@taskforcehq/taskforce 0.3.309 → 0.3.313

package/dist/server/routes/billing.test.js

@@ -1,3455 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { Readable } from 'stream';
-import Database from 'better-sqlite3';
-import { registerBillingRoutes } from './billing';
-const mockConstructEvent = vi.fn();
-const mockPricesList = vi.fn(async () => ({ data: [], has_more: false }));
-const mockPriceRetrieve = vi.fn(async (id) => ({ id, active: true, currency: 'usd', unit_amount: 1500, recurring: { interval: 'month' } }));
-const mockCheckoutCreate = vi.fn(async () => ({
-    id: 'cs_test',
-    url: 'https://example.test/checkout',
-    expires_at: Math.floor(Date.now() / 1000) + (24 * 60 * 60)
-}));
-const mockCheckoutRetrieve = vi.fn(async (id) => ({
-    id,
-    mode: 'subscription',
-    status: 'complete',
-    payment_status: 'paid',
-    customer: 'cus_123',
-    subscription: 'sub_123',
-    metadata: { userId: 'u1' }
-}));
-const mockPortalCreate = vi.fn(async () => ({ id: 'bps_test', url: 'https://example.test/portal' }));
-const mockSubscriptionCancel = vi.fn(async () => ({ id: 'sub_test', status: 'canceled' }));
-const mockSubscriptionList = vi.fn(async () => ({ data: [] }));
-const mockCustomersList = vi.fn(async () => ({ data: [] }));
-const mockSubscriptionUpdate = vi.fn(async (id, input) => ({
-    id,
-    customer: 'cus_123',
-    status: 'active',
-    trial_end: null,
-    metadata: {
-        userId: 'u1',
-        planVersionId: String(input?.metadata?.planVersionId || 'pro-v1')
-    },
-    items: {
-        data: [{
-                id: 'si_123',
-                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                price: { id: String(input?.items?.[0]?.price || 'price_pro_month'), recurring: { interval: 'month' } }
-            }]
-    }
-}));
-const mockSubscriptionRetrieve = vi.fn(async (id) => ({
-    id,
-    customer: 'cus_123',
-    status: 'active',
-    trial_end: null,
-    metadata: { userId: 'u1', planVersionId: 'pro-v1' },
-    items: {
-        data: [{
-                id: 'si_123',
-                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-            }]
-    }
-}));
-vi.mock('stripe', () => ({
-    default: class StripeMock {
-        webhooks = {
-            constructEvent: mockConstructEvent
-        };
-        prices = {
-            list: mockPricesList,
-            retrieve: mockPriceRetrieve
-        };
-        checkout = {
-            sessions: {
-                create: mockCheckoutCreate,
-                retrieve: mockCheckoutRetrieve
-            }
-        };
-        billingPortal = {
-            sessions: {
-                create: mockPortalCreate
-            }
-        };
-        customers = {
-            list: mockCustomersList
-        };
-        subscriptions = {
-            cancel: mockSubscriptionCancel,
-            retrieve: mockSubscriptionRetrieve,
-            update: mockSubscriptionUpdate,
-            list: mockSubscriptionList
-        };
-        constructor(_apiKey) { }
-    }
-}));
-function createMockReq(body, headers = {}) {
-    const req = Readable.from([Buffer.from(body, 'utf8')]);
-    req.headers = headers;
-    return req;
-}
-function createMockRes() {
-    const response = {
-        statusCode: 200,
-        headers: {},
-        body: '',
-        writeHead: vi.fn((statusCode, headers) => {
-            response.statusCode = statusCode;
-            response.headers = headers || {};
-            return response;
-        }),
-        end: vi.fn((payload) => {
-            response.body = String(payload || '');
-            return response;
-        })
-    };
-    return response;
-}
-function setupBillingSchema(db) {
-    db.exec(`
-        CREATE TABLE user_billing (
-            user_id TEXT PRIMARY KEY,
-            tenant_id TEXT NOT NULL,
-            stripe_customer_id TEXT,
-            stripe_subscription_id TEXT,
-            stripe_price_id TEXT,
-            stripe_status TEXT,
-            tier TEXT NOT NULL DEFAULT '',
-            billing_interval TEXT,
-            entitlement_state TEXT NOT NULL DEFAULT 'active',
-            trial_end TEXT,
-            current_period_end TEXT,
-            effective_until TEXT,
-            created_at TEXT NOT NULL,
-            updated_at TEXT NOT NULL
-        );
-        CREATE TABLE stripe_webhook_events (
-            event_id TEXT PRIMARY KEY,
-            tenant_id TEXT NOT NULL,
-            event_type TEXT NOT NULL,
-            processed_at TEXT NOT NULL
-        );
-        CREATE TABLE stripe_webhook_failures (
-            id TEXT PRIMARY KEY,
-            tenant_id TEXT NOT NULL,
-            event_id TEXT NOT NULL,
-            event_type TEXT,
-            reason TEXT NOT NULL,
-            payload_excerpt TEXT,
-            purge_after TEXT NOT NULL,
-            created_at TEXT NOT NULL
-        );
-        CREATE TABLE billing_checkout_attempts (
-            session_id TEXT PRIMARY KEY,
-            tenant_id TEXT NOT NULL,
-            user_id TEXT NOT NULL,
-            plan_version_id TEXT NOT NULL,
-            billing_interval TEXT,
-            status TEXT NOT NULL DEFAULT 'open',
-            expires_at TEXT,
-            created_at TEXT NOT NULL,
-            updated_at TEXT NOT NULL
-        );
-        CREATE TABLE billing_price_mappings (
-            tenant_id TEXT NOT NULL,
-            plan_version_id TEXT NOT NULL,
-            billing_interval TEXT NOT NULL,
-            pricing_audience TEXT NOT NULL DEFAULT 'public',
-            stripe_price_id TEXT NOT NULL,
-            pricing_type TEXT NOT NULL DEFAULT 'stripe',
-            active INTEGER NOT NULL DEFAULT 1,
-            unit_amount INTEGER,
-            currency TEXT,
-            created_at TEXT NOT NULL,
-            updated_at TEXT NOT NULL,
-            PRIMARY KEY (tenant_id, plan_version_id, billing_interval, pricing_audience, stripe_price_id)
-        );
-        CREATE UNIQUE INDEX idx_billing_price_mappings_active_interval
-        ON billing_price_mappings (tenant_id, plan_version_id, billing_interval, pricing_audience)
-        WHERE active = 1;
-        CREATE TABLE plan_versions (
-            plan_version_id TEXT PRIMARY KEY,
-            tenant_id TEXT NOT NULL,
-            plan_id TEXT NOT NULL,
-            version_number INTEGER NOT NULL,
-            is_default INTEGER NOT NULL DEFAULT 0,
-            seat_limit INTEGER,
-            metadata_json TEXT NOT NULL DEFAULT '{}',
-            created_at TEXT NOT NULL,
-            updated_at TEXT NOT NULL
-        );
-        CREATE TABLE plan_feature_matrix (
-            tenant_id TEXT NOT NULL,
-            plan_version_id TEXT NOT NULL,
-            feature_key TEXT NOT NULL,
-            access TEXT NOT NULL DEFAULT 'disabled',
-            config_json TEXT NOT NULL DEFAULT '{}',
-            created_at TEXT NOT NULL,
-            updated_at TEXT NOT NULL,
-            PRIMARY KEY (tenant_id, plan_version_id, feature_key)
-        );
-        CREATE TABLE plan_catalog (
-            plan_id TEXT PRIMARY KEY,
-            tenant_id TEXT NOT NULL,
-            display_name TEXT NOT NULL,
-            status TEXT NOT NULL DEFAULT 'active',
-            created_at TEXT NOT NULL,
-            updated_at TEXT NOT NULL
-        );
-        CREATE TABLE plan_feature_catalog_overrides (
-            tenant_id TEXT NOT NULL,
-            feature_key TEXT NOT NULL,
-            public_label TEXT,
-            public_description TEXT,
-            public_display_order INTEGER,
-            created_at TEXT NOT NULL,
-            updated_at TEXT NOT NULL,
-            PRIMARY KEY (tenant_id, feature_key)
-        );
-        CREATE TABLE account_entitlements (
-            account_id TEXT PRIMARY KEY,
-            tenant_id TEXT NOT NULL,
-            plan_version_id TEXT NOT NULL,
-            entitlement_state TEXT NOT NULL DEFAULT 'active',
-            effective_at TEXT,
-            effective_until TEXT,
-            updated_by TEXT,
-            created_at TEXT NOT NULL,
-            updated_at TEXT NOT NULL
-        );
-        CREATE TABLE system_settings (
-            tenant_id TEXT NOT NULL,
-            settings_key TEXT NOT NULL,
-            payload TEXT,
-            updated_at TEXT NOT NULL,
-            PRIMARY KEY (tenant_id, settings_key)
-        );
-    `);
-}
-function readMockPlanVersionFeatures(db, tenantId, planVersionId) {
-    try {
-        return db.prepare(`
-            SELECT feature_key, access, config_json
-            FROM plan_feature_matrix
-            WHERE tenant_id = ? AND plan_version_id = ?
-        `).all(tenantId, planVersionId).reduce((acc, row) => {
-            const featureKey = String(row?.feature_key || '').trim();
-            if (!featureKey)
-                return acc;
-            acc[featureKey] = {
-                featureKey,
-                access: String(row?.access || '').trim(),
-                config: row?.config_json ? JSON.parse(String(row.config_json)) : {}
-            };
-            return acc;
-        }, {});
-    }
-    catch (error) {
-        const message = String(error?.message || '');
-        if (message.toLowerCase().includes('no such table: plan_feature_matrix')) {
-            return {};
-        }
-        throw error;
-    }
-}
-function buildBillingRouteHandlers(db, opts) {
-    const routes = new Map();
-    const tenantId = 'default';
-    const siteSettings = opts?.siteSettings || {};
-    const resolvePlanIdForVersion = (planVersionIdRaw) => {
-        const planVersionId = String(planVersionIdRaw || '').trim();
-        if (!planVersionId)
-            return '';
-        const row = db.prepare(`
-            SELECT plan_id
-            FROM plan_versions
-            WHERE tenant_id = ? AND plan_version_id = ?
-            LIMIT 1
-        `).get(tenantId, planVersionId);
-        return String(row?.plan_id || '').trim();
-    };
-    const core = {
-        getDatabaseAdapter: () => db,
-        getTenantId: () => tenantId,
-        createUserBillingRecord: (userId) => {
-            const now = new Date().toISOString();
-            db.prepare(`
-                INSERT INTO user_billing (
-                    user_id, tenant_id, tier, entitlement_state, created_at, updated_at
-                ) VALUES (?, ?, '', 'active', ?, ?)
-                ON CONFLICT (user_id) DO NOTHING
-            `).run(userId, tenantId, now, now);
-        },
-        transitionCanonicalCommercialState: (input) => {
-            const now = new Date().toISOString();
-            const planVersionId = String(input.planVersionId || '').trim();
-            const effectiveAt = input.effectiveAt || now;
-            const effectiveUntil = input.effectiveUntil || null;
-            db.prepare(`
-                INSERT INTO account_entitlements (
-                    account_id, tenant_id, plan_version_id, entitlement_state, effective_at, effective_until, updated_by, created_at, updated_at
-                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-                ON CONFLICT (account_id) DO UPDATE SET
-                    plan_version_id = excluded.plan_version_id,
-                    entitlement_state = excluded.entitlement_state,
-                    effective_at = excluded.effective_at,
-                    effective_until = excluded.effective_until,
-                    updated_by = excluded.updated_by,
-                    updated_at = excluded.updated_at
-            `).run(input.accountId, tenantId, planVersionId, input.state, effectiveAt, effectiveUntil, input.updatedBy, input.createdAt || now, input.updatedAt || now);
-            const planId = typeof input.billingMirrorPlanId === 'string'
-                ? input.billingMirrorPlanId
-                : resolvePlanIdForVersion(planVersionId);
-            db.prepare(`
-                INSERT INTO user_billing (
-                    user_id, tenant_id, tier, entitlement_state, effective_until, created_at, updated_at
-                ) VALUES (?, ?, ?, ?, ?, ?, ?)
-                ON CONFLICT (user_id) DO UPDATE SET
-                    tier = excluded.tier,
-                    entitlement_state = excluded.entitlement_state,
-                    effective_until = excluded.effective_until,
-                    updated_at = excluded.updated_at
-            `).run(input.accountId, tenantId, planId, input.state, effectiveUntil, now, now);
-        },
-        listPlanCatalog: () => [
-            { planId: 'pro', displayName: 'Pro Plan', status: 'active', createdAt: '', updatedAt: '' },
-            { planId: 'inactive-plan', displayName: 'Inactive', status: 'archived', createdAt: '', updatedAt: '' },
-            { planId: 'empty-plan', displayName: 'Empty', status: 'active', createdAt: '', updatedAt: '' },
-            { planId: 'starter', displayName: 'Starter', status: 'active', createdAt: '', updatedAt: '' }
-        ],
-        listPlanVersions: (planId) => {
-            return db.prepare(`
-                SELECT plan_version_id, plan_id, version_number, is_default, seat_limit, metadata_json
-                FROM plan_versions
-                WHERE tenant_id = ? AND plan_id = ?
