@taskforcehq/taskforce 0.3.327 → 0.3.329

package/dist/migrations/taskSchemaMigrations.js

@@ -1160,6 +1160,22 @@ export function ensureWorkspaceAssetsSchema(db) {
         ON workspace_asset_links(tenant_id, workspace_id, asset_id, deleted_at, updated_at);
         CREATE INDEX IF NOT EXISTS idx_workspace_asset_links_workspace_updated
         ON workspace_asset_links(tenant_id, workspace_id, updated_at, asset_id);
+
+        CREATE TABLE IF NOT EXISTS workspace_asset_upload_drafts (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            draft_id TEXT NOT NULL,
+            asset_id TEXT NOT NULL,
+            storage_key TEXT NOT NULL,
+            purpose TEXT NOT NULL,
+            created_by_user_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            retired_at TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, draft_id, asset_id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_asset_upload_drafts_expiry
+        ON workspace_asset_upload_drafts(tenant_id, workspace_id, retired_at, created_at);
     `);
     const linkColumns = db.prepare(`PRAGMA table_info(workspace_asset_links)`).all();
     const hasDisplayNameColumn = linkColumns.some((c) => c.name === 'display_name');
@@ -1407,6 +1423,7 @@ export function buildWorkspaceSyncDurabilitySchemaSql(provider) {
             base_lifecycle_revision ${revisionType} NOT NULL DEFAULT 0,
             payload_json TEXT NOT NULL,
             payload_fingerprint TEXT NOT NULL,
+            canonical_intent_json TEXT,
             status TEXT NOT NULL DEFAULT 'pending',
             attempt_count INTEGER NOT NULL DEFAULT 0,
             initial_not_found_attempt_count INTEGER NOT NULL DEFAULT 0,
@@ -1811,6 +1828,9 @@ export function ensureWorkspaceSyncDurabilitySchema(db) {
     if (!outboxColumns.some((column) => column.name === 'initial_not_found_attempt_count')) {
         db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN initial_not_found_attempt_count INTEGER NOT NULL DEFAULT 0`);
     }
+    if (!outboxColumns.some((column) => column.name === 'canonical_intent_json')) {
+        db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN canonical_intent_json TEXT`);
+    }
     if (!outboxColumns.some((column) => column.name === 'owns_task_metadata')) {
         db.exec(`ALTER TABLE workspace_sync_outbox ADD COLUMN owns_task_metadata INTEGER NOT NULL DEFAULT 0`);
     }
@@ -2113,6 +2133,8 @@ export function ensureLocalSyncCoordinatorSchema(db) {
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL,
             next_attempt_at TEXT NOT NULL,
+            terminal_at TEXT,
+            terminal_reason TEXT,
             resolved_at TEXT,
             PRIMARY KEY (tenant_id, workspace_id, task_id)
         );
@@ -2156,6 +2178,12 @@ export function ensureLocalSyncCoordinatorSchema(db) {
     if (!attachmentApplyColumns.has('revision_fingerprint')) {
         db.exec(`ALTER TABLE workspace_sync_v3_attachment_apply_obligations ADD COLUMN revision_fingerprint TEXT`);
     }
+    if (!attachmentApplyColumns.has('terminal_at')) {
+        db.exec(`ALTER TABLE workspace_sync_v3_attachment_apply_obligations ADD COLUMN terminal_at TEXT`);
+    }
+    if (!attachmentApplyColumns.has('terminal_reason')) {
+        db.exec(`ALTER TABLE workspace_sync_v3_attachment_apply_obligations ADD COLUMN terminal_reason TEXT`);
+    }
     const coordinatorStateColumns = db.provider === 'postgres'
         ? new Set(db.prepare(`
             SELECT column_name AS name
@@ -2801,6 +2829,9 @@ export function ensureDocumentReviewSessionsSchema(db) {
             thread_status_updated_at TEXT,
             resolved_at TEXT,
             resolved_by_actor_id TEXT,
+            idempotency_key TEXT,
+            idempotency_fingerprint TEXT,
+            idempotency_actor_scope TEXT NOT NULL DEFAULT '',
             order_index INTEGER NOT NULL DEFAULT 0,
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL,
@@ -2830,6 +2861,22 @@ export function ensureDocumentReviewSessionsSchema(db) {
     if (!commentColumnNames.has('deleted_by_actor_id')) {
         addCommentColumn('deleted_by_actor_id');
     }
+    if (!commentColumnNames.has('idempotency_key')) {
+        addCommentColumn('idempotency_key');
+    }
+    if (!commentColumnNames.has('idempotency_fingerprint')) {
+        addCommentColumn('idempotency_fingerprint');
+    }
+    if (!commentColumnNames.has('idempotency_actor_scope')) {
+        const ifNotExists = db.provider === 'postgres' ? ' IF NOT EXISTS' : '';
+        db.exec(`ALTER TABLE document_review_comments ADD COLUMN${ifNotExists} idempotency_actor_scope TEXT NOT NULL DEFAULT ''`);
+    }
+    db.exec(`
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_document_review_comments_idempotency
+        ON document_review_comments (
+            tenant_id, workspace_id, idempotency_actor_scope, idempotency_key
+        )
+    `);
     if (!commentColumnNames.has('parent_comment_id')) {
         addCommentColumn('parent_comment_id');
     }

