@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/core/Taskforce.listTasksSlim.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/Taskforce.listTasksSlim.test.js

@@ -0,0 +1,91 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { TaskforceCore } from './Taskforce';
+const createdRoots = [];
+const originalHome = process.env.HOME;
+function createProjectRoot(prefix = 'taskforce-list-tasks-slim-') {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    process.env.HOME = root;
+    createdRoots.push(root);
+    return root;
+}
+afterEach(() => {
+    process.env.HOME = originalHome;
+    while (createdRoots.length > 0) {
+        const root = createdRoots.pop();
+        if (root && fs.existsSync(root)) {
+            fs.rmSync(root, { recursive: true, force: true });
+        }
+    }
+});
+describe('TaskforceCore.listTasksSlim', () => {
+    it('does not hydrate comments, task events, attachments, or checklist items', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const task = core.createTask({ title: 'Heavy task' }, { workspaceId: 'default' });
+        core.addComment(task.id, 'note from reviewer', 'user', 'default');
+        core.replaceChecklistItems(task.id, [{ title: 'step one', isCompleted: false }], 'default');
+        const slim = core.listTasksSlim('default');
+        const entry = slim.find((t) => t.id === task.id);
+        expect(entry).toBeDefined();
+        expect(entry).not.toHaveProperty('comments');
+        expect(entry).not.toHaveProperty('taskEvents');
+        expect(entry).not.toHaveProperty('activity');
+        expect(entry).not.toHaveProperty('attachments');
+        expect(entry).not.toHaveProperty('checklistItems');
+        expect(entry).not.toHaveProperty('description');
+        expect(entry).not.toHaveProperty('createdByActor');
+        expect(entry).not.toHaveProperty('assigneeActor');
+        expect(entry).toMatchObject({
+            id: task.id,
+            title: 'Heavy task',
+        });
+    });
+    it('pushes assignee, status, openOnly, type, and priority filters into the query', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const mine = core.createTask({ title: 'Mine open', status: 'in-progress', assignee: 'user-a', priority: 3, type: 'issue' }, { workspaceId: 'default' });
+        core.createTask({ title: 'Other assigned', status: 'task', assignee: 'user-b', priority: 3 }, { workspaceId: 'default' });
+        const mineDone = core.createTask({ title: 'Mine done', status: 'done', assignee: 'user-a', priority: 1 }, { workspaceId: 'default' });
+        core.createTask({ title: 'Mine unassigned' }, { workspaceId: 'default' });
+        const byAssignee = core.listTasksSlim('default', { assignee: 'user-a' }).map((t) => t.id);
+        expect(byAssignee).toEqual(expect.arrayContaining([mine.id, mineDone.id]));
+        expect(byAssignee).toHaveLength(2);
+        const openOnly = core.listTasksSlim('default', { assignee: 'user-a', openOnly: true }).map((t) => t.id);
+        expect(openOnly).toEqual([mine.id]);
+        const byStatus = core.listTasksSlim('default', { status: 'done' }).map((t) => t.id);
+        expect(byStatus).toEqual([mineDone.id]);
+        const byType = core.listTasksSlim('default', { type: 'issue' }).map((t) => t.id);
+        expect(byType).toEqual([mine.id]);
+        const byPriority = core.listTasksSlim('default', { priority: 3 }).map((t) => t.id).sort();
+        expect(byPriority).toHaveLength(2);
+        const byCategory = core.listTasksSlim('default', { category: 'default' }).map((t) => t.id);
+        expect(byCategory).toHaveLength(4);
+    });
+    it('matches unassigned filter against null, empty-string, and "unassigned" values', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const unassigned = core.createTask({ title: 'no one' }, { workspaceId: 'default' });
+        const assigned = core.createTask({ title: 'someone', assignee: 'user-x' }, { workspaceId: 'default' });
+        const db = core.getDatabaseAdapter();
+        // Inject a row with assignee stored as empty string to exercise the fallback branch.
+        db.prepare(`UPDATE tasks SET assignee = '' WHERE id = ?`).run(unassigned.id);
+        const results = core.listTasksSlim('default', { assignee: 'unassigned' }).map((t) => t.id);
+        expect(results).toContain(unassigned.id);
+        expect(results).not.toContain(assigned.id);
+    });
+    it('applies sort, order, and limit in SQL', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const low = core.createTask({ title: 'low', priority: 1 }, { workspaceId: 'default' });
+        const mid = core.createTask({ title: 'mid', priority: 2 }, { workspaceId: 'default' });
+        const high = core.createTask({ title: 'high', priority: 4 }, { workspaceId: 'default' });
+        const byPriorityDesc = core.listTasksSlim('default', { sort: 'priority', order: 'desc' }).map((t) => t.id);
+        expect(byPriorityDesc.slice(0, 3)).toEqual([high.id, mid.id, low.id]);
+        const limited = core.listTasksSlim('default', { sort: 'priority', order: 'desc', limit: 1 });
+        expect(limited).toHaveLength(1);
+        expect(limited[0]?.id).toBe(high.id);
+    });
+});

