@taskforcehq/taskforce 0.3.326 → 0.3.328

package/dist/components/views/standalone/modals/SyncStatusModal.js

@@ -1,38 +1,98 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { AlertTriangle, Copy, Loader2, RefreshCw } from 'lucide-react';
+import { useEffect, useMemo, useState } from 'react';
+import { AlertTriangle, ChevronDown, Copy, Loader2, RefreshCw } from 'lucide-react';
 import { Modal } from '../../../ui/Modal';
 import modalStyles from '../../../ui/Modal.module.css';
 import syncStatusStyles from '../../SyncStatusModal.module.css';
 import styles from '../../../../Taskforce.module.css';
-export function SyncStatusModal({ isOpen, theme, currentWorkspaceLabel, syncStatusMeta, workspaceCloudSyncEnabled, syncControlBusy, canManageWorkspaceSync, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncRepairBusy, referenceMismatchCount, syncStageLabel, workspaceSyncPendingChanges, formattedLastSyncTime, formattedLastPullTime, formattedLastPushTime, syncLastError, workspaceSyncDiagnostics, activeReferenceMismatchSummaries, syncDiagnosticsSummary, syncEventRows, syncEventsListRef, workspaceSyncRepairQueued, workspaceSyncBusy, workspaceSyncCopied, runtimeMode, isAuthenticated, onClose, onToggleWorkspaceSync, onRepairSync, onCopyReport, onOpenLogin, onRetrySync, }) {
-    return (_jsx(Modal, { isOpen: isOpen, onClose: onClose, title: "Sync Manager", size: "mdWide", theme: theme, draggable: true, children: _jsxs("div", { className: `${modalStyles.form} ${syncStatusStyles.syncStatusModal}`, style: { gap: '10px' }, children: [_jsxs("div", { className: syncStatusStyles.syncStatusTop, children: [_jsx("div", { className: syncStatusStyles.syncStatusHeaderInfo, children: _jsxs("div", { className: syncStatusStyles.syncStatusMetaHeader, children: [_jsx("div", { className: syncStatusStyles.syncStatusBadge, style: {
-                                            borderColor: syncStatusMeta.border,
-                                            background: syncStatusMeta.background,
-                                            color: syncStatusMeta.color
-                                        }, children: syncStatusMeta.label }), _jsxs("span", { className: syncStatusStyles.syncStatusLabel, children: ["Workspace: ", _jsx("code", { children: currentWorkspaceLabel })] })] }) }), _jsx("label", { className: syncStatusStyles.syncToggle, children: _jsxs("span", { className: [
+import { isWorkspaceSyncAuthenticationError } from '../../../../utils/workspaceSyncPresentation';
+export function SyncStatusModal({ isOpen, theme, currentWorkspaceLabel, syncStatus, syncStatusMeta, workspaceCloudSyncEnabled, syncControlBusy, canManageWorkspaceSync, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncRepairBusy, referenceMismatchCount, syncStageLabel, workspaceSyncPendingChanges, incomingCloudChanges, formattedLastSyncTime, formattedLastPullTime, formattedLastPushTime, syncLastError, activeReferenceMismatchSummaries, syncDiagnosticsSummary, syncEventRows, syncEventsListRef, workspaceSyncRepairQueued, workspaceSyncBusy, workspaceSyncCopied, coordinatorOwnershipMode, coordinatorOwnershipTransferBusy, coordinatorOwnershipTransferDisabled, onClose, onToggleWorkspaceSync, onRepairSync, onCopyReport, onRetrySync, onTransferCoordinatorOwnership, }) {
+    const [eventFilter, setEventFilter] = useState('all');
+    useEffect(() => {
+        if (isOpen)
+            setEventFilter('all');
+    }, [isOpen]);
+    const needsAttention = syncStatus === 'attention';
+    const activeIssue = workspaceSyncRepairBusy
+        ? referenceMismatchCount > 0
+            ? `Repair is reconciling cloud state, including ${referenceMismatchCount} reference mismatch${referenceMismatchCount === 1 ? '' : 'es'}.`
+            : 'Repair is reconciling workspace state from the cloud.'
+        : needsAttention && syncLastError !== 'None'
+            ? syncLastError
+            : needsAttention
+                ? workspaceSyncSummary
+                : 'No active issue.';
+    const activeIssueIsError = !workspaceSyncRepairBusy && needsAttention && syncLastError !== 'None';
+    const coordinatorOwnedByOtherProcess = /\banother local taskforce process owns workspace synchronization\b/i.test(syncLastError);
+    const coordinatorAuthenticationRequired = isWorkspaceSyncAuthenticationError(syncLastError);
+    const repairActionAvailable = workspaceCloudSyncEnabled
+        && !coordinatorOwnedByOtherProcess
+        && !coordinatorAuthenticationRequired
+        && (needsAttention
+            || workspaceSyncBusy
+            || workspaceSyncRepairBusy
+            || workspaceSyncRepairQueued);
+    const retryActionAvailable = workspaceCloudSyncEnabled
+        && !coordinatorOwnedByOtherProcess
+        && !coordinatorAuthenticationRequired
+        && (workspaceSyncBusy
+            || needsAttention
+            || /\bpress sync\b/i.test(workspaceSyncRecommendedAction));
+    const visibleEventRows = useMemo(() => eventFilter === 'issues'
+        ? syncEventRows.filter((row) => row.tone === 'error')
+        : syncEventRows, [eventFilter, syncEventRows]);
+    const footer = (_jsxs("div", { className: syncStatusStyles.syncStatusFooter, children: [_jsxs("button", { className: styles.cancelBtn, onClick: onCopyReport, title: "Copy the current sync manager report for support or AI troubleshooting.", children: [_jsx(Copy, { size: 14 }), _jsx("span", { children: workspaceSyncCopied ? 'Copied' : 'Copy Report' })] }), _jsxs("div", { className: syncStatusStyles.syncStatusFooterPrimary, children: [_jsx("button", { className: styles.cancelBtn, onClick: onRepairSync, disabled: !repairActionAvailable
+                            || workspaceSyncRepairBusy
+                            || workspaceSyncRepairQueued, title: workspaceSyncRepairBusy
+                            ? 'Repair is running now.'
+                            : workspaceSyncRepairQueued
+                                ? 'Repair is queued and will start when the current sync finishes.'
+                                : !workspaceCloudSyncEnabled
+                                    ? 'Turn on workspace sync before running Repair.'
+                                    : coordinatorOwnedByOtherProcess
+                                        ? 'Repair is unavailable in this process. Use the Taskforce process that owns workspace synchronization.'
+                                        : coordinatorAuthenticationRequired
+                                            ? 'Sign out and sign back in before running Repair.'
+                                            : workspaceSyncBusy
+                                                ? 'Queue a repair to start automatically when the current sync finishes.'
+                                                : !repairActionAvailable
+                                                    ? 'Repair is available when sync needs attention.'
+                                                    : 'Advanced recovery: clear the saved pull cursor and re-fetch cloud state from the beginning.', children: workspaceSyncRepairBusy ? (_jsxs(_Fragment, { children: [_jsx(Loader2, { size: 14, className: styles.spinner }), "Repairing..."] })) : workspaceSyncRepairQueued ? ('Repair Queued') : ('Repair') }), _jsx("button", { className: styles.submitBtn, onClick: onRetrySync, disabled: !retryActionAvailable || workspaceSyncBusy, title: workspaceSyncBusy
+                            ? 'A sync request is already running.'
+                            : !workspaceCloudSyncEnabled
+                                ? 'Turn on workspace sync before retrying.'
+                                : coordinatorOwnedByOtherProcess
+                                    ? 'Retry is unavailable in this process. Use the Taskforce process that owns workspace synchronization.'
+                                    : coordinatorAuthenticationRequired
+                                        ? 'Sign out and sign back in before retrying sync.'
+                                        : !retryActionAvailable
+                                            ? 'No retry is currently needed.'