-                ORDER BY version_number ASC
-            `).all(tenantId, planId).map((row) => {
-                const metadata = row?.metadata_json ? JSON.parse(String(row.metadata_json)) : {};
-                return {
-                    planVersionId: String(row?.plan_version_id || ''),
-                    planId: String(row?.plan_id || ''),
-                    versionNumber: Number(row?.version_number || 1),
-                    isDefault: Number(row?.is_default || 0) === 1,
-                    seatLimit: row?.seat_limit === null || row?.seat_limit === undefined ? null : Number(row.seat_limit),
-                    trialDays: Number.isFinite(Number(metadata?.trialDays)) ? Number(metadata.trialDays) : 0,
-                    metadata,
-                    features: readMockPlanVersionFeatures(db, tenantId, String(row?.plan_version_id || '')),
-                    createdAt: '',
-                    updatedAt: ''
-                };
-            });
-        },
-        listPlanFeatureCatalog: () => {
-            const overrides = db.prepare(`
-                SELECT feature_key, public_label, public_description, public_display_order
-                FROM plan_feature_catalog_overrides
-                WHERE tenant_id = ?
-            `).all(tenantId);
-            const overrideMap = new Map(overrides.map((row) => [
-                String(row.feature_key || '').trim(),
-                {
-                    publicLabel: row.public_label ?? null,
-                    publicDescription: row.public_description ?? null,
-                    publicDisplayOrder: row.public_display_order ?? null
-                }
-            ]));
-            return [
-                {
-                    featureKey: 'collaboration.team_management',
-                    label: 'Team Management',
-                    description: 'Allow managing members, invites, roles, and collaboration settings.',
-                    publicLabel: overrideMap.get('collaboration.team_management')?.publicLabel ?? null,
-                    publicDescription: overrideMap.get('collaboration.team_management')?.publicDescription ?? null,
-                    publicDisplayOrder: overrideMap.get('collaboration.team_management')?.publicDisplayOrder ?? 40,
-                    allowedAccessModes: ['enabled', 'disabled'],
-                    configTemplate: {}
-                },
-                {
-                    featureKey: 'context.uploads',
-                    label: 'Document Cloud Storage',
-                    description: 'Allow cloud document storage with an optional storage allowance in MB.',
-                    publicLabel: overrideMap.get('context.uploads')?.publicLabel ?? null,
-                    publicDescription: overrideMap.get('context.uploads')?.publicDescription ?? null,
-                    publicDisplayOrder: overrideMap.get('context.uploads')?.publicDisplayOrder ?? 30,
-                    allowedAccessModes: ['enabled', 'disabled'],
-                    configTemplate: { storageLimitMb: 1024 }
-                },
-                {
-                    featureKey: 'workspace.workspaces',
-                    label: 'Workspaces',
-                    description: 'Allow multiple workspaces with a configurable workspace limit.',
-                    publicLabel: overrideMap.get('workspace.workspaces')?.publicLabel ?? null,
-                    publicDescription: overrideMap.get('workspace.workspaces')?.publicDescription ?? null,
-                    publicDisplayOrder: overrideMap.get('workspace.workspaces')?.publicDisplayOrder ?? 10,
-                    allowedAccessModes: ['enabled', 'disabled'],
-                    configTemplate: { maxWorkspaces: 1 }
-                },
-                {
-                    featureKey: 'collaboration.ai_profiles',
-                    label: 'AI Profiles',
-                    description: 'Allow registered AI collaborator profiles with an optional per-workspace limit.',
-                    publicLabel: overrideMap.get('collaboration.ai_profiles')?.publicLabel ?? null,
-                    publicDescription: overrideMap.get('collaboration.ai_profiles')?.publicDescription ?? null,
-                    publicDisplayOrder: overrideMap.get('collaboration.ai_profiles')?.publicDisplayOrder ?? 20,
-                    allowedAccessModes: ['enabled', 'limited', 'disabled'],
-                    configTemplate: { maxAiProfiles: 1 }
-                }
-            ];
-        },
-        getAccountEntitlement: () => {
-            const entitlement = opts?.accessStatus?.entitlement;
-            return {
-                accountId: String(entitlement?.accountId || 'u1'),
-                planVersionId: String(entitlement?.planVersionId || 'pro-v1'),
-                planId: String(entitlement?.planId || 'pro'),
-                state: String(entitlement?.state || 'active'),
-                effectiveAt: entitlement?.effectiveAt ?? null,
-                effectiveUntil: entitlement?.effectiveUntil ?? null,
-                updatedBy: null,
-                createdAt: '',
-                updatedAt: ''
-            };
-        },
-        getAccountAccessStatus: () => opts?.accessStatus || ({
-            gate: 'ok',
-            hasEntitlement: true,
-            canAccessApp: true,
-            canAccessPlans: true,
-            planSelectionRequired: false,
-            message: null,
-            entitlement: {
-                accountId: 'u1',
-                planVersionId: 'pro-v1',
-                planId: 'pro',
-                state: 'active',
-                effectiveAt: null,
-                effectiveUntil: null
-            }
-        }),
-        getBillingMirrorProfileForPlanVersion: (planVersionId) => ({
-            planId: planVersionId.startsWith('pro') ? 'pro' : 'starter',
-            entitlementState: 'active'
-        }),
-        getGlobalSettings: () => ({
-            site: siteSettings
-        }),
-        resolveUserIdentity: () => opts?.userIdentity === undefined
-            ? {
-                userId: 'u1',
-                email: 'owner@example.com',
-                systemRole: 'user',
-                betaAccess: true
-            }
-            : opts.userIdentity,
-        updateAccountEntitlement: vi.fn().mockReturnValue({
-            accountId: 'u1',
-            planVersionId: 'starter-v1',
-            planId: 'starter',
-            state: 'active',
-            effectiveAt: null,
-            effectiveUntil: null
-        })
-    };
-    registerBillingRoutes({
-        addRoute: (method, path, handler) => routes.set(`${method} ${path}`, handler),
-        core,
-        context: {
-            getRuntimeMode: () => 'cloud'
-        },
-        ensureAuthenticatedUser: () => true,
-        ensureAdminRole: () => opts?.isAdmin !== false,
-        requestUserId: () => 'u1',
-        resolveErrorStatusCode: (_error, fallback = 500) => fallback,
-        auditAdminAction: () => { }
-    });
-    return routes;
-}
-describe('Billing Webhook Routes', () => {
-    const originalEnv = { ...process.env };
-    let db;
-    let webhookHandler;
-    let routeHandlers;
-    beforeEach(() => {
-        vi.clearAllMocks();
-        db = new Database(':memory:');
-        setupBillingSchema(db);
-        routeHandlers = buildBillingRouteHandlers(db);
-        webhookHandler = routeHandlers.get('POST /api/taskforce/billing/webhook');
-        process.env.TASKFORCE_BILLING_ENABLED = 'true';
-        process.env.TASKFORCE_STRIPE_SECRET_KEY = 'sk_test_123';
-        process.env.TASKFORCE_STRIPE_WEBHOOK_SECRET = 'whsec_123';
-    });
-    afterEach(() => {
-        process.env = { ...originalEnv };
-        db.close();
-    });
-    it('returns 400 for invalid webhook signature', async () => {
-        mockConstructEvent.mockImplementation(() => {
-            throw new Error('invalid signature');
-        });
-        const req = createMockReq('{"id":"evt_bad"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'bad_signature'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(400);
-    });
-    it('returns 200 no-op for duplicate event id', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO stripe_webhook_events (event_id, tenant_id, event_type, processed_at)
-            VALUES (?, 'default', ?, ?)
-        `).run('evt_dupe', 'invoice.paid', now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_dupe',
-            type: 'invoice.paid',
-            data: {
-                object: {
-                    customer: 'cus_1',
-                    lines: { data: [{ price: { id: 'price_1', recurring: { interval: 'month' } } }] }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_dupe"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(JSON.parse(res.body)).toEqual({ received: true, duplicate: true });
-    });
-    it('returns 500 on processing failure so Stripe can retry', async () => {
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_fail',
-            type: 'invoice.paid',
-            data: {
-                object: {
-                    customer: 'cus_missing',
-                    lines: { data: [{ price: { id: 'price_1', recurring: { interval: 'month' } } }] }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_fail"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(500);
-        const failures = db.prepare(`SELECT event_id, reason FROM stripe_webhook_failures WHERE event_id = ?`).all('evt_fail');
-        expect(failures.length).toBeGreaterThan(0);
-        expect(failures[0]?.reason || '').toContain('Unable to resolve user for invoice event.');
-    });
-    it('preserves existing entitlement on unknown price_id and logs failure', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO user_billing (user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at)
-            VALUES ('u1', 'default', 'cus_123', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, created_at, updated_at
-            ) VALUES ('u1', 'default', 'starter-v1', 'active', ?, ?, ?)
-        `).run(now, now, now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_unknown_price',
-            type: 'customer.subscription.updated',
-            data: {
-                object: {
-                    id: 'sub_123',
-                    customer: 'cus_123',
-                    status: 'active',
-                    trial_end: null,
-                    metadata: {},
-                    items: {
-                        data: [{
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_unknown', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_unknown_price"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT plan_version_id
-            FROM account_entitlements
-            WHERE account_id = 'u1' AND tenant_id = 'default'
-        `).get();
-        expect(entitlement.plan_version_id).toBe('starter-v1');
-        const failure = db.prepare(`
-            SELECT reason
-            FROM stripe_webhook_failures
-            WHERE event_id = 'evt_unknown_price'
-            ORDER BY created_at DESC
-            LIMIT 1
-        `).get();
-        expect(failure.reason).toContain('Unknown price mapping');
-    });
-    it('keeps blocked accounts in checkout_pending when Stripe reports an incomplete subscription', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at)
-            VALUES ('u1', 'default', 'cus_123', 'checkout_pending', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'checkout_pending', ?, 'checkout-start', ?, ?)
-        `).run(now, now, now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_incomplete_subscription',
-            type: 'customer.subscription.updated',
-            data: {
-                object: {
-                    id: 'sub_123',
-                    customer: 'cus_123',
-                    status: 'incomplete',
-                    trial_end: null,
-                    metadata: { planVersionId: 'pro-v1' },
-                    items: {
-                        data: [{
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_incomplete_subscription"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state, updated_by
-            FROM account_entitlements
-            WHERE account_id = 'u1' AND tenant_id = 'default'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'pro-v1',
-            entitlement_state: 'checkout_pending',
-            updated_by: 'stripe-webhook'
-        }));
-        const billing = db.prepare(`
-            SELECT entitlement_state, stripe_status, stripe_subscription_id
-            FROM user_billing
-            WHERE user_id = 'u1' AND tenant_id = 'default'
-            LIMIT 1
-        `).get();
-        expect(billing).toEqual(expect.objectContaining({
-            entitlement_state: 'checkout_pending',
-            stripe_status: 'incomplete',
-            stripe_subscription_id: 'sub_123'
-        }));
-    });
-    it('preserves active access when Stripe reports an incomplete subscription for an already-active account', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at)
-            VALUES ('u1', 'default', 'cus_123', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'active', ?, 'stripe-webhook', ?, ?)
-        `).run(now, now, now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_incomplete_active_account',
-            type: 'customer.subscription.updated',
-            data: {
-                object: {
-                    id: 'sub_123',
-                    customer: 'cus_123',
-                    status: 'incomplete',
-                    trial_end: null,
-                    metadata: { planVersionId: 'pro-v1' },
-                    items: {
-                        data: [{
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_incomplete_active_account"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT entitlement_state, updated_by
-            FROM account_entitlements
-            WHERE account_id = 'u1' AND tenant_id = 'default'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            entitlement_state: 'active',
-            updated_by: 'stripe-webhook'
-        }));
-        const billing = db.prepare(`
-            SELECT entitlement_state, stripe_status
-            FROM user_billing
-            WHERE user_id = 'u1' AND tenant_id = 'default'
-            LIMIT 1
-        `).get();
-        expect(billing).toEqual(expect.objectContaining({
-            entitlement_state: 'active',
-            stripe_status: 'incomplete'
-        }));
-    });
-    it('ignores superseded subscription webhook events for a stale checkout plan selection', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at)
-            VALUES ('u1', 'default', 'cus_123', 'checkout_pending', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, effective_until, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'team-v1', 'checkout_pending', ?, ?, 'checkout-start', ?, ?)
