlim(workspaceId, filters = {}) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const clauses = [
+            'tenant_id = ?',
+            'workspace_id = ?',
+            'is_archived = 0',
+        ];
+        const params = [this.tenantId, normalizedWorkspaceId];
+        if (filters.category) {
+            clauses.push('category = ?');
+            params.push(filters.category);
+        }
+        if (filters.status) {
+            clauses.push('status = ?');
+            params.push(filters.status);
+        }
+        else if (filters.openOnly) {
+            clauses.push("status IN ('task','on-hold','in-progress','review')");
+        }
+        if (filters.priority !== undefined) {
+            clauses.push('priority = ?');
+            params.push(Number(filters.priority));
+        }
+        if (filters.type) {
+            clauses.push('type = ?');
+            params.push(filters.type);
+        }
+        if (filters.assignee) {
+            if (filters.assignee === 'unassigned') {
+                clauses.push("(assignee IS NULL OR assignee = '' OR assignee = 'unassigned')");
+            }
+            else {
+                clauses.push('assignee = ?');
+                params.push(filters.assignee);
+            }
+        }
+        const order = filters.order === 'asc' ? 'ASC' : 'DESC';
+        const sort = filters.sort ?? 'created';
+        let orderBy;
+        if (sort === 'priority') {
+            orderBy = `priority ${order}, created_at ${order}`;
+        }
+        else if (sort === 'updated') {
+            orderBy = `COALESCE(updated_at, created_at) ${order}`;
+        }
+        else {
+            orderBy = `created_at ${order}`;
+        }
+        let sql = `SELECT * FROM tasks WHERE ${clauses.join(' AND ')} ORDER BY ${orderBy}`;
+        const rawLimit = Number(filters.limit);
+        const limit = Number.isFinite(rawLimit) ? Math.max(0, Math.floor(rawLimit)) : 0;
+        if (limit > 0) {
+            sql += ' LIMIT ?';
+            params.push(limit);
+        }
+        const rows = this.db.prepare(sql).all(...params);
+        return rows.map((row) => {
+            const sanitizedAssignee = this.sanitizeAssignee(row.assignee, normalizedWorkspaceId);
+            const scheduledDate = this.sanitizeDateOnly(row.scheduled_date);
+            const dueDate = this.sanitizeDateOnly(row.due_date);
+            const scheduledWeekKey = row.scheduled_week_key
+                || (scheduledDate ? this.dateOnlyToIsoWeekKey(scheduledDate) : null);
+            const referenceNumber = this.sanitizeTaskReferenceNumber(row.reference_number);
+            const localReferenceNumber = this.sanitizeTaskReferenceNumber(row.local_reference_number);
+            let taxonomies = {};
+            try {
+                taxonomies = JSON.parse(row.taxonomies || '{}');
+            }
+            catch {
+                taxonomies = {};
+            }
+            return {
+                id: String(row.id || '').trim(),
+                referenceNumber,
+                localReferenceNumber,
+                referenceLabel: deriveTaskReferenceLabel({ referenceNumber, localReferenceNumber }),
+                title: row.title,
+                status: this.normalizeStatusValue(row.status),
+                priority: this.normalizePriorityValue(row.priority),
+                complexity: row.complexity,
+                type: row.type,
+                category: row.category,
+                approach: row.approach || undefined,
+                createdAt: row.created_at,
+                updatedAt: row.updated_at,
+                completedAt: row.completed_at,
+                canceledReason: row.canceled_reason,
+                isArchived: row.is_archived === 1,
+                scheduledDate,
+                dueDate,
+                scheduledWeekKey,
+                orderInDay: this.sanitizeOrderInDay(row.order_in_day),
+                workstreamId: this.sanitizeWorkstreamId(row.workstream_id),
+                taxonomies,
+                createdBy: this.normalizeCreatedBy(row.created_by, normalizedWorkspaceId, { preserveGenericAi: true }),
+                assignee: sanitizedAssignee,
+            };
+        });
+    }
     getDataVersion() {
         if (this.db.provider === 'sqlite') {
             const version = this.db.pragma('data_version', { simple: true });
@@ -4050,9 +4297,9 @@ export class TaskforceCore {
         `).get(this.tenantId, userId);
         if (!existingUser) {
             this.db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-            `).run(userId, this.tenantId, email, displayName, 'token', userId, 1, 0, now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run(userId, this.tenantId, email, displayName, 1, 0, now, now);
         }
         const membership = this.db.prepare(`
             SELECT id, role FROM workspace_memberships
@@ -4097,16 +4344,17 @@ export class TaskforceCore {
         `).get(this.tenantId, normalizedUserId, normalizedWorkspaceId);
         if (!membership?.workspace_id)
             return null;
-        const disabled = Boolean(userRow.is_disabled);
