@taskforcehq/taskforce 0.3.327 → 0.3.329

package/dist/TaskforceCore.js

@@ -17,6 +17,7 @@ import { isLightThemeFamily } from './utils/theme';
 import { Cloud, LaptopMinimal } from 'lucide-react';
 import { getPasswordPolicyGuidance, validatePasswordPolicy } from './shared/passwordPolicy';
 import { TASK_DEEP_LINK_QUERY_KEYS } from './shared/taskDeepLinks';
+import { PasswordInput } from './components/ui/PasswordInput';
 function isDebugModeEnabled() {
     const runtimeOverride = globalThis.__DEBUG_MODE__;
     if (typeof runtimeOverride === 'boolean')
@@ -732,10 +733,10 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, initialActivityEn
         setPendingVerificationRedirectPath(null);
     }, [authMode, isLoginRoute, loginRouteMode]);
     useEffect(() => {
-        if (authMode === 'register')
+        if (authMode === 'register' || authMode === 'reset' || (authMode === 'invite' && invitePasswordRequired))
             return;
         setLoginPasswordConfirm('');
-    }, [authMode]);
+    }, [authMode, invitePasswordRequired]);
     useEffect(() => {
         if (!pendingPostAuthRedirect || !isAuthenticated)
             return;
@@ -1155,10 +1156,234 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, initialActivityEn
     if (shellRenderState === 'app-bootstrap') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: bootstrapSubtitle }), bootstrapState.stalled && (_jsxs(_Fragment, { children: [_jsx("p", { className: authStyles.loginError, children: bootstrapState.error || 'Startup checks timed out.' }), _jsx("button", { className: styles.submitBtn, disabled: bootstrapRetryBusy, onClick: handleRetryBootstrap, children: bootstrapRetryBusy ? 'Retrying...' : 'Retry checks' }), isCloudRuntime && (_jsx("button", { className: styles.cancelBtn, disabled: bootstrapRetryBusy, onClick: handleGoToSignIn, children: "Go to sign-in" }))] }))] }) }) }));
     }
+    const handleAuthSubmit = async () => {
+        setLoginBusy(true);
+        setLoginNotice(null);
+        setLoginError(null);
+        setLoginErrorCode(null);
+        if (authMode === 'register' && !loginDisplayName.trim()) {
+            setLoginError('Display name is required.');
+            setLoginBusy(false);
+            return;
+        }
+        if (authMode === 'register' || authMode === 'reset' || (authMode === 'invite' && invitePasswordRequired)) {
+            const validation = validatePasswordPolicy(loginPassword, {
+                email: loginEmail,
+                displayName: loginDisplayName
+            });
+            if (!validation.ok) {
+                setLoginError(validation.message || 'Password does not meet the password policy.');
+                setLoginErrorCode(validation.code || null);
+                setLoginBusy(false);
+                return;
+            }
+            if (loginPassword !== loginPasswordConfirm) {
+                setLoginError('Passwords do not match.');
+                setLoginErrorCode('PASSWORD_CONFIRMATION_MISMATCH');
+                setLoginBusy(false);
+                return;
+            }
+        }
+        let result = { success: false };
+        if (authMode === 'login') {
+            result = await loginWithCredentials(loginEmail, loginPassword);
+        }
+        else if (authMode === 'register') {
+            result = await registerWithCredentials(loginEmail, loginPassword, {
+                displayName: loginDisplayName,
+                planId: selectedSignupPlanId || undefined,
+                planVersionId: selectedSignupPlanVersionId || undefined,
+                interval: selectedSignupInterval || undefined
+            });
+        }
+        else if (authMode === 'verify') {
+            result = await confirmEmailVerification(verificationToken);
+        }
+        else if (authMode === 'forgot') {
+            result = await requestPasswordReset(loginEmail);
+        }
+        else if (authMode === 'reset') {
+            result = await confirmPasswordReset(resetToken, loginPassword);
+        }
+        else if (authMode === 'invite') {
+            if (inviteResolution === 'existing_user_signed_out') {
+                result = await loginWithCredentials(loginEmail, loginPassword);
+            }
+            else {
+                result = invitePasswordRequired
+                    ? await acceptInviteWithToken(inviteToken, loginPassword)
+                    : await joinInviteWithToken(inviteToken);
+            }
+        }
+        if (!result.success) {
+            if (authMode === 'register'
+                && (result.code === 'SIGNUP_PLAN_NOT_ENABLED'
+                    || result.code === 'SIGNUP_PLAN_VERSION_NOT_FOUND'
+                    || result.code === 'SIGNUP_PLAN_VERSION_REQUIRED')) {
+                navigate(planSelectionPath, { replace: true });
+                setLoginBusy(false);
+                return;
+            }
+            setLoginError(formatAuthError(result));
+            setLoginErrorCode(result.code || null);
+            if (authMode === 'login' && (result.code === 'WORKSPACE_NOT_FOUND' || result.code === 'WORKSPACE_ID_REQUIRED')) {
+                navigate('/setup?step=workspace', { replace: true });
+                setLoginBusy(false);
+                return;
+            }
+            if (authMode === 'login' && result.code === 'EMAIL_NOT_VERIFIED' && loginEmail.trim()) {
+                const sent = await requestEmailVerification(loginEmail);
+                if (sent.success) {
+                    setVerifyCooldownUntil(Date.now() + 30_000);
+                    setLoginMode('verify');
+                    if (sent.verificationToken)
+                        setVerificationToken(sent.verificationToken);
+                    setLoginNotice(buildVerificationRequestNotice({
+                        ...sent,
+                        intro: 'If that account exists and still needs verification, we sent an email.'