-        `).run(now, new Date(Date.now() + 60 * 60 * 1000).toISOString(), now, now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_stale_checkout_superseded',
-            type: 'customer.subscription.updated',
-            data: {
-                object: {
-                    id: 'sub_123',
-                    customer: 'cus_123',
-                    status: 'active',
-                    trial_end: null,
-                    metadata: { planVersionId: 'pro-v1' },
-                    items: {
-                        data: [{
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_stale_checkout_superseded"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state
-            FROM account_entitlements
-            WHERE account_id = 'u1' AND tenant_id = 'default'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'team-v1',
-            entitlement_state: 'checkout_pending'
-        }));
-        const failure = db.prepare(`
-            SELECT reason
-            FROM stripe_webhook_failures
-            WHERE event_id = 'evt_stale_checkout_superseded'
-            ORDER BY created_at DESC
-            LIMIT 1
-        `).get();
-        expect(String(failure?.reason || '')).toContain('no longer current for this account');
-    });
-    it('allows authoritative subscription webhooks to recover accounts after the local checkout expired', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'team-v1', 'month', 'price_team_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'pending_plan_selection', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, effective_until, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'team-v1', 'pending_plan_selection', ?, NULL, 'checkout-expired', ?, ?)
-        `).run(now, now, now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_checkout_expired_recovery',
-            type: 'customer.subscription.updated',
-            data: {
-                object: {
-                    id: 'sub_123',
-                    customer: 'cus_123',
-                    status: 'active',
-                    trial_end: null,
-                    metadata: { planVersionId: 'team-v1' },
-                    items: {
-                        data: [{
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_team_month', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_checkout_expired_recovery"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state, updated_by
-            FROM account_entitlements
-            WHERE account_id = 'u1' AND tenant_id = 'default'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'team-v1',
-            entitlement_state: 'active',
-            updated_by: 'stripe-webhook'
-        }));
-        const failure = db.prepare(`
-            SELECT reason
-            FROM stripe_webhook_failures
-            WHERE event_id = 'evt_checkout_expired_recovery'
-            ORDER BY created_at DESC
-            LIMIT 1
-        `).get();
-        expect(failure).toBeUndefined();
-    });
-    it('ignores stale subscription webhooks for active accounts when a newer checkout attempt is open', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('starter-v1', 'default', 'starter', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, tier, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'starter', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'starter-v1', 'active', ?, 'free-plan-selection', ?, ?)
-        `).run(now, now, now);
-        db.prepare(`
-            INSERT INTO billing_checkout_attempts (
-                session_id, tenant_id, user_id, plan_version_id, billing_interval, status, expires_at, created_at, updated_at
-            ) VALUES ('cs_newer', 'default', 'u1', 'team-v1', 'month', 'open', ?, ?, ?)
-        `).run(new Date(Date.now() + 60 * 60 * 1000).toISOString(), now, now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_active_stale_checkout',
-            type: 'customer.subscription.updated',
-            data: {
-                object: {
-                    id: 'sub_stale',
-                    customer: 'cus_123',
-                    status: 'active',
-                    trial_end: null,
-                    metadata: { planVersionId: 'pro-v1' },
-                    items: {
-                        data: [{
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_active_stale_checkout"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state
-            FROM account_entitlements
-            WHERE account_id = 'u1' AND tenant_id = 'default'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'starter-v1',
-            entitlement_state: 'active'
-        }));
-        const failure = db.prepare(`
-            SELECT reason
-            FROM stripe_webhook_failures
-            WHERE event_id = 'evt_active_stale_checkout'
-            ORDER BY created_at DESC
-            LIMIT 1
-        `).get();
-        expect(String(failure?.reason || '')).toContain('no longer current for this account');
-    });
-    it('purges expired webhook failures during webhook processing', async () => {
-        const past = new Date(Date.now() - 48 * 60 * 60 * 1000).toISOString();
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO stripe_webhook_failures (id, tenant_id, event_id, event_type, reason, payload_excerpt, purge_after, created_at)
-            VALUES ('whf_old', 'default', 'evt_old', 'invoice.paid', 'old', '{}', ?, ?)
-        `).run(past, now);
-        db.prepare(`
-            INSERT INTO stripe_webhook_events (event_id, tenant_id, event_type, processed_at)
-            VALUES ('evt_dup_for_purge', 'default', 'invoice.paid', ?)
-        `).run(now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_dup_for_purge',
-            type: 'invoice.paid',
-            data: { object: { customer: 'cus_1', lines: { data: [] } } }
-        });
-        const req = createMockReq('{"id":"evt_dup_for_purge"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const row = db.prepare(`SELECT id FROM stripe_webhook_failures WHERE id = 'whf_old'`).get();
-        expect(row).toBeUndefined();
-    });
-    it('creates checkout session with plans success/cancel URLs and selection context', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        expect(checkoutHandler).toBeTypeOf('function');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockCheckoutCreate).toHaveBeenCalledTimes(1);
-        const firstCall = mockCheckoutCreate.mock.calls[0];
-        const args = (Array.isArray(firstCall) ? firstCall[0] : {});
-        expect(String(args.success_url || '')).toContain('/?screen=plans&checkout=success');
-        expect(String(args.success_url || '')).toContain('planId=collab');
-        expect(String(args.success_url || '')).toContain('planVersionId=collab-v1');
-        expect(String(args.success_url || '')).toContain('interval=month');
-        expect(String(args.cancel_url || '')).toContain('/?screen=plans&checkout=cancel');
-        expect(String(args.cancel_url || '')).toContain('planId=collab');
-        expect(String(args.cancel_url || '')).toContain('planVersionId=collab-v1');
-        expect(String(args.cancel_url || '')).toContain('interval=month');
-        expect(args.line_items?.[0]?.price).toBe('price_collab_month');
-        expect(args.customer).toBeUndefined();
-        expect(args.customer_email).toBe('owner@example.com');
-    });
-    it('creates checkout with the campaign price mapping when requested', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, pricing_audience, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'public', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, pricing_audience, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'campaign', 'price_collab_campaign_month', 1, ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month',
-            pricingAudience: 'campaign'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler?.(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const args = mockCheckoutCreate.mock.calls.at(-1)?.[0];
-        expect(args.line_items?.[0]?.price).toBe('price_collab_campaign_month');
-        expect(String(args.success_url || '')).toContain('pricingAudience=campaign');
-        expect(String(args.cancel_url || '')).toContain('pricingAudience=campaign');
-        expect(args.metadata?.pricingAudience).toBe('campaign');
-        expect(args.subscription_data?.metadata?.pricingAudience).toBe('campaign');
-    });
-    it('uses per-version trial days when creating checkout', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{"trialDays":21}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const args = mockCheckoutCreate.mock.calls.at(-1)?.[0];
-        expect(args.subscription_data?.trial_period_days).toBe(21);
-    });
-    it('omits Stripe trial period when the selected version trialDays is 0', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{"trialDays":0}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const args = mockCheckoutCreate.mock.calls.at(-1)?.[0];
-        expect(args.subscription_data?.trial_period_days).toBeUndefined();
-    });
-    it('creates checkout session with existing stripe customer and no customer_email override', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at)
-            VALUES ('u1', 'default', 'cus_existing', 'active', ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const args = mockCheckoutCreate.mock.calls.at(-1)?.[0];
-        expect(args.customer).toBe('cus_existing');
-        expect(args.customer_email).toBeUndefined();
-    });
-    it('records checkout_pending when a blocked account starts a paid checkout', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, created_at, updated_at
-            ) VALUES ('u1', 'default', 'starter-v1', 'pending_plan_selection', ?, ?, ?)
-        `).run(now, now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(JSON.parse(res.body)).toEqual(expect.objectContaining({
-            checkoutState: 'checkout',
-            id: 'cs_test'
-        }));
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state, updated_by
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'collab-v1',
-            entitlement_state: 'checkout_pending',
-            updated_by: 'checkout-start'
-        }));
-        const billing = db.prepare(`
-            SELECT tier, entitlement_state, effective_until
-            FROM user_billing
-            WHERE tenant_id = 'default' AND user_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(billing).toEqual(expect.objectContaining({
-            tier: 'collab',
-            entitlement_state: 'checkout_pending'
-        }));
-        expect(typeof billing?.effective_until).toBe('string');
-    });
-    it('does not downgrade an active account to checkout_pending when starting paid checkout', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'team-v1', 'month', 'price_team_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'active', ?, 'stripe-webhook', ?, ?)
-        `).run(now, now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, tier, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_existing', 'pro', 'active', ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'team-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state, updated_by
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'pro-v1',
-            entitlement_state: 'active',
-            updated_by: 'stripe-webhook'
-        }));
-        const billing = db.prepare(`
-            SELECT tier, entitlement_state
-            FROM user_billing
-            WHERE tenant_id = 'default' AND user_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(billing).toEqual(expect.objectContaining({
-            tier: 'pro',
-            entitlement_state: 'active'
-        }));
-    });
-    it('supersedes a stale checkout_pending selection when the user retries paid checkout', async () => {
-        const now = new Date().toISOString();
-        const previousExpiry = new Date(Date.now() - (60 * 60 * 1000)).toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'team-v1', 'month', 'price_team_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, effective_until, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'checkout_pending', ?, ?, 'checkout-start', ?, ?)
-        `).run(now, previousExpiry, now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, tier, entitlement_state, effective_until, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro', 'checkout_pending', ?, ?, ?)
-        `).run(previousExpiry, now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'team-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state, effective_until
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'team-v1',
-            entitlement_state: 'checkout_pending'
-        }));
-        expect(entitlement?.effective_until).not.toBe(previousExpiry);
-        const billing = db.prepare(`
-            SELECT tier, entitlement_state, effective_until
-            FROM user_billing
-            WHERE tenant_id = 'default' AND user_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(billing).toEqual(expect.objectContaining({
-            tier: 'team',
-            entitlement_state: 'checkout_pending'
-        }));
-        expect(billing?.effective_until).not.toBe(previousExpiry);
-    });
-    it('reuses an existing Stripe customer discovered by account email before creating checkout', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        mockCustomersList.mockResolvedValueOnce({
-            data: [{ id: 'cus_email_match' }]
-        });
-        mockSubscriptionList.mockResolvedValueOnce({ data: [] });
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const args = mockCheckoutCreate.mock.calls.at(-1)?.[0];
-        expect(args.customer).toBe('cus_email_match');
-        expect(args.customer_email).toBeUndefined();
-    });
-    it('builds checkout return URLs from explicit local proxy origin headers', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'performance-app.taskforcehq.ai',
-            'x-taskforce-origin-host': 'localhost:5174',
-            'x-taskforce-origin-proto': 'http',
-            'x-taskforce-origin-base-url': 'http://localhost:5174',
-            'x-taskforce-origin-runtime': 'local-proxy',
-            'x-forwarded-host': 'localhost:5174',
-            'x-forwarded-proto': 'http'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const args = mockCheckoutCreate.mock.calls.at(-1)?.[0];
-        expect(String(args.success_url || '')).toContain('http://localhost:5174/?screen=plans&checkout=success');
-        expect(String(args.success_url || '')).toContain('planId=collab');
-        expect(String(args.success_url || '')).toContain('planVersionId=collab-v1');
-        expect(String(args.success_url || '')).toContain('interval=month');
-        expect(String(args.cancel_url || '')).toContain('http://localhost:5174/?screen=plans&checkout=cancel');
-        expect(JSON.parse(res.body)).toEqual(expect.objectContaining({
-            checkoutState: 'checkout',
-            returnBaseUrl: 'http://localhost:5174'
-        }));
-    });
-    it('prefers explicit proxy-origin headers over generic forwarded host values', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'performance-app.taskforcehq.ai',
-            'x-taskforce-origin-host': 'localhost:5174',
-            'x-taskforce-origin-proto': 'http',
-            'x-taskforce-origin-runtime': 'local-proxy',
-            'x-forwarded-host': 'performance-app.taskforcehq.ai',
-            'x-forwarded-proto': 'https'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const args = mockCheckoutCreate.mock.calls.at(-1)?.[0];
-        expect(String(args.success_url || '')).toContain('http://localhost:5174/?screen=plans&checkout=success');
-        expect(String(args.success_url || '')).toContain('planId=collab');
-        expect(String(args.success_url || '')).toContain('planVersionId=collab-v1');
-        expect(String(args.success_url || '')).toContain('interval=month');
-    });
-    it('builds direct cloud checkout return URLs from the actual request protocol when forwarded proto is absent', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: '127.0.0.1:4173'
-        });
-        req.socket = { encrypted: false };
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const args = mockCheckoutCreate.mock.calls.at(-1)?.[0];
-        expect(String(args.success_url || '')).toContain('http://127.0.0.1:4173/?screen=plans&checkout=success');
-        expect(String(args.success_url || '')).toContain('planId=collab');
-        expect(String(args.success_url || '')).toContain('planVersionId=collab-v1');
-        expect(String(args.success_url || '')).toContain('interval=month');
-        expect(String(args.cancel_url || '')).toContain('http://127.0.0.1:4173/?screen=plans&checkout=cancel');
-    });
-    it('applies a free plan immediately without creating a Stripe checkout session', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('starter-v1', 'default', 'starter', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'starter-v1', 'month', 'free:starter-v1:month', 'free', 1, 0, NULL, ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'starter-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockCheckoutCreate).not.toHaveBeenCalled();
-        expect(res.body).toContain('"checkoutState":"free"');
-    });
-    it('falls back to stripe email collection when user identity email is unavailable', async () => {
-        routeHandlers = buildBillingRouteHandlers(db, { userIdentity: { userId: 'u1', email: null, systemRole: 'user', betaAccess: true } });
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const args = mockCheckoutCreate.mock.calls.at(-1)?.[0];
-        expect(args.customer).toBeUndefined();
-        expect(args.customer_email).toBeUndefined();
-    });
-    it('returns a clear error when the saved stripe customer no longer exists', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_collab_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at)
-            VALUES ('u1', 'default', 'cus_missing', 'active', ?, ?)