+                                            : 'Retry workspace synchronization now.', children: workspaceSyncBusy ? (_jsxs(_Fragment, { children: [_jsx(Loader2, { size: 14, className: styles.spinner }), "Syncing..."] })) : (_jsxs(_Fragment, { children: [_jsx(RefreshCw, { size: 14 }), "Retry now"] })) })] })] }));
+    return (_jsx(Modal, { isOpen: isOpen, onClose: onClose, title: "Sync Manager", size: "mdWide", theme: theme, draggable: true, className: syncStatusStyles.syncStatusOverlay, footer: footer, children: _jsxs("div", { className: `${modalStyles.form} ${syncStatusStyles.syncStatusModal}`, children: [_jsxs("div", { className: syncStatusStyles.syncStatusTop, children: [_jsxs("div", { className: syncStatusStyles.syncStatusMetaHeader, children: [_jsx("div", { className: syncStatusStyles.syncStatusBadge, style: {
+                                        borderColor: syncStatusMeta.border,
+                                        background: syncStatusMeta.background,
+                                        color: syncStatusMeta.color
+                                    }, children: syncStatusMeta.label }), _jsxs("span", { className: syncStatusStyles.syncStatusLabel, children: ["Workspace: ", _jsx("code", { children: currentWorkspaceLabel })] })] }), _jsx("label", { className: syncStatusStyles.syncToggle, children: _jsxs("span", { className: [
                                     syncStatusStyles.syncToggleControl,
                                     workspaceCloudSyncEnabled ? syncStatusStyles.syncToggleControlEnabled : syncStatusStyles.syncToggleControlDisabled,
                                     syncControlBusy ? syncStatusStyles.syncToggleControlBusy : '',
                                     !canManageWorkspaceSync ? syncStatusStyles.syncToggleControlBlocked : ''
-                                ].filter(Boolean).join(' '), children: [_jsx("input", { className: syncStatusStyles.syncToggleInput, type: "checkbox", role: "switch", "aria-label": "Enable Sync", checked: workspaceCloudSyncEnabled, disabled: !canManageWorkspaceSync || syncControlBusy, onChange: (event) => onToggleWorkspaceSync(event.target.checked) }), _jsx("span", { className: `${syncStatusStyles.syncToggleState} ${syncStatusStyles.syncToggleStateOn}`, children: "On" }), _jsx("span", { className: `${syncStatusStyles.syncToggleState} ${syncStatusStyles.syncToggleStateOff}`, children: "Off" }), _jsx("span", { className: syncStatusStyles.syncToggleThumb })] }) })] }), _jsxs("div", { className: syncStatusStyles.syncStatusSummaryCompact, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Health" }), _jsx("span", { className: syncStatusStyles.syncStatusSummaryValue, children: workspaceSyncSummary })] }), _jsxs("div", { className: syncStatusStyles.syncStatusSummaryCompact, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Next Step" }), _jsx("span", { className: syncStatusStyles.syncStatusSummaryValue, children: workspaceSyncRecommendedAction })] }), workspaceSyncRepairBusy && (_jsxs("div", { className: syncStatusStyles.syncStatusRepairBanner, children: [_jsxs("div", { className: syncStatusStyles.syncStatusRepairHeader, children: [_jsxs("div", { className: syncStatusStyles.syncStatusRepairBadge, children: [_jsx(Loader2, { size: 13, className: styles.spinner }), _jsx("span", { children: "Repair In Progress" })] }), _jsx("span", { className: syncStatusStyles.syncStatusRepairMeta, children: "Advanced recovery mode" })] }), _jsx("span", { className: syncStatusStyles.syncStatusRepairText, children: referenceMismatchCount > 0
-                                ? `Taskforce is clearing the saved sync cursor and reconciling workspace state from the cloud again, including ${referenceMismatchCount} detected reference mismatch${referenceMismatchCount === 1 ? '' : 'es'}. The panel may stay busy for a while during large repairs.`
-                                : 'Taskforce is clearing the saved sync cursor and reconciling workspace state from the cloud again. The panel may stay busy for a while during large repairs.' })] })), _jsx("div", { className: syncStatusStyles.syncStatusSectionHeader, children: _jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Current Session" }) }), _jsxs("div", { className: syncStatusStyles.syncStatusCompactGrid, children: [_jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Stage" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: syncStageLabel })] }), _jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Local Changes" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: workspaceSyncPendingChanges })] }), _jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Last Successful" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: formattedLastSyncTime })] })] }), _jsx("div", { className: syncStatusStyles.syncStatusSectionHeader, children: _jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Activity" }) }), _jsxs("div", { className: syncStatusStyles.syncStatusCompactGrid, children: [_jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Last Pull" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: formattedLastPullTime })] }), _jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Last Push" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: formattedLastPushTime })] })] }), syncLastError !== 'None' && (_jsxs("div", { className: syncStatusStyles.syncStatusPanel, style: { background: 'rgba(239, 68, 68, 0.05)', borderColor: 'rgba(239, 68, 68, 0.2)' }, children: [_jsxs("div", { className: syncStatusStyles.syncStatusSectionHeader, style: { marginTop: 0 }, children: [_jsx(AlertTriangle, { size: 12, color: "#fda4af" }), _jsxs("span", { className: syncStatusStyles.syncStatusLabel, style: { color: '#fda4af' }, children: ["Last Error (", workspaceSyncDiagnostics.lastErrorAt ? new Date(workspaceSyncDiagnostics.lastErrorAt).toLocaleTimeString() : 'Recent', ")"] })] }), _jsx("span", { className: `${syncStatusStyles.syncStatusValue} ${syncStatusStyles.syncStatusValueError}`, children: syncLastError })] })), referenceMismatchCount > 0 && (_jsxs("div", { className: syncStatusStyles.syncStatusPanel, style: { background: 'rgba(250, 204, 21, 0.08)', borderColor: 'rgba(250, 204, 21, 0.22)' }, children: [_jsxs("div", { className: syncStatusStyles.syncStatusPanelHeader, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, style: { color: '#fde68a' }, children: "Identifier Integrity" }), _jsxs("span", { className: syncStatusStyles.syncStatusPanelMeta, children: [referenceMismatchCount, " mismatch", referenceMismatchCount === 1 ? '' : 'es', " detected"] })] }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: "Task, document, or image reference numbers disagreed during normal sync. Cloud-backed sync preserves the incoming cloud reference and renumbers the displaced local item to the next available reference." }), activeReferenceMismatchSummaries.length > 0 && (_jsx("div", { style: { marginTop: '10px', display: 'flex', flexDirection: 'column', gap: '8px' }, children: activeReferenceMismatchSummaries.map((item) => (_jsxs("div", { style: {
-                                    display: 'flex',
-                                    flexDirection: 'column',
-                                    gap: '2px',
-                                    padding: '8px 10px',
-                                    borderRadius: '8px',
-                                    background: 'rgba(15, 23, 42, 0.18)',
-                                    border: '1px solid rgba(250, 204, 21, 0.16)'
-                                }, children: [_jsx("span", { className: syncStatusStyles.syncStatusValue, style: { fontSize: '12px', wordBreak: 'break-all' }, children: item.pathLabel }), item.refsLabel ? (_jsx("span", { className: syncStatusStyles.syncStatusPanelMeta, children: item.refsLabel })) : null] }, item.key))) }))] })), _jsxs("div", { className: syncStatusStyles.syncStatusPanel, children: [_jsxs("div", { className: syncStatusStyles.syncStatusPanelHeader, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Local Sync Diagnostics" }), _jsx("span", { className: syncStatusStyles.syncStatusPanelMeta, style: { fontSize: '10px' }, children: "AI profiles & metadata" })] }), _jsx("div", { className: syncStatusStyles.syncStatusCompactGrid, style: { gridTemplateColumns: 'repeat(2, 1fr)' }, children: syncDiagnosticsSummary.map((item) => (_jsxs("div", { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'baseline', gap: '8px' }, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, style: { fontSize: '9px', textTransform: 'capitalize' }, children: item.label }), _jsx("span", { className: syncStatusStyles.syncStatusValue, style: { fontSize: '11px', whiteSpace: 'nowrap', overflow: 'hidden', textOverflow: 'ellipsis' }, children: item.value })] }, item.label))) })] }), _jsxs("div", { className: syncStatusStyles.syncStatusPanel, children: [_jsx("div", { className: syncStatusStyles.syncStatusPanelHeader, children: _jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Recent Events" }) }), _jsx("div", { ref: syncEventsListRef, className: syncStatusStyles.syncStatusEventsList, style: { height: '120px' }, children: syncEventRows.map((row) => (_jsx("div", { className: [
+                                ].filter(Boolean).join(' '), children: [_jsx("input", { className: syncStatusStyles.syncToggleInput, type: "checkbox", role: "switch", "aria-label": "Enable Sync", checked: workspaceCloudSyncEnabled, disabled: !canManageWorkspaceSync || syncControlBusy, onChange: (event) => onToggleWorkspaceSync(event.target.checked) }), _jsx("span", { className: `${syncStatusStyles.syncToggleState} ${syncStatusStyles.syncToggleStateOn}`, children: "On" }), _jsx("span", { className: `${syncStatusStyles.syncToggleState} ${syncStatusStyles.syncToggleStateOff}`, children: "Off" }), _jsx("span", { className: syncStatusStyles.syncToggleThumb })] }) })] }), _jsxs("section", { className: syncStatusStyles.syncStatusOverview, "aria-label": "Sync status", children: [_jsxs("div", { className: syncStatusStyles.syncStatusOverviewRow, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Health" }), _jsx("span", { className: syncStatusStyles.syncStatusSummaryValue, children: workspaceSyncSummary })] }), _jsxs("div", { className: syncStatusStyles.syncStatusOverviewRow, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Next step" }), _jsx("span", { className: syncStatusStyles.syncStatusSummaryValue, children: workspaceSyncRecommendedAction })] }), _jsxs("div", { className: [
+                                syncStatusStyles.syncStatusOverviewRow,
+                                syncStatusStyles.syncStatusIssueRow,
+                                activeIssueIsError ? syncStatusStyles.syncStatusIssueRowError : '',
+                            ].filter(Boolean).join(' '), children: [_jsxs("span", { className: syncStatusStyles.syncStatusLabel, children: [activeIssueIsError ? _jsx(AlertTriangle, { size: 12 }) : null, "Current issue"] }), _jsx("span", { className: activeIssueIsError ? syncStatusStyles.syncStatusValueError : syncStatusStyles.syncStatusValueMuted, children: activeIssue })] })] }), _jsxs("div", { className: syncStatusStyles.syncStatusKeyMetrics, children: [_jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Outgoing local changes" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: workspaceSyncPendingChanges })] }), _jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Incoming cloud changes" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: incomingCloudChanges })] }), _jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Last cloud check" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: formattedLastPullTime })] })] }), _jsxs("details", { className: syncStatusStyles.syncStatusAdvanced, children: [_jsxs("summary", { children: [_jsx("span", { children: "Advanced diagnostics" }), _jsx(ChevronDown, { size: 16, "aria-hidden": "true" })] }), _jsxs("div", { className: syncStatusStyles.syncStatusAdvancedContent, children: [_jsxs("div", { className: syncStatusStyles.syncStatusCompactGrid, children: [_jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Stage" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: syncStageLabel })] }), _jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Last upload" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: formattedLastPushTime })] }), _jsxs("div", { className: syncStatusStyles.syncStatusCompactItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Last successful transfer" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: formattedLastSyncTime })] })] }), _jsx("div", { className: syncStatusStyles.syncStatusDiagnosticsList, children: syncDiagnosticsSummary.map((item) => (_jsxs("div", { className: syncStatusStyles.syncStatusDiagnosticRow, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: item.label }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: item.value })] }, item.label))) }), coordinatorOwnershipMode ? (_jsxs("div", { className: syncStatusStyles.syncStatusOwnershipControl, children: [_jsxs("div", { children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Sync coordinator" }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: coordinatorOwnershipMode === 'server'
+                                                        ? 'Local server owns background synchronization.'