+                    }));
+                    setLoginError(null);
+                    setLoginErrorCode(null);
+                }
+            }
+            if (authMode === 'register' && result.code === 'EMAIL_ALREADY_EXISTS_UNVERIFIED' && loginEmail.trim()) {
+                setVerifyCooldownUntil(Date.now() + 30_000);
+                setLoginMode('verify');
+                if (result.verificationToken)
+                    setVerificationToken(result.verificationToken);
+                setLoginNotice(result.emailSent === false
+                    ? `This email already has an unverified account, but verification email delivery failed. ${result.emailError || 'Try Resend Verification again.'}`
+                    : 'This email already has an unverified account. Check your email for verification instructions.');
+                setLoginError(null);
+                setLoginErrorCode(null);
+            }
+        }
+        else if (authMode === 'register') {
+            const postRegistrationPath = resolvePostRegistrationPath(result);
+            const commercialOnboardingGate = hasCommercialOnboardingGate(result);
+            if (result.verificationRequired) {
+                setPendingVerificationWorkspaceSetupRequired(Boolean(result.workspaceSetupRequired));
+                setPendingVerificationCommercialState(commercialOnboardingGate
+                    ? String(result.commercialState || '').trim() || (result.planSelectionRequired ? 'pending_plan_selection' : 'checkout_pending')
+                    : null);
+                setPendingVerificationRedirectPath(postRegistrationPath);
+                if (result.verificationToken)
+                    setVerificationToken(result.verificationToken);
+                setVerifyCooldownUntil(Date.now() + 30_000);
+                setLoginMode('verify');
+                setLoginNotice(result.emailSent === false
+                    ? `Account created, but verification email failed to send. ${result.emailError || 'Try Resend Verification again.'}`
+                    : 'Account created. Check your email for verification instructions.');
+            }
+            else {
+                setCommercialOnboardingRedirectActive(commercialOnboardingGate);
+                setPendingPostAuthRedirect({
+                    path: postRegistrationPath,
+                    workspaceSetupRequired: Boolean(result.workspaceSetupRequired),
+                    commercialOnboardingGate
+                });
+            }
+        }
+        else if (authMode === 'verify') {
+            await retryBootstrapChecks();
+            const commercialOnboardingGate = pendingVerificationCommercialState === 'pending_plan_selection'
+                || pendingVerificationCommercialState === 'checkout_pending';
+            setCommercialOnboardingRedirectActive(commercialOnboardingGate);
+            setPendingPostAuthRedirect({
+                path: pendingVerificationRedirectPath || nextTarget,
+                workspaceSetupRequired: pendingVerificationWorkspaceSetupRequired,
+                commercialOnboardingGate
+            });
+        }
+        else if (authMode === 'forgot') {
+            const passwordResetDeliveryFailed = result.deliveryAttempted === true && result.emailSent === false;
+            if (result.resetToken)
+                setResetToken(result.resetToken);
+            setLoginNotice(buildPasswordResetNotice(result));
+            if (!passwordResetDeliveryFailed) {
+                setResetCooldownUntil(Date.now() + 30_000);
+                setLoginMode('reset');
+            }
+        }
+        else if (authMode === 'reset') {
+            setLoginMode('login');
+            setLoginNotice('Password updated. Sign in with your new password.');
+        }
+        else if (authMode === 'invite') {
+            if (inviteResolution === 'existing_user_signed_out') {
+                const normalizedInviteEmail = String(inviteEmail || '').trim().toLowerCase();
+                const normalizedLoginEmail = loginEmail.trim().toLowerCase();
+                // Make the invite flow deterministically join-ready as soon as
+                // the invited account signs in successfully, instead of waiting
+                // for a later invite inspection effect to catch up.