-        `).run(now, now);
-        mockCheckoutCreate.mockImplementationOnce(async () => {
-            const error = new Error('No such customer: cus_missing');
-            error.code = 'resource_missing';
-            throw error;
-        });
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(409);
-        expect(JSON.parse(res.body)).toEqual({
-            error: 'The saved Stripe customer for this account could not be found. Please contact support before retrying checkout.',
-            code: 'BILLING_STRIPE_CUSTOMER_MISSING'
-        });
-    });
-    it('updates existing subscriptions without creating a checkout session', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v2', 'default', 'pro', 2, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v2', 'year', 'price_pro_year', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, stripe_price_id, billing_interval, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_existing', 'sub_existing', 'price_pro_month', 'month', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'starter-v1', 'active', ?, ?)
-        `).run(now, now);
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'pro-v2',
-            interval: 'year'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockSubscriptionUpdate).toHaveBeenCalledWith('sub_existing', expect.objectContaining({
-            items: [{ id: 'si_123', price: 'price_pro_year' }]
-        }));
-        expect(mockCheckoutCreate).not.toHaveBeenCalled();
-        expect(JSON.parse(res.body)).toEqual(expect.objectContaining({
-            checkoutState: 'updated'
-        }));
-    });
-    it('does not create a second checkout session for the same paid plan', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, stripe_price_id, stripe_status, tier, billing_interval, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'sub_123', 'price_pro_month', 'active', 'pro', 'month', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'active', ?, ?, ?)
-        `).run(now, now, now);
-        mockSubscriptionList.mockResolvedValueOnce({
-            data: [{ id: 'sub_123', status: 'active' }]
-        });
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'pro-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockCheckoutCreate).not.toHaveBeenCalled();
-        expect(mockSubscriptionUpdate).not.toHaveBeenCalled();
-        expect(JSON.parse(res.body)).toEqual(expect.objectContaining({
-            checkoutState: 'already_current_plan',
-            planVersionId: 'pro-v1'
-        }));
-    });
-    it('discovers an active paid subscription by account email and blocks a duplicate purchase', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        mockCustomersList.mockResolvedValueOnce({
-            data: [{ id: 'cus_email_match' }]
-        });
-        mockSubscriptionList.mockResolvedValueOnce({
-            data: [{
-                    id: 'sub_email_match',
-                    customer: 'cus_email_match',
-                    status: 'active',
-                    trial_end: null,
-                    metadata: { userId: 'u1', planVersionId: 'pro-v1' },
-                    items: {
-                        data: [{
-                                id: 'si_email_match',
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }]
-        });
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'pro-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockCheckoutCreate).not.toHaveBeenCalled();
-        expect(JSON.parse(res.body)).toEqual(expect.objectContaining({
-            checkoutState: 'already_current_plan',
-            planVersionId: 'pro-v1'
-        }));
-        const mirrored = db.prepare(`
-            SELECT stripe_customer_id, stripe_subscription_id
-            FROM user_billing
-            WHERE tenant_id = 'default' AND user_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(mirrored).toEqual(expect.objectContaining({
-            stripe_customer_id: 'cus_email_match',
-            stripe_subscription_id: 'sub_email_match'
-        }));
-    });
-    it('updates the existing paid subscription and keeps canonical entitlement aligned with the new plan', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'team-v1', 'month', 'price_team_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, stripe_price_id, stripe_status, tier, billing_interval, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'sub_123', 'price_pro_month', 'active', 'pro', 'month', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'active', ?, ?, ?)
-        `).run(now, now, now);
-        mockSubscriptionList.mockResolvedValueOnce({
-            data: [{ id: 'sub_123', status: 'active' }]
-        });
-        mockSubscriptionUpdate.mockResolvedValueOnce({
-            id: 'sub_123',
-            customer: 'cus_123',
-            status: 'active',
-            trial_end: null,
-            metadata: { userId: 'u1', planVersionId: 'team-v1' },
-            items: {
-                data: [{
-                        id: 'si_123',
-                        current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                        price: { id: 'price_team_month', recurring: { interval: 'month' } }
-                    }]
-            }
-        });
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'team-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockCheckoutCreate).not.toHaveBeenCalled();
-        expect(mockSubscriptionUpdate).toHaveBeenCalledWith('sub_123', expect.objectContaining({
-            items: [{ id: 'si_123', price: 'price_team_month' }]
-        }));
-        expect(JSON.parse(res.body)).toEqual(expect.objectContaining({
-            checkoutState: 'updated',
-            planVersionId: 'team-v1'
-        }));
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state, updated_by
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'team-v1',
-            entitlement_state: 'active',
-            updated_by: 'checkout-confirm'
-        }));
-        const billingRow = db.prepare(`
-            SELECT stripe_price_id, billing_interval
-            FROM user_billing
-            WHERE tenant_id = 'default' AND user_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(billingRow).toEqual(expect.objectContaining({
-            stripe_price_id: 'price_team_month',
-            billing_interval: 'month'
-        }));
-    });
-    it('updates the existing subscription when only the interval changes on the same plan', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'year', 'price_pro_year', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, stripe_price_id, stripe_status, tier, billing_interval, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'sub_123', 'price_pro_month', 'active', 'pro', 'month', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'active', ?, ?, ?)
-        `).run(now, now, now);
-        mockSubscriptionList.mockResolvedValueOnce({
-            data: [{ id: 'sub_123', status: 'active' }]
-        });
-        mockSubscriptionUpdate.mockResolvedValueOnce({
-            id: 'sub_123',
-            customer: 'cus_123',
-            status: 'active',
-            trial_end: null,
-            metadata: { userId: 'u1', planVersionId: 'pro-v1' },
-            items: {
-                data: [{
-                        id: 'si_123',
-                        current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                        price: { id: 'price_pro_year', recurring: { interval: 'year' } }
-                    }]
-            }
-        });
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const req = createMockReq(JSON.stringify({
-            planVersionId: 'pro-v1',
-            interval: 'year'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await checkoutHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockCheckoutCreate).not.toHaveBeenCalled();
-        expect(mockSubscriptionUpdate).toHaveBeenCalledWith('sub_123', expect.objectContaining({
-            items: [{ id: 'si_123', price: 'price_pro_year' }]
-        }));
-        expect(JSON.parse(res.body)).toEqual(expect.objectContaining({
-            checkoutState: 'updated',
-            planVersionId: 'pro-v1'
-        }));
-    });
-    it('confirms a successful checkout session, activates canonical entitlement, and closes the checkout attempt', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_checkout_attempts (
-                session_id, tenant_id, user_id, plan_version_id, billing_interval, status, expires_at, created_at, updated_at
-            ) VALUES ('cs_success_123', 'default', 'u1', 'pro-v1', 'month', 'open', ?, ?, ?)
-        `).run(new Date(Date.now() + 60 * 60 * 1000).toISOString(), now, now);
-        const confirmHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session/confirm');
-        expect(confirmHandler).toBeTypeOf('function');
-        const req = createMockReq(JSON.stringify({
-            sessionId: 'cs_success_123'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await confirmHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockCheckoutRetrieve).toHaveBeenCalledWith('cs_success_123', expect.objectContaining({
-            expand: ['subscription']
-        }));
-        expect(mockSubscriptionRetrieve).toHaveBeenCalledWith('sub_123');
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state, updated_by
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'pro-v1',
-            entitlement_state: 'active',
-            updated_by: 'checkout-confirm'
-        }));
-        const billingRow = db.prepare(`
-            SELECT stripe_customer_id, stripe_subscription_id, stripe_price_id, stripe_status
-            FROM user_billing
-            WHERE tenant_id = 'default' AND user_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(billingRow).toEqual(expect.objectContaining({
-            stripe_customer_id: 'cus_123',
-            stripe_subscription_id: 'sub_123',
-            stripe_price_id: 'price_pro_month',
-            stripe_status: 'active'
-        }));
-        const attempt = db.prepare(`
-            SELECT status
-            FROM billing_checkout_attempts
-            WHERE tenant_id = 'default' AND session_id = 'cs_success_123'
-            LIMIT 1
-        `).get();
-        expect(attempt).toEqual(expect.objectContaining({
-            status: 'confirmed'
-        }));
-    });
-    it('does not activate entitlement when the checkout session is still incomplete', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'checkout_pending', ?, 'checkout-start', ?, ?)
-        `).run(now, now, now);
-        mockCheckoutRetrieve.mockResolvedValueOnce({
-            id: 'cs_open_123',
-            mode: 'subscription',
-            status: 'open',
-            payment_status: 'unpaid',
-            customer: 'cus_123',
-            subscription: 'sub_123',
-            metadata: { userId: 'u1' }
-        });
-        const confirmHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session/confirm');
-        const req = createMockReq(JSON.stringify({
-            sessionId: 'cs_open_123'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await confirmHandler(req, res, {});
-        expect(res.statusCode).toBe(409);
-        expect(JSON.parse(res.body)).toEqual({
-            error: 'Checkout session has not completed yet.',
-            code: 'CHECKOUT_SESSION_INCOMPLETE'
-        });
-        expect(mockSubscriptionRetrieve).not.toHaveBeenCalledWith('sub_123');
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state, updated_by
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'pro-v1',
-            entitlement_state: 'checkout_pending',
-            updated_by: 'checkout-start'
-        }));
-    });
-    it('keeps checkout confirmation retryable until Stripe attaches the subscription to the completed session', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('free-v1', 'default', 'free', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 0, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'free-v1', 'active', ?, 'registration', ?, ?)
-        `).run(now, now, now);
-        db.prepare(`
-            INSERT INTO billing_checkout_attempts (
-                session_id, tenant_id, user_id, plan_version_id, billing_interval, status, expires_at, created_at, updated_at
-            ) VALUES ('cs_pending_subscription', 'default', 'u1', 'pro-v1', 'month', 'open', ?, ?, ?)
-        `).run(new Date(Date.now() + 60 * 60 * 1000).toISOString(), now, now);
-        mockCheckoutRetrieve.mockResolvedValueOnce({
-            id: 'cs_pending_subscription',
-            mode: 'subscription',
-            status: 'complete',
-            payment_status: 'paid',
-            customer: 'cus_123',
-            subscription: null,
-            metadata: { userId: 'u1', planVersionId: 'pro-v1' }
-        });
-        const confirmHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session/confirm');
-        const req = createMockReq(JSON.stringify({
-            sessionId: 'cs_pending_subscription'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await confirmHandler(req, res, {});
-        expect(res.statusCode).toBe(409);
-        expect(JSON.parse(res.body)).toEqual({
-            error: 'Checkout session is still finalizing your subscription.',
-            code: 'CHECKOUT_SESSION_INCOMPLETE'
-        });
-        expect(mockSubscriptionRetrieve).not.toHaveBeenCalled();
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'free-v1',
-            entitlement_state: 'active'
-        }));
-        const attempt = db.prepare(`
-            SELECT status
-            FROM billing_checkout_attempts
-            WHERE tenant_id = 'default' AND session_id = 'cs_pending_subscription'
-            LIMIT 1
-        `).get();
-        expect(attempt).toEqual(expect.objectContaining({
-            status: 'open'
-        }));
-    });
-    it('keeps checkout confirmation retryable until the subscription settles into an active commercial state', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('free-v1', 'default', 'free', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 0, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, tier, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'free', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'free-v1', 'active', ?, 'registration', ?, ?)
-        `).run(now, now, now);
-        db.prepare(`
-            INSERT INTO billing_checkout_attempts (
-                session_id, tenant_id, user_id, plan_version_id, billing_interval, status, expires_at, created_at, updated_at
-            ) VALUES ('cs_wait_for_active', 'default', 'u1', 'pro-v1', 'month', 'open', ?, ?, ?)
