@taskforcehq/taskforce 0.3.309 → 0.3.313

package/dist/core/SystemAdmin.test.js

@@ -1,1106 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { TaskforceCore } from './Taskforce';
-function makeProjectRoot() {
-    return fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-system-admin-'));
-}
-function insertFreePriceMapping(core, planVersionId) {
-    const db = core.db;
-    const now = new Date().toISOString();
-    db.prepare(`
-        INSERT OR IGNORE INTO billing_price_mappings (
-            tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(core.getTenantId(), planVersionId, 'month', `free:${planVersionId}:month`, 'free', 1, 0, null, now, now);
-}
-function seedPlanCatalog(core) {
-    core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
-    core.upsertPlanCatalog({ planId: 'basic', displayName: 'Basic', status: 'active' });
-    core.upsertPlanCatalog({ planId: 'team-5', displayName: 'Team 5', status: 'active' });
-    core.updatePlanVersion({
-        planId: 'basic',
-        versionNumber: 1,
-        seatLimit: null
-    });
-    core.updatePlanVersion({
-        planId: 'team-5',
-        versionNumber: 1,
-        seatLimit: 5
-    });
-    core.updatePlanVersionFeatures({
-        planVersionId: 'free-v1',
-        features: [
-            { featureKey: 'workspace.workspaces', access: 'enabled' }
-        ]
-    });
-    core.updatePlanVersionFeatures({
-        planVersionId: 'basic-v1',
-        features: [
-            { featureKey: 'context.uploads', access: 'enabled' },
-            { featureKey: 'workspace.workspaces', access: 'enabled' }
-        ]
-    });
-    core.updatePlanVersionFeatures({
-        planVersionId: 'team-5-v1',
-        features: [
-            { featureKey: 'collaboration.invites', access: 'enabled' },
-            { featureKey: 'collaboration.team_management', access: 'enabled' },
-            { featureKey: 'context.uploads', access: 'enabled' },
-            { featureKey: 'workspace.workspaces', access: 'enabled' }
-        ]
-    });
-    insertFreePriceMapping(core, 'free-v1');
-}
-function seedPlans(core) {
-    seedPlanCatalog(core);
-    core.updateGlobalSettings({
-        billing: {
-            onboardingPolicy: {
-                mode: 'auto_grant_free',
-                planId: 'free'
-            }
-        }
-    });
-}
-function openCore(projectRoot, options = {}) {
-    const core = new TaskforceCore({
-        projectRoot,
-        storagePath: path.join(projectRoot, '.taskforce')
-    });
-    if (options.seedDefaultPlans === true) {
-        seedPlans(core);
-    }
-    return core;
-}
-describe('TaskforceCore system admin model', () => {
-    it('creates billing row for registration without workspace', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const created = core.registerPasswordUser({
-                email: 'billing-noworkspace@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const db = core.db;
-            const row = db.prepare(`
-                SELECT user_id, tier, entitlement_state
-                FROM user_billing
-                WHERE tenant_id = ? AND user_id = ?
-                LIMIT 1
-            `).get('default', created.userId);
-            expect(row?.user_id).toBe(created.userId);
-            expect(row?.tier).toBe('free');
-            expect(row?.entitlement_state).toBe('active');
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('creates billing row for registration with workspace', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            const created = core.registerPasswordUser({
-                email: 'billing-workspace@example.com',
-                password: 'ValidPassphrase123!',
-                workspaceId: 'workspace-1',
-                role: 'member'
-            });
-            const db = core.db;
-            const row = db.prepare(`
-                SELECT user_id, tier, entitlement_state
-                FROM user_billing
-                WHERE tenant_id = ? AND user_id = ?