+        const accountDisabled = Boolean(userRow.is_disabled);
         const userBetaAccess = userRow.beta_access === undefined || userRow.beta_access === null
             ? true
             : Boolean(userRow.beta_access);
         const isSystemAdmin = this.normalizeSystemRole(userRow.system_role, 'user') === 'system_admin';
         const membershipActive = !membership.status || String(membership.status).toLowerCase() === 'active';
+        const workspaceDisabled = !membershipActive;
         const baseRole = this.normalizeAccessRole(membership.role || fallbackRole, fallbackRole);
         const permissionMode = this.normalizePermissionMode(membership.permission_mode, 'read-write');
         const isMemberReadOnly = baseRole === 'member' && permissionMode === 'read-only';
-        const resolvedRole = (disabled || !membershipActive || isMemberReadOnly)
+        const resolvedRole = (accountDisabled || workspaceDisabled || isMemberReadOnly)
             ? 'read-only'
             : baseRole;
         return {
@@ -4114,7 +4362,9 @@ export class TaskforceCore {
             workspaceId: String(membership.workspace_id || normalizedWorkspaceId),
             role: resolvedRole,
             permissionMode,
-            disabled,
+            disabled: accountDisabled || workspaceDisabled,
+            accountDisabled,
+            workspaceDisabled,
             betaAccess: userBetaAccess || isSystemAdmin
         };
     }
@@ -4333,7 +4583,68 @@ export class TaskforceCore {
     hasAnySystemAdmin() {
         return this.countSystemAdmins() > 0;
     }
-    listSystemUsers() {
+    countSystemUsers(input) {
+        const query = String(input?.query || '').trim().toLowerCase();
+        const queryPattern = query ? `%${query}%` : '';
+        const searchClause = query
+            ? `
+              AND (
+                LOWER(COALESCE(u.display_name, '')) LIKE ?
+                OR LOWER(COALESCE(u.id, '')) LIKE ?
+                OR LOWER(COALESCE(u.email, '')) LIKE ?
+                OR LOWER(COALESCE(COALESCE(p.display_name, v.plan_id), '')) LIKE ?
+                OR LOWER(COALESCE(v.plan_id, '')) LIKE ?
+                OR LOWER(COALESCE(e.entitlement_state, '')) LIKE ?
+                OR LOWER(COALESCE(u.system_role, 'user')) LIKE ?
+              )`
+            : '';
+        const params = [this.tenantId];
+        if (query) {
+            params.push(queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern);
+        }
+        const row = this.db.prepare(`
+            SELECT COUNT(*) AS count
+            FROM users u
+            LEFT JOIN account_entitlements e
+              ON e.tenant_id = u.tenant_id
+             AND e.account_id = u.id
+            LEFT JOIN plan_versions v
+              ON v.tenant_id = u.tenant_id
+             AND v.plan_version_id = e.plan_version_id
+            LEFT JOIN plan_catalog p
+              ON p.tenant_id = u.tenant_id
+             AND p.plan_id = v.plan_id
+            WHERE u.tenant_id = ?
+              ${searchClause}
+        `).get(...params);
+        return Number(row?.count || 0);
+    }
+    listSystemUsers(input) {
+        const query = String(input?.query || '').trim().toLowerCase();
+        const queryPattern = query ? `%${query}%` : '';
+        const sort = input?.sort === 'oldest' ? 'oldest' : 'newest';
+        const limit = Number.isFinite(Number(input?.limit)) ? Math.max(1, Math.min(200, Math.floor(Number(input?.limit)))) : 50;
+        const offset = Number.isFinite(Number(input?.offset)) ? Math.max(0, Math.floor(Number(input?.offset))) : 0;
+        const orderByClause = sort === 'oldest'
+            ? `ORDER BY COALESCE(u.created_at, u.updated_at) ASC, COALESCE(u.updated_at, u.created_at) ASC, u.id ASC`
+            : `ORDER BY COALESCE(u.created_at, u.updated_at) DESC, COALESCE(u.updated_at, u.created_at) DESC, u.id DESC`;
+        const searchClause = query
+            ? `
+              AND (
+                LOWER(COALESCE(u.display_name, '')) LIKE ?
+                OR LOWER(COALESCE(u.id, '')) LIKE ?
+                OR LOWER(COALESCE(u.email, '')) LIKE ?
+                OR LOWER(COALESCE(COALESCE(p.display_name, v.plan_id), '')) LIKE ?
+                OR LOWER(COALESCE(v.plan_id, '')) LIKE ?
+                OR LOWER(COALESCE(e.entitlement_state, '')) LIKE ?
+                OR LOWER(COALESCE(u.system_role, 'user')) LIKE ?
+              )`
+            : '';
+        const params = [this.tenantId];
+        if (query) {
+            params.push(queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern);
+        }
+        params.push(limit, offset);
         const rows = this.db.prepare(`
             SELECT
                 u.id AS user_id,
@@ -4360,8 +4671,10 @@ export class TaskforceCore {
               ON p.tenant_id = u.tenant_id
              AND p.plan_id = v.plan_id
             WHERE u.tenant_id = ?
-            ORDER BY COALESCE(u.updated_at, u.created_at) DESC, u.created_at DESC
-        `).all(this.tenantId);
+              ${searchClause}
+            ${orderByClause}
+            LIMIT ? OFFSET ?