+                                                        : 'This browser owns background synchronization.' })] }), _jsx("button", { className: styles.cancelBtn, type: "button", onClick: onTransferCoordinatorOwnership, disabled: coordinatorOwnershipTransferBusy
+                                                || coordinatorOwnershipTransferDisabled, title: coordinatorOwnershipTransferBusy
+                                                ? 'Sync ownership is transferring.'
+                                                : coordinatorOwnershipTransferDisabled
+                                                    ? 'Finish active sync or recovery work before transferring ownership.'
+                                                    : coordinatorOwnershipMode === 'server'
+                                                        ? 'Return background synchronization to this browser.'
+                                                        : 'Move background synchronization to the local Taskforce server.', children: coordinatorOwnershipTransferBusy ? (_jsxs(_Fragment, { children: [_jsx(Loader2, { size: 14, className: styles.spinner }), "Transferring..."] })) : coordinatorOwnershipMode === 'server' ? ('Use browser sync') : ('Use server sync') })] })) : null, referenceMismatchCount > 0 && (_jsxs("div", { className: syncStatusStyles.syncStatusMismatchPanel, children: [_jsxs("div", { className: syncStatusStyles.syncStatusPanelHeader, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Identifier integrity" }), _jsxs("span", { className: syncStatusStyles.syncStatusPanelMeta, children: [referenceMismatchCount, " mismatch", referenceMismatchCount === 1 ? '' : 'es', " detected"] })] }), _jsx("span", { className: syncStatusStyles.syncStatusValue, children: "Cloud-backed sync preserved the incoming cloud reference and renumbered the displaced local item." }), activeReferenceMismatchSummaries.map((item) => (_jsxs("div", { className: syncStatusStyles.syncStatusMismatchItem, children: [_jsx("span", { className: syncStatusStyles.syncStatusValue, children: item.pathLabel }), item.refsLabel ? (_jsx("span", { className: syncStatusStyles.syncStatusPanelMeta, children: item.refsLabel })) : null] }, item.key)))] }))] })] }), _jsxs("section", { className: syncStatusStyles.syncStatusEventsPanel, "aria-label": "Recent sync events", children: [_jsxs("div", { className: syncStatusStyles.syncStatusPanelHeader, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Recent events" }), _jsxs("div", { className: syncStatusStyles.syncStatusEventFilters, "aria-label": "Filter recent events", children: [_jsx("button", { type: "button", className: eventFilter === 'all' ? syncStatusStyles.syncStatusEventFilterActive : '', "aria-pressed": eventFilter === 'all', onClick: () => setEventFilter('all'), children: "All" }), _jsx("button", { type: "button", className: eventFilter === 'issues' ? syncStatusStyles.syncStatusEventFilterActive : '', "aria-pressed": eventFilter === 'issues', onClick: () => setEventFilter('issues'), children: "Issues" })] })] }), _jsx("div", { ref: syncEventsListRef, className: syncStatusStyles.syncStatusEventsList, children: visibleEventRows.length > 0 ? visibleEventRows.map((row) => (_jsx("div", { className: [
                                     syncStatusStyles.syncStatusEventItem,
                                     row.tone === 'error' ? syncStatusStyles.syncStatusEventItemError : '',
                                     row.tone === 'muted' ? syncStatusStyles.syncStatusEventItemMuted : ''
-                                ].filter(Boolean).join(' '), style: { padding: '6px 8px', borderRadius: '6px' }, children: _jsx("span", { className: syncStatusStyles.syncStatusEventLine, style: { fontSize: '11px' }, children: row.text }) }, row.key))) })] }), _jsxs("div", { className: `${modalStyles.formActions} ${syncStatusStyles.syncStatusActions}`, children: [_jsxs("div", { className: syncStatusStyles.syncStatusSecondaryActions, children: [_jsx("button", { className: styles.cancelBtn, onClick: onRepairSync, disabled: workspaceSyncRepairBusy, title: workspaceSyncRepairBusy
-                                        ? 'Repair is running now.'
-                                        : workspaceSyncRepairQueued
-                                            ? 'Repair is queued and will start when the current sync finishes.'
-                                            : workspaceSyncBusy
-                                                ? 'Queue a repair to start automatically when the current sync finishes.'
-                                                : 'Advanced recovery: clear the saved pull cursor and re-fetch cloud state from the beginning.', children: workspaceSyncRepairBusy ? (_jsxs(_Fragment, { children: [_jsx(Loader2, { size: 14, className: styles.spinner }), _jsx("span", { style: { marginLeft: '6px' }, children: "Repairing..." })] })) : workspaceSyncRepairQueued ? ('Repair Queued') : ('Repair') }), _jsxs("button", { className: styles.cancelBtn, onClick: onCopyReport, title: "Copy the current sync manager report for support or AI troubleshooting.", children: [_jsx(Copy, { size: 14 }), _jsx("span", { style: { marginLeft: '6px' }, children: workspaceSyncCopied ? 'Copied' : 'Copy Report' })] })] }), _jsxs("div", { className: syncStatusStyles.syncStatusPrimaryActions, children: [_jsx("div", { className: syncStatusStyles.syncStatusPrimaryActionSlot, children: runtimeMode === 'local' && !isAuthenticated ? (_jsx("button", { className: styles.submitBtn, onClick: onOpenLogin, children: "Sign In / Register" })) : (_jsx("div", { className: syncStatusStyles.syncStatusActionPlaceholder, "aria-hidden": "true" })) }), _jsx("div", { className: syncStatusStyles.syncStatusPrimaryActionSlot, children: _jsx("button", { className: styles.submitBtn, onClick: onRetrySync, disabled: workspaceSyncBusy, children: workspaceSyncBusy ? (_jsxs(_Fragment, { children: [_jsx(Loader2, { size: 14, className: styles.spinner }), "Syncing..."] })) : (_jsxs(_Fragment, { children: [_jsx(RefreshCw, { size: 14 }), "Sync"] })) }) })] })] })] }) }));
+                                ].filter(Boolean).join(' '), children: _jsx("span", { className: syncStatusStyles.syncStatusEventLine, children: row.text }) }, row.key))) : (_jsx("div", { className: `${syncStatusStyles.syncStatusEventItem} ${syncStatusStyles.syncStatusEventItemMuted}`, children: _jsx("span", { className: syncStatusStyles.syncStatusEventLine, children: "No issues in recent events." }) })) })] })] }) }));
 }

package/dist/components/views/standalone/modals/TeamManagementModal.js

@@ -6,5 +6,5 @@ import authStyles from '../../AuthShell.module.css';
 import managementStyles from '../../StandaloneManagement.module.css';
 import styles from '../../../../Taskforce.module.css';
 export function TeamManagementModal({ isOpen, theme, teamPlanMode, teamMgmtError, teamManagementTab, teamUsersLoading, teamUsers, teamActionBusyUserId, teamInviteFeedback, teamInviteEmail, teamInviteRole, teamInvitePermissionMode, teamInviteBusy, pendingInvites, teamAuditLoading, teamAuditEvents, teamAuditPage, teamAuditPages, teamAuditHasMore, onClose, onOpenMembersTab, onOpenInvitesTab, onOpenAuditTab, onMemberRoleChange, onMemberPermissionChange, onToggleMemberDisabled, onRevokeInvite, onRemoveMember, onInviteEmailChange, onInviteRoleChange, onInvitePermissionModeChange, onSubmitInvite, onLoadAuditPrevious, onLoadAuditNext, }) {
-    return (_jsx(Modal, { isOpen: isOpen, onClose: onClose, title: "Team Management", size: "md", theme: theme, draggable: true, children: _jsxs("div", { className: `${modalStyles.form} ${managementStyles.modalBody}`, children: [teamPlanMode === 'personal' && (_jsx("p", { className: authStyles.loginError, children: "Team management is only available in TEAM accounts." })), teamMgmtError && (_jsx("p", { className: authStyles.loginError, children: teamMgmtError })), _jsxs("div", { className: `${styles.settingsTabs} tf-scrollbar tf-scrollbar--track-transparent tf-scrollbar--compact`, children: [_jsx("button", { className: `${styles.settingsTabBtn} ${teamManagementTab === 'members' ? styles.settingsTabBtnActive : ''}`, onClick: onOpenMembersTab, children: "Members" }), _jsx("button", { className: `${styles.settingsTabBtn} ${teamManagementTab === 'invites' ? styles.settingsTabBtnActive : ''}`, onClick: onOpenInvitesTab, children: "Invites" }), _jsx("button", { className: `${styles.settingsTabBtn} ${teamManagementTab === 'audit' ? styles.settingsTabBtnActive : ''}`, onClick: onOpenAuditTab, children: "Audit Log" })] }), teamManagementTab === 'members' && (_jsxs("div", { className: accountStyles.accountHubCard, children: [teamUsersLoading && _jsx("p", { className: managementStyles.mutedText, children: "Loading members..." }), !teamUsersLoading && teamUsers.length === 0 && (_jsx("p", { className: managementStyles.mutedText, children: "No users found." })), !teamUsersLoading && teamUsers.map((member) => (_jsxs("div", { className: managementStyles.memberRow, children: [_jsx("div", { className: managementStyles.memberTitle, children: member.displayName || member.email }), _jsxs("div", { className: accountStyles.accountMenuMeta, children: [member.email, " \u00B7 ", member.status, member.disabled ? ' · deactivated' : ''] }), _jsxs("div", { className: managementStyles.memberActions, children: [_jsxs("select", { className: `${styles.input} ${managementStyles.selectRole}`, value: member.role, onChange: (event) => onMemberRoleChange(member.userId, event.target.value), disabled: teamActionBusyUserId === member.userId, children: [_jsx("option", { value: "owner", children: "Owner" }), _jsx("option", { value: "admin", children: "Admin" }), _jsx("option", { value: "member", children: "Member" })] }), member.role === 'member' && (_jsxs("select", { className: `${styles.input} ${managementStyles.selectPermission}`, value: member.permissionMode, onChange: (event) => onMemberPermissionChange(member.userId, event.target.value), disabled: teamActionBusyUserId === member.userId, children: [_jsx("option", { value: "read-write", children: "Read / Write" }), _jsx("option", { value: "read-only", children: "Read Only" })] })), _jsx("button", { className: styles.cancelBtn, disabled: teamActionBusyUserId === member.userId, onClick: () => onToggleMemberDisabled(member.userId, !member.disabled), children: member.disabled ? 