@taskforcehq/taskforce 0.3.311 → 0.3.313

package/dist/server/index.test.js

@@ -1,283 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, configureHttpServerTimeouts, isBillingWebhookPath, rewriteProxySetCookieForLocalHost, resolveHttpServerTimeoutSettings, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, resolveMaxPayloadBytesForPath, shouldApplyReadOnlyMutationGuard, shouldRewriteProxySetCookieDomain, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
-describe('server index helper policies', () => {
-    it('uses proxy-friendly HTTP server timeouts by default', () => {
-        const settings = resolveHttpServerTimeoutSettings({});
-        expect(settings.keepAliveTimeoutMs).toBe(65_000);
-        expect(settings.headersTimeoutMs).toBe(70_000);
-        expect(settings.requestTimeoutMs).toBe(120_000);
-    });
-    it('keeps headers timeout above keep-alive timeout for reverse proxies', () => {
-        const settings = resolveHttpServerTimeoutSettings({
-            TASKFORCE_HTTP_KEEP_ALIVE_TIMEOUT_MS: '80000',
-            TASKFORCE_HTTP_HEADERS_TIMEOUT_MS: '1000',
-            TASKFORCE_HTTP_REQUEST_TIMEOUT_MS: '150000'
-        });
-        expect(settings.keepAliveTimeoutMs).toBe(80_000);
-        expect(settings.headersTimeoutMs).toBe(85_000);
-        expect(settings.requestTimeoutMs).toBe(150_000);
-    });
-    it('applies resolved HTTP server timeouts to the Node server', () => {
-        const server = {
-            keepAliveTimeout: 0,
-            headersTimeout: 0,
-            requestTimeout: 0
-        };
-        const settings = configureHttpServerTimeouts(server, {
-            TASKFORCE_HTTP_KEEP_ALIVE_TIMEOUT_MS: '61000',
-            TASKFORCE_HTTP_HEADERS_TIMEOUT_MS: '66000',
-            TASKFORCE_HTTP_REQUEST_TIMEOUT_MS: '90000'
-        });
-        expect(settings).toEqual({
-            keepAliveTimeoutMs: 61_000,
-            headersTimeoutMs: 66_000,
-            requestTimeoutMs: 90_000
-        });
-        expect(server.keepAliveTimeout).toBe(61_000);
-        expect(server.headersTimeout).toBe(66_000);
-        expect(server.requestTimeout).toBe(90_000);
-    });
-    it('adds webhook path to auth exclusions without duplicates', () => {
-        const base = ['/api/taskforce/health', '/api/taskforce/auth'];
-        const next = ensureBillingWebhookAuthExclusion(base);
-        expect(next).toContain('/api/taskforce/billing/webhook');
-        expect(next.filter((entry) => entry === '/api/taskforce/billing/webhook')).toHaveLength(1);
-    });
-    it('adds public site config path to auth exclusions without duplicates', () => {
-        const base = ['/api/taskforce/health', '/api/taskforce/auth'];
-        const next = ensurePublicSiteConfigAuthExclusion(base);
-        expect(next).toContain('/api/taskforce/public/site-config');
-        expect(next.filter((entry) => entry === '/api/taskforce/public/site-config')).toHaveLength(1);
-        expect(next).toContain('/api/taskforce/public/site-config-script');
-        expect(next.filter((entry) => entry === '/api/taskforce/public/site-config-script')).toHaveLength(1);
-    });
-    it('identifies billing webhook path exactly', () => {
-        expect(isBillingWebhookPath('/api/taskforce/billing/webhook')).toBe(true);
-        expect(isBillingWebhookPath('/api/taskforce/billing/webhook/v2')).toBe(false);
-    });
-    it('applies auth limiter only to auth routes except session', () => {
-        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/login')).toBe(true);
-        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/session')).toBe(false);
-        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/billing/webhook')).toBe(false);
-    });
-    it('allows workspace sync-sized ui-state payloads through the global guard', () => {
-        expect(resolveMaxPayloadBytesForPath('/api/taskforce/ui-state', 1_048_576)).toBe(50 * 1024 * 1024);
-        expect(resolveMaxPayloadBytesForPath('/api/taskforce/sync/workspace/push', 1_048_576)).toBe(50 * 1024 * 1024);
-        expect(resolveMaxPayloadBytesForPath('/api/taskforce/task', 1_048_576)).toBe(1_048_576);
-    });
-    it('writes a json error when headers are still available', () => {
-        let headersSent = false;
-        let writableEnded = false;
-        const res = {
