@taskforcehq/taskforce 0.3.326 → 0.3.328

package/dist/server/aiProfileAvatarAssets.js

@@ -1,7 +1,17 @@
-import { createHash } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
+import sharp from 'sharp';
 import { normalizeTaskDataRelativePath } from '../storage/objectStorageClient.js';
+import { isAiProfileAvatarGenerationEligible } from '../shared/aiProfileAvatarEligibility.js';
+import { buildAiProfileAvatarStorageKey, storageKeyBelongsToAiProfileAvatar, } from '../utils/aiProfileAvatarPaths.js';
+export { buildAiProfileAvatarStorageKey } from '../utils/aiProfileAvatarPaths.js';
+export class AiProfileAvatarStateConflictError extends Error {
+    constructor() {
+        super('AI profile avatar state changed before the generated avatar could be saved.');
+        this.name = 'AiProfileAvatarStateConflictError';
+    }
+}
 const SUPPORTED_IMAGE_MIME_TYPES = new Set([
     'image/gif',
     'image/jpeg',
@@ -9,20 +19,15 @@ const SUPPORTED_IMAGE_MIME_TYPES = new Set([
     'image/webp',
 ]);
 const AVATAR_MAX_BYTES = 5 * 1024 * 1024;
+const AVATAR_DISPLAY_MAX_DIMENSION = 256;
+const AVATAR_DISPLAY_WEBP_QUALITY = 82;
 function normalizeId(value) {
     return String(value || '').trim();
 }
-function sanitizeStorageSegment(value, fallback) {
-    const normalized = normalizeId(value)
-        .replace(/[^a-zA-Z0-9._-]/g, '-')
-        .replace(/-+/g, '-')
-        .replace(/^-+|-+$/g, '');
-    return normalized || fallback;
-}
 function normalizeImageMimeType(value) {
     return normalizeId(value).toLowerCase();
 }
-function extensionForMimeType(mimeType) {
+function avatarFileExtensionForMimeType(mimeType) {
     if (mimeType === 'image/gif')
         return 'gif';
     if (mimeType === 'image/jpeg')
@@ -38,12 +43,6 @@ function stableAssetId(workspaceId, profileId, slot) {
         .slice(0, 32);
     return `asset-${digest}`;
 }
-export function buildAiProfileAvatarStorageKey(input) {
-    const workspaceId = sanitizeStorageSegment(input.workspaceId, 'default');
-    const profileId = sanitizeStorageSegment(input.profileId, 'ai-profile');
-    const ext = extensionForMimeType(input.mimeType);
-    return `workspaces/${workspaceId}/assets/images/ai-profiles/${profileId}/avatar/${input.slot}.${ext}`;
-}
 function contextUrlForStorageKey(storageKey) {
     return `/api/taskforce/context/${encodeURIComponent(storageKey)}`;
 }
@@ -75,10 +74,29 @@ function validatePayload(payload, label) {
     }
     return mimeType;
 }
-function storageKeyBelongsToAiProfileAvatar(workspaceId, profileId, storageKey) {
-    const workspaceIdSafe = sanitizeStorageSegment(workspaceId, 'default');
-    const profileIdSafe = sanitizeStorageSegment(profileId, 'ai-profile');
-    return storageKey.startsWith(`workspaces/${workspaceIdSafe}/assets/images/ai-profiles/${profileIdSafe}/avatar/`);
+async function optimizeDisplayAvatar(payload) {
+    try {
+        const buffer = await sharp(payload.buffer, { animated: true })
+            .rotate()
+            .resize({
+            width: AVATAR_DISPLAY_MAX_DIMENSION,
+            height: AVATAR_DISPLAY_MAX_DIMENSION,
+            fit: 'inside',
+            withoutEnlargement: true,
+        })
+            .webp({ quality: AVATAR_DISPLAY_WEBP_QUALITY })
+            .toBuffer();
+        const originalName = normalizeId(payload.originalName);
+        const nameBase = originalName.replace(/\.[^.]+$/, '') || 'avatar';
+        return {
+            buffer,
+            mimeType: 'image/webp',
+            originalName: `${nameBase}.webp`,
+        };
+    }
+    catch {
+        return payload;
+    }
 }
 async function writeAvatarObject(deps, storageKey, payload, provider) {
     if (provider === 'r2') {
@@ -116,18 +134,28 @@ async function deleteAvatarObject(deps, storageKey, provider) {
         fs.rmSync(destination, { force: true });
     }
 }
+function appendAvatarTelemetry(deps, event, payload) {
+    try {
+        deps.appendStorageTelemetry(event, payload);
+    }
+    catch {
+        // Telemetry must never change the outcome of an already committed avatar mutation.
+    }
+}
 function upsertAvatarAsset(input) {
     if (!input.deps.workspaceAssetStore) {
         throw new Error('Workspace asset storage is required for AI profile avatars.');
     }
     const contentSha256 = createHash('sha256').update(input.payload.buffer).digest('hex');
-    const existing = input.deps.workspaceAssetStore.getByStorageKey(input.storageKey, input.workspaceId);
+    const assetId = stableAssetId(input.workspaceId, input.profileId, input.slot);
+    const existing = input.deps.workspaceAssetStore.get(assetId, input.workspaceId)
+        || input.deps.workspaceAssetStore.getByStorageKey(input.storageKey, input.workspaceId);
     return input.deps.workspaceAssetStore.upsertAsset({