package/dist/core/Taskforce.mcpAuth.test.js

@@ -289,6 +289,82 @@ describe('TaskforceCore MCP auth invalidation', () => {
             cleanup();
         }
     });
+    it('does not delete active MCP access tokens', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            const issued = core.createMcpAccessToken({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                name: 'Active Token',
+                scopes: ['tasks:read']
+            });
+            expect(() => core.deleteMcpAccessToken({
+                actorUserId: 'owner-1',
+                workspaceId: 'workspace-1',
+                tokenId: issued.record.id
+            })).toThrow('Active MCP tokens must be revoked before deletion');
+            expect(core.listMcpAccessTokens({ userId: 'owner-1', workspaceId: 'workspace-1' }).items).toHaveLength(1);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('deletes revoked MCP access token records', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            const issued = core.createMcpAccessToken({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                name: 'Revoked Token',
+                scopes: ['tasks:read']
+            });
+            core.revokeMcpAccessToken({
+                actorUserId: 'owner-1',
+                workspaceId: 'workspace-1',
+                tokenId: issued.record.id
+            });
+            expect(core.deleteMcpAccessToken({
+                actorUserId: 'owner-1',
+                workspaceId: 'workspace-1',
+                tokenId: issued.record.id
+            })).toBe(true);
+            expect(core.listMcpAccessTokens({ userId: 'owner-1', workspaceId: 'workspace-1' }).items).toHaveLength(0);
+            expect(core.authenticateMcpAccessToken(issued.token)).toBeNull();
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('deletes expired MCP access token records', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            const issued = core.createMcpAccessToken({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                name: 'Expired Token',
+                scopes: ['tasks:read'],
+                expiresAt: new Date(Date.now() + 60_000).toISOString()
+            });
+            core.db.prepare(`
+                UPDATE mcp_access_tokens
+                SET expires_at = ?
+                WHERE tenant_id = ? AND id = ?
+            `).run(new Date(Date.now() - 60_000).toISOString(), 'default', issued.record.id);
+            expect(core.listMcpAccessTokens({ userId: 'owner-1', workspaceId: 'workspace-1' }).items[0]?.status).toBe('expired');
+            expect(core.deleteMcpAccessToken({
+                actorUserId: 'owner-1',
+                workspaceId: 'workspace-1',
+                tokenId: issued.record.id
+            })).toBe(true);
+            expect(core.listMcpAccessTokens({ userId: 'owner-1', workspaceId: 'workspace-1' }).items).toHaveLength(0);
+        }
+        finally {
+            cleanup();
+        }
+    });
     it('denies OAuth authentication after the authorized member is disabled', () => {
         const { core, cleanup } = makeCore();
         try {
@@ -308,6 +384,39 @@ describe('TaskforceCore MCP auth invalidation', () => {
             cleanup();
         }
     });
+    it('returns persisted AI profile binding on OAuth connector authentication', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            const accessToken = createOauthGrantToken(core, 'owner-1', 'workspace-1');
+            const auth = core.authenticateMcpOAuthAccessToken(accessToken);
+            expect(auth?.aiProfileToken).toBeFalsy();
+            const resolved = core.resolveAiProfile({
+                workspaceId: 'workspace-1',
+                name: 'Codex Connector',
+                icon: 'Code',
+                color: '#0ea5e9',
+            }, {
+                trustedSeatScope: 'cloud_metered',
+            });
+            expect(core.bindMcpOAuthConnectorGrantAiProfile({
+                grantId: auth.grantId,
+                workspaceId: 'workspace-1',
+                profileId: resolved.profile.id,
+                profileToken: resolved.profile.profileToken,
+                profileName: resolved.profile.name,
+            })).toBe(true);
+            expect(core.authenticateMcpOAuthAccessToken(accessToken)).toEqual(expect.objectContaining({
+                grantId: auth.grantId,
+                aiProfileId: resolved.profile.id,
+                aiProfileToken: resolved.profile.profileToken,
+                aiProfileName: 'Codex Connector',
+            }));
+        }
+        finally {
+            cleanup();
+        }
+    });
     it('denies OAuth authentication after account access is suspended', () => {
         const { core, cleanup } = makeCore();
         try {