+                if (normalizedInviteEmail && normalizedLoginEmail === normalizedInviteEmail) {
+                    setAuthMode('invite');
+                    setInviteResolution('existing_user_ready');
+                    setLoginPassword('');
+                    setLoginPasswordConfirm('');
+                    setLoginNotice('Signed in. Review the invite details to continue.');
+                    setLoginError(null);
+                    setLoginErrorCode(null);
+                    setLoginBusy(false);
+                    return;
+                }
+                if (normalizedInviteEmail) {
+                    setLoginEmail(inviteEmail || '');
+                }
+                setInviteResolution('existing_user_signed_out');
+                setLoginPassword('');
+                setLoginPasswordConfirm('');
+                setLoginNotice(normalizedInviteEmail
+                    ? `Signed in, but this invite is for ${inviteEmail}. Sign in with that account to continue.`
+                    : 'Signed in, but this invite requires the invited account. Sign in with that account to continue.');
+                setLoginError('Sign in with the invited account to join this workspace.');
+                setLoginErrorCode('INVITE_ACCOUNT_MISMATCH');
+                setLoginBusy(false);
+                return;
+            }
+            if (result.workspaceSetupRequired) {
+                navigate(resolveWorkspaceSetupPath(), { replace: true });
+                setLoginBusy(false);
+                return;
+            }
+            navigateToPostAuthTarget(nextTarget, { replace: true });
+        }
+        else if (authMode === 'login') {
+            if (inviteToken.trim()) {
+                setAuthMode('invite');
+                setLoginPassword('');
+                setLoginPasswordConfirm('');
+                setLoginNotice('Signed in. Review the invite details to continue.');
+                setLoginBusy(false);
+                return;
+            }
+            if (result.workspaceSetupRequired) {
+                navigate(resolveWorkspaceSetupPath(), { replace: true });
+                setLoginBusy(false);
+                return;
+            }
+            setLoginEmail('');
+            setLoginDisplayName('');
+            setLoginPassword('');
+            setLoginPasswordConfirm('');
+            navigateToPostAuthTarget(nextTarget, { replace: true });
+        }
+        else {
+            setLoginEmail('');
+            setLoginDisplayName('');
+            setLoginPassword('');
+            setLoginPasswordConfirm('');
+            navigateToPostAuthTarget(nextTarget, { replace: true });
+        }
+        setLoginBusy(false);
+    };
     if (shellRenderState === 'login') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, style: {
                     backgroundImage: `linear-gradient(rgba(15, 15, 26, 0.88), rgba(15, 15, 26, 0.9)), url(${taskforceBg})`
-                }, children: _jsxs("div", { className: authStyles.loginCard, children: [!isCloudRuntime && !shouldForceLogin && (_jsx("button", { className: authStyles.loginCloseBtn, "aria-label": "Close sign in", "data-testid": "auth-close-button", onClick: () => navigate(nextPath, { replace: true }), children: "\u00D7" })), _jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsxs("h1", { className: authStyles.loginTitle, children: ["TASKFORCE ", _jsx("span", { className: authStyles.loginTitleAccent, children: "HQ" })] })] }), _jsxs("p", { className: authStyles.loginSubtitle, children: [authMode === 'login' && 'Sign in with your account credentials.', authMode === 'register' && 'Create your Taskforce account.', authMode === 'verify' && 'Enter your verification token.', authMode === 'forgot' && 'Request a password reset link.', authMode === 'reset' && 'Set a new password using your reset token.', authMode === 'invite' && (inviteResolution === 'existing_user_ready'
+                }, children: _jsxs("form", { className: authStyles.loginCard, onSubmit: (event) => {
+                        event.preventDefault();
+                        void handleAuthSubmit();
+                    }, children: [!isCloudRuntime && !shouldForceLogin && (_jsx("button", { type: "button", className: authStyles.loginCloseBtn, "aria-label": "Close sign in", "data-testid": "auth-close-button", onClick: () => navigate(nextPath, { replace: true }), children: "\u00D7" })), _jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsxs("h1", { className: authStyles.loginTitle, children: ["TASKFORCE ", _jsx("span", { className: authStyles.loginTitleAccent, children: "HQ" })] })] }), _jsxs("p", { className: authStyles.loginSubtitle, children: [authMode === 'login' && 'Sign in with your account credentials.', authMode === 'register' && 'Create your Taskforce account.', authMode === 'verify' && 'Enter your verification token.', authMode === 'forgot' && 'Request a password reset link.', authMode === 'reset' && 'Set a new password using your reset token.', authMode === 'invite' && (inviteResolution === 'existing_user_ready'
                                     ? `You've been invited to join ${inviteWorkspaceId || 'this workspace'}.`
                                     : inviteResolution === 'existing_user_signed_out'
                                         ? 'Sign in to join this workspace.'
@@ -1169,15 +1394,17 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, initialActivityEn
                             || (authMode === 'invite' && inviteResolution === 'existing_user_signed_out')) && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Email" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "email", value: loginEmail, placeholder: "Email", autoComplete: "email", "data-testid": "auth-email-input", onChange: (event) => setLoginEmail(event.target.value) })] })), authMode === 'register' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Display name" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: loginDisplayName, placeholder: "Display name", autoComplete: "nickname", "data-testid": "auth-display-name-input", onChange: (event) => setLoginDisplayName(event.target.value) })] })), (authMode === 'login'
                             || authMode === 'register'
                             || authMode === 'reset'
-                            || (authMode === 'invite' && (invitePasswordRequired || inviteResolution === 'existing_user_signed_out'))) && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: authMode === 'reset'
+                            || (authMode === 'invite' && (invitePasswordRequired || inviteResolution === 'existing_user_signed_out'))) && (_jsxs("div", { className: authStyles.loginField, children: [_jsx("label", { className: authStyles.loginFieldLabel, htmlFor: "auth-password-input", children: authMode === 'reset'
                                         ? 'New password'
-                                        : (authMode === 'invite' && invitePasswordRequired ? 'Create password' : 'Password') }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "password", value: loginPassword, placeholder: authMode === 'reset'
+                                        : (authMode === 'invite' && invitePasswordRequired ? 'Create password' : 'Password') }), _jsx(PasswordInput, { id: "auth-password-input", className: `${styles.input} ${authStyles.loginInput}`, value: loginPassword, placeholder: authMode === 'reset'
                                         ? 'New password'
                                         : (authMode === 'invite'