-            writeHead: vi.fn(() => {
-                headersSent = true;
-            }),
-            end: vi.fn(() => {
-                writableEnded = true;
-            })
-        };
-        Object.defineProperty(res, 'headersSent', {
-            configurable: true,
-            get: () => headersSent
-        });
-        Object.defineProperty(res, 'writableEnded', {
-            configurable: true,
-            get: () => writableEnded
-        });
-        expect(writeJsonErrorIfPossible(res, 502, { error: 'Cloud proxy request failed.' })).toBe(true);
-        expect(res.writeHead).toHaveBeenCalledWith(502, { 'Content-Type': 'application/json' });
-        expect(res.end).toHaveBeenCalledWith(JSON.stringify({ error: 'Cloud proxy request failed.' }));
-    });
-    it('skips json error writes after headers are already sent', () => {
-        const res = {
-            writeHead: vi.fn(),
-            end: vi.fn()
-        };
-        Object.defineProperty(res, 'headersSent', {
-            configurable: true,
-            get: () => true
-        });
-        Object.defineProperty(res, 'writableEnded', {
-            configurable: true,
-            get: () => false
-        });
-        expect(writeJsonErrorIfPossible(res, 502, { error: 'Cloud proxy request failed.' })).toBe(false);
-        expect(res.writeHead).not.toHaveBeenCalled();
-        expect(res.end).not.toHaveBeenCalled();
-    });
-});
-describe('shouldProxyCloudPath', () => {
-    it('returns false for empty or null pathname', () => {
-        expect(shouldProxyCloudPath('')).toBe(false);
-        expect(shouldProxyCloudPath(null)).toBe(false);
-    });
-    it('does not proxy local-only sync routes', () => {
-        expect(shouldProxyCloudPath('/api/taskforce/auth/runtime-config')).toBe(false);
-        expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/apply-local')).toBe(false);
-        expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/documents')).toBe(false);
-        expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/assets')).toBe(false);
-        expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/ai-profiles')).toBe(false);
-        expect(shouldProxyCloudPath('/api/taskforce/sync/events')).toBe(false);
-    });
-    it('proxies cloud-owned sync routes', () => {
-        expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/pull')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/push')).toBe(true);
-    });
-    it('proxies cloud-owned user avatar context paths only', () => {
-        expect(shouldProxyCloudPath('/api/taskforce/context/users%2Fuser-1%2Fprofile%2Favatar%2Favatar.webp')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/context/users/user-1/profile/avatar/avatar.webp')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset.png')).toBe(false);
-        expect(shouldProxyCloudPath('/api/taskforce/context/users%2Fuser-1%2Fexports%2Favatar.webp')).toBe(false);
-    });
-    it('proxies admin, billing, and auth routes', () => {
-        expect(shouldProxyCloudPath('/api/taskforce/admin/users')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/billing/plans')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/auth/login')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/account/profile-summary')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/account/team-management-access')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/public/site-config')).toBe(true);
-        expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
-    });
-    it('keeps AI profile workspace mutations local so workspace sync owns replication', () => {
-        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/avatar')).toBe(false);
-        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/archive')).toBe(false);
-        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/merge')).toBe(false);
-    });
-});
-describe('proxy cookie helpers', () => {
-    it('rewrites mismatched cookie domains for non-loopback local hosts', () => {
-        const cookie = 'taskforce_session=abc; Path=/; HttpOnly; SameSite=Lax; Domain=taskforcehq.ai';
-        expect(shouldRewriteProxySetCookieDomain(cookie, 'taskforce.localtest.me:3847')).toBe(true);
-        expect(rewriteProxySetCookieForLocalHost(cookie)).not.toContain('Domain=');