'Reactivate' : 'Deactivate' }), member.status === 'invited' && (_jsx("button", { className: styles.cancelBtn, disabled: teamActionBusyUserId === member.userId, onClick: () => onRevokeInvite(member.userId), children: "Revoke Invite" })), _jsx("button", { className: styles.cancelBtn, disabled: teamActionBusyUserId === member.userId, onClick: () => onRemoveMember(member.userId), children: "Remove" })] })] }, member.userId)))] })), teamManagementTab === 'invites' && (_jsxs("div", { className: accountStyles.accountHubCard, children: [teamInviteFeedback && (_jsx("p", { className: managementStyles.sectionText, children: teamInviteFeedback })), _jsxs("div", { className: styles.pathInputGroup, children: [_jsx("label", { className: `${styles.label} ${managementStyles.labelFixed}`, children: "Email" }), _jsx("input", { className: styles.input, value: teamInviteEmail, onChange: (event) => onInviteEmailChange(event.target.value), placeholder: "name@company.com" })] }), _jsxs("div", { className: styles.pathInputGroup, children: [_jsx("label", { className: `${styles.label} ${managementStyles.labelFixed}`, children: "Role" }), _jsxs("select", { className: `${styles.input} ${managementStyles.selectRole}`, value: teamInviteRole, onChange: (event) => onInviteRoleChange(event.target.value === 'admin' ? 'admin' : 'member'), children: [_jsx("option", { value: "member", children: "Member" }), _jsx("option", { value: "admin", children: "Admin" })] }), teamInviteRole === 'member' && (_jsxs("select", { className: `${styles.input} ${managementStyles.selectPermission}`, value: teamInvitePermissionMode, onChange: (event) => onInvitePermissionModeChange(event.target.value === 'read-only' ? 'read-only' : 'read-write'), children: [_jsx("option", { value: "read-write", children: "Read / Write" }), _jsx("option", { value: "read-only", children: "Read Only" })] })), _jsx("button", { className: styles.submitBtn, disabled: teamInviteBusy || !teamInviteEmail.trim() || teamPlanMode !== 'team', onClick: onSubmitInvite, children: teamInviteBusy ? 'Sending...' : 'Send Invite' })] }), _jsxs("div", { className: managementStyles.inviteRow, children: [_jsx("div", { className: managementStyles.listHeading, children: "Pending Invites" }), pendingInvites.length === 0 && (_jsx("p", { className: managementStyles.mutedText, children: "No pending invites." })), pendingInvites.map((invite) => (_jsxs("div", { className: managementStyles.memberRow, children: [_jsx("div", { className: managementStyles.memberTitle, children: invite.displayName || invite.email }), _jsxs("div", { className: accountStyles.accountMenuMeta, children: [invite.email, " \u00B7 ", invite.role] })] }, invite.userId)))] })] })), teamManagementTab === 'audit' && (_jsxs("div", { className: accountStyles.accountHubCard, children: [teamAuditLoading && _jsx("p", { className: managementStyles.mutedText, children: "Loading audit entries..." }), !teamAuditLoading && teamAuditEvents.length === 0 && (_jsx("p", { className: managementStyles.mutedText, children: "No audit events for this workspace." })), !teamAuditLoading && (_jsx("div", { className: managementStyles.auditList, children: teamAuditEvents.map((event) => (_jsxs("div", { className: managementStyles.memberRow, children: [_jsx("div", { className: accountStyles.accountMenuMeta, children: new Date(event.createdAt).toLocaleString() }), _jsx("div", { className: managementStyles.memberTitle, children: event.action }), _jsxs("div", { className: accountStyles.accountMenuMeta, children: [event.actorUserId, " (", event.actorRole, ")"] })] }, event.id))) })), _jsxs("div", { className: managementStyles.auditPager, children: [_jsx("button", { className: styles.cancelBtn, disabled: teamAuditLoading || teamAuditPage === 0, onClick: onLoadAuditPrevious, children: "Previous" }), _jsxs("span", { className: accountStyles.accountMenuMeta, children: ["Page ", teamAuditPage + 1, " of ", teamAuditPages] }), _jsx("button", { className: styles.cancelBtn, disabled: teamAuditLoading || !teamAuditHasMore || teamAuditPage + 1 >= teamAuditPages, onClick: onLoadAuditNext, children: "Next" })] })] })), _jsx("div", { className: `${modalStyles.formActions} ${managementStyles.modalActionsEnd}`, children: _jsx("button", { className: styles.cancelBtn, onClick: onClose, children: "Close" }) })] }) }));
+    return (_jsx(Modal, { isOpen: isOpen, onClose: onClose, title: "Team Management", size: "md", theme: theme, draggable: true, children: _jsxs("div", { className: `${modalStyles.form} ${managementStyles.modalBody}`, children: [teamPlanMode === 'personal' && (_jsx("p", { className: authStyles.loginError, children: "Team management is only available in TEAM accounts." })), teamMgmtError && (_jsx("p", { className: authStyles.loginError, children: teamMgmtError })), _jsxs("div", { className: `${styles.settingsTabs} tf-scrollbar tf-scrollbar--track-transparent tf-scrollbar--compact`, children: [_jsx("button", { className: `${styles.settingsTabBtn} ${teamManagementTab === 'members' ? styles.settingsTabBtnActive : ''}`, onClick: onOpenMembersTab, children: "Members" }), _jsx("button", { className: `${styles.settingsTabBtn} ${teamManagementTab === 'invites' ? styles.settingsTabBtnActive : ''}`, onClick: onOpenInvitesTab, children: "Invites" }), _jsx("button", { className: `${styles.settingsTabBtn} ${teamManagementTab === 'audit' ? styles.settingsTabBtnActive : ''}`, onClick: onOpenAuditTab, children: "Audit Log" })] }), teamManagementTab === 'members' && (_jsxs("div", { className: accountStyles.accountHubCard, children: [teamUsersLoading && _jsx("p", { className: managementStyles.mutedText, children: "Loading members..." }), !teamUsersLoading && teamUsers.length === 0 && (_jsx("p", { className: managementStyles.mutedText, children: "No users found." })), !teamUsersLoading && teamUsers.map((member) => (_jsxs("div", { className: managementStyles.memberRow, children: [_jsx("div", { className: managementStyles.memberTitle, children: member.displayName || member.email }), _jsxs("div", { className: accountStyles.accountMenuMeta, children: [member.email, " \u00B7 ", member.status, member.disabled ? ' · deactivated' : ''] }), _jsxs("div", { className: managementStyles.memberActions, children: [_jsxs("select", { className: `${styles.input} ${managementStyles.selectRole}`, value: member.role, onChange: (event) => onMemberRoleChange(member.userId, event.target.value), disabled: teamActionBusyUserId === member.userId, children: [_jsx("option", { value: "owner", children: "Owner" }), _jsx("option", { value: "admin", children: "Admin" }), _jsx("option", { value: "member", children: "Member" })] }), member.role === 'member' && (_jsxs("select", { className: `${styles.input} ${managementStyles.selectPermission}`, value: member.permissionMode, onChange: (event) => onMemberPermissionChange(member.userId, event.target.value), disabled: teamActionBusyUserId === member.userId, children: [_jsx("option", { value: "read-write", children: "Read / Write" }), _jsx("option", { value: "read-only", children: "Read Only" })] })), _jsx("button", { className: styles.cancelBtn, disabled: teamActionBusyUserId === member.userId, onClick: () => onToggleMemberDisabled(member.userId, !member.disabled), children: member.disabled ? 'Reactivate' : 'Deactivate' }), member.status === 'invited' && (_jsx("button", { className: styles.cancelBtn, disabled: teamActionBusyUserId === member.userId, onClick: () => onRevokeInvite(member.userId), children: "Revoke Invite" })), _jsx("button", { className: styles.cancelBtn, disabled: teamActionBusyUserId === member.userId, onClick: () => onRemoveMember(member.userId), children: "Remove" })] })] }, member.userId)))] })), teamManagementTab === 'invites' && (_jsxs("div", { className: accountStyles.accountHubCard, children: [teamInviteFeedback && (_jsx("p", { className: managementStyles.sectionText, children: teamInviteFeedback })), _jsxs("div", { className: styles.pathInputGroup, children: [_jsx("label", { className: `${styles.label} ${managementStyles.labelFixed}`, children: "Email" }), _jsx("input", { className: styles.input, value: teamInviteEmail, onChange: (event) => onInviteEmailChange(event.target.value), placeholder: "name@example.com" })] }), _jsxs("div", { className: styles.pathInputGroup, children: [_jsx("label", { className: `${styles.label} ${managementStyles.labelFixed}`, children: "Role" }), _jsxs("select", { className: `${styles.input} ${managementStyles.selectRole}`, value: teamInviteRole, onChange: (event) => onInviteRoleChange(event.target.value === 'admin' ? 'admin' : 'member'), children: [_jsx("option", { value: "member", children: "Member" }), _jsx("option", { value: "admin", children: "Admin" })] }), teamInviteRole === 'member' && (_jsxs("select", { className: `${styles.input} ${managementStyles.selectPermission}`, value: teamInvitePermissionMode, onChange: (event) => onInvitePermissionModeChange(event.target.value === 'read-only' ? 