@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/core/AuthTokenService.test.js

@@ -13,7 +13,7 @@ function makeCore() {
         billing: {
             onboardingPolicy: {
                 mode: 'require_plan_selection',
-                planVersionId: null
+                planId: null
             }
         }
     });
@@ -32,7 +32,7 @@ describe('Auth token lifecycle', () => {
         try {
             core.registerPasswordUser({
                 email: 'verify@example.com',
-                password: 'password123',
+                password: 'ValidPassphrase123!',
                 displayName: 'Verify User',
                 betaAccess: true
             });
@@ -56,7 +56,7 @@ describe('Auth token lifecycle', () => {
         try {
             core.registerPasswordUser({
                 email: 'reset@example.com',
-                password: 'password123',
+                password: 'ValidPassphrase123!',
                 displayName: 'Reset User',
                 betaAccess: true
             });

package/dist/core/EntitlementsPolicy.test.js

@@ -38,7 +38,7 @@ function openCore(projectRoot) {
         features: [
             { featureKey: 'collaboration.invites', access: 'enabled' },
             { featureKey: 'collaboration.team_management', access: 'enabled' },
-            { featureKey: 'workspace.switching', access: 'enabled' }
+            { featureKey: 'workspace.workspaces', access: 'enabled' }
         ]
     });
     return core;
@@ -187,7 +187,7 @@ describe('Taskforce entitlements policy engine', () => {
             core.updatePlanVersionFeatures({
                 planVersionId: 'free-v1',
                 features: [
-                    { featureKey: 'workspace.switching', access: 'limited', config: { maxWorkspaces: 1 } }
+                    { featureKey: 'workspace.workspaces', access: 'limited', config: { maxWorkspaces: 1 } }
                 ]
             });
             core.createWorkspace({ workspaceId: 'workspace-one', name: 'Workspace One' });