-    });
-    it('preserves cookie domains that already match the request host', () => {
-        const cookie = 'taskforce_session=abc; Path=/; HttpOnly; SameSite=Lax; Domain=taskforcehq.ai';
-        expect(shouldRewriteProxySetCookieDomain(cookie, 'app.taskforcehq.ai')).toBe(false);
-    });
-});
-describe('resolveAuthorizedWorkspaceAccess', () => {
-    it('prefers an explicitly requested workspace when the user is authorized for it', () => {
-        const core = {
-            resolveUserAccess: vi.fn((userId, workspaceId, role) => {
-                if (workspaceId !== 'workspace-team')
-                    return null;
-                return {
-                    userId,
-                    workspaceId,
-                    role,
-                    permissionMode: 'read-write',
-                    disabled: false,
-                    betaAccess: true
-                };
-            }),
-            getSystemRole: vi.fn(() => 'user')
-        };
-        const next = resolveAuthorizedWorkspaceAccess(core, {
-            authenticated: true,
-            sessionId: 'session-1',
-            userId: 'user-1',
-            workspaceId: 'workspace-personal',
-            role: 'member',
-            systemRole: 'user',
-            identityId: null
-        }, 'workspace-team');
-        expect(core.resolveUserAccess).toHaveBeenCalledWith('user-1', 'workspace-team', 'member');
-        expect(next.workspaceId).toBe('workspace-team');
-        expect(next.userId).toBe('user-1');
-    });
-    it('falls back to the session workspace when the requested workspace is not authorized', () => {
-        const core = {
-            resolveUserAccess: vi.fn((userId, workspaceId, role) => {
-                if (workspaceId !== 'workspace-personal')
-                    return null;
-                return {
-                    userId,
-                    workspaceId,
-                    role,
-                    permissionMode: 'read-write',
-                    disabled: false,
-                    betaAccess: true
-                };
-            }),
-            getSystemRole: vi.fn(() => 'user')
-        };
-        const next = resolveAuthorizedWorkspaceAccess(core, {
-            authenticated: true,
-            sessionId: 'session-1',
-            userId: 'user-1',
-            workspaceId: 'workspace-personal',
-            role: 'member',
-            systemRole: 'user',
-            identityId: null
-        }, 'workspace-team');
-        expect(core.resolveUserAccess).toHaveBeenNthCalledWith(1, 'user-1', 'workspace-team', 'member');
-        expect(core.resolveUserAccess).toHaveBeenNthCalledWith(2, 'user-1', 'workspace-personal', 'member');
-        expect(next.workspaceId).toBe('workspace-personal');
-    });
-    it('preserves account and workspace disabled scopes separately', () => {
-        const core = {
-            resolveUserAccess: vi.fn((userId, workspaceId, role) => ({
-                userId,
-                workspaceId,
-                role,
-                permissionMode: 'read-write',
-                disabled: true,
-                accountDisabled: false,
-                workspaceDisabled: true,
-                betaAccess: true
-            })),
-            getSystemRole: vi.fn(() => 'user')
-        };
-        const next = resolveAuthorizedWorkspaceAccess(core, {
-            authenticated: true,
-            sessionId: 'session-1',
-            userId: 'user-1',
-            workspaceId: 'workspace-shared',
-            role: 'member',
-            systemRole: 'user',
-            identityId: null
-        }, 'workspace-shared');
-        expect(next.disabled).toBe(true);
-        expect(next.accountDisabled).toBe(false);
-        expect(next.workspaceDisabled).toBe(true);
-    });
-});
-describe('resolveDisabledAccessError', () => {
-    it('blocks globally disabled accounts outside auth routes', () => {
-        expect(resolveDisabledAccessError({ disabled: true, accountDisabled: true }, '/api/taskforce/workspaces')).toBe('Forbidden: user account is disabled.');
-        expect(resolveDisabledAccessError({ disabled: true, accountDisabled: true }, '/api/taskforce/auth/session')).toBeNull();
-    });
-    it('allows workspace-disabled sessions to reach recovery routes only', () => {