                                             ? (invitePasswordRequired ? 'Create password' : 'Password')
                                             : 'Password'), autoComplete: authMode === 'register' || authMode === 'reset' || (authMode === 'invite' && invitePasswordRequired)
                                         ? 'new-password'
-                                        : 'current-password', "data-testid": "auth-password-input", onChange: (event) => setLoginPassword(event.target.value) })] })), (authMode === 'register' || (authMode === 'invite' && invitePasswordRequired)) && (_jsx(_Fragment, { children: _jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Confirm password" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "password", value: loginPasswordConfirm, placeholder: "Confirm password", autoComplete: "new-password", "data-testid": "auth-confirm-password-input", onChange: (event) => setLoginPasswordConfirm(event.target.value) })] }) })), (authMode === 'register' || (authMode === 'invite' && invitePasswordRequired)) && (_jsx("p", { className: authStyles.loginSubtitle, children: registerPasswordGuidance.join(' ') })), authMode === 'verify' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Verification token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: verificationToken, placeholder: "Verification token", autoComplete: "one-time-code", "data-testid": "auth-verification-token-input", onChange: (event) => setVerificationToken(event.target.value) })] })), authMode === 'reset' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Reset token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: resetToken, placeholder: "Reset token", autoComplete: "one-time-code", "data-testid": "auth-reset-token-input", onChange: (event) => setResetToken(event.target.value) })] })), authMode === 'invite' && (_jsxs(_Fragment, { children: [_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Invite token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: inviteToken, placeholder: "Invite token", "data-testid": "auth-invite-token-input", onChange: (event) => setInviteToken(event.target.value) })] }), inviteEmail && (_jsxs("p", { className: authStyles.loginSubtitle, children: ["Invite for: ", _jsx("strong", { children: inviteEmail }), inviteWorkspaceId ? ` · Workspace: ${inviteWorkspaceId}` : ''] }))] })), loginNotice && _jsx("p", { className: authStyles.loginSubtitle, children: loginNotice }), loginError && _jsx("p", { className: authStyles.loginError, children: loginError }), authMode === 'login' && loginErrorCode === 'EMAIL_NOT_VERIFIED' && loginEmail.trim() && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive, onClick: async () => {
+                                        : 'current-password', visibilityLabel: authMode === 'reset'
+                                        ? 'new password'
+                                        : (authMode === 'invite' && invitePasswordRequired ? 'new password' : 'password'), "data-testid": "auth-password-input", visibilityToggleTestId: "auth-password-visibility-toggle", onChange: (event) => setLoginPassword(event.target.value) }, `${authMode}-${invitePasswordRequired ? 'new' : 'current'}`)] })), (authMode === 'register' || authMode === 'reset' || (authMode === 'invite' && invitePasswordRequired)) && (_jsxs("div", { className: authStyles.loginField, children: [_jsx("label", { className: authStyles.loginFieldLabel, htmlFor: "auth-confirm-password-input", children: "Confirm password" }), _jsx(PasswordInput, { id: "auth-confirm-password-input", className: `${styles.input} ${authStyles.loginInput}`, value: loginPasswordConfirm, placeholder: "Confirm password", autoComplete: "new-password", visibilityLabel: "confirm password", "data-testid": "auth-confirm-password-input", visibilityToggleTestId: "auth-confirm-password-visibility-toggle", onChange: (event) => setLoginPasswordConfirm(event.target.value) }, `${authMode}-confirm`)] })), (authMode === 'register' || authMode === 'reset' || (authMode === 'invite' && invitePasswordRequired)) && (_jsx("p", { className: authStyles.loginSubtitle, children: registerPasswordGuidance.join(' ') })), authMode === 'verify' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Verification token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: verificationToken, placeholder: "Verification token", autoComplete: "one-time-code", "data-testid": "auth-verification-token-input", onChange: (event) => setVerificationToken(event.target.value) })] })), authMode === 'reset' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Reset token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: resetToken, placeholder: "Reset token", autoComplete: "one-time-code", "data-testid": "auth-reset-token-input", onChange: (event) => setResetToken(event.target.value) })] })), authMode === 'invite' && (_jsxs(_Fragment, { children: [_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Invite token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: inviteToken, placeholder: "Invite token", "data-testid": "auth-invite-token-input", onChange: (event) => setInviteToken(event.target.value) })] }), inviteEmail && (_jsxs("p", { className: authStyles.loginSubtitle, children: ["Invite for: ", _jsx("strong", { children: inviteEmail }), inviteWorkspaceId ? ` · Workspace: ${inviteWorkspaceId}` : ''] }))] })), loginNotice && _jsx("p", { className: authStyles.loginSubtitle, children: loginNotice }), loginError && _jsx("p", { className: authStyles.loginError, role: "alert", children: loginError }), authMode === 'login' && loginErrorCode === 'EMAIL_NOT_VERIFIED' && loginEmail.trim() && (_jsx("button", { type: "button", className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive, onClick: async () => {
                                 setLoginBusy(true);
                                 setLoginNotice(null);
                                 const sent = await requestEmailVerification(loginEmail);
@@ -1194,227 +1421,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, initialActivityEn
                                     setLoginError(formatAuthError(sent));
                                 }
                                 setLoginBusy(false);
-                            }, children: verifyCooldownActive ? `Resend in ${verifyCooldownSeconds}s` : 'Resend Verification Email' })), _jsx("div", { className: authStyles.authPrimaryActions, role: "group", "aria-label": "Primary authentication action", children: _jsx("button", { className: `${styles.submitBtn} ${authStyles.loginPrimaryBtn}`, disabled: loginBusy || (authMode === 'forgot' && resetCooldownActive), "data-testid": "auth-submit-button", onClick: async () => {
-                                    setLoginBusy(true);
-                                    setLoginNotice(null);
-                                    setLoginError(null);
-                                    setLoginErrorCode(null);
-                                    if (authMode === 'register' && !loginDisplayName.trim()) {
-                                        setLoginError('Display name is required.');
-                                        setLoginBusy(false);
-                                        return;
-                                    }
-                                    if (authMode === 'register') {
-                                        const validation = validatePasswordPolicy(loginPassword, {
-                                            email: loginEmail,
-                                            displayName: loginDisplayName