+        `).all(...params);
         return rows
             .filter((row) => row.user_id && row.email)
             .map((row) => ({
@@ -4653,6 +4966,7 @@ export class TaskforceCore {
                 u.id AS user_id,
                 u.email AS email,
                 u.display_name AS display_name,
+                u.avatar_url AS avatar_url,
                 u.is_disabled AS is_disabled,
                 u.created_at AS created_at,
                 u.updated_at AS updated_at,
@@ -4669,19 +4983,23 @@ export class TaskforceCore {
               AND m.workspace_id = ?
             ORDER BY COALESCE(m.updated_at, m.created_at) DESC, u.created_at DESC
         `).all(this.tenantId, normalizedWorkspaceId);
-        return rows.map((row) => ({
-            userId: row.user_id,
-            email: row.email,
-            displayName: row.display_name || null,
-            role: this.normalizeAccessRole(row.role || 'member', 'member'),
-            permissionMode: this.normalizePermissionMode(row.permission_mode, 'read-write'),
-            betaAccess: row.beta_access === undefined || row.beta_access === null ? true : Boolean(row.beta_access),
-            status: String(row.status || 'active'),
-            disabled: Boolean(row.is_disabled),
-            createdAt: row.created_at || null,
-            updatedAt: row.updated_at || null,
-            emailVerifiedAt: row.email_verified_at || null
-        }));
+        return rows.map((row) => {
+            const status = String(row.status || 'active');
+            return {
+                userId: row.user_id,
+                email: row.email,
+                displayName: row.display_name || null,
+                avatarUrl: row.avatar_url || null,
+                role: this.normalizeAccessRole(row.role || 'member', 'member'),
+                permissionMode: this.normalizePermissionMode(row.permission_mode, 'read-write'),
+                betaAccess: row.beta_access === undefined || row.beta_access === null ? true : Boolean(row.beta_access),
+                status,
+                disabled: Boolean(row.is_disabled) || status.toLowerCase() === 'disabled',
+                createdAt: row.created_at || null,
+                updatedAt: row.updated_at || null,
+                emailVerifiedAt: row.email_verified_at || null
+            };
+        });
     }
     replaceWorkspaceUsersForSync(input) {
         const workspaceId = String(input.workspaceId || 'default').trim() || 'default';
@@ -4725,9 +5043,9 @@ export class TaskforceCore {
                 }
                 else {
                     this.db.prepare(`
-                        INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at, email_verified_at)
-                        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-                    `).run(userId, this.tenantId, email, displayName, 'sync', userId, betaAccess ? 1 : 0, disabled ? 1 : 0, createdAt, updatedAt, emailVerifiedAt);
+                        INSERT INTO users (id, tenant_id, email, display_name, beta_access, is_disabled, created_at, updated_at, email_verified_at)
+                        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+                    `).run(userId, this.tenantId, email, displayName, betaAccess ? 1 : 0, disabled ? 1 : 0, createdAt, updatedAt, emailVerifiedAt);
                 }
                 const membership = this.db.prepare(`
                     SELECT id
@@ -4770,8 +5088,8 @@ export class TaskforceCore {
         tx();
         return this.listWorkspaceUsers(workspaceId);
     }
-    listAiProfiles(workspaceId) {
-        return listAiProfilesService(this.getAiProfileServiceDeps(), workspaceId);
+    listAiProfiles(workspaceId, options) {
+        return listAiProfilesService(this.getAiProfileServiceDeps(), workspaceId, options);
     }
     getAiProfileByToken(input) {
         return getAiProfileByTokenService(this.getAiProfileServiceDeps(), input);
@@ -4782,8 +5100,14 @@ export class TaskforceCore {
     mergeAiProfiles(input) {
         return mergeAiProfilesService(this.getAiProfileServiceDeps(), input);
     }
-    resolveAiProfile(input) {
-        return resolveAiProfileService(this.getAiProfileServiceDeps(), input);
+    archiveAiProfile(input) {
+        return archiveAiProfileService(this.getAiProfileServiceDeps(), input).profile;
+    }
+    updateAiProfileAvatar(input) {
+        return updateAiProfileAvatarService(this.getAiProfileServiceDeps(), input);
+    }
+    resolveAiProfile(input, options) {
+        return resolveAiProfileService(this.getAiProfileServiceDeps(), input, options);
     }
     listAnnotatedAttachmentSessions(input) {
         return listAnnotatedAttachmentSessionsService(this.getAnnotatedAttachmentServiceDeps(), input);
@@ -4813,17 +5137,30 @@ export class TaskforceCore {
         const activeSessions = deps.sessionStore.listByWorkspace('default', { includeDeleted: false });
         if (activeSessions.length === 0)
             return;
-        const hasActiveImageLink = this.db.prepare(`
-            SELECT 1
-            FROM workspace_asset_links
-            WHERE tenant_id = ?
-              AND workspace_id = ?
-              AND task_id = ?