-        `).run(new Date(Date.now() + 60 * 60 * 1000).toISOString(), now, now);
-        mockCheckoutRetrieve.mockResolvedValueOnce({
-            id: 'cs_wait_for_active',
-            mode: 'subscription',
-            status: 'complete',
-            payment_status: 'paid',
-            customer: 'cus_123',
-            subscription: 'sub_123',
-            metadata: { userId: 'u1', planVersionId: 'pro-v1' }
-        });
-        mockSubscriptionRetrieve.mockResolvedValueOnce({
-            id: 'sub_123',
-            customer: 'cus_123',
-            status: 'incomplete',
-            trial_end: null,
-            metadata: { userId: 'u1', planVersionId: 'pro-v1' },
-            items: {
-                data: [{
-                        id: 'si_123',
-                        current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                        price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-                    }]
-            }
-        });
-        const confirmHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session/confirm');
-        const req = createMockReq(JSON.stringify({
-            sessionId: 'cs_wait_for_active'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await confirmHandler(req, res, {});
-        expect(res.statusCode).toBe(409);
-        expect(JSON.parse(res.body)).toEqual({
-            error: 'Checkout session is still finalizing your plan.',
-            code: 'CHECKOUT_SESSION_INCOMPLETE'
-        });
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'free-v1',
-            entitlement_state: 'active'
-        }));
-        const attempt = db.prepare(`
-            SELECT status
-            FROM billing_checkout_attempts
-            WHERE tenant_id = 'default' AND session_id = 'cs_wait_for_active'
-            LIMIT 1
-        `).get();
-        expect(attempt).toEqual(expect.objectContaining({
-            status: 'open'
-        }));
-    });
-    it('does not mutate billing mirror or canonical entitlement when the purchased plan version is still unresolved', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO billing_checkout_attempts (
-                session_id, tenant_id, user_id, plan_version_id, billing_interval, status, expires_at, created_at, updated_at
-            ) VALUES ('cs_plan_unresolved', 'default', 'u1', 'pro-v1', 'month', 'open', ?, ?, ?)
-        `).run(new Date(Date.now() + 60 * 60 * 1000).toISOString(), now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'free-v1', 'active', ?, 'seed', ?, ?)
-        `).run(now, now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, tier, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_existing', 'sub_existing', 'free', 'active', ?, ?)
-        `).run(now, now);
-        mockCheckoutRetrieve.mockResolvedValueOnce({
-            id: 'cs_plan_unresolved',
-            mode: 'subscription',
-            status: 'complete',
-            payment_status: 'paid',
-            customer: 'cus_123',
-            subscription: 'sub_unmapped',
-            metadata: { userId: 'u1' }
-        });
-        mockSubscriptionRetrieve.mockResolvedValueOnce({
-            id: 'sub_unmapped',
-            customer: 'cus_123',
-            status: 'active',
-            trial_end: null,
-            metadata: { userId: 'u1' },
-            items: {
-                data: [{
-                        id: 'si_unmapped',
-                        current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                        price: { id: 'price_unmapped', recurring: { interval: 'month' } }
-                    }]
-            }
-        });
-        const confirmHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session/confirm');
-        const req = createMockReq(JSON.stringify({
-            sessionId: 'cs_plan_unresolved'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await confirmHandler(req, res, {});
-        expect(res.statusCode).toBe(409);
-        expect(JSON.parse(res.body)).toEqual({
-            error: 'Checkout completed, but the purchased plan could not be resolved yet.',
-            code: 'CHECKOUT_PLAN_VERSION_UNRESOLVED'
-        });
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'free-v1',
-            entitlement_state: 'active'
-        }));
-        const billingRow = db.prepare(`
-            SELECT stripe_customer_id, stripe_subscription_id, tier, entitlement_state
-            FROM user_billing
-            WHERE tenant_id = 'default' AND user_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(billingRow).toEqual(expect.objectContaining({
-            stripe_customer_id: 'cus_existing',
-            stripe_subscription_id: 'sub_existing',
-            tier: 'free',
-            entitlement_state: 'active'
-        }));
-        const attempt = db.prepare(`
-            SELECT status
-            FROM billing_checkout_attempts
-            WHERE tenant_id = 'default' AND session_id = 'cs_plan_unresolved'
-            LIMIT 1
-        `).get();
-        expect(attempt).toEqual(expect.objectContaining({
-            status: 'open'
-        }));
-    });
-    it('rejects checkout confirmation when the session belongs to a different account', async () => {
-        mockCheckoutRetrieve.mockResolvedValueOnce({
-            id: 'cs_wrong_account',
-            mode: 'subscription',
-            status: 'complete',
-            payment_status: 'paid',
-            customer: 'cus_other',
-            subscription: 'sub_other',
-            metadata: { userId: 'u2' }
-        });
-        const confirmHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session/confirm');
-        const req = createMockReq(JSON.stringify({
-            sessionId: 'cs_wrong_account'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await confirmHandler(req, res, {});
-        expect(res.statusCode).toBe(403);
-        expect(JSON.parse(res.body)).toEqual({
-            error: 'Checkout session does not belong to the current account.',
-            code: 'CHECKOUT_SESSION_ACCOUNT_MISMATCH'
-        });
-        expect(mockSubscriptionRetrieve).not.toHaveBeenCalled();
-    });
-    it('rejects checkout confirmation when a newer pending checkout superseded the session plan', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, effective_until, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'team-v1', 'checkout_pending', ?, ?, 'checkout-start', ?, ?)
-        `).run(now, new Date(Date.now() + 60 * 60 * 1000).toISOString(), now, now);
-        const confirmHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session/confirm');
-        const req = createMockReq(JSON.stringify({
-            sessionId: 'cs_stale_123'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await confirmHandler(req, res, {});
-        expect(res.statusCode).toBe(409);
-        expect(JSON.parse(res.body)).toEqual({
-            error: 'This checkout session is no longer current for this account.',
-            code: 'CHECKOUT_SESSION_SUPERSEDED'
-        });
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state
-            FROM account_entitlements
-            WHERE tenant_id = 'default' AND account_id = 'u1'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'team-v1',
-            entitlement_state: 'checkout_pending'
-        }));
-    });
-    it('records the latest active-account checkout attempt and rejects confirmation for a superseded session', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('starter-v1', 'default', 'starter', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'team-v1', 'month', 'price_team_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, tier, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'starter', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'starter-v1', 'active', ?, 'free-plan-selection', ?, ?)
-        `).run(now, now, now);
-        mockCheckoutCreate
-            .mockResolvedValueOnce({
-            id: 'cs_old',
-            url: 'https://example.test/checkout/old',
-            expires_at: Math.floor(Date.now() / 1000) + (24 * 60 * 60)
-        })
-            .mockResolvedValueOnce({
-            id: 'cs_new',
-            url: 'https://example.test/checkout/new',
-            expires_at: Math.floor(Date.now() / 1000) + (24 * 60 * 60)
-        });
-        const checkoutHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session');
-        const firstReq = createMockReq(JSON.stringify({
-            planVersionId: 'pro-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const firstRes = createMockRes();
-        await checkoutHandler(firstReq, firstRes, {});
-        expect(firstRes.statusCode).toBe(200);
-        const secondReq = createMockReq(JSON.stringify({
-            planVersionId: 'team-v1',
-            interval: 'month'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const secondRes = createMockRes();
-        await checkoutHandler(secondReq, secondRes, {});
-        expect(secondRes.statusCode).toBe(200);
-        const attempts = db.prepare(`
-            SELECT session_id, plan_version_id, status
-            FROM billing_checkout_attempts
-            WHERE tenant_id = 'default' AND user_id = 'u1'
-            ORDER BY session_id ASC
-        `).all();
-        expect(attempts).toEqual([
-            { session_id: 'cs_new', plan_version_id: 'team-v1', status: 'open' },
-            { session_id: 'cs_old', plan_version_id: 'pro-v1', status: 'superseded' }
-        ]);
-        mockCheckoutRetrieve.mockResolvedValueOnce({
-            id: 'cs_old',
-            mode: 'subscription',
-            status: 'complete',
-            payment_status: 'paid',
-            customer: 'cus_123',
-            subscription: 'sub_old',
-            metadata: { userId: 'u1', planVersionId: 'pro-v1' }
-        });
-        mockSubscriptionRetrieve.mockResolvedValueOnce({
-            id: 'sub_old',
-            customer: 'cus_123',
-            status: 'active',
-            trial_end: null,
-            metadata: { userId: 'u1', planVersionId: 'pro-v1' },
-            items: {
-                data: [{
-                        id: 'si_old',
-                        current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                        price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-                    }]
-            }
-        });
-        const confirmHandler = routeHandlers.get('POST /api/taskforce/billing/checkout-session/confirm');
-        const confirmReq = createMockReq(JSON.stringify({
-            sessionId: 'cs_old'
-        }), {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'app.taskforcehq.ai'
-        });
-        const confirmRes = createMockRes();
-        await confirmHandler(confirmReq, confirmRes, {});
-        expect(confirmRes.statusCode).toBe(409);
-        expect(JSON.parse(confirmRes.body)).toEqual({
-            error: 'This checkout session is no longer current for this account.',
-            code: 'CHECKOUT_SESSION_SUPERSEDED'
-        });
-    });
-    it('ignores subscription webhooks for a stale subscription after a newer checkout already won', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, tier, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'sub_current', 'team', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, updated_by, created_at, updated_at
-            ) VALUES ('u1', 'default', 'team-v1', 'active', ?, 'checkout-confirm', ?, ?)
-        `).run(now, now, now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_stale_subscription_after_confirm',
-            type: 'customer.subscription.updated',
-            data: {
-                object: {
-                    id: 'sub_old',
-                    customer: 'cus_123',
-                    status: 'active',
-                    trial_end: null,
-                    metadata: { planVersionId: 'pro-v1' },
-                    items: {
-                        data: [{
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_stale_subscription_after_confirm"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT plan_version_id, entitlement_state
-            FROM account_entitlements
-            WHERE account_id = 'u1' AND tenant_id = 'default'
-            LIMIT 1
-        `).get();
-        expect(entitlement).toEqual(expect.objectContaining({
-            plan_version_id: 'team-v1',
-            entitlement_state: 'active'
-        }));
-        const failure = db.prepare(`
-            SELECT reason
-            FROM stripe_webhook_failures
-            WHERE event_id = 'evt_stale_subscription_after_confirm'
-            ORDER BY created_at DESC
-            LIMIT 1
-        `).get();
-        expect(String(failure?.reason || '')).toContain('no longer current for this account');
-    });
-    it('lists webhook failure diagnostics for system admin', async () => {
-        const now = new Date().toISOString();
-        const old = new Date(Date.now() - 48 * 60 * 60 * 1000).toISOString();
-        db.prepare(`
-            INSERT INTO stripe_webhook_failures (id, tenant_id, event_id, event_type, reason, payload_excerpt, purge_after, created_at)
-            VALUES ('whf_keep_1', 'default', 'evt_1', 'invoice.paid', 'diagnostic-1', '{"id":"evt_1"}', ?, ?)
-        `).run(new Date(Date.now() + 48 * 60 * 60 * 1000).toISOString(), now);
-        db.prepare(`
-            INSERT INTO stripe_webhook_failures (id, tenant_id, event_id, event_type, reason, payload_excerpt, purge_after, created_at)
-            VALUES ('whf_purge_1', 'default', 'evt_old', 'invoice.paid', 'diagnostic-old', '{"id":"evt_old"}', ?, ?)
-        `).run(old, now);
-        const route = routeHandlers.get('GET /api/taskforce/admin/billing/webhook-failures');
-        expect(route).toBeTypeOf('function');
-        const req = createMockReq('', {
-            'x-taskforce-runtime-mode': 'cloud'
-        });
-        req.url = '/api/taskforce/admin/billing/webhook-failures?limit=10';
-        const res = createMockRes();
-        await route(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const payload = JSON.parse(res.body);
-        expect(payload.purgedExpiredRows).toBeGreaterThanOrEqual(1);
-        expect(payload.total).toBeGreaterThanOrEqual(1);
-        expect(Array.isArray(payload.rows)).toBe(true);
-        expect(payload.rows[0]).toEqual(expect.objectContaining({
-            event_id: 'evt_1',
-            reason: 'diagnostic-1'
-        }));
-    });
-    it('lists checkout attempt diagnostics for system admin and purges old terminal rows', async () => {
-        const now = new Date().toISOString();
-        const stale = new Date(Date.now() - 20 * 24 * 60 * 60 * 1000).toISOString();
-        db.prepare(`
-            INSERT INTO billing_checkout_attempts (
-                session_id, tenant_id, user_id, plan_version_id, billing_interval, status, expires_at, created_at, updated_at
-            ) VALUES ('cs_keep_open', 'default', 'u1', 'team-v1', 'month', 'open', ?, ?, ?)
-        `).run(new Date(Date.now() + 60 * 60 * 1000).toISOString(), now, now);
-        db.prepare(`
-            INSERT INTO billing_checkout_attempts (
-                session_id, tenant_id, user_id, plan_version_id, billing_interval, status, expires_at, created_at, updated_at
-            ) VALUES ('cs_purge_old', 'default', 'u1', 'pro-v1', 'month', 'superseded', ?, ?, ?)