-                                        });
-                                        if (!validation.ok) {
-                                            setLoginError(validation.message || 'Password does not meet the password policy.');
-                                            setLoginErrorCode(validation.code || null);
-                                            setLoginBusy(false);
-                                            return;
-                                        }
-                                        if (loginPassword !== loginPasswordConfirm) {
-                                            setLoginError('Passwords do not match.');
-                                            setLoginErrorCode('PASSWORD_CONFIRMATION_MISMATCH');
-                                            setLoginBusy(false);
-                                            return;
-                                        }
-                                    }
-                                    let result = { success: false };
-                                    if (authMode === 'login') {
-                                        result = await loginWithCredentials(loginEmail, loginPassword);
-                                    }
-                                    else if (authMode === 'register') {
-                                        result = await registerWithCredentials(loginEmail, loginPassword, {
-                                            displayName: loginDisplayName,
-                                            planId: selectedSignupPlanId || undefined,
-                                            planVersionId: selectedSignupPlanVersionId || undefined,
-                                            interval: selectedSignupInterval || undefined
-                                        });
-                                    }
-                                    else if (authMode === 'verify') {
-                                        result = await confirmEmailVerification(verificationToken);
-                                    }
-                                    else if (authMode === 'forgot') {
-                                        result = await requestPasswordReset(loginEmail);
-                                    }
-                                    else if (authMode === 'reset') {
-                                        result = await confirmPasswordReset(resetToken, loginPassword);
-                                    }
-                                    else if (authMode === 'invite') {
-                                        if (inviteResolution === 'existing_user_signed_out') {
-                                            result = await loginWithCredentials(loginEmail, loginPassword);
-                                        }
-                                        else {
-                                            result = invitePasswordRequired
-                                                ? await acceptInviteWithToken(inviteToken, loginPassword)
-                                                : await joinInviteWithToken(inviteToken);
-                                        }
-                                    }
-                                    if (!result.success) {
-                                        if (authMode === 'register'
-                                            && (result.code === 'SIGNUP_PLAN_NOT_ENABLED'
-                                                || result.code === 'SIGNUP_PLAN_VERSION_NOT_FOUND'
-                                                || result.code === 'SIGNUP_PLAN_VERSION_REQUIRED')) {
-                                            navigate(planSelectionPath, { replace: true });
-                                            setLoginBusy(false);
-                                            return;
-                                        }
-                                        setLoginError(formatAuthError(result));
-                                        setLoginErrorCode(result.code || null);
-                                        if (authMode === 'login' && (result.code === 'WORKSPACE_NOT_FOUND' || result.code === 'WORKSPACE_ID_REQUIRED')) {
-                                            navigate('/setup?step=workspace', { replace: true });
-                                            setLoginBusy(false);
-                                            return;
-                                        }
-                                        if (authMode === 'login' && result.code === 'EMAIL_NOT_VERIFIED' && loginEmail.trim()) {
-                                            const sent = await requestEmailVerification(loginEmail);
-                                            if (sent.success) {
-                                                setVerifyCooldownUntil(Date.now() + 30_000);
-                                                setLoginMode('verify');
-                                                if (sent.verificationToken)
-                                                    setVerificationToken(sent.verificationToken);
-                                                setLoginNotice(buildVerificationRequestNotice({
-                                                    ...sent,
-                                                    intro: 'If that account exists and still needs verification, we sent an email.'
-                                                }));
-                                                setLoginError(null);
-                                                setLoginErrorCode(null);
-                                            }
-                                        }
-                                        if (authMode === 'register' && result.code === 'EMAIL_ALREADY_EXISTS_UNVERIFIED' && loginEmail.trim()) {
-                                            setVerifyCooldownUntil(Date.now() + 30_000);
-                                            setLoginMode('verify');
-                                            if (result.verificationToken)
-                                                setVerificationToken(result.verificationToken);
-                                            setLoginNotice(result.emailSent === false
-                                                ? `This email already has an unverified account, but verification email delivery failed. ${result.emailError || 'Try Resend Verification again.'}`
-                                                : 'This email already has an unverified account. Check your email for verification instructions.');
-                                            setLoginError(null);
-                                            setLoginErrorCode(null);
-                                        }
-                                    }
-                                    else if (authMode === 'register') {
-                                        const postRegistrationPath = resolvePostRegistrationPath(result);
-                                        const commercialOnboardingGate = hasCommercialOnboardingGate(result);
-                                        if (result.verificationRequired) {
-                                            setPendingVerificationWorkspaceSetupRequired(Boolean(result.workspaceSetupRequired));
-                                            setPendingVerificationCommercialState(commercialOnboardingGate
-                                                ? String(result.commercialState || '').trim() || (result.planSelectionRequired ? 'pending_plan_selection' : 'checkout_pending')