package/dist/runtime/appGateDefinitions.d.ts

@@ -1,36 +1,60 @@
 export declare const APP_GATE_DEFINITIONS: {
     readonly 'annotated_attachments.workspace_access': {
-        readonly enabled: true;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: true;
+        };
         readonly description: "Annotated Attachment workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Annotated Attachment GA";
     };
     readonly 'documents.workspace_access': {
-        readonly enabled: true;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: true;
+        };
         readonly description: "Document Manager/editor workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Document Manager GA";
     };
     readonly 'workflow_manager.workspace_access': {
-        readonly enabled: true;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: false;
+        };
         readonly description: "Workflow Manager workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Workflow Manager GA";
     };
     readonly 'taskforce_agents.workspace_access': {
-        readonly enabled: true;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: false;
+        };
         readonly description: "Taskforce Agents workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Taskforce Agents workspace GA";
     };
     readonly 'ai_profiles.workspace_access': {
-        readonly enabled: true;
+        readonly enabledByEnvironment: {
+            readonly performance: true;
+            readonly staging: true;
+            readonly production: true;
+        };
         readonly description: "AI Profiles workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "AI Profiles workspace GA";
     };
     readonly 'planning.workspace_access': {
-        readonly enabled: false;
+        readonly enabledByEnvironment: {
+            readonly performance: false;
+            readonly staging: false;
+            readonly production: false;
+        };
         readonly description: "Planning workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Planning workspace GA";

package/dist/runtime/appGateDefinitions.js

@@ -1,36 +1,36 @@
 export const APP_GATE_DEFINITIONS = {
     'annotated_attachments.workspace_access': {
-        enabled: true,
+        enabledByEnvironment: { performance: true, staging: true, production: true },
         description: 'Annotated Attachment workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Annotated Attachment GA'
     },
     'documents.workspace_access': {
-        enabled: true,
+        enabledByEnvironment: { performance: true, staging: true, production: true },
         description: 'Document Manager/editor workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Document Manager GA'
     },
     'workflow_manager.workspace_access': {
-        enabled: true,
+        enabledByEnvironment: { performance: true, staging: true, production: false },
         description: 'Workflow Manager workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Workflow Manager GA'
     },
     'taskforce_agents.workspace_access': {
-        enabled: true,
+        enabledByEnvironment: { performance: true, staging: true, production: false },
         description: 'Taskforce Agents workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Taskforce Agents workspace GA'
     },
     'ai_profiles.workspace_access': {
-        enabled: true,
+        enabledByEnvironment: { performance: true, staging: true, production: true },
         description: 'AI Profiles workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'AI Profiles workspace GA'
     },
     'planning.workspace_access': {
-        enabled: false,
+        enabledByEnvironment: { performance: false, staging: false, production: false },
         description: 'Planning workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Planning workspace GA'

