@taskforcehq/taskforce 0.3.326 → 0.3.328

package/dist/server/routes/auth.js

@@ -10,9 +10,10 @@
  *   GET  /api/taskforce/auth/oauth/:provider/start
  *   GET  /api/taskforce/auth/oauth/:provider/callback
  *   POST /api/taskforce/auth/oauth/apple/callback
- *   GET  /api/taskforce/account/login-methods
- *   DELETE /api/taskforce/account/login-methods/:provider
- *   POST /api/taskforce/account/login-methods/password
+ *   GET  /api/taskforce/auth/login-methods
+ *   DELETE /api/taskforce/auth/login-methods/:provider
+ *   POST /api/taskforce/auth/login-methods/password
+ *   POST /api/taskforce/auth/password/change
  *   GET  /api/taskforce/auth/session
  *   GET  /api/taskforce/auth/admin-session
  *   POST /api/taskforce/auth/profile
@@ -59,15 +60,47 @@ import { buildGithubAuthUrl, exchangeGithubCode } from '../auth/providers/github
 import { hasValidSession, createClearSessionCookie, createSessionTokenCookie, resolveRequestAccess, resolveSessionCookieAttributesForRequest, } from '../auth.js';
 import { sendEmail } from '../email.js';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
+import { resolveTaskMetadataActivationCapability } from '../../sync/v3/taskMetadataActivation.js';
+import { resolveTaskCreateActivationCapability } from '../../sync/v3/taskCreateActivation.js';
+import { resolveTaskStatusActivationCapability } from '../../sync/v3/taskStatusActivation.js';
+import { resolveTaskDeleteActivationCapability } from '../../sync/v3/taskDeleteActivation.js';
+import { resolveTaskHttpRootMutationCapability } from '../../sync/v3/durableTaskHttpRootMutationRouter.js';
+import { resolveLocalOutboxDispatchCapability } from '../../sync/v3/localOutboxDispatchCapability.js';
+import { resolveInitiativeFeedActivationCapability } from '../../sync/v3/initiativeFeedActivationCapability.js';
+import { resolveCombinedFeedCapability } from '../../sync/v3/combinedFeedCapability.js';
+import { resolveLocalSyncBrowserAuthorityCapability } from '../../sync/coordinator/localSyncBrowserAuthorityCapability.js';
 import { resolveRuntimeModeContract } from '../../shared/runtimeContract.js';
 import { getRouteTimingNow, logSlowBootstrapRoute, requestBootstrapTraceId, requestHeader, resolveErrorStatusCode, serializeJsonWithTiming, setServerTimingHeader } from './shared.js';
 import { buildAuthFlowBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, shouldExposeDevAuthTokens } from './authSupport.js';
 import { normalizeTaskDataRelativePath } from '../../storage/objectStorageClient.js';
 import { clearAiProfileAvatarAssets, saveAiProfileAvatarAssets } from '../aiProfileAvatarAssets.js';
+import { BedrockAvatarImageProvider } from '../../services/avatarImageProvider.js';
+import { AiProfileAvatarGenerationError, checkAiProfileAvatarGenerationRateLimit, generateAiProfileAvatar, } from '../../services/aiProfileAvatarGenerationService.js';
 const AI_PROFILE_AVATAR_UPLOAD_MAX_JSON_BYTES = 16 * 1024 * 1024;
 // === SECTION: Registration ===
 export function registerAuthRoutes(deps) {
     const { addRoute, core, context, requestWorkspaceId, requestUserId, resolveAuthenticatedUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, resolveEffectiveObjectStorageConfig, getObjectStorageClient, workspaceAssetStore, ensureWithinDir, markAssetDeleted, appendStorageTelemetry, } = deps;
+    const requireJsonContentType = (req, res) => {
+        const contentType = String(req.headers['content-type'] || '').split(';')[0]?.trim().toLowerCase();
+        if (contentType === 'application/json')
+            return true;