-                                                : null);
-                                            setPendingVerificationRedirectPath(postRegistrationPath);
-                                            if (result.verificationToken)
-                                                setVerificationToken(result.verificationToken);
-                                            setVerifyCooldownUntil(Date.now() + 30_000);
-                                            setLoginMode('verify');
-                                            setLoginNotice(result.emailSent === false
-                                                ? `Account created, but verification email failed to send. ${result.emailError || 'Try Resend Verification again.'}`
-                                                : 'Account created. Check your email for verification instructions.');
-                                        }
-                                        else {
-                                            setCommercialOnboardingRedirectActive(commercialOnboardingGate);
-                                            setPendingPostAuthRedirect({
-                                                path: postRegistrationPath,
-                                                workspaceSetupRequired: Boolean(result.workspaceSetupRequired),
-                                                commercialOnboardingGate
-                                            });
-                                        }
-                                    }
-                                    else if (authMode === 'verify') {
-                                        await retryBootstrapChecks();
-                                        const commercialOnboardingGate = pendingVerificationCommercialState === 'pending_plan_selection'
-                                            || pendingVerificationCommercialState === 'checkout_pending';
-                                        setCommercialOnboardingRedirectActive(commercialOnboardingGate);
-                                        setPendingPostAuthRedirect({
-                                            path: pendingVerificationRedirectPath || nextTarget,
-                                            workspaceSetupRequired: pendingVerificationWorkspaceSetupRequired,
-                                            commercialOnboardingGate
-                                        });
-                                    }
-                                    else if (authMode === 'forgot') {
-                                        const passwordResetDeliveryFailed = result.deliveryAttempted === true && result.emailSent === false;
-                                        if (result.resetToken)
-                                            setResetToken(result.resetToken);
-                                        setLoginNotice(buildPasswordResetNotice(result));
-                                        if (!passwordResetDeliveryFailed) {
-                                            setResetCooldownUntil(Date.now() + 30_000);
-                                            setLoginMode('reset');
-                                        }
-                                    }
-                                    else if (authMode === 'reset') {
-                                        setLoginMode('login');
-                                        setLoginNotice('Password updated. Sign in with your new password.');
-                                    }
-                                    else if (authMode === 'invite') {
-                                        if (inviteResolution === 'existing_user_signed_out') {
-                                            const normalizedInviteEmail = String(inviteEmail || '').trim().toLowerCase();
-                                            const normalizedLoginEmail = loginEmail.trim().toLowerCase();
-                                            // Make the invite flow deterministically join-ready as soon as
-                                            // the invited account signs in successfully, instead of waiting
-                                            // for a later invite inspection effect to catch up.
-                                            if (normalizedInviteEmail && normalizedLoginEmail === normalizedInviteEmail) {
-                                                setAuthMode('invite');
-                                                setInviteResolution('existing_user_ready');
-                                                setLoginPassword('');
-                                                setLoginPasswordConfirm('');
-                                                setLoginNotice('Signed in. Review the invite details to continue.');
-                                                setLoginError(null);
-                                                setLoginErrorCode(null);
-                                                setLoginBusy(false);
-                                                return;
-                                            }
-                                            if (normalizedInviteEmail) {
-                                                setLoginEmail(inviteEmail || '');
-                                            }
-                                            setInviteResolution('existing_user_signed_out');
-                                            setLoginPassword('');
-                                            setLoginPasswordConfirm('');
-                                            setLoginNotice(normalizedInviteEmail
-                                                ? `Signed in, but this invite is for ${inviteEmail}. Sign in with that account to continue.`
-                                                : 'Signed in, but this invite requires the invited account. Sign in with that account to continue.');
-                                            setLoginError('Sign in with the invited account to join this workspace.');
-                                            setLoginErrorCode('INVITE_ACCOUNT_MISMATCH');
-                                            setLoginBusy(false);
-                                            return;
-                                        }
-                                        if (result.workspaceSetupRequired) {
-                                            navigate(resolveWorkspaceSetupPath(), { replace: true });
-                                            setLoginBusy(false);
-                                            return;
-                                        }
-                                        navigateToPostAuthTarget(nextTarget, { replace: true });
-                                    }
-                                    else if (authMode === 'login') {
-                                        if (inviteToken.trim()) {
-                                            setAuthMode('invite');
-                                            setLoginPassword('');
-                                            setLoginPasswordConfirm('');
-                                            setLoginNotice('Signed in. Review the invite details to continue.');
-                                            setLoginBusy(false);
-                                            return;
-                                        }
-                                        if (result.workspaceSetupRequired) {
-                                            navigate(resolveWorkspaceSetupPath(), { replace: true });