-        const access = { disabled: true, accountDisabled: false, workspaceDisabled: true };
-        expect(resolveDisabledAccessError(access, '/api/taskforce/workspaces')).toBeNull();
-        expect(resolveDisabledAccessError(access, '/api/taskforce/session/workspace')).toBeNull();
-        expect(resolveDisabledAccessError(access, '/api/taskforce/tasks')).toBe('Forbidden: workspace access is not active for this user.');
-    });
-});
-describe('shouldApplyReadOnlyMutationGuard', () => {
-    it('guards ordinary Taskforce mutations', () => {
-        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/tasks')).toBe(true);
-        expect(shouldApplyReadOnlyMutationGuard('PATCH', '/api/taskforce/task/task-1')).toBe(true);
-        expect(shouldApplyReadOnlyMutationGuard('DELETE', '/api/taskforce/task/task-1')).toBe(true);
-    });
-    it('allows session workspace switching through route-level access validation', () => {
-        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/session/workspace')).toBe(false);
-    });
-    it('does not guard non-mutations, auth routes, or health checks', () => {
-        expect(shouldApplyReadOnlyMutationGuard('GET', '/api/taskforce/tasks')).toBe(false);
-        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/auth/login')).toBe(false);
-        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/health')).toBe(false);
-    });
-});
-describe('resolveEffectiveRequestUserId', () => {
-    it('prefers the authenticated access user when present', () => {
-        expect(resolveEffectiveRequestUserId('user-authenticated', 'user-explicit')).toBe('user-authenticated');
-    });
-    it('preserves an explicit local actor header when auth access is anonymous', () => {
-        expect(resolveEffectiveRequestUserId('anonymous', 'user-local-actor')).toBe('user-local-actor');
-        expect(resolveEffectiveRequestUserId('', 'user-local-actor')).toBe('user-local-actor');
-    });
-    it('falls back to anonymous when neither source has a user id', () => {
-        expect(resolveEffectiveRequestUserId('anonymous', '')).toBe('anonymous');
-    });
-});

package/dist/server/rateLimit.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/server/rateLimit.test.js

@@ -1,107 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { applyPrefixedRateLimitHeaders, InMemoryRateLimiter, resolveClientIp, resolveRateLimitKey } from './rateLimit';
-describe('InMemoryRateLimiter', () => {
-    it('allows requests within limit and blocks over limit', () => {
-        const limiter = new InMemoryRateLimiter(2, 60_000);
-        const now = 1_000;
-        const first = limiter.check('ip:1', now);
-        const second = limiter.check('ip:1', now + 1);
-        const third = limiter.check('ip:1', now + 2);
-        expect(first.allowed).toBe(true);
-        expect(first.remaining).toBe(1);
-        expect(second.allowed).toBe(true);
-        expect(second.remaining).toBe(0);
-        expect(third.allowed).toBe(false);
-        expect(third.retryAfterSeconds).toBeGreaterThan(0);
-    });
-    it('resets bucket after window', () => {
-        const limiter = new InMemoryRateLimiter(1, 1_000);
-        const first = limiter.check('ip:2', 1_000);
-        const blocked = limiter.check('ip:2', 1_500);
-        const reset = limiter.check('ip:2', 2_001);
-        expect(first.allowed).toBe(true);
-        expect(blocked.allowed).toBe(false);
-        expect(reset.allowed).toBe(true);
-        expect(reset.remaining).toBe(0);
-    });
-});
-describe('resolveClientIp', () => {
-    it('uses x-forwarded-for when present', () => {
-        const req = {
-            headers: { 'x-forwarded-for': '203.0.113.5, 10.0.0.1' },
-            socket: { remoteAddress: '127.0.0.1' }
-        };
-        expect(resolveClientIp(req)).toBe('203.0.113.5');
-    });
-    it('falls back to remoteAddress', () => {
-        const req = {
-            headers: {},
-            socket: { remoteAddress: '127.0.0.2' }
-        };
-        expect(resolveClientIp(req)).toBe('127.0.0.2');
-    });
-});
-describe('applyPrefixedRateLimitHeaders', () => {
-    it('applies prefixed headers without default header names', () => {
-        const headers = new Map();
-        const res = {