package/dist/core/UserProfileAvatarDrafts.test.js

@@ -24,7 +24,7 @@ function seedPlans(core) {
         billing: {
             onboardingPolicy: {
                 mode: 'auto_grant_free',
-                planVersionId: 'starter-v1'
+                planId: 'starter'
             }
         }
     });
@@ -44,7 +44,7 @@ describe('TaskforceCore user profile avatar drafts', () => {
         try {
             const created = core.registerPasswordUser({
                 email: 'avatar-user@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const updated = core.updateUserProfile(created.userId, {
                 displayName: 'Avatar User',
@@ -62,13 +62,40 @@ describe('TaskforceCore user profile avatar drafts', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('exposes cloud-owned user avatarUrl on live workspace member records', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            const created = core.registerPasswordUser({
+                email: 'member-avatar@example.com',
+                password: 'ValidPassphrase123!',
+                workspaceId: 'workspace-1'
+            });
+            const avatarUrl = `/api/taskforce/context/${encodeURIComponent(`users/${created.userId}/profile/avatar/headshot.webp`)}`;
+            core.updateUserProfile(created.userId, {
+                displayName: 'Member Avatar',
+                avatarUrl
+            });
+            const members = core.listWorkspaceUsers('workspace-1');
+            expect(members.find((member) => member.userId === created.userId)).toEqual(expect.objectContaining({
+                userId: created.userId,
+                displayName: 'Member Avatar',
+                avatarUrl
+            }));
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('tracks, finalizes, discards, and cleans up stale avatar upload drafts', () => {
         const projectRoot = makeProjectRoot();
         const core = openCore(projectRoot);
         try {
             const created = core.registerPasswordUser({
                 email: 'draft-user@example.com',
-                password: 'password123'
+                password: 'ValidPassphrase123!'
             });
             const draft = core.createUserAvatarUploadDraft({
                 userId: created.userId,

package/dist/core/WorkspaceLifecycleService.js

@@ -55,11 +55,6 @@ export function deleteWorkspaceService(deps, input) {
             const result = deps.db.prepare(sql).run(...params);
             counts[tableName] = Number(result?.changes || 0);
         };
-        deps.db.prepare(`
-            UPDATE tasks
-            SET parent_task_id = NULL
-            WHERE tenant_id = ? AND workspace_id = ? AND parent_task_id IS NOT NULL
-        `).run(deps.tenantId, normalizedWorkspaceId);
         runDelete('comments', 'DELETE FROM comments WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
         runDelete('task_events', 'DELETE FROM task_events WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);
         runDelete('deleted_tasks', 'DELETE FROM deleted_tasks WHERE tenant_id = ? AND workspace_id = ?', deps.tenantId, normalizedWorkspaceId);