-                LIMIT 1
-            `).get('default', created.userId);
-            expect(row?.user_id).toBe(created.userId);
-            expect(row?.tier).toBe('free');
-            expect(row?.entitlement_state).toBe('active');
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('starts a configured onboarding trial when the onboarding policy is trial-based', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.createPlanVersion({
-                planId: 'team-5',
-                versionNumber: 2,
-                isDefault: true,
-                seatLimit: 10,
-                trialDays: 14
-            });
-            core.updatePlanVersionFeatures({
-                planVersionId: 'team-5-v2',
-                features: [
-                    { featureKey: 'collaboration.invites', access: 'enabled' },
-                    { featureKey: 'collaboration.team_management', access: 'enabled' },
-                    { featureKey: 'context.uploads', access: 'enabled' },
-                    { featureKey: 'workspace.workspaces', access: 'enabled' }
-                ]
-            });
-            core.createPlanVersion({
-                planId: 'free',
-                versionNumber: 2,
-                isDefault: false,
-                seatLimit: null
-            });
-            core.updateGlobalSettings({
-                billing: {
-                    onboardingPolicy: {
-                        mode: 'auto_start_trial',
-                        planId: 'team-5'
-                    }
-                }
-            });
-            const created = core.registerPasswordUser({
-                email: 'configured-signup@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const entitlement = core.getAccountEntitlement(created.userId);
-            const db = core.db;
-            const billing = db.prepare(`
-                SELECT tier, entitlement_state
-                FROM user_billing
-                WHERE tenant_id = ? AND user_id = ?
-                LIMIT 1
-            `).get(core.getTenantId(), created.userId);
-            expect(entitlement.planVersionId).toBe('team-5-v2');
-            expect(entitlement.planId).toBe('team-5');
-            expect(entitlement.state).toBe('trialing');
-            expect(billing?.tier).toBe('team-5');
-            expect(billing?.entitlement_state).toBe('trialing');
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('fails registration when the onboarding policy is stale or invalid', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.updateGlobalSettings({
-                billing: {
-                    onboardingPolicy: {
-                        mode: 'auto_grant_free',
-                        planId: 'missing'
-                    }
-                }
-            });
-            expect(() => core.registerPasswordUser({
-                email: 'fallback-signup@example.com',
-                password: 'ValidPassphrase123!'
-            })).toThrowError(/was not found/i);
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('registers without an entitlement when plan selection is required', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.updateGlobalSettings({
-                billing: {
-                    onboardingPolicy: {
-                        mode: 'require_plan_selection',
-                        planId: null
-                    }
-                }
-            });
-            const created = core.registerPasswordUser({
-                email: 'pending-plan@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            expect(created.planSelectionRequired).toBe(true);
-            expect(core.hasAccountEntitlement(created.userId)).toBe(true);
-            const db = core.db;
-            const billing = db.prepare(`
-                SELECT entitlement_state, tier
-                FROM user_billing
-                WHERE tenant_id = ? AND user_id = ?
-                LIMIT 1
-            `).get('default', created.userId);
-            expect(billing?.entitlement_state).toBe('pending_plan_selection');
-            expect(String(billing?.tier || '')).toBe('');
-            expect(core.getAccountAccessStatus(created.userId)).toMatchObject({
-                gate: 'plan_selection_required',
-                hasEntitlement: true,
-                canAccessApp: false,
-                canAccessPlans: true
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('removes legacy documents.workspace_access plan feature rows during startup normalization', () => {
-        const projectRoot = makeProjectRoot();
-        let core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const db = core.db;
-            const now = new Date().toISOString();
-            db.prepare(`
-                INSERT INTO plan_feature_matrix (tenant_id, plan_version_id, feature_key, access, config_json, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?)
-                ON CONFLICT (tenant_id, plan_version_id, feature_key) DO UPDATE SET
-                    access = excluded.access,
-                    config_json = excluded.config_json,
-                    updated_at = excluded.updated_at
-            `).run('default', 'team-5-v1', 'documents.workspace_access', 'enabled', '{}', now, now);
-        }
-        finally {
-            core.close();
-        }
-        core = openCore(projectRoot);
-        try {
-            const db = core.db;
-            const row = db.prepare(`
-                SELECT feature_key
-                FROM plan_feature_matrix
-                WHERE tenant_id = ? AND plan_version_id = ? AND feature_key = ?