-            setHeader: (name, value) => headers.set(name, value)
-        };
-        applyPrefixedRateLimitHeaders(res, {
-            allowed: true,
-            limit: 10,
-            remaining: 8,
-            resetAt: 1_700_000_000_000,
-            retryAfterSeconds: 30
-        }, 'X-Auth-RateLimit');
-        expect(headers.get('X-Auth-RateLimit-Limit')).toBe('10');
-        expect(headers.get('X-Auth-RateLimit-Remaining')).toBe('8');
-        expect(headers.get('X-Auth-RateLimit-Reset')).toBe(String(Math.ceil(1_700_000_000_000 / 1000)));
-        expect(headers.has('X-RateLimit-Limit')).toBe(false);
-    });
-});
-describe('resolveRateLimitKey', () => {
-    it('uses authenticated user identity when available', () => {
-        const req = {
-            method: 'GET',
-            headers: { 'x-forwarded-for': '203.0.113.10' },
-            socket: { remoteAddress: '127.0.0.1' }
-        };
-        const key = resolveRateLimitKey({
-            req,
-            pathname: '/api/taskforce/tasks',
-            authenticated: true,
-            userId: 'user-123',
-            sessionId: 'session-abc'
-        });
-        expect(key).toBe('user:user-123:GET:/api/taskforce/tasks');
-    });
-    it('falls back to session identity for authenticated anonymous users', () => {
-        const req = {
-            method: 'patch',
-            headers: {},
-            socket: { remoteAddress: '127.0.0.5' }
-        };
-        const key = resolveRateLimitKey({
-            req,
-            pathname: '/api/taskforce/task/1',
-            authenticated: true,
-            userId: 'anonymous',
-            sessionId: 'session-123'
-        });
-        expect(key).toBe('session:session-123:PATCH:/api/taskforce/task/1');
-    });
-    it('falls back to IP identity for unauthenticated requests', () => {
-        const req = {
-            method: 'post',
-            headers: { 'x-forwarded-for': '198.51.100.11, 10.0.0.1' },
-            socket: { remoteAddress: '127.0.0.1' }
-        };
-        const key = resolveRateLimitKey({
-            req,
-            pathname: '/api/taskforce/config',
-            authenticated: false
-        });
-        expect(key).toBe('ip:198.51.100.11:POST:/api/taskforce/config');
-    });
-});

package/dist/server/realtimeSync.auth.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/server/realtimeSync.auth.test.js

@@ -1,62 +0,0 @@
-import { EventEmitter } from 'events';
-import { describe, expect, it, vi } from 'vitest';
-import { createRealtimeSyncWsManager } from './realtimeSyncWs';
-import { createSessionTokenCookie, resolveAuthConfigFromEnv } from './auth';
-class MockWs extends EventEmitter {
-    readyState = 1;
-    sent = [];
-    closeCode;
-    closeReason;
-    send(data) {
-        this.sent.push(data);
-    }
-    close(code, reason) {
-        this.closeCode = code;
-        this.closeReason = reason;
-        this.readyState = 3;
-    }
-}
-function makeReq(cookie) {
-    return {
-        headers: cookie ? { cookie } : {}
-    };
-}
-describe('server/realtimeSyncWs auth', () => {
-    it('rejects unauthenticated websocket connections when auth is required', () => {
-        const authConfig = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
-            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
-        });
-        const manager = createRealtimeSyncWsManager({ resolveUserAccess: vi.fn(() => null) }, authConfig, { log: vi.fn(), warn: vi.fn() });
-        const ws = new MockWs();
-        manager.handleConnection(ws, makeReq());
-        expect(ws.closeCode).toBe(1008);
-        expect(ws.closeReason).toBe('unauthorized');
-    });
-    it('accepts authenticated websocket connections', () => {
-        const authConfig = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
-            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
-        });
-        const sessionCookie = createSessionTokenCookie('session-1', authConfig, {
-            role: 'member',
-            workspaceId: 'workspace-a',
-            userId: 'user-a'
-        });
-        const cookieHeader = sessionCookie.split(';')[0];
-        const manager = createRealtimeSyncWsManager({
-            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a'
-                ? { workspaceId }
-                : null))