package/dist/runtime/appGates.d.ts

@@ -1,17 +1,18 @@
-export type RuntimeMode = 'local' | 'cloud';
+import type { TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+import { APP_GATE_DEFINITIONS as APP_GATE_CONFIG } from './appGateDefinitions.js';
 export declare const ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY: "annotated_attachments.workspace_access";
 export declare const DOCUMENT_WORKSPACE_FEATURE_KEY: "documents.workspace_access";
 export declare const WORKFLOW_MANAGER_WORKSPACE_FEATURE_KEY: "workflow_manager.workspace_access";
 export declare const TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY: "taskforce_agents.workspace_access";
 export declare const AI_PROFILES_WORKSPACE_FEATURE_KEY: "ai_profiles.workspace_access";
 export declare const PLANNING_WORKSPACE_FEATURE_KEY: "planning.workspace_access";
-export type AppGateKey = typeof ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY | typeof DOCUMENT_WORKSPACE_FEATURE_KEY | typeof WORKFLOW_MANAGER_WORKSPACE_FEATURE_KEY | typeof TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY | typeof AI_PROFILES_WORKSPACE_FEATURE_KEY | typeof PLANNING_WORKSPACE_FEATURE_KEY;
+export type AppGateKey = keyof typeof APP_GATE_CONFIG;
 export interface AppGateDefinition {
-    key: AppGateKey;
-    enabled: boolean;
-    description: string;
-    owner: string;
-    removalMilestone: string;
+    readonly key: AppGateKey;
+    readonly enabledByEnvironment: Readonly<Record<TaskforceCloudEnvironment, boolean>>;
+    readonly description: string;
+    readonly owner: string;
+    readonly removalMilestone: string;
 }
 export interface ResolvedFeatureAccess {
     featureKey: string;
@@ -20,11 +21,9 @@ export interface ResolvedFeatureAccess {
     code: string;
 }
 export type ResolvedFeatureAccessMap = Record<string, ResolvedFeatureAccess>;
-export declare const APP_GATE_DEFINITIONS: Record<AppGateKey, AppGateDefinition>;
+export declare const APP_GATE_DEFINITIONS: Readonly<Record<AppGateKey, AppGateDefinition>>;
 export declare function listAppGateDefinitions(): AppGateDefinition[];
 export declare function getAppGateDefinition(featureKey: string): AppGateDefinition | null;
-export declare function resolveAppGateAccess(featureKey: string): ResolvedFeatureAccess;
-export declare function resolveFeatureAccess(input: {
-    featureKey: string;
-    runtimeMode: RuntimeMode;
-}): ResolvedFeatureAccess;
+export declare function resolveAppGateAccess(featureKey: string, environment: TaskforceCloudEnvironment): ResolvedFeatureAccess;
+export declare function resolveAppGateAccessMap(environment: TaskforceCloudEnvironment): ResolvedFeatureAccessMap;
+export declare function isResolvedFeatureAccessMap(value: unknown): value is ResolvedFeatureAccessMap;