-                LIMIT 1
-            `).get('default', 'team-5-v1', 'documents.workspace_access');
-            expect(row).toBeUndefined();
-            const snapshot = core.listPlanVersions('team-5').find((version) => version.planVersionId === 'team-5-v1');
-            expect(snapshot).toBeDefined();
-            expect(snapshot.features['documents.workspace_access']).toBeUndefined();
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('keeps configured auto-grant onboarding plan when registration includes a selected plan version', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.updatePlanVersion({
-                planId: 'basic',
-                versionNumber: 1,
-                seatLimit: null
-            });
-            core.updateGlobalSettings({
-                billing: {
-                    onboardingPolicy: {
-                        mode: 'auto_grant_free',
-                        planId: 'free'
-                    }
-                }
-            });
-            const created = core.registerPasswordUser({
-                email: 'selected-plan@example.com',
-                password: 'ValidPassphrase123!',
-                planVersionId: 'basic-v1'
-            });
-            expect(created.planSelectionRequired).toBe(false);
-            expect(core.getAccountEntitlement(created.userId)).toMatchObject({
-                planVersionId: 'free-v1',
-                planId: 'free',
-                state: 'active'
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('uses the explicitly selected plan version when onboarding requires plan selection', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.updatePlanVersion({
-                planId: 'basic',
-                versionNumber: 1,
-                seatLimit: null
-            });
-            core.updateGlobalSettings({
-                billing: {
-                    onboardingPolicy: {
-                        mode: 'require_plan_selection',
-                        planId: null
-                    }
-                }
-            });
-            const created = core.registerPasswordUser({
-                email: 'selected-plan-required@example.com',
-                password: 'ValidPassphrase123!',
-                planVersionId: 'basic-v1'
-            });
-            expect(created.planSelectionRequired).toBe(false);
-            expect(core.getAccountEntitlement(created.userId)).toMatchObject({
-                planVersionId: 'basic-v1',
-                planId: 'basic',
-                state: 'checkout_pending'
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('auto-heals stranded legacy personal free entitlements onto the active default free version', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
-            insertFreePriceMapping(core, 'free-v1');
-            core.createPlanVersion({
-                planId: 'free',
-                versionNumber: 2,
-                isDefault: true,
-                seatLimit: 1
-            });
-            insertFreePriceMapping(core, 'free-v2');
-            core.updateGlobalSettings({
-                billing: {
-                    onboardingPolicy: {
-                        mode: 'require_plan_selection',
-                        planId: null
-                    }
-                }
-            });
-            const created = core.registerPasswordUser({
-                email: 'legacy-free@example.com',
-                password: 'ValidPassphrase123!',
-                planVersionId: 'free-v1'
-            });
-            core.updateAccountEntitlement({
-                accountId: created.userId,
-                planVersionId: 'free-v1',
-                entitlementState: 'canceled',
-                actorUserId: created.userId,
-                actorRole: 'user',
-                reason: 'legacy-free-v1-canceled'
-            });
-            expect(core.getAccountAccessStatus(created.userId)).toMatchObject({
-                gate: 'ok',
-                hasEntitlement: true,
-                canAccessApp: true,
-                entitlement: {
-                    planVersionId: 'free-v2',
-                    planId: 'free',
-                    state: 'active'
-                }
-            });
-            expect(core.getAccountEntitlement(created.userId)).toMatchObject({
-                planVersionId: 'free-v2',
-                planId: 'free',
-                state: 'active'
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('does not auto-heal canceled accounts already on the current default free version', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
-            insertFreePriceMapping(core, 'free-v1');
-            core.createPlanVersion({
-                planId: 'free',
-                versionNumber: 2,
-                isDefault: true,
-                seatLimit: 1
-            });
-            insertFreePriceMapping(core, 'free-v2');
-            core.updateGlobalSettings({
-                billing: {
-                    onboardingPolicy: {
-                        mode: 'require_plan_selection',
-                        planId: null
-                    }
-                }
-            });
-            const created = core.registerPasswordUser({
-                email: 'current-default-free@example.com',
-                password: 'ValidPassphrase123!',
-                planVersionId: 'free-v2'
-            });
-            core.updateAccountEntitlement({
-                accountId: created.userId,
-                planVersionId: 'free-v2',
-                entitlementState: 'canceled',
-                actorUserId: created.userId,
-                actorRole: 'user',
-                reason: 'intentional-free-v2-cancel'
-            });
-            expect(core.getAccountAccessStatus(created.userId)).toMatchObject({
-                gate: 'missing_entitlement',
-                hasEntitlement: true,
-                canAccessApp: false,
-                entitlement: {
-                    planVersionId: 'free-v2',
-                    planId: 'free',
-                    state: 'canceled'
-                }
-            });
-            expect(core.getAccountEntitlement(created.userId)).toMatchObject({
-                planVersionId: 'free-v2',
-                planId: 'free',
-                state: 'canceled'
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('treats accounts without an entitlement or pending-selection marker as missing entitlement', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.updateGlobalSettings({
-                billing: {
-                    onboardingPolicy: {
-                        mode: 'require_plan_selection',
-                        planId: null
-                    }
-                }
-            });
-            const now = new Date().toISOString();
-            const db = core.db;
-            db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, system_role, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, 'user', 1, 0, ?, ?)