+        res.writeHead(415, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: false, error: 'Content-Type must be application/json.', code: 'JSON_CONTENT_TYPE_REQUIRED' }));
+        return false;
+    };
+    const passwordErrorMessage = (code, fallback) => {
+        switch (code) {
+            case 'CURRENT_PASSWORD_INVALID': return 'Current password is incorrect.';
+            case 'PASSWORD_UNCHANGED': return 'New password must be different from the current password.';
+            case 'PASSWORD_REQUIRED': return 'Password is required.';
+            case 'PASSWORD_TOO_SHORT': return 'Password is too short.';
+            case 'PASSWORD_TOO_LONG': return 'Password is too long.';
+            case 'PASSWORD_TOO_COMMON': return 'Choose a less common password.';
+            case 'PASSWORD_CONTAINS_PERSONAL_INFO': return 'Password cannot contain your email or display name.';
+            case 'IDENTITY_ALREADY_EXISTS': return 'A password login already exists for this account.';
+            default: return fallback;
+        }
+    };
     const normalizeTeamWorkspaceRole = (value) => {
         const role = String(value || '').trim().toLowerCase();
         if (role === 'owner' || role === 'admin' || role === 'member' || role === 'read-only')
@@ -87,6 +120,8 @@ export function registerAuthRoutes(deps) {
         username: profile.username,
         icon: profile.icon,
         color: profile.color,
+        colorSource: profile.colorSource ?? null,
+        colorUpdatedAt: profile.colorUpdatedAt ?? null,
         avatarUrl: profile.avatarUrl ?? null,
         avatarSourceUrl: profile.avatarSourceUrl ?? null,
         avatarRevision: profile.avatarRevision ?? 0,
@@ -97,6 +132,7 @@ export function registerAuthRoutes(deps) {
         model: profile.model ?? null,
         surfaceType: profile.surfaceType ?? null,
         seatScope: profile.seatScope ?? null,
+        providerMetadata: profile.providerMetadata ?? null,
         archivedAt: profile.archivedAt ?? null,
         archivedBy: profile.archivedBy ?? null,
         archivedReason: profile.archivedReason ?? null,
@@ -130,6 +166,12 @@ export function registerAuthRoutes(deps) {
         markAssetDeleted,
         appendStorageTelemetry,
     };
+    let aiProfileAvatarImageProvider = null;
+    const getAiProfileAvatarImageProvider = () => {
+        aiProfileAvatarImageProvider ??= new BedrockAvatarImageProvider();
+        return aiProfileAvatarImageProvider;
+    };
+    const canExposeDevAuthTokens = () => shouldExposeDevAuthTokens(context.authConfig?.runtimeMode);
     const resolveBillingConflictCodeForUser = (userIdRaw, gateRaw) => {
         const userId = String(userIdRaw || '').trim();
         const gate = String(gateRaw || '').trim().toLowerCase();
@@ -344,7 +386,8 @@ export function registerAuthRoutes(deps) {
         const urlPath = kind === 'verify-email'
             ? `/login?mode=verify&token=${encodeURIComponent(token)}`
             : `/login?mode=reset&token=${encodeURIComponent(token)}`;
-        console.info(`[Taskforce Auth] ${kind} email=${email} link=${base}${urlPath}`);
+        const linkLabel = canExposeDevAuthTokens() ? `${base}${urlPath}` : '(redacted)';
+        console.info(`[Taskforce Auth] ${kind} email=${email} link=${linkLabel}`);
     };
     const deliverAuthEmail = async (kind, email, token, req) => {
         const base = resolvePublicAuthBaseUrl(req);
@@ -397,7 +440,21 @@ export function registerAuthRoutes(deps) {
         const requestBaseUrl = resolveRuntimeConfigBaseUrl(req);
         const deployment = resolveDeploymentConfig(process.env, { requestBaseUrl });