-        }, authConfig, { log: vi.fn(), warn: vi.fn() });
-        const ws = new MockWs();
-        manager.handleConnection(ws, makeReq(cookieHeader));
-        expect(ws.closeCode).toBeUndefined();
-        manager.broadcastTaskforceUpdate('workspace-a');
-        expect(ws.sent).toContain(JSON.stringify({ type: 'taskforce:update', workspaceId: 'workspace-a' }));
-    });
-});

package/dist/server/realtimeSync.replay.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/server/realtimeSync.replay.test.js

@@ -1,192 +0,0 @@
-import { EventEmitter } from 'events';
-import { describe, expect, it, vi } from 'vitest';
-import { createRealtimeSyncWsManager } from './realtimeSyncWs';
-import { createSessionTokenCookie, resolveAuthConfigFromEnv } from './auth';
-class MockWs extends EventEmitter {
-    readyState = 1;
-    bufferedAmount = 0;
-    sent = [];
-    closeCode;
-    closeReason;
-    send(data) {
-        this.sent.push(data);
-    }
-    close(code, reason) {
-        this.closeCode = code;
-        this.closeReason = reason;
-        this.readyState = 3;
-    }
-}
-function makeReq(cookie) {
-    return {
-        headers: cookie ? { cookie } : {}
-    };
-}
-function parseMessages(ws) {
-    return ws.sent.map((entry) => JSON.parse(entry));
-}
-function makeEvent(seq, workspaceId = 'workspace-a', serverEpoch = 'epoch-1') {
-    return {
-        eventId: `${serverEpoch}:${seq}`,
-        workspaceId,
-        cursor: `${serverEpoch}:${seq}`,
-        serverEpoch,
-        seq,
-        entityType: 'task',
-        changeType: 'upsert',
-        entityIds: [`task-${seq}`],
-        dataVersion: seq,
-        serverTs: new Date().toISOString()
-    };
-}
-describe('server/realtimeSyncWs replay + backpressure', () => {
-    it('replays events after a cursor for subscribed workspace', () => {
-        const authConfig = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
-            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
-        });
-        const manager = createRealtimeSyncWsManager({
-            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
-        }, authConfig, { log: vi.fn(), warn: vi.fn() });
-        const ws = new MockWs();
-        const cookie = createSessionTokenCookie('session-a', authConfig, {
-            role: 'member',
-            workspaceId: 'workspace-a',
-            userId: 'user-a'
-        }).split(';')[0];
-        manager.handleConnection(ws, makeReq(cookie));
-        manager.broadcastMutation(makeEvent(1));
-        manager.broadcastMutation(makeEvent(2));
-        manager.broadcastMutation(makeEvent(3));
-        ws.emit('message', JSON.stringify({
-            type: 'taskforce:replay',
-            workspaceId: 'workspace-a',
-            cursor: 'epoch-1:1'
-        }));
-        const replayMsg = parseMessages(ws).find((msg) => msg.type === 'taskforce:replay');
-        expect(replayMsg).toBeTruthy();
-        expect(Array.isArray(replayMsg?.events)).toBe(true);
-        const events = (replayMsg?.events || []);
-        expect(events.map((event) => event.seq)).toEqual([2, 3]);
-    });
-    it('returns deterministic replay-reset on server-epoch mismatch', () => {
-        const authConfig = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
-            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
-        });
-        const manager = createRealtimeSyncWsManager({
-            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
-        }, authConfig, { log: vi.fn(), warn: vi.fn() });
-        const ws = new MockWs();
-        const cookie = createSessionTokenCookie('session-a', authConfig, {
-            role: 'member',
-            workspaceId: 'workspace-a',
-            userId: 'user-a'
-        }).split(';')[0];
-        manager.handleConnection(ws, makeReq(cookie));
-        manager.broadcastMutation(makeEvent(1, 'workspace-a', 'epoch-2'));
-        ws.emit('message', JSON.stringify({
-            type: 'taskforce:replay',
-            workspaceId: 'workspace-a',
-            cursor: 'epoch-1:1'
-        }));
-        const reset = parseMessages(ws).find((msg) => msg.type === 'taskforce:replay-reset');
-        expect(reset).toBeTruthy();
-        expect(reset?.reason).toBe('server-epoch-mismatch');