package/dist/runtime/appGates.js

@@ -5,16 +5,17 @@ export const WORKFLOW_MANAGER_WORKSPACE_FEATURE_KEY = 'workflow_manager.workspac
 export const TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY = 'taskforce_agents.workspace_access';
 export const AI_PROFILES_WORKSPACE_FEATURE_KEY = 'ai_profiles.workspace_access';
 export const PLANNING_WORKSPACE_FEATURE_KEY = 'planning.workspace_access';
-export const APP_GATE_DEFINITIONS = Object.entries(APP_GATE_CONFIG).reduce((acc, [key, definition]) => {
-    acc[key] = {
+const appGateDefinitions = Object.fromEntries(Object.entries(APP_GATE_CONFIG).map(([key, definition]) => [
+    key,
+    Object.freeze({
         key: key,
-        enabled: Boolean(definition.enabled),
-        description: String(definition.description || ''),
-        owner: String(definition.owner || ''),
-        removalMilestone: String(definition.removalMilestone || '')
-    };
-    return acc;
-}, {});
+        enabledByEnvironment: Object.freeze({ ...definition.enabledByEnvironment }),
+        description: definition.description,
+        owner: definition.owner,
+        removalMilestone: definition.removalMilestone,
+    }),
+]));
+export const APP_GATE_DEFINITIONS = Object.freeze(appGateDefinitions);
 export function listAppGateDefinitions() {
     return Object.values(APP_GATE_DEFINITIONS);
 }
@@ -24,7 +25,7 @@ export function getAppGateDefinition(featureKey) {
         return null;
     return APP_GATE_DEFINITIONS[normalizedKey] || null;
 }
-export function resolveAppGateAccess(featureKey) {
+export function resolveAppGateAccess(featureKey, environment) {
     const gate = getAppGateDefinition(featureKey);
     if (!gate) {
         return {
@@ -34,7 +35,7 @@ export function resolveAppGateAccess(featureKey) {
             code: 'OK'
         };
     }
-    if (!gate.enabled) {
+    if (!gate.enabledByEnvironment[environment]) {
         return {
             featureKey,
             allowed: false,
@@ -49,6 +50,21 @@ export function resolveAppGateAccess(featureKey) {
         code: 'OK'
     };
 }
-export function resolveFeatureAccess(input) {
-    return resolveAppGateAccess(input.featureKey);
+export function resolveAppGateAccessMap(environment) {
+    return Object.fromEntries(listAppGateDefinitions().map(({ key }) => [key, resolveAppGateAccess(key, environment)]));
+}
+export function isResolvedFeatureAccessMap(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    return listAppGateDefinitions().every(({ key }) => {
+        const access = candidate[key];
+        if (!access || typeof access !== 'object' || Array.isArray(access))
+            return false;
+        const resolved = access;
+        return resolved.featureKey === key
+            && typeof resolved.allowed === 'boolean'
+            && (resolved.source === 'app_gate' || resolved.source === 'cloud_entitlement' || resolved.source === 'none')
+            && typeof resolved.code === 'string';
+    });
 }

package/dist/runtime/nodeAppGates.d.ts

@@ -0,0 +1,8 @@
+import type { TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+import { type ResolvedFeatureAccess, type ResolvedFeatureAccessMap } from './appGates.js';
+export interface NodeAppGateResolutionOptions {
+    onWarning?: (message: string) => void;
+}
+export declare function resolveNodeAppGateEnvironment(env?: NodeJS.ProcessEnv, options?: NodeAppGateResolutionOptions): TaskforceCloudEnvironment;
+export declare function resolveNodeAppGateAccess(featureKey: string, env?: NodeJS.ProcessEnv, options?: NodeAppGateResolutionOptions): ResolvedFeatureAccess;
+export declare function resolveNodeAppGateAccessMap(env?: NodeJS.ProcessEnv, options?: NodeAppGateResolutionOptions): ResolvedFeatureAccessMap;

package/dist/runtime/nodeAppGates.js

@@ -0,0 +1,27 @@
+import { resolveDeploymentConfig } from '../config/deployment.js';
+import { resolveAppGateAccess, resolveAppGateAccessMap, } from './appGates.js';
+const warnedEnvironmentSignatures = new WeakMap();
+export function resolveNodeAppGateEnvironment(env = process.env, options = {}) {
+    const deployment = resolveDeploymentConfig(env);
+    const warnings = [...deployment.warnings];
+    if (!deployment.cloudEnvironment) {
+        warnings.push('TASKFORCE_CLOUD_ENVIRONMENT could not be resolved; using the production App Gate profile.');
+    }
+    const warningSignature = warnings.join('\n');
+    if (warnings.length === 0) {
+        warnedEnvironmentSignatures.delete(env);
+    }
+    else if (warnedEnvironmentSignatures.get(env) !== warningSignature) {
+        const onWarning = options.onWarning || ((message) => console.warn(`[Taskforce App Gates] ${message}`));
+        for (const warning of warnings)
+            onWarning(warning);
+        warnedEnvironmentSignatures.set(env, warningSignature);
+    }
+    return deployment.cloudEnvironment || 'production';
+}
+export function resolveNodeAppGateAccess(featureKey, env = process.env, options = {}) {
+    return resolveAppGateAccess(featureKey, resolveNodeAppGateEnvironment(env, options));
+}
+export function resolveNodeAppGateAccessMap(env = process.env, options = {}) {
+    return resolveAppGateAccessMap(resolveNodeAppGateEnvironment(env, options));
+}