-        `).run(stale, stale, stale);
-        db.prepare(`
-            INSERT INTO billing_checkout_attempts (
-                session_id, tenant_id, user_id, plan_version_id, billing_interval, status, expires_at, created_at, updated_at
-            ) VALUES ('cs_expire_now', 'default', 'u2', 'pro-v1', 'month', 'open', ?, ?, ?)
-        `).run(new Date(Date.now() - 60 * 1000).toISOString(), now, now);
-        const route = routeHandlers.get('GET /api/taskforce/admin/billing/checkout-attempts');
-        expect(route).toBeTypeOf('function');
-        const req = createMockReq('', {
-            'x-taskforce-runtime-mode': 'cloud'
-        });
-        req.url = '/api/taskforce/admin/billing/checkout-attempts?limit=10';
-        const res = createMockRes();
-        await route(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const payload = JSON.parse(res.body);
-        expect(payload.purgedTerminalRows).toBeGreaterThanOrEqual(1);
-        expect(payload.expiredRowsNormalized).toBeGreaterThanOrEqual(1);
-        expect(payload.openCount).toBe(1);
-        expect(payload.rows).toEqual(expect.arrayContaining([
-            expect.objectContaining({ session_id: 'cs_keep_open', status: 'open' }),
-            expect.objectContaining({ session_id: 'cs_expire_now', status: 'expired' })
-        ]));
-        const purged = db.prepare(`
-            SELECT session_id
-            FROM billing_checkout_attempts
-            WHERE session_id = 'cs_purge_old'
-            LIMIT 1
-        `).get();
-        expect(purged).toBeUndefined();
-    });
-    it('lists active Stripe price options for the requested interval', async () => {
-        mockPricesList.mockResolvedValueOnce({
-            data: [
-                {
-                    id: 'price_month_1',
-                    active: true,
-                    currency: 'usd',
-                    unit_amount: 1900,
-                    nickname: 'Monthly Core',
-                    recurring: { interval: 'month' },
-                    product: { id: 'prod_core', name: 'Core' }
-                },
-                {
-                    id: 'price_year_1',
-                    active: true,
-                    currency: 'usd',
-                    unit_amount: 19000,
-                    nickname: 'Yearly Core',
-                    recurring: { interval: 'year' },
-                    product: { id: 'prod_core', name: 'Core' }
-                }
-            ],
-            has_more: false
-        });
-        const route = routeHandlers.get('GET /api/taskforce/admin/billing/stripe-price-options');
-        expect(route).toBeTypeOf('function');
-        const req = createMockReq('', {
-            'x-taskforce-runtime-mode': 'cloud'
-        });
-        req.url = '/api/taskforce/admin/billing/stripe-price-options?interval=month';
-        const res = createMockRes();
-        await route(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const body = JSON.parse(res.body);
-        expect(body.options).toEqual([
-            expect.objectContaining({
-                stripePriceId: 'price_month_1',
-                interval: 'month',
-                unitAmount: 1900,
-                currency: 'usd',
-                nickname: 'Monthly Core',
-                productId: 'prod_core',
-                productName: 'Core'
-            })
-        ]);
-    });
-    it('keeps active imported price mappings during Stripe import when the Stripe price is still active but lacks plan metadata', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_manual', 'stripe', 1, 1900, 'usd', ?, ?)
-        `).run(now, now);
-        mockPricesList.mockResolvedValueOnce({
-            data: [
-                {
-                    id: 'price_manual',
-                    active: true,
-                    currency: 'usd',
-                    unit_amount: 1900,
-                    recurring: { interval: 'month' },
-                    metadata: {}
-                }
-            ],
-            has_more: false
-        });
-        const route = routeHandlers.get('POST /api/taskforce/admin/billing/prices/import');
-        expect(route).toBeTypeOf('function');
-        const req = createMockReq('', {
-            'x-taskforce-runtime-mode': 'cloud'
-        });
-        const res = createMockRes();
-        await route(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const row = db.prepare(`
-            SELECT active
-            FROM billing_price_mappings
-            WHERE tenant_id = 'default' AND stripe_price_id = 'price_manual'
-            LIMIT 1
-        `).get();
-        expect(row.active).toBe(1);
-    });
-    it('upserts manual Stripe price mappings and deactivates the prior active mapping', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_old', 'stripe', 1, 1500, 'usd', ?, ?)
-        `).run(now, now);
-        mockPriceRetrieve.mockResolvedValueOnce({
-            id: 'price_new',
-            active: true,
-            currency: 'usd',
-            unit_amount: 2400,
-            recurring: { interval: 'month' }
-        });
-        const upsertRoute = routeHandlers.get('PUT /api/taskforce/admin/billing/price-mappings');
-        expect(upsertRoute).toBeTypeOf('function');
-        const upsertReq = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month',
-            stripePriceId: 'price_new',
-            active: true
-        }), { 'x-taskforce-runtime-mode': 'cloud' });
-        const upsertRes = createMockRes();
-        await upsertRoute(upsertReq, upsertRes, {});
-        expect(upsertRes.statusCode).toBe(200);
-        const body = JSON.parse(upsertRes.body);
-        expect(body.mapping).toEqual(expect.objectContaining({
-            plan_version_id: 'collab-v1',
-            billing_interval: 'month',
-            stripe_price_id: 'price_new',
-            pricing_type: 'stripe',
-            active: 1,
-            unit_amount: 2400,
-            currency: 'usd'
-        }));
-        const rows = db.prepare(`
-            SELECT stripe_price_id, active, unit_amount
-            FROM billing_price_mappings
-            WHERE tenant_id = 'default' AND plan_version_id = 'collab-v1' AND billing_interval = 'month'
-            ORDER BY stripe_price_id ASC
-        `).all();
-        expect(rows).toEqual([
-            { stripe_price_id: 'price_new', active: 1, unit_amount: 2400 },
-            { stripe_price_id: 'price_old', active: 0, unit_amount: 1500 }
-        ]);
-    });
-    it('keeps campaign price mappings separate from public mappings in admin routes', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, pricing_audience, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'public', 'price_public', 'stripe', 1, 1500, 'usd', ?, ?)
-        `).run(now, now);
-        mockPriceRetrieve.mockResolvedValueOnce({
-            id: 'price_campaign',
-            active: true,
-            currency: 'usd',
-            unit_amount: 900,
-            recurring: { interval: 'month' }
-        });
-        const upsertRoute = routeHandlers.get('PUT /api/taskforce/admin/billing/price-mappings');
-        const upsertReq = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month',
-            pricingAudience: 'campaign',
-            stripePriceId: 'price_campaign',
-            active: true
-        }), { 'x-taskforce-runtime-mode': 'cloud' });
-        const upsertRes = createMockRes();
-        await upsertRoute(upsertReq, upsertRes, {});
-        expect(upsertRes.statusCode).toBe(200);
-        expect(JSON.parse(upsertRes.body)).toEqual(expect.objectContaining({
-            mapping: expect.objectContaining({
-                plan_version_id: 'collab-v1',
-                billing_interval: 'month',
-                pricing_audience: 'campaign',
-                stripe_price_id: 'price_campaign',
-                active: 1,
-                unit_amount: 900
-            })
-        }));
-        const rows = db.prepare(`
-            SELECT pricing_audience, stripe_price_id, active
-            FROM billing_price_mappings
-            WHERE tenant_id = 'default' AND plan_version_id = 'collab-v1' AND billing_interval = 'month'
-            ORDER BY pricing_audience ASC
-        `).all();
-        expect(rows).toEqual([
-            { pricing_audience: 'campaign', stripe_price_id: 'price_campaign', active: 1 },
-            { pricing_audience: 'public', stripe_price_id: 'price_public', active: 1 }
-        ]);
-    });
-    it('rejects manual reuse of a Stripe price id across multiple plan versions', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        const upsertRoute = routeHandlers.get('PUT /api/taskforce/admin/billing/price-mappings');
-        const firstReq = createMockReq(JSON.stringify({
-            planVersionId: 'collab-v1',
-            interval: 'month',
-            stripePriceId: 'price_shared',
-            active: true
-        }), { 'x-taskforce-runtime-mode': 'cloud' });
-        const firstRes = createMockRes();
-        await upsertRoute(firstReq, firstRes, {});
-        expect(firstRes.statusCode).toBe(200);
-        const secondReq = createMockReq(JSON.stringify({
-            planVersionId: 'team-v1',
-            interval: 'month',
-            stripePriceId: 'price_shared',
-            active: true
-        }), { 'x-taskforce-runtime-mode': 'cloud' });
-        const secondRes = createMockRes();
-        await upsertRoute(secondReq, secondRes, {});
-        expect(secondRes.statusCode).toBe(409);
-        expect(JSON.parse(secondRes.body)).toEqual(expect.objectContaining({
-            code: 'BILLING_PRICE_ALREADY_ASSIGNED'
-        }));
-    });
-    it('keeps reused active mappings during Stripe import when the shared Stripe price is still active', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('collab-v1', 'default', 'collab', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'collab-v1', 'month', 'price_shared', 'stripe', 1, 1900, 'usd', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'team-v1', 'month', 'price_shared', 'stripe', 1, 1900, 'usd', ?, ?)
-        `).run(now, now);
-        mockPricesList.mockResolvedValueOnce({
-            data: [
-                {
-                    id: 'price_shared',
-                    active: true,
-                    currency: 'usd',
-                    unit_amount: 1900,
-                    recurring: { interval: 'month' },
-                    metadata: { taskforce_plan_version_id: 'collab-v1' }
-                }
-            ],
-            has_more: false
-        });
-        const route = routeHandlers.get('POST /api/taskforce/admin/billing/prices/import');
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const res = createMockRes();
-        await route(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const rows = db.prepare(`
-            SELECT plan_version_id, stripe_price_id, active
-            FROM billing_price_mappings
-            WHERE tenant_id = 'default' AND stripe_price_id = 'price_shared'
-            ORDER BY plan_version_id ASC
-        `).all();
-        expect(rows).toEqual([
-            { plan_version_id: 'collab-v1', stripe_price_id: 'price_shared', active: 1 },
-            { plan_version_id: 'team-v1', stripe_price_id: 'price_shared', active: 1 }
-        ]);
-    });
-    it('supports manual free price mappings and deactivation', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('starter-v1', 'default', 'starter', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'starter-v1', 'month', 'price_old', 'stripe', 1, 1500, 'usd', ?, ?)
-        `).run(now, now);
-        const upsertRoute = routeHandlers.get('PUT /api/taskforce/admin/billing/price-mappings');
-        expect(upsertRoute).toBeTypeOf('function');
-        const upsertReq = createMockReq(JSON.stringify({
-            planVersionId: 'starter-v1',
-            interval: 'month',
-            pricingType: 'free',
-            active: true
-        }), { 'x-taskforce-runtime-mode': 'cloud' });
-        const upsertRes = createMockRes();
-        await upsertRoute(upsertReq, upsertRes, {});
-        expect(upsertRes.statusCode).toBe(200);
-        expect(JSON.parse(upsertRes.body)).toEqual(expect.objectContaining({
-            mapping: expect.objectContaining({
-                plan_version_id: 'starter-v1',
-                billing_interval: 'month',
-                stripe_price_id: 'free:starter-v1:month',
-                pricing_type: 'free',
-                active: 1,
-                unit_amount: 0,
-                currency: null
-            })
-        }));
-        const deactivateRoute = routeHandlers.get('POST /api/taskforce/admin/billing/price-mappings/deactivate');
-        expect(deactivateRoute).toBeTypeOf('function');
-        const deactivateReq = createMockReq(JSON.stringify({
-            planVersionId: 'starter-v1',
-            interval: 'month'
-        }), { 'x-taskforce-runtime-mode': 'cloud' });
-        const deactivateRes = createMockRes();
-        await deactivateRoute(deactivateReq, deactivateRes, {});
-        expect(deactivateRes.statusCode).toBe(200);
-        expect(JSON.parse(deactivateRes.body)).toEqual(expect.objectContaining({
-            success: true,
-            changedRows: 2
-        }));
-        const rows = db.prepare(`
-            SELECT stripe_price_id, pricing_type, active
-            FROM billing_price_mappings
-            WHERE tenant_id = 'default' AND plan_version_id = 'starter-v1' AND billing_interval = 'month'
-            ORDER BY stripe_price_id ASC
-        `).all();
-        expect(rows).toEqual([
-            { stripe_price_id: 'free:starter-v1:month', pricing_type: 'free', active: 0 },
-            { stripe_price_id: 'price_old', pricing_type: 'stripe', active: 0 }
-        ]);
-    });
-    it('rejects webhook failure diagnostics for non-admin', async () => {
-        const nonAdminHandlers = buildBillingRouteHandlers(db, { isAdmin: false });
-        const route = nonAdminHandlers.get('GET /api/taskforce/admin/billing/webhook-failures');
-        expect(route).toBeTypeOf('function');
-        const req = createMockReq('', {
-            'x-taskforce-runtime-mode': 'cloud'
-        });
-        req.url = '/api/taskforce/admin/billing/webhook-failures';
-        const res = createMockRes();
-        await route(req, res, {});
-        expect(res.statusCode).toBe(403);
-    });
-    it('rejects checkout attempt diagnostics for non-admin', async () => {
-        const nonAdminHandlers = buildBillingRouteHandlers(db, { isAdmin: false });
-        const route = nonAdminHandlers.get('GET /api/taskforce/admin/billing/checkout-attempts');
-        expect(route).toBeTypeOf('function');
-        const req = createMockReq('', {
-            'x-taskforce-runtime-mode': 'cloud'
-        });
-        req.url = '/api/taskforce/admin/billing/checkout-attempts';
-        const res = createMockRes();
-        await route(req, res, {});
-        expect(res.statusCode).toBe(403);
-    });
-    it('returns public pricing catalog with cached Stripe amounts without auth', async () => {
-        const now = new Date().toISOString();
-        routeHandlers = buildBillingRouteHandlers(db);
-        const pricingRoute = routeHandlers.get('GET /api/taskforce/public/pricing');
-        expect(pricingRoute).toBeTypeOf('function');
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('starter-v1', 'default', 'starter', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 'stripe', 1, 1500, 'usd', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, pricing_audience, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'campaign', 'price_pro_campaign_month', 'stripe', 1, 900, 'usd', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'starter-v1', 'month', 'free:starter-v1:month', 'free', 1, 0, NULL, ?, ?)