         const runtimeContract = resolveRuntimeModeContract(context.authConfig?.runtimeMode || 'local');
-        res.writeHead(200, { 'Content-Type': 'application/json' });
+        const syncV3 = {
+            ...resolveLocalSyncBrowserAuthorityCapability({ runtimeMode: runtimeContract.runtimeMode }),
+            ...resolveLocalOutboxDispatchCapability({ runtimeMode: runtimeContract.runtimeMode }),
+            ...resolveTaskMetadataActivationCapability({ runtimeMode: runtimeContract.runtimeMode }),
+            ...resolveTaskStatusActivationCapability({ runtimeMode: runtimeContract.runtimeMode }),
+            ...resolveTaskDeleteActivationCapability({ runtimeMode: runtimeContract.runtimeMode }),
+            ...resolveTaskCreateActivationCapability({ runtimeMode: runtimeContract.runtimeMode }),
+            taskCloudHttpRootActivation: resolveTaskHttpRootMutationCapability({ runtimeMode: runtimeContract.runtimeMode }),
+            ...resolveInitiativeFeedActivationCapability({ runtimeMode: runtimeContract.runtimeMode }),
+            ...resolveCombinedFeedCapability({ runtimeMode: runtimeContract.runtimeMode }),
+        };
+        res.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'no-store',
+        });
         res.end(JSON.stringify({
             success: true,
             config: {
@@ -412,7 +469,8 @@ export function registerAuthRoutes(deps) {
                 runtimeMode: runtimeContract.runtimeMode,
                 authSource: runtimeContract.authSource,
                 workspaceMode: runtimeContract.workspaceMode,
-                workspaceSwitchingEnabled: runtimeContract.workspaceSwitchingEnabled
+                workspaceSwitchingEnabled: runtimeContract.workspaceSwitchingEnabled,
+                syncV3
             }
         }));
     });
@@ -961,9 +1019,9 @@ export function registerAuthRoutes(deps) {
             res.end();
         }
     });
-    // GET /api/taskforce/account/login-methods
+    // GET /api/taskforce/auth/login-methods
     // Returns the list of active login identities for the authenticated user.
-    addRoute('GET', '/api/taskforce/account/login-methods', async (req, res) => {
+    addRoute('GET', '/api/taskforce/auth/login-methods', async (req, res) => {
         if (!requireCloudRuntime(res, 'Login methods'))
             return;
         const authConfig = context.authConfig;
@@ -993,10 +1051,10 @@ export function registerAuthRoutes(deps) {
             }))
         }));
     });
-    // DELETE /api/taskforce/account/login-methods/:provider
+    // DELETE /api/taskforce/auth/login-methods/:provider
     // Unlinks a provider identity from the authenticated user.
     // Rejects with 409 if it would be the last active login method.
-    addRoute('DELETE', '/api/taskforce/account/login-methods/:provider', async (req, res, params) => {
+    addRoute('DELETE', '/api/taskforce/auth/login-methods/:provider', async (req, res, params) => {
         if (!requireCloudRuntime(res, 'Login methods'))
             return;
         const authConfig = context.authConfig;
@@ -1031,10 +1089,10 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: err?.message || 'Unlink failed.', code }));
         }
     });
-    // POST /api/taskforce/account/login-methods/password
-    // Adds (or replaces) a password identity for the authenticated user.
+    // POST /api/taskforce/auth/login-methods/password
+    // Adds a password identity for an authenticated user that does not already have one.
     // Social-only accounts use this to add a password login method.