package/dist/server/appAccess.d.ts

@@ -0,0 +1,12 @@
+import type { AccountAccessStatus } from '../core/types.js';
+export interface AppAccessDeniedResponse {
+    statusCode: 403;
+    body: {
+        error: string;
+        code: string;
+        gate: AccountAccessStatus['gate'];
+        canAccessPlans: boolean;
+        planSelectionRequired: boolean;
+    };
+}
+export declare function resolveAppAccessDeniedResponse(accountAccess: AccountAccessStatus): AppAccessDeniedResponse | null;

package/dist/server/appAccess.js

@@ -0,0 +1,21 @@
+export function resolveAppAccessDeniedResponse(accountAccess) {
+    if (accountAccess.canAccessApp)
+        return null;
+    const code = accountAccess.gate === 'plan_selection_required'
+        ? 'PLAN_SELECTION_REQUIRED'
+        : accountAccess.gate === 'checkout_pending'
+            ? 'CHECKOUT_PENDING'
+            : accountAccess.gate === 'misconfigured'
+                ? 'ACCOUNT_ACCESS_MISCONFIGURED'
+                : 'ACCOUNT_ENTITLEMENT_REQUIRED';
+    return {
+        statusCode: 403,
+        body: {
+            error: accountAccess.message || 'This account cannot access the app.',
+            code,
+            gate: accountAccess.gate,
+            canAccessPlans: accountAccess.canAccessPlans,
+            planSelectionRequired: accountAccess.planSelectionRequired
+        }
+    };
+}

package/dist/server/authorizedWorkspaceAccess.d.ts

@@ -0,0 +1,12 @@
+import type { TaskforceCore } from '../core/Taskforce.js';
+import type { RequestAccessContext } from './auth.js';
+export interface AuthorizedRequestAccess extends RequestAccessContext {
+    disabled?: boolean;
+    accountDisabled?: boolean;
+    workspaceDisabled?: boolean;
+}
+type WorkspaceAccessCore = Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole'>;
+export declare function resolveAuthorizedWorkspaceAccess(core: WorkspaceAccessCore, access: AuthorizedRequestAccess, requestedWorkspaceId: string): AuthorizedRequestAccess;
+export declare function isWorkspaceAccessRecoveryRoute(pathname: string): boolean;
+export declare function resolveDisabledAccessError(access: Pick<AuthorizedRequestAccess, 'disabled' | 'accountDisabled' | 'workspaceDisabled'>, pathname: string): string | null;
+export {};