-        assetId: existing?.assetId || stableAssetId(input.workspaceId, input.profileId, input.slot),
+        assetId,
         workspaceId: input.workspaceId,
         kind: 'image',
         logicalName: `AI profile avatar ${input.slot}`,
-        originalFilename: normalizeId(input.payload.originalName) || `${input.slot}.${extensionForMimeType(input.payload.mimeType)}`,
+        originalFilename: normalizeId(input.payload.originalName) || `${input.slot}.${avatarFileExtensionForMimeType(input.payload.mimeType)}`,
         mimeType: input.payload.mimeType,
         storageProvider: input.provider,
         storageKey: input.storageKey,
@@ -178,7 +206,7 @@ async function cleanupAiProfileAvatarAssets(input) {
             }
         }
         catch {
-            input.deps.appendStorageTelemetry('ai_avatar.cleanup', {
+            appendAvatarTelemetry(input.deps, 'ai_avatar.cleanup', {
                 path: storageKey,
                 provider,
                 status: 'metadata-delete-failed',
@@ -186,14 +214,14 @@ async function cleanupAiProfileAvatarAssets(input) {
         }
         try {
             await deleteAvatarObject(input.deps, storageKey, provider);
-            input.deps.appendStorageTelemetry('ai_avatar.cleanup', {
+            appendAvatarTelemetry(input.deps, 'ai_avatar.cleanup', {
                 path: storageKey,
                 provider,
                 status: 'deleted',
             });
         }
         catch {
-            input.deps.appendStorageTelemetry('ai_avatar.cleanup', {
+            appendAvatarTelemetry(input.deps, 'ai_avatar.cleanup', {
                 path: storageKey,
                 provider,
                 status: 'object-delete-failed',
@@ -212,62 +240,118 @@ export async function saveAiProfileAvatarAssets(deps, input) {
         .find((profile) => profile.id === profileId);
     if (!existingProfile)
         throw new Error(`Profile ${profileId} not found.`);
-    const displayMimeType = validatePayload(input.display, 'Display avatar');
-    const sourcePayload = input.source || input.display;
-    const sourceMimeType = validatePayload(sourcePayload, 'Source avatar');
-    const displayPayload = { ...input.display, mimeType: displayMimeType };
-    const normalizedSourcePayload = { ...sourcePayload, mimeType: sourceMimeType };
+    validatePayload(input.display, 'Display avatar');
+    const preserveExistingSource = input.preserveExistingSource === true;
+    const preservedSourceStorageKey = preserveExistingSource
+        ? storageKeyFromContextUrl(existingProfile.avatarSourceUrl)
+        : null;
+    const preservedSourceAsset = preserveExistingSource && preservedSourceStorageKey && deps.workspaceAssetStore
+        ? (deps.workspaceAssetStore.get(stableAssetId(workspaceId, profileId, 'source'), workspaceId)
+            || deps.workspaceAssetStore.getByStorageKey(preservedSourceStorageKey, workspaceId))
+        : null;
+    if (preserveExistingSource && (!preservedSourceStorageKey
+        || !preservedSourceAsset
+        || preservedSourceAsset.storageKey !== preservedSourceStorageKey)) {
+        throw new Error('The existing source avatar is unavailable. Choose the original image again before applying changes.');
+    }
+    const sourcePayload = preserveExistingSource ? null : (input.source || input.display);
+    const sourceMimeType = sourcePayload ? validatePayload(sourcePayload, 'Source avatar') : null;
+    const displayPayload = await optimizeDisplayAvatar(input.display);
+    const displayMimeType = normalizeImageMimeType(displayPayload.mimeType);
+    const normalizedSourcePayload = sourcePayload && sourceMimeType
+        ? { ...sourcePayload, mimeType: sourceMimeType }
+        : null;
+    const generationId = randomUUID().replace(/-/g, '');
     const displayStorageKey = buildAiProfileAvatarStorageKey({
         workspaceId,
         profileId,
         slot: 'display',
         mimeType: displayMimeType,
+        generationId,
     });
-    const sourceStorageKey = buildAiProfileAvatarStorageKey({
+    const sourceStorageKey = preservedSourceStorageKey || buildAiProfileAvatarStorageKey({
         workspaceId,
         profileId,
         slot: 'source',
         mimeType: sourceMimeType,
+        generationId,
     });
     const objectStorageClient = deps.getObjectStorageClient();
     const provider = objectStorageClient ? 'r2' : 'local';
     const nowIso = new Date().toISOString();
-    await writeAvatarObject(deps, displayStorageKey, displayPayload, provider);
-    await writeAvatarObject(deps, sourceStorageKey, normalizedSourcePayload, provider);
-    const displayAsset = upsertAvatarAsset({
-        deps,
-        workspaceId,
-        profileId,
-        slot: 'display',
-        storageKey: displayStorageKey,
-        payload: displayPayload,
-        provider,