-              AND asset_id = ?
-              AND role = 'image'
-              AND deleted_at IS NULL
-            LIMIT 1
-        `);
+        const hasActiveImageLink = this.supportsWorkspaceAssetLinkTargetType()
+            ? this.db.prepare(`
+                SELECT 1
+                FROM workspace_asset_links
+                WHERE tenant_id = ?
+                  AND workspace_id = ?
+                  AND target_type = 'task'
+                  AND task_id = ?
+                  AND asset_id = ?
+                  AND role = 'image'
+                  AND deleted_at IS NULL
+                LIMIT 1
+            `)
+            : this.db.prepare(`
+                SELECT 1
+                FROM workspace_asset_links
+                WHERE tenant_id = ?
+                  AND workspace_id = ?
+                  AND task_id = ?
+                  AND asset_id = ?
+                  AND role = 'image'
+                  AND deleted_at IS NULL
+                LIMIT 1
+            `);
         for (const session of activeSessions) {
             const taskId = String(session.taskId || '').trim();
             const imageAssetId = String(session.baseImageAssetId || '').trim();
@@ -4982,6 +5319,7 @@ export class TaskforceCore {
             FROM ai_profiles
             WHERE tenant_id = ?
               AND workspace_id = ?
+              AND archived_at IS NULL
               AND (
                   LOWER(name) = LOWER(?)
                   OR LOWER(username) = LOWER(?)
@@ -4992,6 +5330,22 @@ export class TaskforceCore {
         if (aiProfileByName) {
             return this.aiProfileToActor(this.aiProfileRowToRecord(aiProfileByName));
         }
+        const archivedAiProfileByName = this.db.prepare(`
+            SELECT *
+            FROM ai_profiles
+            WHERE tenant_id = ?
+              AND workspace_id = ?
+              AND archived_at IS NOT NULL
+              AND (
+                  LOWER(name) = LOWER(?)
+                  OR LOWER(username) = LOWER(?)
+              )
+            ORDER BY COALESCE(last_active_at, updated_at, created_at) DESC, id ASC
+            LIMIT 1
+        `).get(this.tenantId, normalizedWorkspaceId, raw, raw);
+        if (archivedAiProfileByName) {
+            return this.aiProfileToActor(this.aiProfileRowToRecord(archivedAiProfileByName));
+        }
         const workspaceUser = this.listWorkspaceUsers(normalizedWorkspaceId).find((user) => user.userId === raw);
         if (workspaceUser) {
             return this.workspaceUserToActor(workspaceUser);
@@ -5235,6 +5589,9 @@ export class TaskforceCore {
     listPlanFeatureCatalog() {
         return this.planEntitlementService.listPlanFeatureCatalog();
     }
+    updatePlanFeatureCatalogMarketingCopy(input) {
+        return this.planEntitlementService.updatePlanFeatureCatalogMarketingCopy(input);
+    }
     listPlanVersions(planId) {
         return this.planEntitlementService.listPlanVersions(planId);
     }
@@ -5354,11 +5711,6 @@ export class TaskforceCore {
                 }
             }
             const now = new Date().toISOString();
-            this.db.prepare(`
-                UPDATE users
-                SET is_disabled = ?, updated_at = ?
-                WHERE tenant_id = ? AND id = ?
-            `).run(disabled ? 1 : 0, now, this.tenantId, normalizedUserId);
             if (membership?.id) {
                 this.db.prepare(`
                     UPDATE workspace_memberships
@@ -5532,9 +5884,7 @@ export class TaskforceCore {
         if (!email || !email.includes('@')) {
             throw new TaskforceRuleError('Valid email is required', 400, 'EMAIL_REQUIRED');
         }
-        if (!password || password.length < 8) {
-            throw new TaskforceRuleError('Password must be at least 8 characters', 400, 'PASSWORD_TOO_SHORT');
-        }
+        assertPasswordPolicy(password, { email, displayName: input.displayName || null });
         if (!workspaceId || workspaceId.toLowerCase() === 'default') {
             throw new TaskforceRuleError('A non-default workspaceId is required', 400, 'WORKSPACE_ID_REQUIRED');
         }
@@ -5551,20 +5901,16 @@ export class TaskforceCore {
             email,
             displayName
         });
-        if (emailVerified) {
-            this.db.prepare(`
-                UPDATE users
-                SET password_hash = ?, auth_provider = ?, external_auth_id = ?, email_verified_at = ?, beta_access = ?, is_disabled = 0, updated_at = ?
-                WHERE tenant_id = ? AND id = ?
-            `).run(hashPassword(password), 'password', email, now, betaAccess ? 1 : 0, now, this.tenantId, userId);
-        }
-        else {
-            this.db.prepare(`
-                UPDATE users
-                SET password_hash = ?, auth_provider = ?, external_auth_id = ?, beta_access = ?, is_disabled = 0, updated_at = ?
-                WHERE tenant_id = ? AND id = ?