-    addRoute('POST', '/api/taskforce/account/login-methods/password', async (req, res) => {
+    addRoute('POST', '/api/taskforce/auth/login-methods/password', async (req, res) => {
         if (!requireCloudRuntime(res, 'Login methods'))
             return;
         const authConfig = context.authConfig;
@@ -1050,6 +1108,8 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: 'Unable to resolve user.' }));
             return;
         }
+        if (!requireJsonContentType(req, res))
+            return;
         let body;
         try {
             body = await parseJsonBody(req);
@@ -1062,15 +1122,65 @@ export function registerAuthRoutes(deps) {
         const password = String(body?.password || '');
         try {
             core.addPasswordToAccount(userId, password);
-            auditAuthAction(req, 'account-password-added', { userId });
+            auditAuthAction(req, 'auth-password-added', { userId, code: 'PASSWORD_ADDED' });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: true }));
         }
         catch (err) {
             const code = err?.code || 'ADD_PASSWORD_ERROR';
             const status = resolveErrorStatusCode(err);
+            auditAuthAction(req, 'auth-password-add-failed', { userId, code });
             res.writeHead(status, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: false, error: err?.message || 'Failed to add password.', code }));
+            res.end(JSON.stringify({ success: false, error: passwordErrorMessage(code, 'Failed to add password.'), code }));
+        }
+    });
+    // POST /api/taskforce/auth/password/change
+    addRoute('POST', '/api/taskforce/auth/password/change', async (req, res) => {
+        if (!requireCloudRuntime(res, 'Password change'))
+            return;
+        const authConfig = context.authConfig;
+        if (!authConfig?.enabled || !hasValidSession(req, authConfig)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.', code: 'AUTHENTICATION_REQUIRED' }));
+            return;
+        }
+        const access = resolveRequestAccess(req, authConfig);
+        const userId = access?.userId || '';
+        if (!userId) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Unable to resolve user.', code: 'AUTHENTICATION_REQUIRED' }));
+            return;
+        }
+        if (!requireJsonContentType(req, res))
+            return;
+        let body;
+        try {
+            body = await parseJsonBody(req);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Invalid JSON body.', code: 'INVALID_JSON' }));
+            return;
+        }
+        try {
+            const replacementSessionCookie = buildPasswordSessionCookieForUser(req, authConfig, userId, {
+                preferredWorkspaceId: access.workspaceId,
+                fallbackRole: access.role
+            });
+            core.changePassword(userId, String(body.currentPassword || ''), String(body.newPassword || ''));
+            auditAuthAction(req, 'auth-password-change-succeeded', { userId, code: 'PASSWORD_CHANGED' });
+            res.writeHead(200, {
+                'Content-Type': 'application/json',
+                'Set-Cookie': replacementSessionCookie
+            });
+            res.end(JSON.stringify({ success: true }));
+        }
+        catch (err) {
+            const code = String(err?.code || 'PASSWORD_CHANGE_ERROR');
+            const status = resolveErrorStatusCode(err);
+            auditAuthAction(req, 'auth-password-change-failed', { userId, code });
+            res.writeHead(status, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: passwordErrorMessage(code, 'Failed to change password.'), code }));
         }
     });
     // GET /api/taskforce/auth/session - Return current auth/session state
@@ -1088,6 +1198,9 @@ export function registerAuthRoutes(deps) {
         let displayName = null;
         let avatarUrl = null;
         let betaAccess = true;
+        let workspaceAccessActive = false;
+        let accountDisabled = false;
+        let workspaceDisabled = false;
         let betaAccessResolvedAt = authResolvedAt;
         let userAccessResolvedAt = authResolvedAt;
         let identityResolvedAt = authResolvedAt;
@@ -1103,6 +1216,11 @@ export function registerAuthRoutes(deps) {
                 workspaceId = resolved.workspaceId;
                 userId = resolved.userId;