'read-only' : 'read-write'), children: [_jsx("option", { value: "read-write", children: "Read / Write" }), _jsx("option", { value: "read-only", children: "Read Only" })] })), _jsx("button", { className: styles.submitBtn, disabled: teamInviteBusy || !teamInviteEmail.trim() || teamPlanMode !== 'team', onClick: onSubmitInvite, children: teamInviteBusy ? 'Sending...' : 'Send Invite' })] }), _jsxs("div", { className: managementStyles.inviteRow, children: [_jsx("div", { className: managementStyles.listHeading, children: "Pending Invites" }), pendingInvites.length === 0 && (_jsx("p", { className: managementStyles.mutedText, children: "No pending invites." })), pendingInvites.map((invite) => (_jsxs("div", { className: managementStyles.memberRow, children: [_jsx("div", { className: managementStyles.memberTitle, children: invite.displayName || invite.email }), _jsxs("div", { className: accountStyles.accountMenuMeta, children: [invite.email, " \u00B7 ", invite.role] })] }, invite.userId)))] })] })), teamManagementTab === 'audit' && (_jsxs("div", { className: accountStyles.accountHubCard, children: [teamAuditLoading && _jsx("p", { className: managementStyles.mutedText, children: "Loading audit entries..." }), !teamAuditLoading && teamAuditEvents.length === 0 && (_jsx("p", { className: managementStyles.mutedText, children: "No audit events for this workspace." })), !teamAuditLoading && (_jsx("div", { className: managementStyles.auditList, children: teamAuditEvents.map((event) => (_jsxs("div", { className: managementStyles.memberRow, children: [_jsx("div", { className: accountStyles.accountMenuMeta, children: new Date(event.createdAt).toLocaleString() }), _jsx("div", { className: managementStyles.memberTitle, children: event.action }), _jsxs("div", { className: accountStyles.accountMenuMeta, children: [event.actorUserId, " (", event.actorRole, ")"] })] }, event.id))) })), _jsxs("div", { className: managementStyles.auditPager, children: [_jsx("button", { className: styles.cancelBtn, disabled: teamAuditLoading || teamAuditPage === 0, onClick: onLoadAuditPrevious, children: "Previous" }), _jsxs("span", { className: accountStyles.accountMenuMeta, children: ["Page ", teamAuditPage + 1, " of ", teamAuditPages] }), _jsx("button", { className: styles.cancelBtn, disabled: teamAuditLoading || !teamAuditHasMore || teamAuditPage + 1 >= teamAuditPages, onClick: onLoadAuditNext, children: "Next" })] })] })), _jsx("div", { className: `${modalStyles.formActions} ${managementStyles.modalActionsEnd}`, children: _jsx("button", { className: styles.cancelBtn, onClick: onClose, children: "Close" }) })] }) }));
 }

package/dist/config/applicationBaseUrl.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveCloudApplicationBaseUrl(env?: NodeJS.ProcessEnv): string | null;
+export declare function resolveLocalApplicationBaseUrl(env?: NodeJS.ProcessEnv): string | null;

package/dist/config/applicationBaseUrl.js

@@ -0,0 +1,23 @@
+import { TASKFORCE_CLOUD_ENVIRONMENTS, parseTaskforceCloudEnvironment, resolveTaskforceCloudEnvironmentFromBaseUrl, } from './cloudEnvironment.js';
+import { normalizeTaskforceApplicationBaseUrl } from '../shared/taskDeepLinks.js';
+export function resolveCloudApplicationBaseUrl(env = process.env) {
+    const explicitEnvironment = parseTaskforceCloudEnvironment(env.TASKFORCE_CLOUD_ENVIRONMENT);
+    if (explicitEnvironment)
+        return TASKFORCE_CLOUD_ENVIRONMENTS[explicitEnvironment].appBaseUrl;
+    const explicitApplicationUrls = [
+        env.TASKFORCE_AUTH_PUBLIC_BASE_URL,
+        env.TASKFORCE_BASE_URL,
+        env.VITE_TASKFORCE_BASE_URL,
+        env.VITE_TASKFORCE_CLOUD_AUTH_BASE_URL,
+        env.VITE_TASKFORCE_API_BASE_URL,
+    ];
+    for (const candidate of explicitApplicationUrls) {
+        const environment = resolveTaskforceCloudEnvironmentFromBaseUrl(candidate);
+        if (environment)
+            return TASKFORCE_CLOUD_ENVIRONMENTS[environment].appBaseUrl;
+    }
+    return null;
+}
+export function resolveLocalApplicationBaseUrl(env = process.env) {
+    return normalizeTaskforceApplicationBaseUrl(env.TASKFORCE_APP_BASE_URL);
+}

package/dist/config/envSchema.d.ts

@@ -1,5 +1,5 @@
 export type EnvValidationTarget = 'server' | 'soak' | 'all';
-type EnvCategory = 'Core' | 'Auth' | 'Storage' | 'Security' | 'Email' | 'Build' | 'Client' | 'Soak' | 'Cloudflare';
+type EnvCategory = 'Core' | 'Auth' | 'Storage' | 'Security' | 'Email' | 'AI' | 'Build' | 'Client' | 'Soak' | 'Cloudflare';
 export interface EnvVarSpec {
     key: string;
     description: string;

package/dist/config/envSchema.js

@@ -1,19 +1,89 @@
 import { resolveDeploymentConfig } from './deployment.js';
 import { MIGRATION_COMPAT_ENABLED } from '../runtime/migrationFlags.js';
+import { parseWorkspaceSyncV3FeedCursorKeyring } from '../sync/v3/workspaceSyncV3FeedCursorKeys.js';
 const SPECS = [
     { key: 'PORT', description: 'Standalone server port.', category: 'Core', defaultValue: '8080', targets: ['server', 'all'] },
     { key: 'TASKFORCE_TENANT_ID', description: 'Tenant identifier.', category: 'Core', defaultValue: 'default', targets: ['server', 'all'] },
     { key: 'TASKFORCE_WORKSPACE_ID', description: 'Optional explicit workspace scope for MCP/server tooling.', category: 'Core', targets: ['server', 'all'] },
     { key: 'TASKFORCE_RUNTIME_MODE', description: 'Runtime mode (local|cloud).', category: 'Core', defaultValue: 'local', example: 'cloud', targets: ['server', 'all'] },
     { key: 'TASKFORCE_CLOUD_ENVIRONMENT', description: 'Canonical cloud target (production|staging|performance).', category: 'Core', defaultValue: 'production', example: 'staging', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_APP_BASE_URL', description: 'Browser-visible HTTP(S) application origin used for task deep links in local MCP output.', category: 'Core', example: 'http://localhost:5174', targets: ['server', 'all'] },
     { key: 'TASKFORCE_DB_PROVIDER', description: 'Database provider (sqlite|postgres).', category: 'Core', defaultValue: 'sqlite', example: 'postgres', targets: ['server', 'all'] },
     { key: 'TASKFORCE_BILLING_ENABLED', description: 'Enable Stripe billing routes and webhook processing.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_DATABASE_URL', description: 'Postgres connection string when provider=postgres.', category: 'Core', example: 'postgresql://user:pass@host:5432/db', secret: true, targets: ['server', 'all'] },
+    { key: 'TASKFORCE_CLOUD_READ_WORKERS', description: 'Bounded cloud collection-read worker count (1-8, or 0 to disable).', category: 'Core', defaultValue: '2', targets: ['server', 'all'] },
     { key: 'TASKFORCE_ALLOW_SQLITE_IN_CLOUD', description: 'Emergency override to allow sqlite in cloud runtime.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_FORCE_SETUP', description: 'Force local setup gate for development.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_FORCE_GLOBAL_SETUP', description: 'Force global setup step for development.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_FORCE_WORKSPACE_SETUP', description: 'Force workspace setup step for development.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_REALTIME_SYNC', description: 'Enable realtime sync transport layer (feature-flag).', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SHARED_LOCAL_MCP_ENABLED', description: 'Enable the shared local MCP service lifecycle and transport.', category: 'Core', defaultValue: 'true', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SHARED_LOCAL_MCP_CLIENT_MODE', description: 'Select the local MCP client path (proxy, or legacy for controlled rollback only).', category: 'Core', defaultValue: 'proxy', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SHARED_LOCAL_MCP_ROLLBACK_VERSION', description: 'Exact CLI version required to authorize the explicit legacy MCP rollback path.', category: 'Core', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_LOCAL_SYNC_BROWSER_AUTHORITY_GATE_ENABLED', description: 'Legacy rollout observation flag. Browser transfers always use the permit-backed coordinator gateway and persisted ownership is always authoritative.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_LOCAL_SYNC_SERVER_OWNERSHIP_TRANSFER_ENABLED', description: 'Permit explicit local sync ownership transfer from the browser gateway to the process-owned server runner.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASKS_ENABLED', description: 'Enable authenticated v3 task metadata, create/delete, and relationship operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_LOCAL_CAPTURE_ENABLED', description: 'Enable the local-only v3 durable operation capture boundary.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_LOCAL_DISPATCH_ENABLED', description: 'Enable local v3 outbox delivery to the configured cloud.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_COMMENTS_ENABLED', description: 'Enable durable v3 task-comment acceptance on this runtime.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_COMMENTS_CAPTURE_ENABLED', description: 'Enable local durable v3 task-comment capture when the shared local capture and dispatch boundaries are enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_COMMENTS_HTTP_ACTIVATION_ENABLED', description: 'Route ordinary task-comment HTTP writes through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_COMMENTS_MCP_ACTIVATION_ENABLED', description: 'Route ordinary task-comment MCP writes through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_CHECKLIST_ENABLED', description: 'Enable durable v3 task-checklist acceptance on this runtime.