-        expect(reset?.serverEpoch).toBe('epoch-2');
-    });
-    it('returns replay-gap when cursor has been evicted from buffer window', () => {
-        const authConfig = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
-            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
-        });
-        const manager = createRealtimeSyncWsManager({
-            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
-        }, authConfig, { log: vi.fn(), warn: vi.fn() }, { replayMaxEvents: 2, replayTtlMs: 60_000 });
-        const ws = new MockWs();
-        const cookie = createSessionTokenCookie('session-a', authConfig, {
-            role: 'member',
-            workspaceId: 'workspace-a',
-            userId: 'user-a'
-        }).split(';')[0];
-        manager.handleConnection(ws, makeReq(cookie));
-        manager.broadcastMutation(makeEvent(1));
-        manager.broadcastMutation(makeEvent(2));
-        manager.broadcastMutation(makeEvent(3));
-        ws.emit('message', JSON.stringify({
-            type: 'taskforce:replay',
-            workspaceId: 'workspace-a',
-            cursor: 'epoch-1:0'
-        }));
-        const gap = parseMessages(ws).find((msg) => msg.type === 'taskforce:replay-gap');
-        expect(gap).toBeTruthy();
-        expect(gap?.reason).toBe('cursor-evicted');
-        expect(gap?.earliestSeq).toBe(2);
-        expect(gap?.cursorSeq).toBe(0);
-    });
-    it('drops slow consumers instead of blocking broadcast loop', () => {
-        const authConfig = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
-            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
-        });
-        const manager = createRealtimeSyncWsManager({
-            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
-        }, authConfig, { log: vi.fn(), warn: vi.fn() }, { maxBufferedBytes: 10 });
-        const ws = new MockWs();
-        ws.bufferedAmount = 9999;
-        const cookie = createSessionTokenCookie('session-a', authConfig, {
-            role: 'member',
-            workspaceId: 'workspace-a',
-            userId: 'user-a'
-        }).split(';')[0];
-        manager.handleConnection(ws, makeReq(cookie));
-        manager.broadcastMutation(makeEvent(1));
-        expect(ws.closeCode).toBe(1013);
-        expect(ws.closeReason).toBe('slow-consumer');
-    });
-    it('returns stable replay batches across repeated requests with same cursor', () => {
-        const authConfig = resolveAuthConfigFromEnv('cloud', {
-            TASKFORCE_AUTH_ENABLED: 'true',
-            TASKFORCE_AUTH_REQUIRED_FOR_API: 'true',
-            TASKFORCE_AUTH_SESSION_SECRET: 'test-secret',
-            TASKFORCE_AUTH_SESSION_COOKIE: 'taskforce_session'
-        });
-        const manager = createRealtimeSyncWsManager({
-            resolveUserAccess: vi.fn((userId, workspaceId) => (userId === 'user-a' && workspaceId === 'workspace-a' ? { workspaceId } : null))
-        }, authConfig, { log: vi.fn(), warn: vi.fn() });
-        const ws = new MockWs();
-        const cookie = createSessionTokenCookie('session-a', authConfig, {
-            role: 'member',
-            workspaceId: 'workspace-a',
-            userId: 'user-a'
-        }).split(';')[0];
-        manager.handleConnection(ws, makeReq(cookie));
-        manager.broadcastMutation(makeEvent(1));
-        manager.broadcastMutation(makeEvent(2));
-        manager.broadcastMutation(makeEvent(3));
-        ws.emit('message', JSON.stringify({
-            type: 'taskforce:replay',
-            workspaceId: 'workspace-a',
-            cursor: 'epoch-1:1'
-        }));
-        ws.emit('message', JSON.stringify({
-            type: 'taskforce:replay',
-            workspaceId: 'workspace-a',
-            cursor: 'epoch-1:1'
-        }));
-        const replays = parseMessages(ws).filter((msg) => msg.type === 'taskforce:replay');
-        expect(replays.length).toBeGreaterThanOrEqual(2);
-        const firstEvents = (replays[0]?.events || []).map((event) => event.eventId);
-        const secondEvents = (replays[1]?.events || []).map((event) => event.eventId);
-        expect(firstEvents).toEqual(['epoch-1:2', 'epoch-1:3']);
-        expect(secondEvents).toEqual(firstEvents);
-    });
-});

package/dist/server/realtimeSync.workspaceIsolation.test.d.ts

@@ -1 +0,0 @@
-export {};