                 betaAccess = resolved.betaAccess;
+                accountDisabled = Boolean(resolved.accountDisabled);
+                workspaceDisabled = Boolean(resolved.workspaceDisabled);
+                workspaceAccessActive = !resolved.disabled
+                    && !accountDisabled
+                    && !workspaceDisabled;
             }
             else {
                 workspaceId = 'default';
@@ -1124,7 +1242,10 @@ export function registerAuthRoutes(deps) {
             email,
             displayName,
             avatarUrl,
-            betaAccess
+            betaAccess,
+            workspaceAccessActive,
+            accountDisabled,
+            workspaceDisabled
         };
         const serialized = serializeJsonWithTiming(payload, identityResolvedAt);
         const totalDurationMs = getRouteTimingNow() - routeStartedAt;
@@ -1645,7 +1766,7 @@ export function registerAuthRoutes(deps) {
                 verificationRequired: authBehavior.requireVerifiedEmail,
                 emailSent,
                 emailError,
-                verificationToken: authBehavior.requireVerifiedEmail && shouldExposeDevAuthTokens()
+                verificationToken: authBehavior.requireVerifiedEmail && canExposeDevAuthTokens()
                     ? (verificationToken || null)
                     : undefined
             }));
@@ -1682,7 +1803,7 @@ export function registerAuthRoutes(deps) {
                     emailSent,
                     deliveryAttempted,
                     emailError,
-                    verificationToken: shouldExposeDevAuthTokens()
+                    verificationToken: canExposeDevAuthTokens()
                         ? (verificationToken || null)
                         : undefined
                 }));
@@ -1733,7 +1854,7 @@ export function registerAuthRoutes(deps) {
                 emailSent,
                 deliveryAttempted,
                 emailError,
-                verificationToken: shouldExposeDevAuthTokens() ? (verification.token || null) : undefined
+                verificationToken: canExposeDevAuthTokens() ? (verification.token || null) : undefined
             }));
         }
         catch (error) {
@@ -1824,7 +1945,7 @@ export function registerAuthRoutes(deps) {
                 emailSent,
                 deliveryAttempted,
                 emailError,
-                resetToken: shouldExposeDevAuthTokens() ? (reset.token || null) : undefined
+                resetToken: canExposeDevAuthTokens() ? (reset.token || null) : undefined
             }));
         }
         catch (error) {
@@ -2269,7 +2390,7 @@ export function registerAuthRoutes(deps) {
         res.end(JSON.stringify({ users }));
     });
     // GET /api/taskforce/workspace/assignee-options - Read active workspace humans and registered AI collaborators for task assignee selection.
-    // Use ?kind=agent for Agent Manager roster loads that do not need human workspace members.
+    // Use ?kind=agent for AI Profiles roster loads that do not need human workspace members.
     addRoute('GET', '/api/taskforce/workspace/assignee-options', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
@@ -2316,6 +2437,8 @@ export function registerAuthRoutes(deps) {
             username: profile.username,
             icon: profile.icon,
             color: profile.color,
+            colorSource: profile.colorSource ?? null,
+            colorUpdatedAt: profile.colorUpdatedAt ?? null,
             avatarUrl: profile.avatarUrl ?? null,
             avatarSourceUrl: profile.avatarSourceUrl ?? null,
             avatarRevision: profile.avatarRevision ?? 0,
@@ -2327,6 +2450,7 @@ export function registerAuthRoutes(deps) {
             model: profile.model ?? null,
             surfaceType: profile.surfaceType ?? null,
             seatScope: profile.seatScope ?? null,
+            providerMetadata: profile.providerMetadata ?? null,
             archivedAt: profile.archivedAt ?? null,
             createdAt: profile.createdAt,
             updatedAt: profile.updatedAt,
@@ -2412,6 +2536,73 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ error: err?.message ?? 'Failed to update AI profile avatar.' }));
         }
     });
+    // POST /api/taskforce/workspace/ai-profiles/avatar/generate - Generate an avatar for an eligible external agent profile.