-        actorId: input.actorId,
-        nowIso,
-    });
-    const sourceAsset = upsertAvatarAsset({
-        deps,
-        workspaceId,
-        profileId,
-        slot: 'source',
-        storageKey: sourceStorageKey,
-        payload: normalizedSourcePayload,
-        provider,
-        actorId: input.actorId,
-        nowIso,
-    });
-    deps.core.notifyDocumentMetadataMutation(workspaceId, [displayStorageKey, sourceStorageKey], 'upsert');
-    deps.appendStorageTelemetry('ai_avatar.upload', {
-        path: displayStorageKey,
-        provider,
-        status: 'stored',
-    });
-    const profile = deps.core.updateAiProfileAvatar({
-        workspaceId,
-        profileId,
-        avatarUrl: contextUrlForStorageKey(displayStorageKey),
-        avatarSourceUrl: contextUrlForStorageKey(sourceStorageKey),
-    });
+    const stagedStorageKeys = [];
+    let displayAsset;
+    let sourceAsset;
+    let profile;
+    try {
+        await writeAvatarObject(deps, displayStorageKey, displayPayload, provider);
+        stagedStorageKeys.push(displayStorageKey);
+        if (normalizedSourcePayload) {
+            await writeAvatarObject(deps, sourceStorageKey, normalizedSourcePayload, provider);
+            stagedStorageKeys.push(sourceStorageKey);
+        }
+        const commit = deps.core.getDatabaseAdapter().transaction(() => {
+            const currentProfile = deps.core.listAiProfiles(workspaceId)
+                .find((candidate) => candidate.id === profileId);
+            const expected = input.expectedProfileState;
+            if (!currentProfile || (expected && (Number(currentProfile.avatarRevision || 0) !== expected.avatarRevision
+                || (currentProfile.avatarUrl || null) !== (expected.avatarUrl || null)
+                || (currentProfile.avatarSourceUrl || null) !== (expected.avatarSourceUrl || null)
+                || (expected.requireGenerationEligibility === true && !isAiProfileAvatarGenerationEligible(currentProfile))))) {
+                throw new AiProfileAvatarStateConflictError();
+            }
+            displayAsset = upsertAvatarAsset({
+                deps,
+                workspaceId,
+                profileId,
+                slot: 'display',
+                storageKey: displayStorageKey,
+                payload: displayPayload,
+                provider,
+                actorId: input.actorId,
+                nowIso,
+            });
+            sourceAsset = preservedSourceAsset || upsertAvatarAsset({
+                deps,
+                workspaceId,
+                profileId,
+                slot: 'source',
+                storageKey: sourceStorageKey,
+                payload: normalizedSourcePayload,
+                provider,
+                actorId: input.actorId,
+                nowIso,
+            });
+            profile = deps.core.updateAiProfileAvatar({
+                workspaceId,
+                profileId,
+                avatarUrl: contextUrlForStorageKey(displayStorageKey),
+                avatarSourceUrl: contextUrlForStorageKey(sourceStorageKey),
+            });
+        });
+        commit();
+    }
+    catch (error) {
+        for (const storageKey of stagedStorageKeys) {
+            if (provider === 'r2') {
+                await deps.getObjectStorageClient()?.deleteObject(storageKey).catch(() => false);
+            }
+            else {
+                const { basePath } = deps.core.getPaths();
+                const destination = deps.ensureWithinDir(path.join(basePath, storageKey), basePath);
+                if (destination && fs.existsSync(destination))
+                    fs.rmSync(destination, { force: true });
+            }
+        }
+        throw error;
+    }
+    try {
+        deps.core.notifyDocumentMetadataMutation(workspaceId, preserveExistingSource ? [displayStorageKey] : [displayStorageKey, sourceStorageKey], 'upsert');
+    }
+    catch {
+        // Realtime notification is best-effort after the database commit.
+    }
+    appendAvatarTelemetry(deps, 'ai_avatar.upload', { path: displayStorageKey, provider, status: 'stored' });
     await cleanupAiProfileAvatarAssets({
         deps,
         workspaceId,
@@ -278,11 +362,16 @@ export async function saveAiProfileAvatarAssets(deps, input) {
             storageKeyFromContextUrl(existingProfile.avatarSourceUrl),
         ],
         providerFallback: provider,
+    }).catch(() => {
+        appendAvatarTelemetry(deps, 'ai_avatar.cleanup', {
+            provider,
+            status: 'cleanup-failed-after-commit',
+        });
     });
     return {
-        profile,
-        displayAsset,
-        sourceAsset,
+        profile: profile,
+        displayAsset: displayAsset,
+        sourceAsset: sourceAsset,
         displayStorageKey,
         sourceStorageKey,
     };