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_CHECKLIST_CAPTURE_ENABLED', description: 'Enable local durable v3 task-checklist capture when the shared local capture and dispatch boundaries are enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_CHECKLIST_HTTP_ACTIVATION_ENABLED', description: 'Route ordinary task-checklist HTTP writes through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_CHECKLIST_MCP_ACTIVATION_ENABLED', description: 'Route ordinary task-checklist MCP writes through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_ATTACHMENT_LINKS_ENABLED', description: 'Enable durable v3 task attachment-link acceptance on this runtime.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_ATTACHMENT_LINKS_CAPTURE_ENABLED', description: 'Enable local durable v3 task attachment-link capture when shared local capture and dispatch are enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_ATTACHMENT_LINKS_HTTP_ACTIVATION_ENABLED', description: 'Route ordinary task attachment-link HTTP writes through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_ATTACHMENT_LINKS_MCP_ACTIVATION_ENABLED', description: 'Route ordinary task attachment-link MCP writes through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_CREATE_CAPTURE_ENABLED', description: 'Enable behavior-dark local v3 task-create capture; no browser caller is activated by this flag.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_DELETE_CAPTURE_ENABLED', description: 'Enable behavior-dark local v3 task-delete capture with atomic relationship tombstones.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_RELATIONSHIP_CAPTURE_ENABLED', description: 'Enable behavior-dark local v3 task relationship capture and dependency-ordered dispatch.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_RELATIONSHIP_MCP_ACTIVATION_ENABLED', description: 'Route MCP task relationship mutations through durable v3 acceptance/outbox boundaries.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_LIFECYCLE_CAPTURE_ENABLED', description: 'Enable behavior-dark local v3 task archive, unarchive, complete, and reopen capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_STATUS_ENABLED', description: 'Enable durable v3 task-status acceptance and cloud MCP status/lifecycle routing; local writers remain separately activation-gated.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_STATUS_ACTIVATION_ENABLED', description: 'Route ordinary local browser task status and lifecycle writes through durable v3 operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_STATUS_MCP_ACTIVATION_ENABLED', description: 'Enable local MCP task status and lifecycle capture through durable v3 operations; cloud MCP uses the shared durable task-status acceptance capability.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_CLOUD_HTTP_ACTIVATION_ENABLED', description: 'Route covered cloud task HTTP writes through durable v3 acceptance before combined-feed activation.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_CREATE_MCP_ACTIVATION_ENABLED', description: 'Route supported MCP task creation through durable v3 acceptance/outbox boundaries.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_METADATA_MCP_ACTIVATION_ENABLED', description: 'Route supported MCP task-root metadata writes through durable v3 acceptance/outbox boundaries.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_CREATE_ACTIVATION_ENABLED', description: 'Enable the strict simple-task browser create path when every required v3 boundary is also enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_DELETE_ACTIVATION_ENABLED', description: 'Route ordinary local browser task deletion through durable v3 capture when every required boundary is enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TASK_METADATA_ACTIVATION_ENABLED', description: 'Enable the local v3 task metadata client path when every required v3 boundary is also enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TAXONOMY_ENABLED', description: 'Enable cloud acceptance for durable v3 taxonomy operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TAXONOMY_CAPTURE_ENABLED', description: 'Enable behavior-dark local capture for durable v3 taxonomy operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TAXONOMY_ACTIVATION_ENABLED', description: 'Route ordinary taxonomy HTTP writes through durable v3 operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_TAXONOMY_MCP_ACTIVATION_ENABLED', description: 'Route ordinary taxonomy MCP writes through durable v3 operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_INITIATIVES_ENABLED', description: 'Enable cloud acceptance for durable v3 initiative operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_INITIATIVE_CAPTURE_ENABLED', description: 'Enable behavior-dark local capture for durable v3 initiative operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_INITIATIVE_ACTIVATION_ENABLED', description: 'Route ordinary initiative HTTP writes through durable v3 operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_INITIATIVE_MCP_ACTIVATION_ENABLED', description: 'Route ordinary initiative MCP writes through durable v3 operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_FEED_ENABLED', description: 'Enable the behavior-dark cloud v3 covered-metadata feed.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_FEED_REPAIR_ENABLED', description: 'Enable authoritative v3 initiative repair snapshots and legacy revision backfill.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_INITIATIVE_FEED_ACTIVATION_ENABLED', description: 'Activate v3 initiative feed orchestration after all durable initiative writer and local apply gates are enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_INITIATIVE_LEGACY_PUSH_DISABLED', description: 'Fail closed on legacy v2 initiative push and bootstrap bodies before activating v3 initiative feed ownership.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_LOCAL_FEED_APPLY_ENABLED', description: 'Enable the local-only atomic v3 initiative feed apply boundary.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_COMBINED_FEED_ENABLED', description: 'Expose registered task-planning-metadata cloud feed and repair contracts.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_COMBINED_FEED_ACTIVATION_ENABLED', description: 'Request combined coordinator activation; activation still requires exact local prerequisites and a matching ready cloud capability attestation.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_COMBINED_FEED_COVERAGE_VERSION', description: 'Request a frozen combined-feed coverage profile by registered version. Omit for version 3; version 4 adds nested task and entity-event coverage; version 5 adds workflow runtime coverage; version 6 extends version 4 with workstream task order.', category: 'Core', defaultValue: '3', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_COMBINED_LOCAL_FEED_APPLY_ENABLED', description: 'Enable local atomic apply for registered task-planning-metadata coverage profiles.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_COMBINED_LEGACY_FENCE_ENABLED', description: 'Configure the combined stale-v2 fence; it becomes effective only after every covered cloud HTTP and MCP writer boundary is ready.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_NESTED_LEGACY_FENCE_ENABLED', description: 'Fence the four v4-only legacy projections after every nested cloud writer boundary is ready.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_ENABLED', description: 'Enable cloud acceptance for durable v3 workflow runtime commands.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_CAPTURE_ENABLED', description: 'Enable local durable workflow runtime capture when the shared local capture boundary is enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_DISPATCH_ENABLED', description: 'Enable local durable workflow runtime outbox dispatch when the shared dispatcher is enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_HTTP_ACTIVATION_ENABLED', description: 'Route workflow runtime HTTP commands through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_MCP_ACTIVATION_ENABLED', description: 'Route workflow runtime MCP commands through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_CARRIER_COEXISTENCE_ENABLED', description: 'Acknowledge that task-status workflow activation remains the v5 bootstrap and rollback carrier.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKSTREAM_TASK_ORDER_ENABLED', description: 'Enable cloud acceptance for durable v3 workstream task-order operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKSTREAM_TASK_ORDER_CAPTURE_ENABLED', description: 'Enable local durable workstream task-order capture when the shared local capture and dispatch boundaries are enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKSTREAM_TASK_ORDER_HTTP_ACTIVATION_ENABLED', description: 'Route workstream task-order HTTP writes through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_FEED_CURSOR_KEYS_JSON', description: 'Secret JSON keyring containing the active v3 feed cursor signing key and retained verification keys.', category: 'Core', secret: true, targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKSTREAMS_ENABLED', description: 'Enable cloud acceptance for durable v3 workstream operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKSTREAM_CAPTURE_ENABLED', description: 'Enable behavior-dark local capture for durable v3 workstream operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKSTREAM_ACTIVATION_ENABLED', description: 'Route ordinary workstream HTTP writes through durable v3 operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKSTREAM_MCP_ACTIVATION_ENABLED', description: 'Route ordinary workstream MCP writes through durable v3 operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_AUTH_ENABLED', description: 'Enable auth endpoints and session checks.', category: 'Auth', defaultValue: 'true', targets: ['server', 'all'] },