-            `).run(hashPassword(password), 'password', email, betaAccess ? 1 : 0, now, this.tenantId, userId);
-        }
+        this.db.prepare(`
+            UPDATE users
+            SET
+                email_verified_at = CASE WHEN ? = 1 THEN COALESCE(email_verified_at, ?) ELSE email_verified_at END,
+                beta_access = ?,
+                is_disabled = 0,
+                updated_at = ?
+            WHERE tenant_id = ? AND id = ?
+        `).run(emailVerified ? 1 : 0, now, betaAccess ? 1 : 0, now, this.tenantId, userId);
+        this.identityService.setPasswordIdentity(userId, password);
         this.updateWorkspaceUserRole(userId, workspaceId, role);
         this.setWorkspaceUserDisabled(userId, workspaceId, false);
         return { userId, workspaceId, role };
@@ -5575,9 +5921,7 @@ export class TaskforceCore {
         if (!email || !email.includes('@')) {
             throw new TaskforceRuleError('Valid email is required', 400, 'EMAIL_REQUIRED');
         }
-        if (!password || password.length < 8) {
-            throw new TaskforceRuleError('Password must be at least 8 characters', 400, 'PASSWORD_TOO_SHORT');
-        }
+        assertPasswordPolicy(password, { email, displayName: input.displayName || null });
         const existing = this.db.prepare(`
             SELECT id FROM users WHERE tenant_id = ? AND email = ? LIMIT 1
         `).get(this.tenantId, email);
@@ -5606,9 +5950,10 @@ export class TaskforceCore {
             const userId = this.generateEntityId('user');
             const displayName = String(input.displayName || email.split('@')[0] || email).trim() || email;
             this.db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, password_hash, system_role, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?)
-            `).run(userId, this.tenantId, email, displayName, 'password', email, hashPassword(password), assignFirstSystemAdmin ? 'system_admin' : 'user', betaAccess ? 1 : 0, now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, system_role, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
+            `).run(userId, this.tenantId, email, displayName, assignFirstSystemAdmin ? 'system_admin' : 'user', betaAccess ? 1 : 0, now, now);
+            this.identityService.createPasswordIdentity(userId, password);
             applyRegistrationCommercialState(userId, now);
             return {
                 userId,
@@ -5642,6 +5987,151 @@ export class TaskforceCore {
             commercialState: onboardingOutcome.commercialState
         };
     }
+    // ─── OAuth state management (delegated to AuthIdentityService) ────────────
+    /**
+     * Creates an OAuth state record and returns the state token + PKCE materials.
+     * Delegates to AuthIdentityService.createOAuthState.
+     */
+    createOAuthLoginState(input) {
+        return this.identityService.createOAuthState(input);
+    }
+    /**
+     * Atomically consumes an OAuth state token and returns the row.
+     * Returns null if invalid, expired, or already consumed.
+     */
+    consumeOAuthLoginState(state) {
+        return this.identityService.consumeOAuthState(state);
+    }
+    // ─── OAuth identity operations ─────────────────────────────────────────────
+    /**
+     * Finds the Taskforce user associated with a provider identity.
+     * Returns { userId, identityId } or null if not yet linked.
+     */
+    findUserByOAuthProvider(provider, providerSubject) {
+        return this.identityService.findUserByProviderIdentity({ provider, providerSubject });
+    }
+    /**
+     * Links an OAuth provider identity to an existing user.
+     * Throws IDENTITY_ALREADY_EXISTS if the user already has an identity for this provider.
+     */
+    linkOAuthProviderToUser(input) {
+        return this.identityService.linkProviderIdentity(input);
+    }
+    /**
+     * Lists all active login identities for a user.
+     * Used by the Account Hub "Login methods" section.
+     */
+    listLoginMethodsForUser(userId) {
+        return this.identityService.listIdentitiesForUser(userId);
+    }
+    /**
+     * Unlinks a provider identity from a user.
+     * Throws LAST_IDENTITY_REQUIRED if it would be the last active method.
+     */
+    unlinkLoginMethod(userId, provider) {
+        return this.identityService.unlinkProviderIdentity({ userId, provider });
+    }
+    /**
+     * Adds or replaces a password identity for a user that signed up via OAuth.
+     * Uses upsert semantics (safe to call on accounts that already have a password).
+     */
+    addPasswordToAccount(userId, password) {
+        const user = this.db.prepare(`
+            SELECT email, display_name
+            FROM users
+            WHERE tenant_id = ? AND id = ?
+            LIMIT 1
+        `).get(this.tenantId, String(userId || '').trim());
+        assertPasswordPolicy(password, {
+            email: user?.email || null,
+            displayName: user?.display_name || null
+        });
+        return this.identityService.setPasswordIdentity(userId, password);
+    }
+    /**
+     * Registers a new user account via an OAuth provider (no password).
+     *
+     * Creates the user row, applies commercial onboarding, and links the
+     * provider identity — all in a single transaction.
+     *
+     * Returns the same shape as `registerPasswordUser` so callers can use
+     * the same session-issuance path.