package/dist/server/appAccess.d.ts

@@ -0,0 +1,12 @@
+import type { AccountAccessStatus } from '../core/types.js';
+export interface AppAccessDeniedResponse {
+    statusCode: 403;
+    body: {
+        error: string;
+        code: string;
+        gate: AccountAccessStatus['gate'];
+        canAccessPlans: boolean;
+        planSelectionRequired: boolean;
+    };
+}
+export declare function resolveAppAccessDeniedResponse(accountAccess: AccountAccessStatus): AppAccessDeniedResponse | null;

package/dist/server/appAccess.js

@@ -0,0 +1,21 @@
+export function resolveAppAccessDeniedResponse(accountAccess) {
+    if (accountAccess.canAccessApp)
+        return null;
+    const code = accountAccess.gate === 'plan_selection_required'
+        ? 'PLAN_SELECTION_REQUIRED'
+        : accountAccess.gate === 'checkout_pending'
+            ? 'CHECKOUT_PENDING'
+            : accountAccess.gate === 'misconfigured'
+                ? 'ACCOUNT_ACCESS_MISCONFIGURED'
+                : 'ACCOUNT_ENTITLEMENT_REQUIRED';
+    return {
+        statusCode: 403,
+        body: {
+            error: accountAccess.message || 'This account cannot access the app.',
+            code,
+            gate: accountAccess.gate,
+            canAccessPlans: accountAccess.canAccessPlans,
+            planSelectionRequired: accountAccess.planSelectionRequired
+        }
+    };
+}