-            `).run('user-missing-entitlement', 'default', 'broken@example.com', 'Broken', now, now);
-            expect(core.getAccountAccessStatus('user-missing-entitlement')).toMatchObject({
-                gate: 'missing_entitlement',
-                hasEntitlement: false,
-                canAccessApp: false,
-                planSelectionRequired: false
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('repairs missing default version during startup for existing plans', () => {
-        const projectRoot = makeProjectRoot();
-        const initial = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const db = initial.db;
-            db.prepare(`
-                UPDATE plan_versions
-                SET is_default = 0
-                WHERE tenant_id = ? AND plan_id = ?
-            `).run('default', 'free');
-        }
-        finally {
-            initial.close();
-        }
-        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
-        try {
-            const db = reopened.db;
-            const row = db.prepare(`
-                SELECT plan_version_id, is_default
-                FROM plan_versions
-                WHERE tenant_id = ? AND plan_id = ? AND plan_version_id = ?
-                LIMIT 1
-            `).get('default', 'free', 'free-v1');
-            expect(row?.plan_version_id).toBe('free-v1');
-            expect(row?.is_default).toBe(1);
-            expect(reopened.getRequiredDefaultPlanVersionId('free')).toBe('free-v1');
-        }
-        finally {
-            reopened.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('preserves require_plan_selection onboarding policy across restart', () => {
-        const projectRoot = makeProjectRoot();
-        const initial = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            initial.updateGlobalSettings({
-                billing: {
-                    onboardingPolicy: {
-                        mode: 'require_plan_selection',
-                        planId: null
-                    }
-                }
-            });
-        }
-        finally {
-            initial.close();
-        }
-        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
-        try {
-            expect(reopened.getOnboardingPolicy()).toEqual({
-                mode: 'require_plan_selection',
-                planId: null
-            });
-        }
-        finally {
-            reopened.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('migrates legacy seat-limit feature config to version seatLimit during startup', () => {
-        const projectRoot = makeProjectRoot();
-        const initial = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const db = initial.db;
-            const now = new Date().toISOString();
-            db.prepare(`
-                UPDATE plan_versions
-                SET seat_limit = NULL, updated_at = ?
-                WHERE tenant_id = ? AND plan_version_id = ?
-            `).run(now, 'default', 'team-5-v1');
-            db.prepare(`
-                INSERT INTO plan_feature_matrix (tenant_id, plan_version_id, feature_key, access, config_json, created_at, updated_at)
-                VALUES (?, ?, 'collaboration.seat_limit', 'limited', ?, ?, ?)
-                ON CONFLICT (tenant_id, plan_version_id, feature_key) DO UPDATE SET
-                    access = excluded.access,
-                    config_json = excluded.config_json,
-                    updated_at = excluded.updated_at
-            `).run('default', 'team-5-v1', JSON.stringify({ seat_limit: 7 }), now, now);
-        }
-        finally {
-            initial.close();
-        }
-        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
-        try {
-            const version = reopened.getPlanVersionFeatures('team-5', 'team-5-v1');
-            expect(version.seatLimit).toBe(7);
-            expect(version.features['collaboration.seat_limit']?.config || {}).toEqual({});
-        }
-        finally {
-            reopened.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('normalizes legacy billing mirror rows during startup', () => {
-        const projectRoot = makeProjectRoot();
-        const initial = openCore(projectRoot, { seedDefaultPlans: true });
-        let legacyUserId = '';
-        try {
-            const created = initial.registerPasswordUser({
-                email: 'legacy-billing@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            legacyUserId = created.userId;
-            const db = initial.db;
-            db.prepare(`
-                UPDATE user_billing
-                SET tier = 'free',
-                    entitlement_state = 'free'
-                WHERE tenant_id = ? AND user_id = ?