package/dist/core/WorkspacePermissions.test.js

@@ -124,10 +124,11 @@ describe('TaskforceCore workspace permission invariants', () => {
             cleanup();
         }
     });
-    it('marks deactivated users as disabled in access resolution immediately', () => {
+    it('marks deactivated workspace memberships as disabled without disabling the global account', () => {
         const { core, cleanup } = makeCore();
         try {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.createWorkspace({ workspaceId: 'workspace-home', name: 'Workspace Home' });
             core.ensureBootstrapUserAccess({
                 userId: 'owner-1',
                 workspaceId: 'workspace-1',
@@ -140,9 +141,32 @@ describe('TaskforceCore workspace permission invariants', () => {
                 role: 'member',
                 email: 'member@example.com'
             });
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-home',
+                role: 'owner',
+                email: 'member@example.com'
+            });
             expect(core.setWorkspaceUserDisabled('member-1', 'workspace-1', true)).toBe(true);
             const access = core.resolveUserAccess('member-1', 'workspace-1', 'member');
             expect(access?.disabled).toBe(true);
+            expect(access?.accountDisabled).toBe(false);
+            expect(access?.workspaceDisabled).toBe(true);
+            expect(core.resolveUserAccess('member-1', 'workspace-home', 'owner')).toEqual(expect.objectContaining({
+                role: 'owner',
+                disabled: false,
+                accountDisabled: false,
+                workspaceDisabled: false
+            }));
+            expect(core.listUserWorkspaces('member-1').map((workspace) => workspace.id)).toEqual(['workspace-home']);
+            expect(core.listWorkspaceUsers('workspace-1').find((user) => user.userId === 'member-1')).toEqual(expect.objectContaining({
+                status: 'disabled',
+                disabled: true
+            }));
+            const row = core.db.prepare(`
+                SELECT is_disabled FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+            `).get('default', 'member-1');
+            expect(Boolean(row?.is_disabled)).toBe(false);
         }
         finally {
             cleanup();