package/dist/server/auth.js

@@ -1,5 +1,6 @@
 import { createHmac, timingSafeEqual } from 'crypto';
 import { getTaskforceCloudEnvironmentConfig, parseTaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+import { resolveDeploymentConfig } from '../config/deployment.js';
 function parseBoolean(raw, fallback) {
     if (raw === undefined)
         return fallback;
@@ -33,6 +34,18 @@ function inferCloudSessionCookieDomain(env) {
         return 'taskforcehq.ai';
     return undefined;
 }
+function inferLocalProxySessionCookieName(runtimeMode, env) {
+    if (runtimeMode !== 'local')
+        return 'taskforce_session';
+    const cloudEnvironment = resolveDeploymentConfig(env).cloudEnvironment;
+    if (cloudEnvironment === 'production')
+        return 'taskforce_session_prod';
+    if (cloudEnvironment === 'staging')
+        return 'taskforce_session_staging';
+    if (cloudEnvironment === 'performance')
+        return 'taskforce_session_performance';
+    return 'taskforce_session';
+}
 function normalizeSameSite(raw, fallback) {
     const value = String(raw || '').trim().toLowerCase();
     if (value === 'lax')
@@ -88,7 +101,8 @@ export function resolveAuthConfigFromEnv(runtimeMode, env = process.env) {
         .split(',')
         .map(v => v.trim())
         .filter(Boolean);
-    const sessionCookieName = (env.TASKFORCE_AUTH_SESSION_COOKIE || 'taskforce_session').trim();
+    const sessionCookieName = (env.TASKFORCE_AUTH_SESSION_COOKIE
+        || inferLocalProxySessionCookieName(runtimeMode, env)).trim();
     const sessionSecret = (env.TASKFORCE_AUTH_SESSION_SECRET || '').trim();
     const sessionTtlSeconds = parsePositiveInt(env.TASKFORCE_AUTH_SESSION_TTL_SECONDS, 60 * 60 * 24 * 30);
     const sessionCookieSameSite = normalizeSameSite(env.TASKFORCE_AUTH_SESSION_SAMESITE, runtimeMode === 'cloud' ? 'None' : 'Lax');

package/dist/server/authorizedWorkspaceAccess.d.ts

@@ -0,0 +1,12 @@
+import type { TaskforceCore } from '../core/Taskforce.js';
+import type { RequestAccessContext } from './auth.js';
+export interface AuthorizedRequestAccess extends RequestAccessContext {
+    disabled?: boolean;
+    accountDisabled?: boolean;
+    workspaceDisabled?: boolean;
+}
+type WorkspaceAccessCore = Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole'>;
+export declare function resolveAuthorizedWorkspaceAccess(core: WorkspaceAccessCore, access: AuthorizedRequestAccess, requestedWorkspaceId: string): AuthorizedRequestAccess;
+export declare function isWorkspaceAccessRecoveryRoute(pathname: string): boolean;
+export declare function resolveDisabledAccessError(access: Pick<AuthorizedRequestAccess, 'disabled' | 'accountDisabled' | 'workspaceDisabled'>, pathname: string): string | null;
+export {};

package/dist/server/authorizedWorkspaceAccess.js

@@ -0,0 +1,40 @@
+export function resolveAuthorizedWorkspaceAccess(core, access, requestedWorkspaceId) {
+    if (!access.authenticated || !access.userId || access.userId === 'anonymous')
+        return access;
+    const trimmedRequestedWorkspaceId = String(requestedWorkspaceId || '').trim();
+    const candidateWorkspaceIds = [
+        trimmedRequestedWorkspaceId,
+        String(access.workspaceId || '').trim()
+    ].filter((workspaceId, index, values) => Boolean(workspaceId) && values.indexOf(workspaceId) === index);
+    for (const workspaceId of candidateWorkspaceIds) {
+        const resolved = core.resolveUserAccess(access.userId, workspaceId, access.role);
+        if (!resolved)
+            continue;
+        return {
+            ...access,
+            role: resolved.role,
+            workspaceId: resolved.workspaceId,
+            userId: resolved.userId,
+            systemRole: core.getSystemRole(resolved.userId),
+            disabled: resolved.disabled,
+            accountDisabled: resolved.accountDisabled ?? resolved.disabled,
+            workspaceDisabled: resolved.workspaceDisabled ?? false
+        };
+    }
+    return access;
+}
+export function isWorkspaceAccessRecoveryRoute(pathname) {
+    return pathname === '/api/taskforce/workspaces'
+        || pathname === '/api/taskforce/session/workspace';
+}
+export function resolveDisabledAccessError(access, pathname) {
+    if (pathname.startsWith('/api/taskforce/auth/'))
+        return null;
+    if (access.accountDisabled ?? access.disabled) {
+        return 'Forbidden: user account is disabled.';
+    }
+    if (access.workspaceDisabled && !isWorkspaceAccessRecoveryRoute(pathname)) {
+        return 'Forbidden: workspace access is not active for this user.';
+    }
+    return null;
+}