-        `).run(now, now);
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const res = createMockRes();
-        await pricingRoute(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const body = JSON.parse(res.body);
-        expect(body.plans).toBeInstanceOf(Array);
-        expect(body.pageTitle).toBe('Subscription Plans');
-        expect(body.pageDescription).toBe('Manage your subscription and explore available features. Your current plan is highlighted below.');
-        expect(body.pricingSource).toEqual({
-            environment: 'production',
-            runtimeMode: 'cloud'
-        });
-        // Only active plans with versions should be returned (pro, starter)
-        // inactive-plan (archived) and empty-plan (no versions) are excluded.
-        expect(body.plans.length).toBe(2);
-        const proPlan = body.plans.find((p) => p.planId === 'pro');
-        const freePlan = body.plans.find((p) => p.planId === 'starter');
-        expect(proPlan).toBeDefined();
-        expect(freePlan).toBeDefined();
-        // Pro plan has mapped prices
-        const monthPricing = proPlan.pricing.month;
-        expect(monthPricing).not.toBeNull();
-        expect(monthPricing.unitAmount).toBe(1500);
-        expect(monthPricing.currency).toBe('usd');
-        expect(monthPricing.stripePriceId).toBe('price_pro_month');
-        expect(proPlan.pricing.year).toBeNull();
-        expect(proPlan.campaignPricing.month).toEqual(expect.objectContaining({
-            pricingType: 'stripe',
-            unitAmount: 900,
-            currency: 'usd',
-            stripePriceId: 'price_pro_campaign_month',
-            interval: 'month'
-        }));
-        expect(proPlan.campaignPricing.year).toBeNull();
-        // Free plan is explicitly free, not "missing"
-        expect(freePlan.pricing.month.pricingType).toBe('free');
-        expect(freePlan.pricing.month.unitAmount).toBe(0);
-        expect(freePlan.pricing.month.stripePriceId).toBeNull();
-        expect(freePlan.pricing.year).toBeNull();
-        expect(proPlan.defaultVersion.trialDays).toBe(0);
-    });
-    it('invalidates cached public pricing when billing mappings change', async () => {
-        const now = new Date().toISOString();
-        routeHandlers = buildBillingRouteHandlers(db);
-        const pricingRoute = routeHandlers.get('GET /api/taskforce/public/pricing');
-        expect(pricingRoute).toBeTypeOf('function');
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (
-                tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
-            ) VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 'stripe', 1, 1200, 'usd', ?, ?)
-        `).run(now, now);
-        const firstReq = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const firstRes = createMockRes();
-        await pricingRoute(firstReq, firstRes, {});
-        expect(firstRes.statusCode).toBe(200);
-        const firstBody = JSON.parse(firstRes.body);
-        expect(firstBody.plans.find((p) => p.planId === 'pro')?.pricing?.month?.unitAmount).toBe(1200);
-        const updatedAt = new Date(Date.now() + 1000).toISOString();
-        db.prepare(`
-            UPDATE billing_price_mappings
-            SET unit_amount = 2400, updated_at = ?
-            WHERE tenant_id = 'default' AND plan_version_id = 'pro-v1' AND billing_interval = 'month'
-        `).run(updatedAt);
-        const secondReq = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const secondRes = createMockRes();
-        await pricingRoute(secondReq, secondRes, {});
-        expect(secondRes.statusCode).toBe(200);
-        const secondBody = JSON.parse(secondRes.body);
-        expect(secondBody.plans.find((p) => p.planId === 'pro')?.pricing?.month?.unitAmount).toBe(2400);
-    });
-    it('invalidates cached public pricing when pricing page header copy changes', async () => {
-        const now = new Date().toISOString();
-        const siteSettings = {};
-        routeHandlers = buildBillingRouteHandlers(db, { siteSettings });
-        const pricingRoute = routeHandlers.get('GET /api/taskforce/public/pricing');
-        expect(pricingRoute).toBeTypeOf('function');
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (
-                tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
-            ) VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 'stripe', 1, 1200, 'usd', ?, ?)
-        `).run(now, now);
-        const firstReq = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const firstRes = createMockRes();
-        await pricingRoute(firstReq, firstRes, {});
-        expect(firstRes.statusCode).toBe(200);
-        expect(JSON.parse(firstRes.body)).toMatchObject({
-            pageTitle: 'Subscription Plans',
-            pageDescription: 'Manage your subscription and explore available features. Your current plan is highlighted below.'
-        });
-        siteSettings.pricingPageTitle = 'Choose Your Plan';
-        siteSettings.pricingPageDescription = 'Compare plans and pick the right fit for your team.';
-        const secondReq = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const secondRes = createMockRes();
-        await pricingRoute(secondReq, secondRes, {});
-        expect(secondRes.statusCode).toBe(200);
-        expect(JSON.parse(secondRes.body)).toMatchObject({
-            pageTitle: 'Choose Your Plan',
-            pageDescription: 'Compare plans and pick the right fit for your team.'
-        });
-    });
-    it('invalidates cached public pricing when plan features change', async () => {
-        const now = new Date().toISOString();
-        routeHandlers = buildBillingRouteHandlers(db);
-        const pricingRoute = routeHandlers.get('GET /api/taskforce/public/pricing');
-        expect(pricingRoute).toBeTypeOf('function');
-        db.exec(`
-            CREATE TABLE IF NOT EXISTS plan_feature_matrix (
-                tenant_id TEXT NOT NULL,
-                plan_version_id TEXT NOT NULL,
-                feature_key TEXT NOT NULL,
-                access TEXT NOT NULL,
-                config_json TEXT,
-                created_at TEXT NOT NULL,
-                updated_at TEXT NOT NULL,
-                PRIMARY KEY (tenant_id, plan_version_id, feature_key)
-            )
-        `);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (
-                tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
-            ) VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 'stripe', 1, 1200, 'usd', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_feature_matrix (tenant_id, plan_version_id, feature_key, access, config_json, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'ai.chat', 'enabled', '{}', ?, ?)
-        `).run(now, now);
-        const firstReq = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const firstRes = createMockRes();
-        await pricingRoute(firstReq, firstRes, {});
-        expect(firstRes.statusCode).toBe(200);
-        const firstBody = JSON.parse(firstRes.body);
-        expect(firstBody.plans.find((p) => p.planId === 'pro')?.features).toEqual([
-            expect.objectContaining({ featureKey: 'ai.chat' })
-        ]);
-        const updatedAt = new Date(Date.now() + 1000).toISOString();
-        db.prepare(`
-            UPDATE plan_feature_matrix
-            SET access = 'disabled', updated_at = ?
-            WHERE tenant_id = 'default' AND plan_version_id = 'pro-v1' AND feature_key = 'ai.chat'
-        `).run(updatedAt);
-        const secondReq = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const secondRes = createMockRes();
-        await pricingRoute(secondReq, secondRes, {});
-        expect(secondRes.statusCode).toBe(200);
-        const secondBody = JSON.parse(secondRes.body);
-        expect(secondBody.plans.find((p) => p.planId === 'pro')?.features).toEqual([]);
-    });
-    it('includes public feature copy and invalidates cached public pricing when catalog overrides change', async () => {
-        const now = new Date().toISOString();
-        const siteSettings = {};
-        routeHandlers = buildBillingRouteHandlers(db, { siteSettings });
-        const pricingRoute = routeHandlers.get('GET /api/taskforce/public/pricing');
-        expect(pricingRoute).toBeTypeOf('function');
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (
-                tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
-            ) VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 'stripe', 1, 1200, 'usd', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_feature_matrix (tenant_id, plan_version_id, feature_key, access, config_json, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'collaboration.ai_profiles', 'enabled', '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_feature_catalog_overrides (tenant_id, feature_key, public_label, public_description, created_at, updated_at)
-            VALUES ('default', 'collaboration.ai_profiles', 'AI teammates', 'Add reusable AI teammates to your workspace.', ?, ?)
-        `).run(now, now);
-        const firstReq = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const firstRes = createMockRes();
-        await pricingRoute(firstReq, firstRes, {});
-        expect(firstRes.statusCode).toBe(200);
-        const firstBody = JSON.parse(firstRes.body);
-        expect(firstBody.plans.find((p) => p.planId === 'pro')?.features).toEqual([
-            expect.objectContaining({
-                featureKey: 'collaboration.ai_profiles',
-                label: 'AI Profiles',
-                publicLabel: 'AI teammates',
-                publicDescription: 'Add reusable AI teammates to your workspace.',
-                publicDescriptionVisible: false
-            })
-        ]);
-        siteSettings.pricingPageShowPublicDescriptions = true;
-        const secondReq = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const secondRes = createMockRes();
-        await pricingRoute(secondReq, secondRes, {});
-        expect(secondRes.statusCode).toBe(200);
-        const secondBody = JSON.parse(secondRes.body);
-        expect(secondBody.plans.find((p) => p.planId === 'pro')?.features).toEqual([
-            expect.objectContaining({
-                featureKey: 'collaboration.ai_profiles',
-                publicDescriptionVisible: true
-            })
-        ]);
-        const updatedAt = new Date(Date.now() + 1000).toISOString();
-        db.prepare(`
-            UPDATE plan_feature_catalog_overrides
-            SET public_label = 'AI copilots', updated_at = ?
-            WHERE tenant_id = 'default' AND feature_key = 'collaboration.ai_profiles'
-        `).run(updatedAt);
-        const thirdReq = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const thirdRes = createMockRes();
-        await pricingRoute(thirdReq, thirdRes, {});
-        expect(thirdRes.statusCode).toBe(200);
-        const thirdBody = JSON.parse(thirdRes.body);
-        expect(thirdBody.plans.find((p) => p.planId === 'pro')?.features).toEqual([
-            expect.objectContaining({
-                featureKey: 'collaboration.ai_profiles',
-                publicLabel: 'AI copilots',
-                publicDescriptionVisible: true
-            })
-        ]);
-    });
-    it('orders public pricing features by catalog display order', async () => {
-        const now = new Date().toISOString();
-        routeHandlers = buildBillingRouteHandlers(db);
-        const pricingRoute = routeHandlers.get('GET /api/taskforce/public/pricing');
-        expect(pricingRoute).toBeTypeOf('function');
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, seat_limit, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, 5, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (
-                tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
-            ) VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 'stripe', 1, 1800, 'usd', ?, ?)
-        `).run(now, now);
-        for (const feature of [
-            { key: 'collaboration.team_management', access: 'enabled', config: '{}' },
-            { key: 'collaboration.invites', access: 'enabled', config: '{}' },
-            { key: 'collaboration.seat_limit', access: 'limited', config: '{"seat_limit":5}' },
-            { key: 'context.uploads', access: 'enabled', config: '{"storageLimitMb":24}' },
-            { key: 'workspace.workspaces', access: 'enabled', config: '{"maxWorkspaces":1}' },
-            { key: 'collaboration.ai_profiles', access: 'limited', config: '{"maxAiProfiles":4}' }
-        ]) {
-            db.prepare(`
-                INSERT INTO plan_feature_matrix (tenant_id, plan_version_id, feature_key, access, config_json, created_at, updated_at)
-                VALUES ('default', 'pro-v1', ?, ?, ?, ?, ?)