     { key: 'TASKFORCE_AUTH_REQUIRED_FOR_API', description: 'Require auth for protected API routes.', category: 'Auth', defaultValue: 'true', targets: ['server', 'all'] },
     { key: 'TASKFORCE_AUTH_EXCLUDED_PATHS', description: 'Comma-separated API paths excluded from auth checks.', category: 'Auth', defaultValue: '/api/taskforce/health,/api/taskforce/version,/api/taskforce/auth,/api/taskforce/public/pricing,/api/taskforce/public/site-config,/api/taskforce/public/site-config-script', targets: ['server', 'all'] },
@@ -47,12 +117,32 @@ const SPECS = [
     { key: 'TASKFORCE_VIRUS_SCAN_ASYNC', description: 'Run scan asynchronously when supported.', category: 'Security', defaultValue: 'true', targets: ['server', 'all'] },
     { key: 'TASKFORCE_CLAMAV_HOST', description: 'ClamAV host.', category: 'Security', defaultValue: '127.0.0.1', targets: ['server', 'all'] },
     { key: 'TASKFORCE_CLAMAV_PORT', description: 'ClamAV port.', category: 'Security', defaultValue: '3310', targets: ['server', 'all'] },
-    { key: 'TASKFORCE_EMAIL_PROVIDER', description: 'Email provider (console|resend|google-workspace).', category: 'Email', defaultValue: 'console', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_EMAIL_PROVIDER', description: 'Email provider (console|resend|google-workspace|mailpit). Mailpit is non-production only.', category: 'Email', defaultValue: 'console', targets: ['server', 'all'] },
     { key: 'TASKFORCE_EMAIL_FROM', description: 'Email from address.', category: 'Email', defaultValue: 'Taskforce <no-reply@taskforcehq.ai>', targets: ['server', 'all'] },
     { key: 'TASKFORCE_EMAIL_REPLY_TO', description: 'Optional reply-to address.', category: 'Email', targets: ['server', 'all'] },
     { key: 'TASKFORCE_EMAIL_PROVIDER_API_KEY', description: 'Provider API key.', category: 'Email', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_EMAIL_RESEND_API_KEY', description: 'Legacy resend API key alias.', category: 'Email', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_EMAIL_GOOGLE_APP_PASSWORD', description: 'Google Workspace app password alias.', category: 'Email', secret: true, targets: ['server', 'all'] },
+    { key: 'TASKFORCE_EMAIL_SMTP_HOST', description: 'SMTP host for the Mailpit test provider.', category: 'Email', defaultValue: '127.0.0.1', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_EMAIL_SMTP_PORT', description: 'SMTP port for the Mailpit test provider.', category: 'Email', defaultValue: '1025', targets: ['server', 'all'] },
+    { key: 'AWS_REGION', description: 'AWS region for Bedrock/model gateway calls.', category: 'AI', defaultValue: 'us-west-2', targets: ['server', 'all'] },
+    { key: 'AWS_REGION_AVATAR_GENERATION', description: 'AWS region for server-side agent avatar image generation.', category: 'AI', example: 'us-west-2', targets: ['server', 'all'] },
+    { key: 'AWS_BEDROCK_AVATAR_MODEL_ID', description: 'Optional Bedrock image model ID override for server-side agent avatar generation.', category: 'AI', defaultValue: 'stability.stable-image-core-v1:1', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_AI_AVATAR_PROFILE_LIMIT', description: 'Maximum paid avatar generation attempts per AI profile in one generation window.', category: 'AI', defaultValue: '3', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_AI_AVATAR_WORKSPACE_LIMIT', description: 'Maximum paid avatar generation attempts per workspace in one generation window.', category: 'AI', defaultValue: '20', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_AI_AVATAR_RATE_LIMIT_WINDOW_MS', description: 'Window size for paid AI profile avatar generation limits.', category: 'AI', defaultValue: '3600000', targets: ['server', 'all'] },
+    { key: 'AWS_DEFAULT_REGION', description: 'AWS SDK default region fallback.', category: 'AI', example: 'us-west-2', targets: ['server', 'all'] },
+    { key: 'AWS_PROFILE', description: 'AWS shared config profile for local Bedrock smoke tests.', category: 'AI', example: 'taskforce-bedrock-dev', targets: ['server', 'all'] },
+    { key: 'AWS_ACCESS_KEY_ID', description: 'AWS access key ID for local Bedrock smoke tests or cloud runtime credentials.', category: 'AI', secret: true, targets: ['server', 'all'] },
+    { key: 'AWS_SECRET_ACCESS_KEY', description: 'AWS secret access key for local Bedrock smoke tests or cloud runtime credentials.', category: 'AI', secret: true, targets: ['server', 'all'] },
+    { key: 'AWS_SESSION_TOKEN', description: 'Optional AWS session token for temporary credentials.', category: 'AI', secret: true, targets: ['server', 'all'] },
+    { key: 'TASKFORCE_BEDROCK_MODEL_ID', description: 'Optional Bedrock model or inference profile ID override for the model gateway.', category: 'AI', defaultValue: 'us.anthropic.claude-sonnet-4-6', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_BEDROCK_MODEL_TIER', description: 'Model gateway tier to use with TASKFORCE_BEDROCK_MODEL_ID and Bedrock smoke tests (fast|balanced|advanced).', category: 'AI', defaultValue: 'balanced', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_BEDROCK_SMOKE', description: 'Explicit opt-in flag for live Bedrock smoke tests.', category: 'AI', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_BEDROCK_SMOKE_PROMPT', description: 'Optional prompt for live Bedrock smoke tests.', category: 'AI', example: 'Reply with ok.', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_BEDROCK_SMOKE_MAX_TOKENS', description: 'Maximum output tokens for live Bedrock smoke tests.', category: 'AI', defaultValue: '128', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_BEDROCK_MANTLE_MODEL_KEY', description: 'Optional model key for Bedrock Mantle smoke tests (openai.gpt-5-4|xai.grok-4-3).', category: 'AI', defaultValue: 'openai.gpt-5-4', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_BEDROCK_ENV_FILE', description: 'Optional env file path for the Bedrock smoke script.', category: 'AI', defaultValue: '.env.local', targets: ['server', 'all'] },
     { key: 'TASKFORCE_ALLOWED_ORIGINS', description: 'Allowed CORS origins (comma-separated).', category: 'Security', targets: ['server', 'all'] },
     { key: 'TASKFORCE_API_RATE_LIMIT_ENABLED', description: 'Enable API rate limiter.', category: 'Security', defaultValue: 'true', targets: ['server', 'all'] },
     { key: 'TASKFORCE_API_RATE_LIMIT_MAX_REQUESTS', description: 'API rate limit max requests per window.', category: 'Security', defaultValue: '120', targets: ['server', 'all'] },
@@ -64,6 +154,11 @@ const SPECS = [
     { key: 'TASKFORCE_DOCUMENT_PURGE_ENABLED', description: 'Enable document purge scheduler.', category: 'Security', defaultValue: 'true', targets: ['server', 'all'] },
     { key: 'TASKFORCE_DOCUMENT_PURGE_INTERVAL_MINUTES', description: 'Document purge interval in minutes.', category: 'Security', defaultValue: '15', targets: ['server', 'all'] },
     { key: 'TASKFORCE_STORAGE_INTEGRITY_SCHEDULE_POLL_MINUTES', description: 'Storage integrity schedule poll frequency in minutes.', category: 'Security', defaultValue: '1', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_ADMIN_AUDIT_RETENTION_ENABLED', description: 'Enable bounded cloud admin-audit retention maintenance.', category: 'Security', defaultValue: 'true', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_ADMIN_AUDIT_RETENTION_INTERVAL_MINUTES', description: 'Admin-audit retention maintenance interval.', category: 'Security', defaultValue: '15', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_ADMIN_AUDIT_RETENTION_BATCH_SIZE', description: 'Maximum admin-audit rows removed per maintenance run.', category: 'Security', defaultValue: '5000', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_ADMIN_AUDIT_SYNC_RETENTION_DAYS', description: 'Retention period for non-routine sync audit failures and exceptional events.', category: 'Security', defaultValue: '30', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_ADMIN_AUDIT_RETENTION_DAYS', description: 'Default retention period for administrative and security audit events.', category: 'Security', defaultValue: '365', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_KEY', description: 'Optional sync encryption key.', category: 'Security', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_STRIPE_SECRET_KEY', description: 'Stripe secret API key used by server-side billing routes.', category: 'Security', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_STRIPE_WEBHOOK_SECRET', description: 'Stripe webhook signing secret used to verify incoming webhooks.', category: 'Security', secret: true, targets: ['server', 'all'] },
@@ -71,6 +166,8 @@ const SPECS = [
     { key: 'TASKFORCE_BUILD_GIT_SHA', description: 'Build git SHA metadata.', category: 'Build', targets: ['server', 'all'] },
     { key: 'TASKFORCE_BUILD_TIME', description: 'Build timestamp metadata.', category: 'Build', targets: ['server', 'all'] },
     { key: 'TASKFORCE_BUILD_DEPLOY_ID', description: 'Build deploy ID metadata.', category: 'Build', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_UI_DIST_DIR', description: 'Override the standalone UI distribution directory for isolated local QA runtimes.', category: 'Build', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_REQUIRE_EXACT_PORT', description: 'Require the standalone server to use only its requested port.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'DEBUG_MODE', description: 'Expose debug-only client diagnostics such as pricing source metadata.', category: 'Build', defaultValue: 'false', targets: ['all'] },