package/dist/server/cloudCollectionRead.d.ts

@@ -0,0 +1,25 @@
+import type { TaskforceCore } from '../core/Taskforce.js';
+import { type AuthorizedRequestAccess } from './authorizedWorkspaceAccess.js';
+export type CloudCollectionReadOperation = 'tasks' | 'archive' | 'deleted' | 'planning-bootstrap';
+export interface CloudCollectionReadRequest {
+    operation: CloudCollectionReadOperation;
+    pathname: string;
+    requestedWorkspaceId: string;
+    access: AuthorizedRequestAccess;
+    performanceTrace: boolean;
+}
+export interface CloudCollectionReadResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: string;
+    workspaceId: string;
+    performance?: {
+        durationMs: number;
+        details: Record<string, number>;
+    };
+}
+type CloudCollectionReadCore = Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole' | 'getAccountAccessStatus' | 'listTasks' | 'listArchive' | 'listDeletedTasksReadOnly' | 'listPlanningBootstrap'>;
+export declare function resolveCloudCollectionReadOperation(method: string | undefined, pathname: string): CloudCollectionReadOperation | null;
+export declare function executeCloudCollectionRead(core: CloudCollectionReadCore, request: CloudCollectionReadRequest): CloudCollectionReadResponse;
+export declare function cloudCollectionReadRoute(operation: CloudCollectionReadOperation): string;
+export {};

package/dist/server/cloudCollectionRead.js

@@ -0,0 +1,120 @@
+import { getRequestPerformanceDiagnostics, runWithRequestPerformanceDiagnostics, } from '../storage/postgresRequestDiagnostics.js';
+import { resolveAppAccessDeniedResponse } from './appAccess.js';
+import { resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, } from './authorizedWorkspaceAccess.js';
+const ROUTE_BY_OPERATION = {
+    tasks: '/api/taskforce/tasks',
+    archive: '/api/taskforce/archive',
+    deleted: '/api/taskforce/deleted',
+    'planning-bootstrap': '/api/taskforce/planning/bootstrap',
+};
+export function resolveCloudCollectionReadOperation(method, pathname) {
+    if (String(method || 'GET').toUpperCase() !== 'GET')
+        return null;
+    if (pathname === '/api/taskforce/tasks')
+        return 'tasks';
+    if (pathname === '/api/taskforce/archive')
+        return 'archive';
+    if (pathname === '/api/taskforce/deleted' || pathname === '/api/taskforce/trash')
+        return 'deleted';
+    if (pathname === '/api/taskforce/planning/bootstrap')
+        return 'planning-bootstrap';
+    return null;
+}
+function serverTimingMetric(name, durationMs) {
+    return `${name};dur=${Math.max(0, Math.round(durationMs))}`;
+}
+function performanceHeaders(diagnostics, responseBytes, metrics) {
+    const headers = {
+        'Content-Type': 'application/json',
+        'Server-Timing': metrics.map((metric) => serverTimingMetric(metric.name, metric.durationMs)).join(', '),
+    };
+    if (diagnostics) {
+        headers['X-Taskforce-Postgres-Query-Count'] = String(diagnostics.postgresQueryCount);
+        headers['X-Taskforce-Postgres-Worker-Call-Count'] = String(diagnostics.postgresWorkerCallCount);
+        headers['X-Taskforce-Response-Bytes'] = String(responseBytes);
+    }
+    return headers;
+}
+export function executeCloudCollectionRead(core, request) {
+    return runWithRequestPerformanceDiagnostics(request.performanceTrace, () => {
+        const access = resolveAuthorizedWorkspaceAccess(core, request.access, request.requestedWorkspaceId);
+        const workspaceId = String(access.workspaceId || '').trim();
+        const disabledAccessError = resolveDisabledAccessError(access, request.pathname);
+        if (disabledAccessError) {
+            return {
+                statusCode: 403,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ error: disabledAccessError }),
+                workspaceId,
+            };
+        }
+        if (access.authenticated && access.userId && access.userId !== 'anonymous') {
+            const denied = resolveAppAccessDeniedResponse(core.getAccountAccessStatus(access.userId));
+            if (denied) {
+                return {
+                    statusCode: denied.statusCode,
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify(denied.body),
+                    workspaceId,
+                };
+            }
+        }
+        const startedAt = performance.now();
+        let data;
+        const planningDiagnostics = {};
+        if (request.operation === 'tasks')
+            data = core.listTasks(workspaceId);
+        else if (request.operation === 'archive')
+            data = core.listArchive(workspaceId);
+        else if (request.operation === 'deleted')
+            data = core.listDeletedTasksReadOnly(workspaceId);
+        else
+            data = core.listPlanningBootstrap(workspaceId, planningDiagnostics);
+        const loadCompletedAt = performance.now();
+        const serializeStartedAt = performance.now();
+        const body = JSON.stringify(data);
+        const serializeDurationMs = performance.now() - serializeStartedAt;
+        const totalDurationMs = performance.now() - startedAt;
+        const responseBytes = Buffer.byteLength(body, 'utf8');
+        const diagnostics = getRequestPerformanceDiagnostics();
+        const metrics = request.operation === 'planning-bootstrap'
+            ? [
+                { name: 'planning-bootstrap', durationMs: totalDurationMs },
+                { name: 'planning-bootstrap-initiatives', durationMs: planningDiagnostics.initiativeLoadMs || 0 },
+                { name: 'planning-bootstrap-workstreams', durationMs: planningDiagnostics.workstreamLoadMs || 0 },
+                { name: 'planning-bootstrap-tasks', durationMs: planningDiagnostics.taskSummaryQueryMs || 0 },
+                { name: 'planning-bootstrap-build', durationMs: planningDiagnostics.taskSummaryBuildMs || 0 },
+                { name: 'planning-bootstrap-json', durationMs: serializeDurationMs },
+            ]
+            : [
+                { name: 'route-total', durationMs: totalDurationMs },
+                { name: 'route-load', durationMs: loadCompletedAt - startedAt },
+                { name: 'route-json', durationMs: serializeDurationMs },
+            ];
+        if (diagnostics) {
+            metrics.push({ name: 'postgres-worker-wait', durationMs: diagnostics.postgresWorkerWaitMs });
+        }
+        return {
+            statusCode: 200,
+            headers: performanceHeaders(diagnostics, responseBytes, metrics),
+            body,
+            workspaceId,
+            performance: {
+                durationMs: totalDurationMs,
+                details: {
+                    responseBytes,
+                    jsonSerializeMs: serializeDurationMs,
+                    ...(diagnostics ? {
+                        postgresQueryCount: diagnostics.postgresQueryCount,
+                        postgresWorkerCallCount: diagnostics.postgresWorkerCallCount,
+                        postgresWorkerWaitMs: Math.round(diagnostics.postgresWorkerWaitMs),
+                    } : {}),
+                    ...(request.operation === 'planning-bootstrap' ? planningDiagnostics : {}),
+                },
+            },
+        };
+    });
+}
+export function cloudCollectionReadRoute(operation) {
+    return ROUTE_BY_OPERATION[operation];
+}