-            `).run(feature.key, feature.access, feature.config, now, now);
-        }
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const res = createMockRes();
-        await pricingRoute(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const body = JSON.parse(res.body);
-        const orderedPlan = body.plans.find((plan) => plan.planId === 'pro');
-        expect(orderedPlan.features.map((feature) => feature.featureKey)).toEqual([
-            'workspace.workspaces',
-            'collaboration.ai_profiles',
-            'context.uploads',
-            'collaboration.team_management'
-        ]);
-        expect(orderedPlan.features.map((feature) => feature.featureKey)).not.toContain('collaboration.invites');
-        expect(orderedPlan.features.map((feature) => feature.featureKey)).not.toContain('collaboration.seat_limit');
-    });
-    it('returns the pricing environment derived from the cloud host', async () => {
-        routeHandlers = buildBillingRouteHandlers(db);
-        const pricingRoute = routeHandlers.get('GET /api/taskforce/public/pricing');
-        expect(pricingRoute).toBeTypeOf('function');
-        const req = createMockReq('', {
-            'x-taskforce-runtime-mode': 'cloud',
-            host: 'performance-app.taskforcehq.ai'
-        });
-        const res = createMockRes();
-        await pricingRoute(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const body = JSON.parse(res.body);
-        expect(body.pageTitle).toBe('Subscription Plans');
-        expect(body.pricingSource).toEqual({
-            environment: 'performance',
-            runtimeMode: 'cloud'
-        });
-    });
-    it('rejects local runtime pricing requests so they cannot serve local catalog data', async () => {
-        routeHandlers = buildBillingRouteHandlers(db);
-        const pricingRoute = routeHandlers.get('GET /api/taskforce/public/pricing');
-        expect(pricingRoute).toBeTypeOf('function');
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'local' });
-        const res = createMockRes();
-        await pricingRoute(req, res, {});
-        expect(res.statusCode).toBe(500);
-        expect(JSON.parse(res.body)).toEqual({
-            error: 'Pricing must be served through the configured cloud pricing proxy in local runtime.'
-        });
-    });
-    it('returns plan display name in billing status payload', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_catalog (plan_id, tenant_id, display_name, status, created_at, updated_at)
-            VALUES ('pro', 'default', 'Pro Plan', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, stripe_price_id, stripe_status, tier, billing_interval, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'sub_123', 'price_123', 'active', 'pro', 'month', 'active', ?, ?)
-        `).run(now, now);
-        const statusRoute = routeHandlers.get('GET /api/taskforce/billing/status');
-        expect(statusRoute).toBeTypeOf('function');
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const res = createMockRes();
-        await statusRoute(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const body = JSON.parse(res.body);
-        expect(body.planId).toBe('pro');
-        expect(body.planName).toBe('Pro Plan');
-        expect(body.planVersionId).toBe('pro-v1');
-        expect(body.entitlementState).toBe('active');
-    });
-    it('prefers canonical checkout_pending state over stale billing mirror state in billing status payload', async () => {
-        routeHandlers = buildBillingRouteHandlers(db, {
-            accessStatus: {
-                gate: 'checkout_pending',
-                hasEntitlement: true,
-                canAccessApp: false,
-                canAccessPlans: true,
-                planSelectionRequired: false,
-                message: 'Complete checkout to continue.',
-                entitlement: {
-                    accountId: 'u1',
-                    planVersionId: 'pro-v1',
-                    planId: 'pro',
-                    state: 'checkout_pending',
-                    effectiveAt: null,
-                    effectiveUntil: null
-                }
-            }
-        });
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_catalog (plan_id, tenant_id, display_name, status, created_at, updated_at)
-            VALUES ('pro', 'default', 'Pro Plan', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, stripe_price_id, stripe_status, tier, billing_interval, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'sub_123', 'price_pro_month', 'active', 'starter', 'month', 'active', ?, ?)
-        `).run(now, now);
-        const statusRoute = routeHandlers.get('GET /api/taskforce/billing/status');
-        expect(statusRoute).toBeTypeOf('function');
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const res = createMockRes();
-        await statusRoute(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const body = JSON.parse(res.body);
-        expect(body).toEqual(expect.objectContaining({
-            planId: 'pro',
-            planName: 'Pro Plan',
-            planVersionId: 'pro-v1',
-            entitlementState: 'checkout_pending',
-            gate: 'checkout_pending',
-            message: 'Complete checkout to continue.',
-            planSelectionRequired: false,
-            billingConflictCode: null,
-            stripeStatus: 'active',
-            stripeCustomerId: 'cus_123',
-            stripeSubscriptionId: 'sub_123'
-        }));
-    });
-    it('returns checkout conflict code in billing status when the latest attempt expired', async () => {
-        routeHandlers = buildBillingRouteHandlers(db, {
-            accessStatus: {
-                gate: 'plan_selection_required',
-                hasEntitlement: true,
-                canAccessApp: false,
-                canAccessPlans: true,
-                planSelectionRequired: true,
-                message: 'Choose a plan to continue.',
-                entitlement: {
-                    accountId: 'u1',
-                    planVersionId: 'pro-v1',
-                    planId: 'pro',
-                    state: 'pending_plan_selection',
-                    effectiveAt: null,
-                    effectiveUntil: null
-                }
-            }
-        });
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_catalog (plan_id, tenant_id, display_name, status, created_at, updated_at)
-            VALUES ('pro', 'default', 'Pro Plan', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_checkout_attempts (
-                session_id, tenant_id, user_id, plan_version_id, billing_interval, status, expires_at, created_at, updated_at
-            ) VALUES ('cs_expired_status', 'default', 'u1', 'pro-v1', 'month', 'expired', ?, ?, ?)
-        `).run(new Date(Date.now() - 60 * 1000).toISOString(), now, now);
-        const statusRoute = routeHandlers.get('GET /api/taskforce/billing/status');
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const res = createMockRes();
-        await statusRoute(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const body = JSON.parse(res.body);
-        expect(body.billingConflictCode).toBe('CHECKOUT_SESSION_EXPIRED');
-    });
-    it('does not reconcile stale billing state from Stripe when billing status is requested', async () => {
-        const now = new Date().toISOString();
-        const stale = new Date(Date.now() - 60_000).toISOString();
-        db.prepare(`
-            INSERT INTO plan_catalog (plan_id, tenant_id, display_name, status, created_at, updated_at)
-            VALUES ('pro', 'default', 'Pro Plan', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, stripe_price_id, stripe_status, tier, billing_interval, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'sub_123', 'price_old', 'active', 'starter', 'month', 'active', ?, ?)
-        `).run(stale, stale);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'active', ?, ?, ?)
-        `).run(stale, stale, stale);
-        const statusRoute = routeHandlers.get('GET /api/taskforce/billing/status');
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const res = createMockRes();
-        await statusRoute(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockSubscriptionRetrieve).not.toHaveBeenCalled();
-        expect(mockCustomersList).not.toHaveBeenCalled();
-        expect(mockSubscriptionList).not.toHaveBeenCalled();
-        const body = JSON.parse(res.body);
-        expect(body.planVersionId).toBe('pro-v1');
-        expect(body.planName).toBe('Pro Plan');
-    });
-    it('skips Stripe reconciliation for fresh billing mirror rows when billing status is requested', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_catalog (plan_id, tenant_id, display_name, status, created_at, updated_at)
-            VALUES ('pro', 'default', 'Pro Plan', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (
-                user_id, tenant_id, stripe_customer_id, stripe_subscription_id, stripe_price_id, stripe_status, tier, billing_interval, entitlement_state, created_at, updated_at
-            ) VALUES ('u1', 'default', 'cus_123', 'sub_123', 'price_pro_month', 'active', 'pro', 'month', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO account_entitlements (
-                account_id, tenant_id, plan_version_id, entitlement_state, effective_at, created_at, updated_at
-            ) VALUES ('u1', 'default', 'pro-v1', 'active', ?, ?, ?)
-        `).run(now, now, now);
-        const statusRoute = routeHandlers.get('GET /api/taskforce/billing/status');
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const res = createMockRes();
-        await statusRoute(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockSubscriptionRetrieve).not.toHaveBeenCalled();
-        expect(mockCustomersList).not.toHaveBeenCalled();
-        expect(mockSubscriptionList).not.toHaveBeenCalled();
-    });
-    it('does not discover Stripe subscriptions by account email when billing status is requested', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_catalog (plan_id, tenant_id, display_name, status, created_at, updated_at)
-            VALUES ('pro', 'default', 'Pro Plan', 'active', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('pro-v1', 'default', 'pro', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, active, created_at, updated_at)
-            VALUES ('default', 'pro-v1', 'month', 'price_pro_month', 1, ?, ?)
-        `).run(now, now);
-        mockCustomersList.mockResolvedValueOnce({
-            data: [{ id: 'cus_email_match' }]
-        });
-        mockSubscriptionList.mockResolvedValueOnce({
-            data: [{
-                    id: 'sub_email_match',
-                    customer: 'cus_email_match',
-                    status: 'active',
-                    trial_end: null,
-                    metadata: { userId: 'u1', planVersionId: 'pro-v1' },
-                    items: {
-                        data: [{
-                                id: 'si_email_match',
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_pro_month', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }]
-        });
-        const statusRoute = routeHandlers.get('GET /api/taskforce/billing/status');
-        const req = createMockReq('', { 'x-taskforce-runtime-mode': 'cloud' });
-        const res = createMockRes();
-        await statusRoute(req, res, {});
-        expect(res.statusCode).toBe(200);
-        expect(mockCustomersList).not.toHaveBeenCalled();
-        expect(mockSubscriptionList).not.toHaveBeenCalled();
-        const body = JSON.parse(res.body);
-        expect(body.planId).toBe('pro');
-        expect(body.planVersionId).toBe('pro-v1');
-        expect(body.stripeCustomerId).toBeNull();
-        expect(body.stripeSubscriptionId).toBeNull();
-    });
-    it('prefers subscription metadata over shared price fallback during webhook processing', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('starter-v1', 'default', 'starter', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'starter-v1', 'month', 'price_shared', 'stripe', 1, 1900, 'usd', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'team-v1', 'month', 'price_shared', 'stripe', 1, 1900, 'usd', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at)
-            VALUES ('u1', 'default', 'cus_123', 'active', ?, ?)
-        `).run(now, now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_shared_metadata',
-            type: 'customer.subscription.updated',
-            data: {
-                object: {
-                    id: 'sub_123',
-                    customer: 'cus_123',
-                    status: 'active',
-                    trial_end: null,
-                    metadata: { planVersionId: 'team-v1' },
-                    items: {
-                        data: [{
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_shared', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_shared_metadata"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const entitlement = db.prepare(`
-            SELECT plan_version_id
-            FROM account_entitlements
-            WHERE account_id = 'u1' AND tenant_id = 'default'
-            LIMIT 1
-        `).get();
-        expect(entitlement.plan_version_id).toBe('team-v1');
-    });
-    it('logs webhook failure when shared price fallback is ambiguous and metadata is missing', async () => {
-        const now = new Date().toISOString();
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('starter-v1', 'default', 'starter', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO plan_versions (plan_version_id, tenant_id, plan_id, version_number, is_default, metadata_json, created_at, updated_at)
-            VALUES ('team-v1', 'default', 'team', 1, 1, '{}', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'starter-v1', 'month', 'price_shared', 'stripe', 1, 1900, 'usd', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO billing_price_mappings (tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at)
-            VALUES ('default', 'team-v1', 'month', 'price_shared', 'stripe', 1, 1900, 'usd', ?, ?)
-        `).run(now, now);
-        db.prepare(`
-            INSERT INTO user_billing (user_id, tenant_id, stripe_customer_id, entitlement_state, created_at, updated_at)
-            VALUES ('u1', 'default', 'cus_456', 'active', ?, ?)
-        `).run(now, now);
-        mockConstructEvent.mockReturnValue({
-            id: 'evt_shared_ambiguous',
-            type: 'customer.subscription.updated',
-            data: {
-                object: {
-                    id: 'sub_456',
-                    customer: 'cus_456',
-                    status: 'active',
-                    trial_end: null,
-                    metadata: {},
-                    items: {
-                        data: [{
-                                current_period_end: Math.floor(Date.now() / 1000) + 86400,
-                                price: { id: 'price_shared', recurring: { interval: 'month' } }
-                            }]
-                    }
-                }
-            }
-        });
-        const req = createMockReq('{"id":"evt_shared_ambiguous"}', {
-            'x-taskforce-runtime-mode': 'cloud',
-            'stripe-signature': 'sig'
-        });
-        const res = createMockRes();
-        await webhookHandler(req, res, {});
-        expect(res.statusCode).toBe(200);
-        const failure = db.prepare(`
-            SELECT reason
-            FROM stripe_webhook_failures
-            WHERE event_id = 'evt_shared_ambiguous'
-            ORDER BY created_at DESC
-            LIMIT 1
-        `).get();
-        expect(failure.reason).toContain('Ambiguous price mapping');
-    });
-});