-            `).run('default', legacyUserId);
-        }
-        finally {
-            initial.close();
-        }
-        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
-        try {
-            const db = reopened.db;
-            const normalizedPersonalVersionId = reopened.getDefaultPlanVersionIdByMode('personal');
-            const normalizedBillingMirror = reopened.getBillingMirrorProfileForPlanVersion(normalizedPersonalVersionId);
-            const row = db.prepare(`
-                SELECT tier, entitlement_state
-                FROM user_billing
-                WHERE tenant_id = ? AND user_id = ?
-                LIMIT 1
-            `).get('default', legacyUserId);
-            expect(row?.tier).toBe(normalizedBillingMirror.planId);
-            expect(row?.entitlement_state).toBe('active');
-        }
-        finally {
-            reopened.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('does not seed business plans into an empty catalog on startup', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: false });
-        try {
-            expect(core.listPlanCatalog()).toEqual([]);
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('keeps a custom catalog untouched on startup', () => {
-        const projectRoot = makeProjectRoot();
-        const initial = openCore(projectRoot, { seedDefaultPlans: false });
-        try {
-            const db = initial.db;
-            const now = new Date().toISOString();
-            db.prepare(`DELETE FROM plan_feature_matrix WHERE tenant_id = ?`).run('default');
-            db.prepare(`DELETE FROM plan_versions WHERE tenant_id = ?`).run('default');
-            db.prepare(`DELETE FROM plan_catalog WHERE tenant_id = ?`).run('default');
-            db.prepare(`
-                INSERT INTO plan_catalog (plan_id, tenant_id, display_name, status, created_at, updated_at)
-                VALUES (?, ?, ?, 'active', ?, ?)
-            `).run('agency', 'default', 'Agency', now, now);
-            db.prepare(`
-                INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, seat_limit, metadata_json, created_at, updated_at)
-                VALUES (?, ?, ?, 1, 1, 25, '{}', ?, ?)
-            `).run('agency-v1', 'default', 'agency', now, now);
-        }
-        finally {
-            initial.close();
-        }
-        const reopened = openCore(projectRoot, { seedDefaultPlans: false });
-        try {
-            const plans = reopened.listPlanCatalog();
-            expect(plans.map((plan) => plan.planId)).toEqual(['agency']);
-            expect(reopened.getDefaultPlanVersionIdByMode('personal')).toBe('agency-v1');
-        }
-        finally {
-            reopened.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('assigns first registered user as system_admin and later users as user', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const first = core.registerPasswordUser({
-                email: 'first@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const second = core.registerPasswordUser({
-                email: 'second@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            expect(core.getSystemRole(first.userId)).toBe('system_admin');
-            expect(core.getSystemRole(second.userId)).toBe('user');
-            expect(core.countSystemAdmins()).toBe(1);
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('applies registration betaAccess at user level', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            core.registerPasswordUser({
-                email: 'bootstrap-admin@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const user = core.registerPasswordUser({
-                email: 'beta-off@example.com',
-                password: 'ValidPassphrase123!',
-                workspaceId: 'workspace-1',
-                role: 'owner',
-                betaAccess: false
-            });
-            expect(core.getUserBetaAccess(user.userId)).toBe(false);
-            expect(core.setUserBetaAccessGlobal(user.userId, true)).toBe(true);
-            expect(core.getUserBetaAccess(user.userId)).toBe(true);
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('enforces last-system-admin guard on demote and disable', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const first = core.registerPasswordUser({
-                email: 'first@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            expect(() => core.setSystemRole(first.userId, 'user')).toThrowError(/last system admin/i);
-            expect(() => core.setUserDisabledGlobal(first.userId, true)).toThrowError(/last system admin/i);
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('does not auto-promote system role from workspace role changes post-migration', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const first = core.registerPasswordUser({
-                email: 'first@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const second = core.registerPasswordUser({
-                email: 'second@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            core.ensureBootstrapUserAccess({
-                userId: second.userId,
-                workspaceId: 'workspace-1',
-                role: 'member',
-                email: 'second@example.com'
-            });
-            expect(core.updateWorkspaceUserRole(second.userId, 'workspace-1', 'admin')).toBe(true);
-            expect(core.getSystemRole(second.userId)).toBe('user');
-            expect(core.getSystemRole(first.userId)).toBe('system_admin');