-                                            setLoginBusy(false);
-                                            return;
-                                        }
-                                        setLoginEmail('');
-                                        setLoginDisplayName('');
-                                        setLoginPassword('');
-                                        setLoginPasswordConfirm('');
-                                        navigateToPostAuthTarget(nextTarget, { replace: true });
-                                    }
-                                    else {
-                                        setLoginEmail('');
-                                        setLoginDisplayName('');
-                                        setLoginPassword('');
-                                        setLoginPasswordConfirm('');
-                                        navigateToPostAuthTarget(nextTarget, { replace: true });
-                                    }
-                                    setLoginBusy(false);
-                                }, children: loginBusy ? 'Working...' : (authMode === 'login' ? 'Sign In'
+                            }, children: verifyCooldownActive ? `Resend in ${verifyCooldownSeconds}s` : 'Resend Verification Email' })), _jsx("div", { className: authStyles.authPrimaryActions, role: "group", "aria-label": "Primary authentication action", children: _jsx("button", { type: "submit", className: `${styles.submitBtn} ${authStyles.loginPrimaryBtn}`, disabled: loginBusy || (authMode === 'forgot' && resetCooldownActive), "data-testid": "auth-submit-button", children: loginBusy ? 'Working...' : (authMode === 'login' ? 'Sign In'
                                     : authMode === 'register' ? 'Create Account'
                                         : authMode === 'verify' ? 'Verify Email'
                                             : authMode === 'forgot'
@@ -1423,12 +1430,12 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, initialActivityEn
                                                     ? 'Reset Password'
                                                     : (inviteResolution === 'existing_user_signed_out'
                                                         ? 'Sign In to Continue'
-                                                        : (invitePasswordRequired ? 'Create Account and Join' : 'Join Workspace'))) }) }), (authMode === 'login' || authMode === 'register') && availableAuthProviders.length > 0 && (_jsxs("div", { className: authStyles.oauthProviders, children: [_jsx("div", { className: authStyles.oauthDivider, children: _jsx("span", { children: "or continue with" }) }), _jsxs("div", { className: authStyles.oauthButtons, children: [availableAuthProviders.includes('google') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('google', nextTarget), "aria-label": "Continue with Google", children: "Google" })), availableAuthProviders.includes('github') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('github', nextTarget), "aria-label": "Continue with GitHub", children: "GitHub" })), availableAuthProviders.includes('apple') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('apple', nextTarget), "aria-label": "Continue with Apple", children: "Apple" }))] })] })), authMode === 'invite' && inviteResolution === 'new_user' && inviteOAuthProviders.length > 0 && (_jsxs("div", { className: authStyles.oauthProviders, children: [_jsx("div", { className: authStyles.oauthDivider, children: _jsx("span", { children: "or join with" }) }), _jsxs("div", { className: authStyles.oauthButtons, children: [inviteOAuthProviders.includes('google') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('google', '/', inviteToken), "aria-label": "Join with Google", children: "Google" })), inviteOAuthProviders.includes('github') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('github', '/', inviteToken), "aria-label": "Join with GitHub", children: "GitHub" })), inviteOAuthProviders.includes('apple') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('apple', '/', inviteToken), "aria-label": "Join with Apple", children: "Apple" }))] })] })), authMode === 'register' && (_jsxs("p", { className: authStyles.registerConsent, children: ["By creating an account, you agree to the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.ai/legal/terms/", target: "_blank", rel: "noopener noreferrer", children: "Terms of Service" }), ' ', "and acknowledge the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.ai/legal/privacy/", target: "_blank", rel: "noopener noreferrer", children: "Privacy Policy" }), "."] })), _jsxs("div", { className: authStyles.authSecondaryActions, role: "group", "aria-label": "Authentication navigation", children: [directRegistrationEnabled && (authMode === 'login' || authMode === 'register') && (_jsxs("p", { className: authStyles.authModeSwitch, children: [authMode === 'login' ? 'Need an account?' : 'Already have an account?', ' ', _jsx("button", { className: authStyles.authModeSwitchLink, disabled: loginBusy, "data-testid": "auth-switch-mode-button", onClick: () => {
+                                                        : (invitePasswordRequired ? 'Create Account and Join' : 'Join Workspace'))) }) }), (authMode === 'login' || authMode === 'register') && availableAuthProviders.length > 0 && (_jsxs("div", { className: authStyles.oauthProviders, children: [_jsx("div", { className: authStyles.oauthDivider, children: _jsx("span", { children: "or continue with" }) }), _jsxs("div", { className: authStyles.oauthButtons, children: [availableAuthProviders.includes('google') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('google', nextTarget), "aria-label": "Continue with Google", children: "Google" })), availableAuthProviders.includes('github') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('github', nextTarget), "aria-label": "Continue with GitHub", children: "GitHub" })), availableAuthProviders.includes('apple') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('apple', nextTarget), "aria-label": "Continue with Apple", children: "Apple" }))] })] })), authMode === 'invite' && inviteResolution === 'new_user' && inviteOAuthProviders.length > 0 && (_jsxs("div", { className: authStyles.oauthProviders, children: [_jsx("div", { className: authStyles.oauthDivider, children: _jsx("span", { children: "or join with" }) }), _jsxs("div", { className: authStyles.oauthButtons, children: [inviteOAuthProviders.includes('google') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('google', '/', inviteToken), "aria-label": "Join with Google", children: "Google" })), inviteOAuthProviders.includes('github') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('github', '/', inviteToken), "aria-label": "Join with GitHub", children: "GitHub" })), inviteOAuthProviders.includes('apple') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('apple', '/', inviteToken), "aria-label": "Join with Apple", children: "Apple" }))] })] })), authMode === 'register' && (_jsxs("p", { className: authStyles.registerConsent, children: ["By creating an account, you agree to the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.ai/legal/terms/", target: "_blank", rel: "noopener noreferrer", children: "Terms of Service" }), ' ', "and acknowledge the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.ai/legal/privacy/", target: "_blank", rel: "noopener noreferrer", children: "Privacy Policy" }), "."] })), _jsxs("div", { className: authStyles.authSecondaryActions, role: "group", "aria-label": "Authentication navigation", children: [directRegistrationEnabled && (authMode === 'login' || authMode === 'register') && (_jsxs("p", { className: authStyles.authModeSwitch, children: [authMode === 'login' ? 'Need an account?' : 'Already have an account?', ' ', _jsx("button", { type: "button", className: authStyles.authModeSwitchLink, disabled: loginBusy, "data-testid": "auth-switch-mode-button", onClick: () => {