package/dist/server/authorizedWorkspaceAccess.js

@@ -0,0 +1,40 @@
+export function resolveAuthorizedWorkspaceAccess(core, access, requestedWorkspaceId) {
+    if (!access.authenticated || !access.userId || access.userId === 'anonymous')
+        return access;
+    const trimmedRequestedWorkspaceId = String(requestedWorkspaceId || '').trim();
+    const candidateWorkspaceIds = [
+        trimmedRequestedWorkspaceId,
+        String(access.workspaceId || '').trim()
+    ].filter((workspaceId, index, values) => Boolean(workspaceId) && values.indexOf(workspaceId) === index);
+    for (const workspaceId of candidateWorkspaceIds) {
+        const resolved = core.resolveUserAccess(access.userId, workspaceId, access.role);
+        if (!resolved)
+            continue;
+        return {
+            ...access,
+            role: resolved.role,
+            workspaceId: resolved.workspaceId,
+            userId: resolved.userId,
+            systemRole: core.getSystemRole(resolved.userId),
+            disabled: resolved.disabled,
+            accountDisabled: resolved.accountDisabled ?? resolved.disabled,
+            workspaceDisabled: resolved.workspaceDisabled ?? false
+        };
+    }
+    return access;
+}
+export function isWorkspaceAccessRecoveryRoute(pathname) {
+    return pathname === '/api/taskforce/workspaces'
+        || pathname === '/api/taskforce/session/workspace';
+}
+export function resolveDisabledAccessError(access, pathname) {
+    if (pathname.startsWith('/api/taskforce/auth/'))
+        return null;
+    if (access.accountDisabled ?? access.disabled) {
+        return 'Forbidden: user account is disabled.';
+    }
+    if (access.workspaceDisabled && !isWorkspaceAccessRecoveryRoute(pathname)) {
+        return 'Forbidden: workspace access is not active for this user.';
+    }
+    return null;
+}

package/dist/server/cloudCollectionRead.d.ts

@@ -0,0 +1,25 @@
+import type { TaskforceCore } from '../core/Taskforce.js';
+import { type AuthorizedRequestAccess } from './authorizedWorkspaceAccess.js';
+export type CloudCollectionReadOperation = 'tasks' | 'archive' | 'deleted' | 'planning-bootstrap';
+export interface CloudCollectionReadRequest {
+    operation: CloudCollectionReadOperation;
+    pathname: string;
+    requestedWorkspaceId: string;
+    access: AuthorizedRequestAccess;
+    performanceTrace: boolean;
+}
+export interface CloudCollectionReadResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: string;
+    workspaceId: string;
+    performance?: {
+        durationMs: number;
+        details: Record<string, number>;
+    };
+}
+type CloudCollectionReadCore = Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole' | 'getAccountAccessStatus' | 'listActiveTaskSummaries' | 'listArchiveSummaries' | 'listDeletedTasksReadOnly' | 'listPlanningBootstrap'>;
+export declare function resolveCloudCollectionReadOperation(method: string | undefined, pathname: string): CloudCollectionReadOperation | null;
+export declare function executeCloudCollectionRead(core: CloudCollectionReadCore, request: CloudCollectionReadRequest): CloudCollectionReadResponse;
+export declare function cloudCollectionReadRoute(operation: CloudCollectionReadOperation): string;
+export {};