     { key: 'VITE_TASKFORCE_BASE_URL', description: 'Client base URL for both API and cloud auth when specific overrides are not set.', category: 'Client', example: 'https://performance-app.taskforcehq.ai', targets: ['all'] },
     { key: 'VITE_TASKFORCE_API_BASE_URL', description: 'Client API base URL (overrides VITE_TASKFORCE_BASE_URL when set).', category: 'Client', example: 'https://performance-app.taskforcehq.ai', targets: ['all'] },
@@ -80,6 +177,7 @@ const SPECS = [
     { key: 'SYNC_SOAK_LOCAL_BASE_URL', description: 'Soak local app URL.', category: 'Soak', defaultValue: 'http://localhost:5174', targets: ['soak', 'all'] },
     { key: 'SYNC_SOAK_CLOUD_BASE_URL', description: 'Soak cloud app URL.', category: 'Soak', example: 'https://performance-app.taskforcehq.ai', targets: ['soak', 'all'] },
     { key: 'SYNC_SOAK_WORKSPACE_ID', description: 'Base soak workspace ID.', category: 'Soak', defaultValue: 'test-smoke', targets: ['soak', 'all'] },
+    { key: 'SYNC_COORDINATOR_CANARY_WORKSPACE_ID', description: 'Dedicated, intentionally empty performance workspace used by the operator-gated multi-profile coordinator canary.', category: 'Soak', targets: ['soak', 'all'] },
     { key: 'SYNC_SOAK_EMAIL', description: 'Primary soak account email fallback.', category: 'Soak', targets: ['soak', 'all'] },
     { key: 'SYNC_SOAK_PASSWORD', description: 'Primary soak account password fallback.', category: 'Soak', secret: true, targets: ['soak', 'all'] },
     { key: 'SYNC_SOAK_ACCOUNTS_JSON', description: 'JSON account pool for soak login rotation.', category: 'Soak', secret: true, example: '[{"email":"test_01@taskforcehq.ai","password":"..."}]', targets: ['soak', 'all'] },
@@ -103,7 +201,17 @@ const SPECS = [
 ];
 const SPEC_BY_KEY = new Map(SPECS.map((spec) => [spec.key, spec]));
 const MANAGED_PREFIXES = ['TASKFORCE_', 'SYNC_SOAK_', 'VITE_TASKFORCE_', 'R2_', 'CF_ACCESS_'];
-const ADDITIONAL_MANAGED_KEYS = new Set(['PORT']);
+const ADDITIONAL_MANAGED_KEYS = new Set([
+    'PORT',
+    'AWS_REGION',
+    'AWS_REGION_AVATAR_GENERATION',
+    'AWS_BEDROCK_AVATAR_MODEL_ID',
+    'AWS_DEFAULT_REGION',
+    'AWS_PROFILE',
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN'
+]);
 function hasValue(env, key) {
     return String(env[key] || '').trim().length > 0;
 }
@@ -153,9 +261,14 @@ function validateCommonNumbers(env, errors) {
         'TASKFORCE_DOCUMENT_RETENTION_DAYS',
         'TASKFORCE_DOCUMENT_PURGE_INTERVAL_MINUTES',
         'TASKFORCE_STORAGE_INTEGRITY_SCHEDULE_POLL_MINUTES',
+        'TASKFORCE_ADMIN_AUDIT_RETENTION_INTERVAL_MINUTES',
+        'TASKFORCE_ADMIN_AUDIT_RETENTION_BATCH_SIZE',
+        'TASKFORCE_ADMIN_AUDIT_SYNC_RETENTION_DAYS',
+        'TASKFORCE_ADMIN_AUDIT_RETENTION_DAYS',
         'TASKFORCE_AUTH_SESSION_TTL_SECONDS',
         'TASKFORCE_VIRUS_SCAN_TIMEOUT_MS',
         'TASKFORCE_CLAMAV_PORT',
+        'TASKFORCE_BEDROCK_SMOKE_MAX_TOKENS',
         'R2_SIGNED_UPLOAD_TTL_SECONDS',
         'R2_SIGNED_DOWNLOAD_TTL_SECONDS',
         'SYNC_SOAK_DURATION_MIN',
@@ -189,10 +302,17 @@ function validateServerEnv(env, errors, warnings) {
     if (runtimeRaw && !['local', 'cloud'].includes(runtimeRaw)) {
         errors.push('TASKFORCE_RUNTIME_MODE must be one of: local, cloud.');
     }
+    const sharedLocalMcpClientMode = String(env.TASKFORCE_SHARED_LOCAL_MCP_CLIENT_MODE || 'proxy').trim().toLowerCase();
+    if (!['legacy', 'proxy'].includes(sharedLocalMcpClientMode)) {
+        errors.push('TASKFORCE_SHARED_LOCAL_MCP_CLIENT_MODE must be one of: legacy, proxy.');
+    }
     const cloudEnvironmentRaw = String(env.TASKFORCE_CLOUD_ENVIRONMENT || '').trim().toLowerCase();
     if (cloudEnvironmentRaw && !['production', 'staging', 'performance'].includes(cloudEnvironmentRaw)) {
         errors.push('TASKFORCE_CLOUD_ENVIRONMENT must be one of: production, staging, performance.');
     }
+    if (hasValue(env, 'TASKFORCE_APP_BASE_URL') && !isHttpUrl(env.TASKFORCE_APP_BASE_URL)) {
+        errors.push('TASKFORCE_APP_BASE_URL must be an HTTP(S) URL.');
+    }
     warnings.push(...deployment.warnings);
     const cloudTargetConfigured = runtimeMode === 'cloud'
         || hasValue(env, 'TASKFORCE_CLOUD_ENVIRONMENT')
@@ -231,6 +351,32 @@ function validateServerEnv(env, errors, warnings) {
     if (billingEnabled && !hasValue(env, 'TASKFORCE_STRIPE_WEBHOOK_SECRET')) {
         errors.push('TASKFORCE_STRIPE_WEBHOOK_SECRET is required when TASKFORCE_BILLING_ENABLED=true.');
     }
+    if (parseBoolean(env.TASKFORCE_SYNC_V3_FEED_ENABLED) === true) {
+        try {
+            parseWorkspaceSyncV3FeedCursorKeyring(env.TASKFORCE_SYNC_V3_FEED_CURSOR_KEYS_JSON);
+        }
+        catch (error) {
+            errors.push(String(error?.message || error));
+        }
+    }
+    if (parseBoolean(env.TASKFORCE_SYNC_V3_FEED_REPAIR_ENABLED) === true
+        && parseBoolean(env.TASKFORCE_SYNC_V3_FEED_ENABLED) !== true) {
+        errors.push('TASKFORCE_SYNC_V3_FEED_REPAIR_ENABLED requires TASKFORCE_SYNC_V3_FEED_ENABLED=true.');
+    }
+    if (parseBoolean(env.TASKFORCE_SYNC_V3_COMBINED_FEED_ENABLED) === true
+        && (parseBoolean(env.TASKFORCE_SYNC_V3_FEED_ENABLED) !== true
+            || parseBoolean(env.TASKFORCE_SYNC_V3_FEED_REPAIR_ENABLED) !== true
+            || parseBoolean(env.TASKFORCE_SYNC_V3_COMBINED_LEGACY_FENCE_ENABLED) !== true)) {
+        errors.push('TASKFORCE_SYNC_V3_COMBINED_FEED_ENABLED requires feed, repair, and combined legacy fence flags.');
+    }
+    if (parseBoolean(env.TASKFORCE_SYNC_V3_COMBINED_LOCAL_FEED_APPLY_ENABLED) === true
+        && parseBoolean(env.TASKFORCE_SYNC_V3_LOCAL_FEED_APPLY_ENABLED) !== true) {
+        errors.push('TASKFORCE_SYNC_V3_COMBINED_LOCAL_FEED_APPLY_ENABLED requires TASKFORCE_SYNC_V3_LOCAL_FEED_APPLY_ENABLED=true.');
+    }
+    if (parseBoolean(env.TASKFORCE_SYNC_V3_COMBINED_LEGACY_FENCE_ENABLED) === true
+        && parseBoolean(env.TASKFORCE_SYNC_V3_COMBINED_FEED_ENABLED) !== true) {
+        errors.push('TASKFORCE_SYNC_V3_COMBINED_LEGACY_FENCE_ENABLED requires TASKFORCE_SYNC_V3_COMBINED_FEED_ENABLED=true.');
+    }
     const authEnabled = parseBoolean(env.TASKFORCE_AUTH_ENABLED);
     const effectiveAuthEnabled = authEnabled === null ? runtimeMode === 'cloud' : authEnabled;
     if (effectiveAuthEnabled && !hasValue(env, 'TASKFORCE_AUTH_SESSION_SECRET')) {
@@ -253,8 +399,20 @@ function validateServerEnv(env, errors, warnings) {
         }
     }
     const emailProviderRaw = String(env.TASKFORCE_EMAIL_PROVIDER || 'console').trim().toLowerCase();
-    if (!['console', 'resend', 'google-workspace'].includes(emailProviderRaw)) {
-        errors.push('TASKFORCE_EMAIL_PROVIDER must be one of: console, resend, google-workspace.');
+    if (!['console', 'resend', 'google-workspace', 'mailpit'].includes(emailProviderRaw)) {
+        errors.push('TASKFORCE_EMAIL_PROVIDER must be one of: console, resend, google-workspace, mailpit.');
+    }
+    if (emailProviderRaw === 'mailpit'
+        && runtimeMode === 'cloud'
+        && deployment.cloudEnvironment !== 'staging'
+        && deployment.cloudEnvironment !== 'performance') {
+        errors.push('TASKFORCE_EMAIL_PROVIDER=mailpit is only allowed in local, staging, or performance runtimes.');
+    }
+    if (emailProviderRaw === 'mailpit') {
+        const smtpPort = Number(env.TASKFORCE_EMAIL_SMTP_PORT || 1025);
+        if (!Number.isInteger(smtpPort) || smtpPort < 1 || smtpPort > 65535) {
+            errors.push('TASKFORCE_EMAIL_SMTP_PORT must be an integer between 1 and 65535.');
+        }
     }
     if (emailProviderRaw === 'resend' || emailProviderRaw === 'google-workspace') {
         const hasApiKey = hasValue(env, 'TASKFORCE_EMAIL_PROVIDER_API_KEY')
@@ -273,6 +431,10 @@ function validateServerEnv(env, errors, warnings) {
     if (!['none', 'clamav'].includes(virusProviderRaw)) {
         errors.push('TASKFORCE_VIRUS_SCAN_PROVIDER must be one of: none, clamav.');
     }
+    const bedrockTierRaw = String(env.TASKFORCE_BEDROCK_MODEL_TIER || '').trim().toLowerCase();
+    if (bedrockTierRaw && !['fast', 'balanced', 'advanced'].includes(bedrockTierRaw)) {
+        errors.push('TASKFORCE_BEDROCK_MODEL_TIER must be one of: fast, balanced, advanced.');
+    }
 }
 function validateSoakEnv(env, errors) {
     if (!hasValue(env, 'SYNC_SOAK_LOCAL_BASE_URL'))
@@ -371,7 +533,7 @@ export function getEnvSpecs(target = 'all') {
 }
 export function renderEnvExample(target = 'all') {
     const specs = getEnvSpecs(target);
-    const categoryOrder = ['Core', 'Auth', 'Storage', 'Security', 'Email', 'Build', 'Client', 'Soak', 'Cloudflare'];
+    const categoryOrder = ['Core', 'Auth', 'Storage', 'Security', 'Email', 'AI', 'Build', 'Client', 'Soak', 'Cloudflare'];
     const grouped = new Map();
     for (const category of categoryOrder)
         grouped.set(category, []);

package/dist/config/localServiceCloudTarget.d.ts

@@ -0,0 +1,10 @@
+import { type TaskforceCloudEnvironment } from './cloudEnvironment.js';
+export interface LocalServiceCloudTarget {
+    environment: TaskforceCloudEnvironment | null;
+    cloudProxyBaseUrl: string;
+    cloudAuthBaseUrl: string;
+}
+export declare function resolveLocalServiceCloudTarget(env: NodeJS.ProcessEnv): LocalServiceCloudTarget;
+export declare function applyLocalServiceCloudTarget(env: NodeJS.ProcessEnv, target: LocalServiceCloudTarget): void;
+export declare function parseLocalServiceCloudTarget(value: unknown): LocalServiceCloudTarget | null;
+export declare function localServiceCloudTargetsEqual(left: LocalServiceCloudTarget | null | undefined, right: LocalServiceCloudTarget | null | undefined): boolean;