                                                 setLoginError(null);
                                                 setLoginErrorCode(null);
                                                 setLoginNotice(null);
                                                 setLoginMode(authMode === 'login' ? 'register' : 'login');
-                                            }, children: authMode === 'login' ? 'Register' : 'Sign In' })] })), _jsxs("div", { className: authStyles.authModeLinks, children: [(authMode === 'login' || authMode === 'register') && (_jsxs(_Fragment, { children: [_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || resetCooldownActive, "data-testid": "auth-forgot-password-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('forgot'); }, children: resetCooldownActive ? `Forgot Password (${resetCooldownSeconds}s)` : 'Forgot Password' }), _jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive, "data-testid": "auth-resend-verification-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('verify'); }, children: verifyCooldownActive ? `Resend Verification (${verifyCooldownSeconds}s)` : 'Resend Verification' }), _jsx("button", { className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-accept-invite-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('invite'); }, children: "Accept Invite" })] })), (authMode !== 'login' && authMode !== 'register') && (_jsxs(_Fragment, { children: [authMode === 'verify' && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive || !loginEmail.trim(), "data-testid": "auth-resend-verification-button", onClick: async () => {
+                                            }, children: authMode === 'login' ? 'Register' : 'Sign In' })] })), _jsxs("div", { className: authStyles.authModeLinks, children: [(authMode === 'login' || authMode === 'register') && (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", className: authStyles.authModeLink, disabled: loginBusy || resetCooldownActive, "data-testid": "auth-forgot-password-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('forgot'); }, children: resetCooldownActive ? `Forgot Password (${resetCooldownSeconds}s)` : 'Forgot Password' }), _jsx("button", { type: "button", className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive, "data-testid": "auth-resend-verification-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('verify'); }, children: verifyCooldownActive ? `Resend Verification (${verifyCooldownSeconds}s)` : 'Resend Verification' }), _jsx("button", { type: "button", className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-accept-invite-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('invite'); }, children: "Accept Invite" })] })), (authMode !== 'login' && authMode !== 'register') && (_jsxs(_Fragment, { children: [authMode === 'verify' && (_jsx("button", { type: "button", className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive || !loginEmail.trim(), "data-testid": "auth-resend-verification-button", onClick: async () => {
                                                         setLoginBusy(true);
                                                         setLoginNotice(null);
                                                         setLoginError(null);
@@ -1444,7 +1451,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, initialActivityEn
                                                             setLoginError(formatAuthError(sent));
                                                         }
                                                         setLoginBusy(false);
-                                                    }, children: verifyCooldownActive ? `Resend Verification (${verifyCooldownSeconds}s)` : 'Resend Verification' })), _jsx("button", { className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-return-sign-in-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('login'); }, children: authMode === 'verify' ? 'Back to Sign In' : 'Sign In' }), directRegistrationEnabled && authMode !== 'verify' && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-return-register-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('register'); }, children: "Register" })), authMode === 'reset' && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || resetCooldownActive, "data-testid": "auth-return-forgot-password-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('forgot'); }, children: resetCooldownActive ? `Forgot Password (${resetCooldownSeconds}s)` : 'Forgot Password' }))] }))] })] })] }) }) }));
+                                                    }, children: verifyCooldownActive ? `Resend Verification (${verifyCooldownSeconds}s)` : 'Resend Verification' })), _jsx("button", { type: "button", className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-return-sign-in-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('login'); }, children: authMode === 'verify' ? 'Back to Sign In' : 'Sign In' }), directRegistrationEnabled && authMode !== 'verify' && (_jsx("button", { type: "button", className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-return-register-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('register'); }, children: "Register" })), authMode === 'reset' && (_jsx("button", { type: "button", className: authStyles.authModeLink, disabled: loginBusy || resetCooldownActive, "data-testid": "auth-return-forgot-password-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('forgot'); }, children: resetCooldownActive ? `Forgot Password (${resetCooldownSeconds}s)` : 'Forgot Password' }))] }))] })] })] }) }) }));
     }
     if (shellRenderState === 'login-redirect') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: "Redirecting to sign in..." })] }) }) }));

package/dist/annotatedAttachments/AnnotatedAttachmentSessionStore.js

@@ -249,7 +249,7 @@ export class AnnotatedAttachmentSessionStore {
             WHERE tenant_id = ?
               AND workspace_id = ?
               AND id = ?
-        `).run(normalizeId(input.taskId) || existing.taskId, normalizeId(input.baseImageAssetId) || existing.baseImageAssetId, normalizeNullable(input.title), normalizeNullable(input.globalInstruction), JSON.stringify(Array.isArray(input.annotations) ? input.annotations : []), normalizeNullable(input.createdByActorId), normalizeNullable(input.updatedByActorId), normalizeId(input.createdAt) || existing.createdAt, normalizeId(input.updatedAt) || existing.updatedAt, normalizeNullable(input.deletedAt), this.tenantId, workspaceId, id);
+        `).run(normalizeId(input.taskId), normalizeId(input.baseImageAssetId) || existing.baseImageAssetId, normalizeNullable(input.title), normalizeNullable(input.globalInstruction), JSON.stringify(Array.isArray(input.annotations) ? input.annotations : []), normalizeNullable(input.createdByActorId), normalizeNullable(input.updatedByActorId), normalizeId(input.createdAt) || existing.createdAt, normalizeId(input.updatedAt) || existing.updatedAt, normalizeNullable(input.deletedAt), this.tenantId, workspaceId, id);
         return this.get(id, workspaceId, { includeDeleted: true });
     }
     update(input) {