package/dist/core/GlobalSettingsService.js

@@ -17,6 +17,12 @@ function splitGlobalSettingsPayload(settings) {
     if (settings.setup && typeof settings.setup === 'object') {
         system.setup = { ...settings.setup };
     }
+    if (settings.objectStorage && typeof settings.objectStorage === 'object') {
+        system.objectStorage = { ...settings.objectStorage };
+    }
+    if (settings.oauthProviders && typeof settings.oauthProviders === 'object') {
+        system.oauthProviders = { ...settings.oauthProviders };
+    }
     const normalizedTheme = normalizeTaskforceTheme(settings.theme);
     if (normalizedTheme) {
         userPreferences.theme = normalizedTheme;
@@ -107,8 +113,8 @@ export function getGlobalSettingsService(deps) {
             || global.billing.onboardingPolicy.mode === 'auto_start_trial')
         ? {
             mode: global.billing.onboardingPolicy.mode,
-            planVersionId: typeof global.billing.onboardingPolicy.planVersionId === 'string'
-                ? (global.billing.onboardingPolicy.planVersionId.trim() || null)
+            planId: typeof global.billing.onboardingPolicy.planId === 'string'
+                ? (global.billing.onboardingPolicy.planId.trim() || null)
                 : null
         }
         : null;
@@ -188,6 +194,12 @@ export function getGlobalSettingsService(deps) {
                         : {}),
                     ...(typeof global.site.pricingPageEnabled === 'boolean'
                         ? { pricingPageEnabled: global.site.pricingPageEnabled }
+                        : {}),
+                    ...(typeof global.site.animatedBackgroundEnabled === 'boolean'
+                        ? { animatedBackgroundEnabled: global.site.animatedBackgroundEnabled }
+                        : {}),
+                    ...(global.site.siteTheme === 'light' || global.site.siteTheme === 'dark'
+                        ? { siteTheme: global.site.siteTheme }
                         : {})
                 }
             }
@@ -231,6 +243,57 @@ export function getGlobalSettingsService(deps) {
                         : {})
                 }
             }
+            : {}),
+        ...(global.oauthProviders && typeof global.oauthProviders === 'object'
+            ? {
+                oauthProviders: {
+                    ...(global.oauthProviders.google && typeof global.oauthProviders.google === 'object'
+                        ? {
+                            google: {
+                                ...(typeof global.oauthProviders.google.enabled === 'boolean' ? { enabled: global.oauthProviders.google.enabled } : {}),
+                                ...(typeof global.oauthProviders.google.clientId === 'string' && global.oauthProviders.google.clientId.trim()
+                                    ? { clientId: global.oauthProviders.google.clientId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.google.clientSecret === 'string' && global.oauthProviders.google.clientSecret.trim()
+                                    ? { clientSecret: global.oauthProviders.google.clientSecret.trim() }
+                                    : {})
+                            }
+                        }
+                        : {}),
+                    ...(global.oauthProviders.github && typeof global.oauthProviders.github === 'object'
+                        ? {
+                            github: {
+                                ...(typeof global.oauthProviders.github.enabled === 'boolean' ? { enabled: global.oauthProviders.github.enabled } : {}),
+                                ...(typeof global.oauthProviders.github.clientId === 'string' && global.oauthProviders.github.clientId.trim()
+                                    ? { clientId: global.oauthProviders.github.clientId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.github.clientSecret === 'string' && global.oauthProviders.github.clientSecret.trim()
+                                    ? { clientSecret: global.oauthProviders.github.clientSecret.trim() }
+                                    : {})
+                            }
+                        }
+                        : {}),
+                    ...(global.oauthProviders.apple && typeof global.oauthProviders.apple === 'object'
+                        ? {
+                            apple: {
+                                ...(typeof global.oauthProviders.apple.enabled === 'boolean' ? { enabled: global.oauthProviders.apple.enabled } : {}),
+                                ...(typeof global.oauthProviders.apple.servicesId === 'string' && global.oauthProviders.apple.servicesId.trim()
+                                    ? { servicesId: global.oauthProviders.apple.servicesId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.apple.teamId === 'string' && global.oauthProviders.apple.teamId.trim()
+                                    ? { teamId: global.oauthProviders.apple.teamId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.apple.keyId === 'string' && global.oauthProviders.apple.keyId.trim()
+                                    ? { keyId: global.oauthProviders.apple.keyId.trim() }
+                                    : {}),
+                                ...(typeof global.oauthProviders.apple.privateKeyPem === 'string' && global.oauthProviders.apple.privateKeyPem.trim()
+                                    ? { privateKeyPem: global.oauthProviders.apple.privateKeyPem.trim() }
+                                    : {})
+                            }
+                        }