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('lists system users without ambiguous updated_at ordering', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const admin = core.registerPasswordUser({
-                email: 'admin@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const member = core.registerPasswordUser({
-                email: 'member@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            core.createPlanVersion({
-                planId: 'free',
-                versionNumber: 2,
-                isDefault: true
-            });
-            core.updateAccountEntitlement({
-                accountId: member.userId,
-                planVersionId: 'free-v2',
-                entitlementState: 'active',
-                actorUserId: admin.userId,
-                actorRole: 'system_admin'
-            });
-            const users = core.listSystemUsers();
-            expect(users.map((user) => user.email)).toContain('admin@example.com');
-            expect(users.map((user) => user.email)).toContain('member@example.com');
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('purges a non-production test user and clears active ownership references', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const admin = core.registerPasswordUser({
-                email: 'admin@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const member = core.registerPasswordUser({
-                email: 'member@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const workspaceId = member.workspaceId || 'default';
-            const db = core.db;
-            db.prepare(`
-                UPDATE workspace_memberships
-                SET role = 'member', updated_at = ?
-                WHERE tenant_id = ? AND user_id = ?
-            `).run(new Date().toISOString(), 'default', member.userId);
-            const task = core.createTask({
-                title: 'Signup test task',
-                assignee: member.userId
-            }, { workspaceId });
-            const initiative = core.createInitiative({
-                title: 'Signup initiative',
-                ownerId: member.userId
-            }, workspaceId);
-            const workstream = core.createWorkstream({
-                title: 'Signup workstream',
-                ownerId: member.userId
-            }, workspaceId);
-            const now = new Date().toISOString();
-            db.prepare(`
-                INSERT INTO ui_state (tenant_id, workspace_id, user_id, state_key, payload, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?)
-            `).run('default', workspaceId, member.userId, 'admin.users', '{"open":true}', now);
-            db.prepare(`
-                INSERT INTO user_preferences (tenant_id, user_id, prefs_key, payload, updated_at)
-                VALUES (?, ?, ?, ?, ?)
-            `).run('default', member.userId, 'profile', '{"theme":"light"}', now);
-            const summary = core.purgeSystemUser({
-                targetUserId: member.userId,
-                actorUserId: admin.userId,
-                emailConfirmation: 'member@example.com'
-            });
-            expect(summary).toMatchObject({
-                targetUserId: member.userId,
-                email: 'member@example.com',
-                unassignedTaskCount: 1,
-                clearedInitiativeOwnerCount: 1,
-                clearedWorkstreamOwnerCount: 1,
-                deletedUiStateCount: 1,
-                deletedUserPreferenceCount: 1,
-                deletedUserCount: 1
-            });
-            expect(db.prepare(`SELECT assignee FROM tasks WHERE id = ?`).get(task.id)).toMatchObject({
-                assignee: 'unassigned'
-            });
-            expect(db.prepare(`SELECT owner_id FROM initiatives WHERE id = ?`).get(initiative.id)).toMatchObject({
-                owner_id: null
-            });
-            expect(db.prepare(`SELECT owner_id FROM workstreams WHERE id = ?`).get(workstream.id)).toMatchObject({
-                owner_id: null
-            });
-            expect(db.prepare(`SELECT COUNT(*) AS count FROM users WHERE tenant_id = ? AND id = ?`).get('default', member.userId)).toMatchObject({
-                count: 0
-            });
-            expect(db.prepare(`SELECT COUNT(*) AS count FROM account_entitlements WHERE tenant_id = ? AND account_id = ?`).get('default', member.userId)).toMatchObject({
-                count: 0
-            });
-            expect(db.prepare(`SELECT COUNT(*) AS count FROM ui_state WHERE tenant_id = ? AND user_id = ?`).get('default', member.userId)).toMatchObject({
-                count: 0
-            });
-            expect(db.prepare(`SELECT COUNT(*) AS count FROM user_preferences WHERE tenant_id = ? AND user_id = ?`).get('default', member.userId)).toMatchObject({
-                count: 0
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('blocks purging a user with active commercial billing state', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const admin = core.registerPasswordUser({
-                email: 'admin@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const member = core.registerPasswordUser({
-                email: 'member@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            const db = core.db;
-            const now = new Date().toISOString();
-            db.prepare(`
-                UPDATE workspace_memberships
-                SET role = 'member', updated_at = ?