+    addRoute('POST', '/api/taskforce/workspace/ai-profiles/avatar/generate', async (req, res) => {
+        if (!requireCloudRuntime(res, 'AI profile avatar generation'))
+            return;
+        const body = await parseJsonBody(req);
+        const workspaceId = String(body?.workspaceId || requestWorkspaceId(req)).trim();
+        if (!ensureWorkspaceAdminRole(req, workspaceId)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: false,
+                error: 'Forbidden: owner or admin role required.',
+                code: 'AI_PROFILE_AVATAR_FORBIDDEN',
+            }));
+            return;
+        }
+        const profileId = String(body?.profileId || '').trim();
+        if (!profileId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'profileId is required.', code: 'AI_PROFILE_AVATAR_PROFILE_REQUIRED' }));
+            return;
+        }
+        try {
+            const result = await generateAiProfileAvatar({
+                core,
+                avatarAssetDeps: aiProfileAvatarAssetDeps,
+                imageProvider: getAiProfileAvatarImageProvider(),
+                checkRateLimit: checkAiProfileAvatarGenerationRateLimit,
+            }, {
+                workspaceId,
+                profileId,
+                actorId: resolveAuthenticatedUserId(req),
+                visualDirection: typeof body?.visualDirection === 'string' ? body.visualDirection : null,
+                replaceExisting: body?.replaceExisting === true,
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                profile: serializeAiProfilePublicRecord(result.profile),
+                avatar: {
+                    profileId: result.profile.id,
+                    avatarUrl: result.profile.avatarUrl ?? null,
+                    avatarRevision: result.profile.avatarRevision ?? 0,
+                    replacedExisting: result.replacedExisting,
+                },
+            }));
+        }
+        catch (error) {
+            const generationError = error instanceof AiProfileAvatarGenerationError ? error : null;
+            const status = generationError?.statusCode || 500;
+            if (generationError?.retryAfterSeconds) {
+                res.setHeader('Retry-After', String(generationError.retryAfterSeconds));
+            }
+            console.warn('[ai-profiles] avatar generation failed', {
+                workspaceId,
+                profileId,
+                code: generationError?.code || 'AI_PROFILE_AVATAR_GENERATION_FAILED',
+                diagnostics: aiProfileAvatarImageProvider?.getDiagnostics?.() || null,
+            });
+            res.writeHead(status, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: false,
+                error: generationError?.message || 'Avatar generation failed. Please try again.',
+                code: generationError?.code || 'AI_PROFILE_AVATAR_GENERATION_FAILED',
+                ...(generationError?.retryAfterSeconds ? { retryAfterSeconds: generationError.retryAfterSeconds } : {}),
+            }));
+        }
+    });
     // POST /api/taskforce/workspace/ai-profiles/avatar/upload - Upload stable AI profile avatar slots.
     addRoute('POST', '/api/taskforce/workspace/ai-profiles/avatar/upload', async (req, res) => {
         if (!ensureWorkspaceAdminRole(req)) {
@@ -2440,6 +2631,7 @@ export function registerAuthRoutes(deps) {
                 profileId,
                 display,
                 source,
+                preserveExistingSource: body?.preserveExistingSource === true,
                 actorId: resolveAuthenticatedUserId(req)
             });
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -2530,6 +2722,29 @@ export function registerAuthRoutes(deps) {
             }));
         }
     });
+    addRoute('POST', '/api/taskforce/workspace/ai-profiles/color', async (req, res) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        try {
+            const profiles = core.updateAiProfileColorGroup({
+                workspaceId: requestWorkspaceId(req),
+                profileIds: Array.isArray(body.profileIds) ? body.profileIds : [],
+                color: body.color,
+                reset: body.reset === true,
+                allowTaskforceManaged: true,
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, profiles: profiles.map(serializeAiProfilePublicRecord) }));
+        }
+        catch (err) {
+            res.writeHead(err?.statusCode ?? 500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err?.message ?? 'Failed to update AI profile color.', code: err?.code }));
+        }
+    });
     // POST /api/taskforce/workspace/ai-profiles/archive - Remove an AI profile from the active roster without deleting its history.