+                        : {})
+                }
+            }
             : {})
     };
 }
@@ -350,6 +413,12 @@ export function updateGlobalSettingsService(deps, settings) {
                 : {}),
             ...(typeof incoming.pricingPageEnabled === 'boolean'
                 ? { pricingPageEnabled: incoming.pricingPageEnabled }
+                : {}),
+            ...(typeof incoming.animatedBackgroundEnabled === 'boolean'
+                ? { animatedBackgroundEnabled: incoming.animatedBackgroundEnabled }
+                : {}),
+            ...(incoming.siteTheme === 'light' || incoming.siteTheme === 'dark'
+                ? { siteTheme: incoming.siteTheme }
                 : {})
         };
     }
@@ -362,8 +431,8 @@ export function updateGlobalSettingsService(deps, settings) {
                 || currentBilling.onboardingPolicy.mode === 'auto_start_trial')
             ? {
                 mode: currentBilling.onboardingPolicy.mode,
-                planVersionId: typeof currentBilling.onboardingPolicy.planVersionId === 'string'
-                    ? (currentBilling.onboardingPolicy.planVersionId.trim() || null)
+                planId: typeof currentBilling.onboardingPolicy.planId === 'string'
+                    ? (currentBilling.onboardingPolicy.planId.trim() || null)
                     : null
             }
             : null;
@@ -373,8 +442,8 @@ export function updateGlobalSettingsService(deps, settings) {
                 || incoming.onboardingPolicy.mode === 'auto_start_trial')
             ? {
                 mode: incoming.onboardingPolicy.mode,
-                planVersionId: typeof incoming.onboardingPolicy.planVersionId === 'string'
-                    ? (incoming.onboardingPolicy.planVersionId.trim() || null)
+                planId: typeof incoming.onboardingPolicy.planId === 'string'
+                    ? (incoming.onboardingPolicy.planId.trim() || null)
                     : null
             }
             : null;
@@ -426,5 +495,57 @@ export function updateGlobalSettingsService(deps, settings) {
                 : {})
         };
     }
+    if (settings.oauthProviders && typeof settings.oauthProviders === 'object') {
+        const currentProviders = next.oauthProviders && typeof next.oauthProviders === 'object' ? next.oauthProviders : {};
+        const incoming = settings.oauthProviders;
+        next.oauthProviders = { ...currentProviders };
+        if (incoming.google && typeof incoming.google === 'object') {
+            const cur = currentProviders.google && typeof currentProviders.google === 'object' ? currentProviders.google : {};
+            next.oauthProviders.google = {
+                ...cur,
+                ...(typeof incoming.google.enabled === 'boolean' ? { enabled: incoming.google.enabled } : {}),
+                ...(typeof incoming.google.clientId === 'string' ? { clientId: incoming.google.clientId.trim() } : {}),
+                ...(typeof incoming.google.clientSecret === 'string'
+                    ? (incoming.google.clientSecret.trim()
+                        ? { clientSecret: incoming.google.clientSecret.trim() }
+                        : { clientSecret: undefined })
+                    : {})
+            };
+            if (!next.oauthProviders.google.clientSecret)
+                delete next.oauthProviders.google.clientSecret;
+        }
+        if (incoming.github && typeof incoming.github === 'object') {
+            const cur = currentProviders.github && typeof currentProviders.github === 'object' ? currentProviders.github : {};
+            next.oauthProviders.github = {
+                ...cur,
+                ...(typeof incoming.github.enabled === 'boolean' ? { enabled: incoming.github.enabled } : {}),
+                ...(typeof incoming.github.clientId === 'string' ? { clientId: incoming.github.clientId.trim() } : {}),
+                ...(typeof incoming.github.clientSecret === 'string'
+                    ? (incoming.github.clientSecret.trim()
+                        ? { clientSecret: incoming.github.clientSecret.trim() }
+                        : { clientSecret: undefined })
+                    : {})
+            };
+            if (!next.oauthProviders.github.clientSecret)
+                delete next.oauthProviders.github.clientSecret;
+        }
+        if (incoming.apple && typeof incoming.apple === 'object') {
+            const cur = currentProviders.apple && typeof currentProviders.apple === 'object' ? currentProviders.apple : {};
+            next.oauthProviders.apple = {
+                ...cur,
+                ...(typeof incoming.apple.enabled === 'boolean' ? { enabled: incoming.apple.enabled } : {}),
+                ...(typeof incoming.apple.servicesId === 'string' ? { servicesId: incoming.apple.servicesId.trim() } : {}),
+                ...(typeof incoming.apple.teamId === 'string' ? { teamId: incoming.apple.teamId.trim() } : {}),
+                ...(typeof incoming.apple.keyId === 'string' ? { keyId: incoming.apple.keyId.trim() } : {}),
+                ...(typeof incoming.apple.privateKeyPem === 'string'
+                    ? (incoming.apple.privateKeyPem.trim()
+                        ? { privateKeyPem: incoming.apple.privateKeyPem.trim() }
+                        : { privateKeyPem: undefined })
+                    : {})
+            };
+            if (!next.oauthProviders.apple.privateKeyPem)
+                delete next.oauthProviders.apple.privateKeyPem;
+        }
+    }
     writeGlobalConfigService(deps, next);
 }