package/dist/core/WorkspacePlanMode.test.js

@@ -31,7 +31,7 @@ function openCore(projectRoot) {
     core.updatePlanVersionFeatures({
         planVersionId: 'free-v1',
         features: [
-            { featureKey: 'workspace.switching', access: 'enabled' }
+            { featureKey: 'workspace.workspaces', access: 'enabled' }
         ]
     });
     core.upsertPlanCatalog({ planId: 'team-5', displayName: 'Team 5' });
@@ -71,17 +71,17 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
                 VALUES (?, ?, ?, ?, ?, ?)
             `).run('workspace-u1-second', 'default', 'workspace-u1-second', 'Second U1 Workspace', now, now);
             db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
-            `).run('u1', 'default', 'u1@example.com', 'U1', 'token', 'u1', now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, 0, ?, ?)
+            `).run('u1', 'default', 'u1@example.com', 'U1', now, now);
             db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
-            `).run('u2', 'default', 'u2@example.com', 'U2', 'token', 'u2', now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, 0, ?, ?)
+            `).run('u2', 'default', 'u2@example.com', 'U2', now, now);
             db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)
-            `).run('u3', 'default', 'u3@example.com', 'U3', 'token', 'u3', now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, 0, ?, ?)
+            `).run('u3', 'default', 'u3@example.com', 'U3', now, now);
             db.prepare(`
                 INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -153,7 +153,7 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
             });
             core.ensurePasswordUser({
                 email: 'existing@example.com',
-                password: 'Password123!',
+                password: 'HarborLanternOrbit!2026',
                 workspaceId: 'workspace-invite',
                 role: 'member'
             });
@@ -190,7 +190,7 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
             core.setUserAccountPlanMode('owner-user', 'team');
             const existing = core.ensurePasswordUser({
                 email: 'existing@example.com',
-                password: 'Password123!',
+                password: 'HarborLanternOrbit!2026',
                 workspaceId: 'workspace-invite',
                 role: 'member'
             });
@@ -202,7 +202,8 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
                 WHERE tenant_id = ? AND user_id = ? AND workspace_id = ?
             `).run('default', existing.userId, 'workspace-invite');
             const before = db.prepare(`
-                SELECT password_hash FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+                SELECT password_hash FROM user_auth_identities
+                WHERE tenant_id = ? AND user_id = ? AND provider = 'password' LIMIT 1
             `).get('default', existing.userId);
             const invite = core.requestInviteAcceptance({ userId: existing.userId, workspaceId: 'workspace-invite' });
             const accepted = core.joinInviteWithAuthenticatedUser({
@@ -210,7 +211,8 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
                 userId: existing.userId
             });
             const after = db.prepare(`
-                SELECT password_hash FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+                SELECT password_hash FROM user_auth_identities
+                WHERE tenant_id = ? AND user_id = ? AND provider = 'password' LIMIT 1
             `).get('default', existing.userId);
             const membership = db.prepare(`
                 SELECT status FROM workspace_memberships WHERE tenant_id = ? AND user_id = ? AND workspace_id = ? LIMIT 1
@@ -233,7 +235,7 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
                 billing: {
                     onboardingPolicy: {
                         mode: 'auto_grant_free',
-                        planVersionId: 'free-v1'
+                        planId: 'free'
                     }
                 }
             });
@@ -261,7 +263,7 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
             const invite = core.requestInviteAcceptance({ userId: 'invited-user', workspaceId: 'workspace-invite' });
             const accepted = core.acceptInviteWithToken({
                 token: String(invite.token),
-                password: 'Password123!'
+                password: 'LanternHarborOrbit!2026'
             });
             expect(accepted.workspaceId).toBe('workspace-invite');
             expect(core.hasAccountEntitlement('invited-user')).toBe(true);
@@ -279,4 +281,103 @@ describe('TaskforceCore account-level plan mode and invite revoke', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('grants the free personal entitlement to newly accepted invited accounts even without explicit self-serve onboarding policy', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-invite', name: 'Invite Workspace' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-user',
+                workspaceId: 'workspace-invite',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.setUserAccountPlanMode('owner-user', 'team');
+            core.ensureBootstrapUserAccess({
+                userId: 'invited-user',
+                workspaceId: 'workspace-invite',
+                role: 'member',
+                email: 'invited-no-policy@example.com'
+            });
+            core.setWorkspaceUserDisabled('invited-user', 'workspace-invite', true);
+            const db = core.db;
+            db.prepare(`
+                UPDATE workspace_memberships
+                SET status = 'invited'
+                WHERE tenant_id = ? AND user_id = ? AND workspace_id = ?
+            `).run('default', 'invited-user', 'workspace-invite');
+            const invite = core.requestInviteAcceptance({ userId: 'invited-user', workspaceId: 'workspace-invite' });
+            const accepted = core.acceptInviteWithToken({
+                token: String(invite.token),
+                password: 'LanternHarborOrbit!2026'
+            });
+            expect(accepted.workspaceId).toBe('workspace-invite');
+            expect(core.hasAccountEntitlement('invited-user')).toBe(true);
+            expect(core.getAccountEntitlement('invited-user')).toEqual(expect.objectContaining({
+                planVersionId: 'free-v1',
+                state: 'active'
+            }));
+            expect(core.getAccountAccessStatus('invited-user')).toEqual(expect.objectContaining({
+                gate: 'ok',
+                canAccessApp: true
+            }));
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('reactivates blocked placeholder entitlements when a new invited user accepts a reused seat', () => {
+        const projectRoot = makeProjectRoot();
+        const core = openCore(projectRoot);
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-invite', name: 'Invite Workspace' });
+            core.ensureBootstrapUserAccess({
+                userId: 'owner-user',
+                workspaceId: 'workspace-invite',
+                role: 'owner',
+                email: 'owner@example.com'
+            });
+            core.setUserAccountPlanMode('owner-user', 'team');
+            core.ensureBootstrapUserAccess({
+                userId: 'invited-user',
+                workspaceId: 'workspace-invite',
+                role: 'member',
+                email: 'invited@example.com'
+            });
+            core.setWorkspaceUserDisabled('invited-user', 'workspace-invite', true);
+            const db = core.db;
+            db.prepare(`
+                UPDATE workspace_memberships
+                SET status = 'invited'
+                WHERE tenant_id = ? AND user_id = ? AND workspace_id = ?
+            `).run('default', 'invited-user', 'workspace-invite');
+            core.updateAccountEntitlement({
+                accountId: 'invited-user',
+                planVersionId: 'free-v1',
+                entitlementState: 'canceled',
+                actorUserId: 'system-admin',
+                actorRole: 'system_admin',
+                reason: 'invite-reaccept-regression'
+            });
+            const invite = core.requestInviteAcceptance({ userId: 'invited-user', workspaceId: 'workspace-invite' });
+            const accepted = core.acceptInviteWithToken({
+                token: String(invite.token),
+                password: 'LanternHarborOrbit!2026'
+            });
+            expect(accepted.workspaceId).toBe('workspace-invite');
+            expect(core.getAccountEntitlement('invited-user')).toEqual(expect.objectContaining({
+                planVersionId: 'free-v1',
+                state: 'active'
+            }));
+            expect(core.getAccountAccessStatus('invited-user')).toEqual(expect.objectContaining({
+                gate: 'ok',
+                canAccessApp: true
+            }));
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
 });