-                WHERE tenant_id = ? AND user_id = ?
-            `).run(now, 'default', member.userId);
-            db.prepare(`
-                INSERT INTO user_billing (
-                    user_id, tenant_id, stripe_customer_id, entitlement_state, tier, created_at, updated_at
-                ) VALUES (?, ?, ?, ?, ?, ?, ?)
-                ON CONFLICT (user_id) DO UPDATE SET
-                    stripe_customer_id = excluded.stripe_customer_id,
-                    updated_at = excluded.updated_at
-            `).run(member.userId, 'default', 'cus_test_123', 'active', 'basic', now, now);
-            expect(() => core.purgeSystemUser({
-                targetUserId: member.userId,
-                actorUserId: admin.userId,
-                emailConfirmation: 'member@example.com'
-            })).toThrowError(/active commercial billing state/i);
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('creates v1 automatically when a new plan is created', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const plan = core.upsertPlanCatalog({
-                planId: 'agency',
-                displayName: 'Agency',
-                status: 'active'
-            });
-            expect(plan.planId).toBe('agency');
-            const versions = core.listPlanVersions('agency');
-            expect(versions).toHaveLength(1);
-            expect(versions[0]).toMatchObject({
-                planVersionId: 'agency-v1',
-                planId: 'agency',
-                versionNumber: 1,
-                isDefault: true,
-                seatLimit: null
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('does not recreate v1 when an existing plan is updated', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            core.upsertPlanCatalog({
-                planId: 'agency',
-                displayName: 'Agency',
-                status: 'active'
-            });
-            core.createPlanVersion({
-                planId: 'agency',
-                versionNumber: 2,
-                isDefault: true,
-                seatLimit: 25
-            });
-            core.upsertPlanCatalog({
-                planId: 'agency',
-                displayName: 'Agency Plus',
-                status: 'archived'
-            });
-            const versions = core.listPlanVersions('agency');
-            expect(versions.map((version) => version.planVersionId)).toEqual(['agency-v2', 'agency-v1']);
-            expect(versions.find((version) => version.planVersionId === 'agency-v1')).toMatchObject({
-                isDefault: false
-            });
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('backfills owner/admin memberships once and does not rerun after completion', () => {
-        const projectRoot = makeProjectRoot();
-        const initial = openCore(projectRoot);
-        try {
-            initial.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            initial.ensureBootstrapUserAccess({
-                userId: 'owner-1',
-                workspaceId: 'workspace-1',
-                role: 'owner',
-                email: 'owner@example.com'
-            });
-            initial.ensureBootstrapUserAccess({
-                userId: 'admin-1',
-                workspaceId: 'workspace-1',
-                role: 'admin',
-                email: 'admin@example.com'
-            });
-            initial.ensureBootstrapUserAccess({
-                userId: 'member-1',
-                workspaceId: 'workspace-1',
-                role: 'member',
-                email: 'member@example.com'
-            });
-            const db = initial.db;
-            db.prepare(`UPDATE users SET system_role = 'user' WHERE tenant_id = ?`).run('default');
-            db.prepare(`DELETE FROM system_settings WHERE tenant_id = ? AND settings_key = ?`).run('default', 'migration.system_role.backfill.v1');
-        }
-        finally {
-            initial.close();
-        }
-        const reopened = openCore(projectRoot);
-        try {
-            expect(reopened.getSystemRole('owner-1')).toBe('system_admin');
-            expect(reopened.getSystemRole('admin-1')).toBe('system_admin');
-            expect(reopened.getSystemRole('member-1')).toBe('user');
-            expect(reopened.countSystemAdmins()).toBe(2);