+     */
+    registerOAuthUser(input) {
+        const email = input.email ? String(input.email).trim().toLowerCase() : null;
+        if (email && !email.includes('@')) {
+            throw new TaskforceRuleError('Valid email is required', 400, 'EMAIL_REQUIRED');
+        }
+        // Duplicate guard — email uniqueness (if email is provided)
+        if (email) {
+            const existing = this.db.prepare(`
+                SELECT id FROM users WHERE tenant_id = ? AND email = ? LIMIT 1
+            `).get(this.tenantId, email);
+            if (existing?.id) {
+                throw new TaskforceRuleError('Email is already registered', 409, 'EMAIL_ALREADY_EXISTS');
+            }
+        }
+        const assignFirstSystemAdmin = !this.hasAnySystemAdmin();
+        const betaAccess = input.betaAccess !== false;
+        const onboardingOutcome = this.resolveRegistrationOnboardingOutcome(input.planVersionId);
+        const now = new Date().toISOString();
+        const userId = this.generateEntityId('user');
+        const displayName = String(input.displayName || (email ? email.split('@')[0] : '') || '').trim()
+            || (email || userId);
+        this.db.prepare(`
+            INSERT INTO users
+                (id, tenant_id, email, email_verified_at, display_name, system_role,
+                 beta_access, is_disabled, created_at, updated_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ?)
+        `).run(userId, this.tenantId, email, 
+        // OAuth providers that attest email_verified give us a verified email up-front
+        (email && input.emailVerified) ? now : null, displayName, assignFirstSystemAdmin ? 'system_admin' : 'user', betaAccess ? 1 : 0, now, now);
+        const identityId = this.identityService.linkProviderIdentity({
+            userId,
+            provider: input.provider,
+            providerSubject: input.providerSubject,
+            providerEmail: email,
+            providerEmailVerified: input.emailVerified ?? null,
+            displayNameSnapshot: input.displayName ?? null,
+            avatarUrlSnapshot: input.avatarUrl ?? null,
+        });
+        this.transitionCanonicalCommercialState({
+            accountId: userId,
+            planVersionId: onboardingOutcome.planVersionId,
+            state: onboardingOutcome.commercialState,
+            billingMirrorPlanId: onboardingOutcome.planId,
+            source: 'registration',
+            updatedBy: 'registration',
+            createdAt: now,
+            updatedAt: now
+        });
+        return {
+            userId,
+            workspaceId: null,
+            role: 'member',
+            identityId,
+            planSelectionRequired: onboardingOutcome.requiresPlanSelection,
+            checkoutPending: onboardingOutcome.checkoutPending,
+            commercialState: onboardingOutcome.commercialState,
+        };
+    }
+    /**
+     * Looks up a user by email address (exact, case-insensitive).
+     * Returns { userId, email } or null.
+     */
+    findUserByEmail(email) {
+        const normalized = String(email || '').trim().toLowerCase();
+        if (!normalized)
+            return null;
+        const row = this.db.prepare(`
+            SELECT id, email FROM users
+            WHERE tenant_id = ? AND email = ? AND COALESCE(is_disabled, 0) = 0
+            LIMIT 1
+        `).get(this.tenantId, normalized);
+        if (!row?.id)
+            return null;
+        return { userId: row.id, email: row.email || normalized };
+    }
     createOneTimeAuthToken(userId, purpose, ttlSeconds, workspaceId) {
         return this.authTokenService.createOneTimeAuthToken(userId, purpose, ttlSeconds, workspaceId);
     }
@@ -5744,19 +6234,23 @@ export class TaskforceCore {
         if (!inspection.userId)
             return inspection;
         const user = this.db.prepare(`
-            SELECT email, password_hash
-            FROM users
-            WHERE tenant_id = ? AND id = ? LIMIT 1
+            SELECT email FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
         `).get(this.tenantId, inspection.userId);
         const workspaceId = String(inspection.workspaceId || '').trim();
-        const hasPassword = Boolean(String(user?.password_hash || '').trim());
+        const hasIdentity = this.identityService.hasAnyActiveIdentity(inspection.userId);
+        const inviteeState = hasIdentity ? 'existing_account' : 'pending_setup';
+        const identities = this.identityService.listIdentitiesForUser(inspection.userId);
+        const availableMethods = identities.map(i => i.provider);
         return {
             state: inspection.state,
             email: user?.email,
             userId: inspection.userId,
             workspaceId: workspaceId || 'default',
-            inviteeKind: hasPassword ? 'existing_user' : 'new_user',
-            passwordRequired: !hasPassword
+            inviteeState,
+            availableMethods,
+            // Backward-compatible fields
+            inviteeKind: hasIdentity ? 'existing_user' : 'new_user',
+            passwordRequired: !hasIdentity
         };
     }
     completeInviteWorkspaceActivation(input) {
@@ -5813,14 +6307,20 @@ export class TaskforceCore {
             role: this.normalizeAccessRole(membership?.role || 'member', 'member')
         };
     }
-    acceptInviteWithToken(input) {
+    /**
+     * Claims an invite by linking an OAuth provider identity to the invited user.