package/dist/core/McpTokenService.d.ts

@@ -60,6 +60,11 @@ export declare class McpTokenService {
         workspaceId: string;
         tokenId: string;
     }): McpAccessTokenRecord;
+    deleteMcpAccessToken(input: {
+        actorUserId: string;
+        workspaceId: string;
+        tokenId: string;
+    }): boolean;
     regenerateMcpAccessToken(input: {
         actorUserId: string;
         workspaceId: string;
@@ -111,6 +116,13 @@ export declare class McpTokenService {
         grantId: string;
     }): McpOAuthConnectorGrantRecord;
     authenticateMcpOAuthAccessToken(token: string, workspaceId?: string): McpOAuthAccessTokenAuthResult | null;
+    bindMcpOAuthConnectorGrantAiProfile(input: {
+        grantId: string;
+        workspaceId: string;
+        profileId: string;
+        profileToken: string;
+        profileName: string;
+    }): boolean;
     recordMcpOAuthConnectorGrantUsage(input: {
         grantId: string;
         workspaceId: string;

package/dist/core/McpTokenService.js

@@ -518,6 +518,23 @@ export class McpTokenService {
         }
         return this.rowToMcpAccessTokenRecord(updated);
     }
+    deleteMcpAccessToken(input) {
+        this.getActiveWorkspaceMemberForMcp(input.actorUserId, input.workspaceId);
+        const row = this.getMcpAccessTokenRow(input.tokenId, input.workspaceId);
+        if (!row) {
+            throw new TaskforceRuleError('MCP token not found', 404, 'MCP_TOKEN_NOT_FOUND');
+        }
+        this.assertCanManageOwnMcpAccessToken(input.actorUserId, row);
+        const status = this.resolveMcpAccessTokenStatus(row);
+        if (status === 'active') {
+            throw new TaskforceRuleError('Active MCP tokens must be revoked before deletion', 400, 'MCP_TOKEN_DELETE_ACTIVE');
+        }
+        const result = this.db.prepare(`
+            DELETE FROM mcp_access_tokens
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `).run(this.tenantId, input.workspaceId, row.id);
+        return Number(result.changes || 0) > 0;
+    }
     regenerateMcpAccessToken(input) {
         this.getActiveWorkspaceMemberForMcp(input.actorUserId, input.workspaceId);
         const existing = this.getMcpAccessTokenRow(input.tokenId, input.workspaceId);
@@ -872,7 +889,8 @@ export class McpTokenService {
         if (!parsed)
             return null;
         const row = this.db.prepare(`
-            SELECT id, provider, client_id, user_id, workspace_id, scopes_json, token_hash, status, revoked_at
+            SELECT id, provider, client_id, user_id, workspace_id, scopes_json, token_hash, status, revoked_at,
+                   ai_profile_id, ai_profile_token, ai_profile_name
             FROM mcp_oauth_connector_grants
             WHERE tenant_id = ?
               AND token_prefix = ?
@@ -902,8 +920,33 @@ export class McpTokenService {
             provider: this.normalizeMcpOAuthProvider(row.provider),
             scopes,
             status: this.resolveMcpOAuthGrantStatus(row),
+            aiProfileId: row?.ai_profile_id ? String(row.ai_profile_id) : null,
+            aiProfileToken: row?.ai_profile_token ? String(row.ai_profile_token) : null,
+            aiProfileName: row?.ai_profile_name ? String(row.ai_profile_name) : null,
         };
     }
+    bindMcpOAuthConnectorGrantAiProfile(input) {
+        const grantId = String(input.grantId || '').trim();
+        const workspaceId = String(input.workspaceId || '').trim();
+        const profileId = String(input.profileId || '').trim();
+        const profileToken = String(input.profileToken || '').trim();
+        const profileName = String(input.profileName || '').trim();
+        if (!grantId || !workspaceId || !profileId || !profileToken || !profileName)
+            return false;
+        const now = new Date().toISOString();
+        const result = this.db.prepare(`
+            UPDATE mcp_oauth_connector_grants
+            SET ai_profile_id = ?,
+                ai_profile_token = ?,
+                ai_profile_name = ?,
+                updated_at = ?
+            WHERE tenant_id = ?
+              AND workspace_id = ?
+              AND id = ?
+              AND status = 'active'
+        `).run(profileId, profileToken, profileName, now, this.tenantId, workspaceId, grantId);
+        return Number(result?.changes || 0) > 0;
+    }
     recordMcpOAuthConnectorGrantUsage(input) {
         const grantId = String(input.grantId || '').trim();
         const workspaceId = String(input.workspaceId || '').trim();