-            expect(reopened.setSystemRole('owner-1', 'user')).toBe(true);
-        }
-        finally {
-            reopened.close();
-        }
-        const reopenedAgain = openCore(projectRoot);
-        try {
-            expect(reopenedAgain.getSystemRole('owner-1')).toBe('user');
-            expect(reopenedAgain.getSystemRole('admin-1')).toBe('system_admin');
-            expect(reopenedAgain.countSystemAdmins()).toBe(1);
-        }
-        finally {
-            reopenedAgain.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('backfills user beta access from membership beta flags once', () => {
-        const projectRoot = makeProjectRoot();
-        const initial = openCore(projectRoot);
-        try {
-            initial.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
-            initial.ensureBootstrapUserAccess({
-                userId: 'beta-on',
-                workspaceId: 'workspace-1',
-                role: 'member',
-                email: 'beta-on@example.com'
-            });
-            initial.ensureBootstrapUserAccess({
-                userId: 'beta-off',
-                workspaceId: 'workspace-1',
-                role: 'member',
-                email: 'beta-off@example.com'
-            });
-            initial.setWorkspaceUserBetaAccess('beta-off', 'workspace-1', false);
-            const db = initial.db;
-            db.prepare(`UPDATE users SET beta_access = 1 WHERE tenant_id = ?`).run('default');
-            db.prepare(`DELETE FROM system_settings WHERE tenant_id = ? AND settings_key = ?`).run('default', 'migration.user_beta_access.backfill.v1');
-        }
-        finally {
-            initial.close();
-        }
-        const reopened = openCore(projectRoot);
-        try {
-            expect(reopened.getUserBetaAccess('beta-on')).toBe(true);
-            expect(reopened.getUserBetaAccess('beta-off')).toBe(false);
-            expect(reopened.setUserBetaAccessGlobal('beta-off', true)).toBe(true);
-        }
-        finally {
-            reopened.close();
-        }
-        const reopenedAgain = openCore(projectRoot);
-        try {
-            expect(reopenedAgain.getUserBetaAccess('beta-off')).toBe(true);
-        }
-        finally {
-            reopenedAgain.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('resolvePreferredUserWorkspaceId prefers explicit and persisted ids before fallback', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot);
-        try {
-            core.createWorkspace({ workspaceId: 'workspace-a', name: 'Workspace A' });
-            core.createWorkspace({ workspaceId: 'workspace-b', name: 'Workspace B' });
-            core.ensureBootstrapUserAccess({
-                userId: 'member-1',
-                workspaceId: 'workspace-a',
-                role: 'member',
-                email: 'member-1@example.com'
-            });
-            core.ensureBootstrapUserAccess({
-                userId: 'member-1',
-                workspaceId: 'workspace-b',
-                role: 'member',
-                email: 'member-1@example.com'
-            });
-            expect(core.resolvePreferredUserWorkspaceId('member-1', { preferredWorkspaceId: 'workspace-b' })).toBe('workspace-b');
-            expect(core.resolvePreferredUserWorkspaceId('member-1', { persistedWorkspaceId: 'workspace-a' })).toBe('workspace-a');
-            expect(core.resolvePreferredUserWorkspaceId('member-1', { preferredWorkspaceId: 'workspace-missing', persistedWorkspaceId: 'workspace-b' })).toBe('workspace-b');
-            expect(core.resolvePreferredUserWorkspaceId('member-1')).toBeTruthy();
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-    it('resolvePreferredUserWorkspaceId returns null for users with no active memberships', () => {
-        const projectRoot = makeProjectRoot();
-        const core = openCore(projectRoot, { seedDefaultPlans: true });
-        try {
-            const created = core.registerPasswordUser({
-                email: 'nomembership@example.com',
-                password: 'ValidPassphrase123!'
-            });
-            expect(core.resolvePreferredUserWorkspaceId(created.userId)).toBeNull();
-        }
-        finally {
-            core.close();
-            fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-    });
-});