package/dist/core/shared.d.ts

@@ -16,7 +16,7 @@
  */
 import type { McpAccessTokenScope, PlanFeatureCatalogItem } from './types.js';
 export declare const DOCUMENT_CLOUD_STORAGE_FEATURE_KEY = "context.uploads";
-export declare const WORKSPACES_FEATURE_KEY = "workspace.switching";
+export declare const WORKSPACES_FEATURE_KEY = "workspace.workspaces";
 export declare const AI_PROFILES_FEATURE_KEY = "collaboration.ai_profiles";
 export declare const DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY = "storageLimitMb";
 export declare const WORKSPACES_LIMIT_CONFIG_KEY = "maxWorkspaces";

package/dist/core/shared.js

@@ -17,7 +17,7 @@
 import { createHash, pbkdf2Sync, randomBytes, timingSafeEqual } from 'crypto';
 // === SECTION: Constants ===
 export const DOCUMENT_CLOUD_STORAGE_FEATURE_KEY = 'context.uploads';
-export const WORKSPACES_FEATURE_KEY = 'workspace.switching';
+export const WORKSPACES_FEATURE_KEY = 'workspace.workspaces';
 export const AI_PROFILES_FEATURE_KEY = 'collaboration.ai_profiles';
 export const DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY = 'storageLimitMb';
 export const WORKSPACES_LIMIT_CONFIG_KEY = 'maxWorkspaces';
@@ -32,6 +32,7 @@ export const DEFAULT_PLAN_FEATURE_CATALOG = [
         featureKey: 'collaboration.team_management',
         label: 'Team Management',
         description: 'Allow managing members, invites, roles, and collaboration settings.',
+        publicDisplayOrder: 40,
         allowedAccessModes: ['enabled', 'disabled'],
         configTemplate: {}
     },
@@ -39,6 +40,7 @@ export const DEFAULT_PLAN_FEATURE_CATALOG = [
         featureKey: DOCUMENT_CLOUD_STORAGE_FEATURE_KEY,
         label: 'Document Cloud Storage',
         description: 'Allow cloud document storage with an optional storage allowance in MB.',
+        publicDisplayOrder: 30,
         allowedAccessModes: ['enabled', 'disabled'],
         configTemplate: {
             [DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY]: 1024
@@ -48,6 +50,7 @@ export const DEFAULT_PLAN_FEATURE_CATALOG = [
         featureKey: WORKSPACES_FEATURE_KEY,
         label: 'Workspaces',
         description: 'Allow multiple workspaces with a configurable workspace limit.',
+        publicDisplayOrder: 10,
         allowedAccessModes: ['enabled', 'disabled'],
         configTemplate: {
             [WORKSPACES_LIMIT_CONFIG_KEY]: 1
@@ -57,6 +60,7 @@ export const DEFAULT_PLAN_FEATURE_CATALOG = [
         featureKey: AI_PROFILES_FEATURE_KEY,
         label: 'AI Profiles',
         description: 'Allow registered AI collaborator profiles with an optional per-workspace limit.',
+        publicDisplayOrder: 20,
         allowedAccessModes: ['enabled', 'limited', 'disabled'],
         configTemplate: {
             [AI_PROFILES_LIMIT_CONFIG_KEY]: 1