     addRoute('POST', '/api/taskforce/workspace/ai-profiles/archive', async (req, res) => {
         if (!ensureWorkspaceAdminRole(req)) {

package/dist/server/routes/authSupport.d.ts

@@ -1,7 +1,9 @@
 import type { IncomingMessage } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
+import { type TaskforceEmailSettingsInput } from '../email.js';
 import type { RouteContext } from './primitives.js';
 export declare function resolveBooleanSetting(value: unknown, fallback: boolean): boolean;
+export declare function resolveRouteEmailConfig(runtimeMode: unknown, settings: TaskforceEmailSettingsInput | null, env?: NodeJS.ProcessEnv): import("../email.js").TaskforceEmailConfig;
 export declare function getRouteEmailConfig(core: TaskforceCore, context: RouteContext): import("../email.js").TaskforceEmailConfig;
 export declare function buildAuthFlowBehavior(core: TaskforceCore): {
     allowSelfRegistration: boolean;
@@ -30,6 +32,6 @@ export declare function buildSiteBehavior(core: TaskforceCore): {
     pricingPageDescription: string;
     pricingPageShowPublicDescriptions: boolean;
 };
-export declare function shouldExposeDevAuthTokens(): boolean;
+export declare function shouldExposeDevAuthTokens(runtimeMode?: unknown): boolean;
 export declare function resolveRuntimeConfigBaseUrl(req: IncomingMessage): string;
 export declare function resolvePublicAuthBaseUrl(req: IncomingMessage): string;

package/dist/server/routes/authSupport.js

@@ -1,4 +1,4 @@
-import { resolveEffectiveEmailConfig } from '../email.js';
+import { resolveEffectiveEmailConfig, resolveEmailConfig } from '../email.js';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
 export function resolveBooleanSetting(value, fallback) {
     if (typeof value === 'boolean')
@@ -14,12 +14,25 @@ export function resolveBooleanSetting(value, fallback) {
         return false;
     return fallback;
 }
-export function getRouteEmailConfig(core, context) {
-    if (context.authConfig?.runtimeMode !== 'cloud') {
-        return resolveEffectiveEmailConfig(process.env, { provider: 'console' });
+export function resolveRouteEmailConfig(runtimeMode, settings, env = process.env) {
+    const mode = String(runtimeMode || '').trim().toLowerCase();
+    const envConfig = resolveEmailConfig(env);
+    if (envConfig.provider === 'mailpit') {
+        const cloudEnvironment = resolveDeploymentConfig(env).cloudEnvironment;
+        if (mode === 'cloud' && cloudEnvironment !== 'staging' && cloudEnvironment !== 'performance') {
+            throw new Error('Mailpit email capture is unavailable in production.');
+        }
+        return envConfig;
     }
-    const globalSettings = core.getGlobalSettings();
-    return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
+    if (mode !== 'cloud') {
+        return resolveEffectiveEmailConfig(env, { provider: 'console' });
+    }
+    return resolveEffectiveEmailConfig(env, settings);
+}
+export function getRouteEmailConfig(core, context) {
+    const runtimeMode = context.authConfig?.runtimeMode;
+    const settings = runtimeMode === 'cloud' ? core.getGlobalSettings().email || null : null;
+    return resolveRouteEmailConfig(runtimeMode, settings);
 }
 export function buildAuthFlowBehavior(core) {
     const globalSettings = core.getGlobalSettings();
@@ -68,9 +81,10 @@ export function buildSiteBehavior(core) {
         pricingPageShowPublicDescriptions: resolveBooleanSetting(siteSettings.pricingPageShowPublicDescriptions, false)
     };
 }
-export function shouldExposeDevAuthTokens() {
+export function shouldExposeDevAuthTokens(runtimeMode) {
     const explicit = String(process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS || '').trim().toLowerCase();
-    return explicit === '1' || explicit === 'true' || explicit === 'yes';
+    const enabled = explicit === '1' || explicit === 'true' || explicit === 'yes';
+    return enabled && String(runtimeMode || '').trim().toLowerCase() !== 'cloud';
 }
 export function resolveRuntimeConfigBaseUrl(req) {
     const host = String(req.headers['x-forwarded-host'] || req.headers.host || '').trim();

package/dist/server/routes/documentReviews.d.ts

@@ -6,6 +6,8 @@ export interface DocumentReviewRouteDependencies {
     core: TaskforceCore;
     requestWorkspaceId: (req: IncomingMessage) => string;
     resolveAuthenticatedUserId: (req: IncomingMessage) => string;
+    resolveAuthenticatedMutationUserId: (req: IncomingMessage) => string;
+    ensureWorkspaceAdminRole: (req: IncomingMessage, workspaceIdOverride?: string | null) => boolean;
     ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
 }
 export declare function registerDocumentReviewRoutes(deps: DocumentReviewRouteDependencies): void;