+     *
+     * Used when an invited user with `inviteeState: 'pending_setup'` completes an
+     * OAuth flow with `flow_mode: 'invite_claim'`.  The invite token must still be
+     * valid and the user must have zero active identities (pending setup).
+     *
+     * Returns the same shape as `acceptInviteWithToken` so callers can issue a
+     * session cookie on the same path.
+     */
+    claimInviteWithOAuthProvider(input) {
         const token = String(input.token || '').trim();
-        const password = String(input.password || '');
-        if (!token || !password) {
-            throw new TaskforceRuleError('Token and password are required', 400, 'TOKEN_PASSWORD_REQUIRED');
-        }
-        if (password.length < 8) {
-            throw new TaskforceRuleError('Password must be at least 8 characters', 400, 'PASSWORD_TOO_SHORT');
+        if (!token) {
+            throw new TaskforceRuleError('Invite token is required', 400, 'TOKEN_REQUIRED');
         }
         const consumed = this.consumeOneTimeAuthToken(token, 'invite_accept');
         if (!consumed?.userId) {
@@ -5841,38 +6341,111 @@ export class TaskforceCore {
             throw new TaskforceRuleError('Invite token is missing workspace context', 400, 'INVITE_WORKSPACE_REQUIRED');
         }
         const user = this.db.prepare(`
-            SELECT id, email, password_hash
+            SELECT id, email FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+        `).get(this.tenantId, consumed.userId);
+        if (!user?.id || !user.email) {
+            throw new TaskforceRuleError('User not found', 404, 'USER_NOT_FOUND');
+        }
+        if (this.identityService.hasAnyActiveIdentity(consumed.userId)) {
+            throw new TaskforceRuleError('Existing users must sign in before joining this workspace', 409, 'INVITE_SIGN_IN_REQUIRED');
+        }
+        const now = new Date().toISOString();
+        const identityId = this.identityService.linkProviderIdentity({
+            userId: consumed.userId,
+            provider: input.provider,
+            providerSubject: input.providerSubject,
+            providerEmail: input.providerEmail ?? null,
+            providerEmailVerified: input.providerEmailVerified ?? null,
+            displayNameSnapshot: input.displayNameSnapshot ?? null,
+            avatarUrlSnapshot: input.avatarUrlSnapshot ?? null,
+        });
+        // Mark email verified if the provider attested it
+        if (input.providerEmailVerified) {
+            this.db.prepare(`
+                UPDATE users
+                SET email_verified_at = COALESCE(email_verified_at, ?), is_disabled = 0, updated_at = ?
+                WHERE tenant_id = ? AND id = ?
+            `).run(now, now, this.tenantId, consumed.userId);
+        }
+        else {
+            this.db.prepare(`
+                UPDATE users SET is_disabled = 0, updated_at = ? WHERE tenant_id = ? AND id = ?
+            `).run(now, this.tenantId, consumed.userId);
+        }
+        this.ensureDefaultOnboardingEntitlement(consumed.userId, {
+            source: 'invite-accept',
+            updatedBy: 'invite-accept',
+            now
+        });
+        const activation = this.completeInviteWorkspaceActivation({
+            userId: consumed.userId,
+            workspaceId: inviteWorkspaceId
+        });
+        return { ...activation, identityId };
+    }
+    acceptInviteWithToken(input) {
+        const token = String(input.token || '').trim();
+        const password = String(input.password || '');
+        if (!token || !password) {
+            throw new TaskforceRuleError('Token and password are required', 400, 'TOKEN_PASSWORD_REQUIRED');
+        }
+        const inspected = this.inspectOneTimeAuthToken(token, 'invite_accept');
+        if (inspected.state !== 'valid' || !inspected.userId) {
+            if (inspected.state === 'expired') {
+                throw new TaskforceRuleError('Invite token expired', 400, 'INVITE_TOKEN_EXPIRED');
+            }
+            if (inspected.state === 'revoked') {
+                throw new TaskforceRuleError('Invite token revoked', 400, 'INVITE_TOKEN_REVOKED');
+            }
+            if (inspected.state === 'used') {
+                throw new TaskforceRuleError('Invite token already used', 400, 'INVITE_TOKEN_USED');
+            }
+            throw new TaskforceRuleError('Invalid invite token', 400, 'INVITE_TOKEN_INVALID');
+        }
+        const inviteWorkspaceId = String(inspected.workspaceId || '').trim();
+        if (!inviteWorkspaceId) {
+            throw new TaskforceRuleError('Invite token is missing workspace context', 400, 'INVITE_WORKSPACE_REQUIRED');
+        }
+        const user = this.db.prepare(`
+            SELECT id, email, display_name
             FROM users
             WHERE tenant_id = ? AND id = ?