package/dist/server/cloudCollectionReadPool.d.ts

@@ -0,0 +1,52 @@
+import type { CloudCollectionReadRequest, CloudCollectionReadResponse } from './cloudCollectionRead.js';
+export interface CloudCollectionReadPoolOptions {
+    projectRoot: string;
+    tenantId: string;
+    connectionString: string;
+    size?: number;
+    requestTimeoutMs?: number;
+    workerFactory?: () => CloudCollectionReadWorker;
+}
+export interface CloudCollectionReadWorker {
+    postMessage(message: unknown): void;
+    terminate(): Promise<number>;
+    on(event: 'message', listener: (message: CloudCollectionReadWorkerResponse) => void): this;
+    on(event: 'error', listener: (error: unknown) => void): this;
+    on(event: 'exit', listener: (code: number) => void): this;
+}
+export type CloudCollectionReadWorkerResponse = {
+    type: 'ready';
+} | {
+    type: 'result';
+    requestId: number;
+    response: CloudCollectionReadResponse;
+} | {
+    type: 'error';
+    requestId: number;
+    error: string;
+};
+export declare class CloudCollectionReadPool {
+    private readonly slots;
+    private readonly queue;
+    private readonly requestTimeoutMs;
+    private readonly desiredSize;
+    private readonly workerData;
+    private readonly workerFactory;
+    private nextRequestId;
+    private closing;
+    constructor(options: CloudCollectionReadPoolOptions);
+    execute(request: CloudCollectionReadRequest): Promise<CloudCollectionReadResponse>;
+    close(): Promise<void>;
+    private spawnSlot;
+    private handleMessage;
+    private handleWorkerFailure;
+    private ensureSlots;
+    private pump;
+}
+export declare function resolveCloudCollectionReadPoolSize(env?: NodeJS.ProcessEnv): number;
+export declare function shouldUseCloudCollectionReadPool(input: {
+    runtimeMode: 'local' | 'cloud';
+    databaseProvider: 'sqlite' | 'postgres';
+    connectionString?: string;
+    workerCount: number;
+}): boolean;