package/dist/core/PlanEntitlementService.d.ts

@@ -1,5 +1,5 @@
 import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
-import type { EntitlementState, PlanFeatureAccess, PlanFeatureSnapshot, PlanFeatureCatalogItem, PlanVersionSnapshot, PlanCatalogSnapshot, AccountEntitlementSnapshot, SeatUsageSnapshot, FeatureEvaluationResult, AccountAccessStatus, GlobalTaskforceSettings, OnboardingPolicy, OnboardingPolicyValidationResult } from './types.js';
+import type { EntitlementState, PlanFeatureAccess, PlanFeatureSnapshot, PlanFeatureCatalogItem, PlanVersionSnapshot, PlanCatalogSnapshot, OnboardingPlanOption, AccountEntitlementSnapshot, SeatUsageSnapshot, FeatureEvaluationResult, AccountAccessStatus, GlobalTaskforceSettings, OnboardingPolicy, OnboardingPolicyValidationResult } from './types.js';
 export interface PlanEntitlementServiceDeps {
     getWorkspaceOwnerUserId: (workspaceId: string) => string | null;
     readGlobalConfig: () => GlobalTaskforceSettings;
@@ -17,6 +17,10 @@ export declare class PlanEntitlementService {
     constructor(db: DatabaseAdapter, tenantId: string, deps: PlanEntitlementServiceDeps);
     private generateEntityId;
     private parseJsonObject;
+    private normalizeOptionalCatalogMarketingCopy;
+    private canonicalizePlanFeatureKey;
+    private normalizeOptionalCatalogDisplayOrder;
+    private listPlanFeatureCatalogOverrideMap;
     normalizeEntitlementState(value: unknown): EntitlementState;
     private normalizeFeatureAccess;
     private readPositiveIntegerConfig;
@@ -27,7 +31,7 @@ export declare class PlanEntitlementService {
     private isEntitlementStateAllowed;
     private isIsoTimestampExpired;
     private readAccountEntitlementRow;
-    private normalizeExpiredCheckoutPendingRow;
+    private normalizeExpiredLifecycleRow;
     private isBillingConfirmedTransitionSource;
     private countWorkspaceStorageUsageBytes;
     private resolveCanonicalTransitionSource;
@@ -36,6 +40,7 @@ export declare class PlanEntitlementService {
     private repairPlanDefaultVersionIfNeeded;
     repairPlanCatalogDefaultsIfNeeded(): void;
     normalizeLegacyPlanDataIfNeeded(): void;
+    private renameLegacyWorkspacesFeatureKey;
     private removeLegacyPlanFeatureRows;
     private migrateLegacySeatLimitFeatureConfigToVersionSeatLimit;
     private normalizeLegacyBillingMirrorRows;
@@ -85,6 +90,7 @@ export declare class PlanEntitlementService {
     private getActiveDefaultPlanVersions;
     private getDefaultPlanVersionByMode;
     private tryGetDefaultPlanVersionByMode;
+    private getOnboardingPlanSnapshot;
     getOnboardingPolicy(): OnboardingPolicy;
     validateOnboardingPolicy(input?: Partial<OnboardingPolicy>): OnboardingPolicyValidationResult;
     resolveRegistrationOnboardingOutcome(selectedPlanVersionIdRaw?: string): {
@@ -94,6 +100,7 @@ export declare class PlanEntitlementService {
         planVersionId: string | null;
         planId: string | null;
     };
+    listOnboardingPlanOptions(): OnboardingPlanOption[];
     createUserBillingRecord(userId: string, options?: {
         entitlementState?: string;
         planId?: string | null;
@@ -106,6 +113,7 @@ export declare class PlanEntitlementService {
     hasAccountEntitlement(accountId: string): boolean;
     private tryGetAccountEntitlement;
     private tryAutoHealLegacyPersonalFreeEntitlement;
+    private tryAutoHealCommercialEntitlementFromBillingMirror;
     getAccountAccessStatus(accountId: string): AccountAccessStatus;
     getEffectivePlanVersion(accountId: string): PlanVersionSnapshot;
     getAccountEntitlement(accountId: string): AccountEntitlementSnapshot;
@@ -131,6 +139,11 @@ export declare class PlanEntitlementService {
         planId: string;
         entitlementState: EntitlementState;
     };
+    resolveInviteAcceptanceDefaultEntitlement(): {
+        planVersionId: string;
+        planId: string;
+        commercialState: 'active';
+    } | null;
     private isValidEntitlementTransition;
     addEntitlementAuditLog(input: {
         actorUserId: string;
@@ -145,6 +158,7 @@ export declare class PlanEntitlementService {
     upsertPlanCatalog(input: {
         planId: string;
         displayName: string;
+        description?: string | null;
         status?: 'active' | 'archived';
         initialMode?: 'personal' | 'team';
         initialSeatLimit?: number | null;
@@ -152,10 +166,17 @@ export declare class PlanEntitlementService {
     }): {
         planId: string;
         displayName: string;
+        description: string | null;
         status: 'active' | 'archived';
     };
     listPlanCatalog(): PlanCatalogSnapshot[];
     listPlanFeatureCatalog(): PlanFeatureCatalogItem[];
+    updatePlanFeatureCatalogMarketingCopy(input: {
+        featureKey: string;
+        publicLabel?: string | null;
+        publicDescription?: string | null;
+        publicDisplayOrder?: number | null;
+    }): PlanFeatureCatalogItem;
     listPlanVersions(planId: string): PlanVersionSnapshot[];
     getPlanVersionFeatures(planId: string, versionId: string): PlanVersionSnapshot;
     searchAccountsByEmail(query: string, limit?: number): Array<{