             LIMIT 1
-        `).get(this.tenantId, consumed.userId);
+        `).get(this.tenantId, inspected.userId);
         if (!user?.id || !user.email) {
             throw new TaskforceRuleError('User not found', 404, 'USER_NOT_FOUND');
         }
-        if (String(user.password_hash || '').trim()) {
+        assertPasswordPolicy(password, {
+            email: user.email,
+            displayName: user.display_name || null
+        });
+        if (this.identityService.hasAnyActiveIdentity(inspected.userId)) {
             throw new TaskforceRuleError('Existing users must sign in before joining this workspace', 409, 'INVITE_SIGN_IN_REQUIRED');
         }
+        const consumed = this.consumeOneTimeAuthToken(token, 'invite_accept');
+        if (!consumed?.userId) {
+            throw new TaskforceRuleError('Invalid invite token', 400, 'INVITE_TOKEN_INVALID');
+        }
         const now = new Date().toISOString();
+        const identityId = this.identityService.setPasswordIdentity(consumed.userId, password);
         this.db.prepare(`
             UPDATE users
-            SET
-                password_hash = ?,
-                auth_provider = ?,
-                external_auth_id = ?,
-                email_verified_at = COALESCE(email_verified_at, ?),
-                is_disabled = 0,
-                updated_at = ?
+            SET email_verified_at = COALESCE(email_verified_at, ?), is_disabled = 0, updated_at = ?
             WHERE tenant_id = ? AND id = ?
-        `).run(hashPassword(password), 'password', user.email, now, now, this.tenantId, consumed.userId);
+        `).run(now, now, this.tenantId, consumed.userId);
         this.ensureDefaultOnboardingEntitlement(consumed.userId, {
             source: 'invite-accept',
             updatedBy: 'invite-accept',
             now
         });
-        return this.completeInviteWorkspaceActivation({
+        const activation = this.completeInviteWorkspaceActivation({
             userId: consumed.userId,
             workspaceId: inviteWorkspaceId
         });
+        return {
+            ...activation,
+            identityId
+        };
     }
     joinInviteWithAuthenticatedUser(input) {
         const token = String(input.token || '').trim();
@@ -5896,7 +6469,7 @@ export class TaskforceCore {
             }
             throw new TaskforceRuleError('Invalid invite token', 400, 'INVITE_TOKEN_INVALID');
         }
-        if (details.inviteeKind !== 'existing_user') {
+        if (details.inviteeState !== 'existing_account') {
             throw new TaskforceRuleError('This invite requires account setup before joining', 409, 'INVITE_PASSWORD_SETUP_REQUIRED');
         }
         if (details.userId !== authenticatedUserId) {
@@ -5930,32 +6503,31 @@ export class TaskforceCore {
         const workspaceId = String(input.workspaceId || 'default').trim() || 'default';
         if (!email || !password)
             return { ok: false, code: 'INVALID_CREDENTIALS' };
-        const row = this.db.prepare(`
-            SELECT id, password_hash, email_verified_at
-            FROM users
-            WHERE tenant_id = ? AND email = ?
-            LIMIT 1
-        `).get(this.tenantId, email);
-        if (!row?.id || !row.password_hash)
-            return { ok: false, code: 'INVALID_CREDENTIALS' };
-        if (!verifyPassword(password, row.password_hash))
+        const authResult = this.identityService.authenticatePasswordIdentity(email, password);
+        if (!authResult)
             return { ok: false, code: 'INVALID_CREDENTIALS' };
-        if (input.requireVerifiedEmail && !row.email_verified_at) {
-            return { ok: false, code: 'EMAIL_NOT_VERIFIED' };
+        if (input.requireVerifiedEmail) {
+            const userRow = this.db.prepare(`
+                SELECT email_verified_at FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+            `).get(this.tenantId, authResult.userId);
+            if (!userRow?.email_verified_at) {
+                return { ok: false, code: 'EMAIL_NOT_VERIFIED' };
+            }
         }
-        const resolvedWorkspaceId = this.resolvePreferredUserWorkspaceId(row.id, {
+        const resolvedWorkspaceId = this.resolvePreferredUserWorkspaceId(authResult.userId, {
             preferredWorkspaceId: workspaceId
         }) || workspaceId;
-        const access = this.resolveUserAccess(row.id, resolvedWorkspaceId, input.fallbackRole || 'member');
+        const access = this.resolveUserAccess(authResult.userId, resolvedWorkspaceId, input.fallbackRole || 'member');
         if (!access) {
             // Allow authenticated users without workspace memberships.
             // Provisioning flow will create/switch to a workspace after login.
             return {
                 ok: true,
                 access: {
-                    userId: row.id,
+                    userId: authResult.userId,
                     workspaceId: 'default',
-                    role: this.normalizeAccessRole(input.fallbackRole || 'member', 'member')
+                    role: this.normalizeAccessRole(input.fallbackRole || 'member', 'member'),
+                    identityId: authResult.identityId
                 }
             };
         }
@@ -5964,7 +6536,8 @@ export class TaskforceCore {
             access: {
                 userId: access.userId,
                 workspaceId: access.workspaceId,
-                role: access.role
+                role: access.role,
+                identityId: authResult.identityId
             }
         };
     }