package/dist/server/cloudCollectionRead.js

@@ -0,0 +1,120 @@
+import { getRequestPerformanceDiagnostics, runWithRequestPerformanceDiagnostics, } from '../storage/postgresRequestDiagnostics.js';
+import { resolveAppAccessDeniedResponse } from './appAccess.js';
+import { resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, } from './authorizedWorkspaceAccess.js';
+const ROUTE_BY_OPERATION = {
+    tasks: '/api/taskforce/tasks',
+    archive: '/api/taskforce/archive',
+    deleted: '/api/taskforce/deleted',
+    'planning-bootstrap': '/api/taskforce/planning/bootstrap',
+};
+export function resolveCloudCollectionReadOperation(method, pathname) {
+    if (String(method || 'GET').toUpperCase() !== 'GET')
+        return null;
+    if (pathname === '/api/taskforce/tasks')
+        return 'tasks';
+    if (pathname === '/api/taskforce/archive')
+        return 'archive';
+    if (pathname === '/api/taskforce/deleted' || pathname === '/api/taskforce/trash')
+        return 'deleted';
+    if (pathname === '/api/taskforce/planning/bootstrap')
+        return 'planning-bootstrap';
+    return null;
+}
+function serverTimingMetric(name, durationMs) {
+    return `${name};dur=${Math.max(0, Math.round(durationMs))}`;
+}
+function performanceHeaders(diagnostics, responseBytes, metrics) {
+    const headers = {
+        'Content-Type': 'application/json',
+        'Server-Timing': metrics.map((metric) => serverTimingMetric(metric.name, metric.durationMs)).join(', '),
+    };
+    if (diagnostics) {
+        headers['X-Taskforce-Postgres-Query-Count'] = String(diagnostics.postgresQueryCount);
+        headers['X-Taskforce-Postgres-Worker-Call-Count'] = String(diagnostics.postgresWorkerCallCount);
+        headers['X-Taskforce-Response-Bytes'] = String(responseBytes);
+    }
+    return headers;
+}
+export function executeCloudCollectionRead(core, request) {
+    return runWithRequestPerformanceDiagnostics(request.performanceTrace, () => {
+        const access = resolveAuthorizedWorkspaceAccess(core, request.access, request.requestedWorkspaceId);
+        const workspaceId = String(access.workspaceId || '').trim();
+        const disabledAccessError = resolveDisabledAccessError(access, request.pathname);
+        if (disabledAccessError) {
+            return {
+                statusCode: 403,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ error: disabledAccessError }),
+                workspaceId,
+            };
+        }
+        if (access.authenticated && access.userId && access.userId !== 'anonymous') {
+            const denied = resolveAppAccessDeniedResponse(core.getAccountAccessStatus(access.userId));
+            if (denied) {
+                return {
+                    statusCode: denied.statusCode,
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify(denied.body),
+                    workspaceId,
+                };
+            }
+        }
+        const startedAt = performance.now();
+        let data;
+        const planningDiagnostics = {};
+        if (request.operation === 'tasks')
+            data = core.listActiveTaskSummaries(workspaceId);
+        else if (request.operation === 'archive')
+            data = core.listArchiveSummaries(workspaceId);
+        else if (request.operation === 'deleted')
+            data = core.listDeletedTasksReadOnly(workspaceId);
+        else
+            data = core.listPlanningBootstrap(workspaceId, planningDiagnostics);
+        const loadCompletedAt = performance.now();
+        const serializeStartedAt = performance.now();
+        const body = JSON.stringify(data);
+        const serializeDurationMs = performance.now() - serializeStartedAt;
+        const totalDurationMs = performance.now() - startedAt;
+        const responseBytes = Buffer.byteLength(body, 'utf8');
+        const diagnostics = getRequestPerformanceDiagnostics();
+        const metrics = request.operation === 'planning-bootstrap'
+            ? [
+                { name: 'planning-bootstrap', durationMs: totalDurationMs },
+                { name: 'planning-bootstrap-initiatives', durationMs: planningDiagnostics.initiativeLoadMs || 0 },
+                { name: 'planning-bootstrap-workstreams', durationMs: planningDiagnostics.workstreamLoadMs || 0 },
+                { name: 'planning-bootstrap-tasks', durationMs: planningDiagnostics.taskSummaryQueryMs || 0 },
+                { name: 'planning-bootstrap-build', durationMs: planningDiagnostics.taskSummaryBuildMs || 0 },
+                { name: 'planning-bootstrap-json', durationMs: serializeDurationMs },
+            ]
+            : [
+                { name: 'route-total', durationMs: totalDurationMs },
+                { name: 'route-load', durationMs: loadCompletedAt - startedAt },
+                { name: 'route-json', durationMs: serializeDurationMs },
+            ];
+        if (diagnostics) {
+            metrics.push({ name: 'postgres-worker-wait', durationMs: diagnostics.postgresWorkerWaitMs });
+        }
+        return {
+            statusCode: 200,
+            headers: performanceHeaders(diagnostics, responseBytes, metrics),
+            body,
+            workspaceId,
+            performance: {
+                durationMs: totalDurationMs,
+                details: {
+                    responseBytes,
+                    jsonSerializeMs: serializeDurationMs,
+                    ...(diagnostics ? {
+                        postgresQueryCount: diagnostics.postgresQueryCount,
+                        postgresWorkerCallCount: diagnostics.postgresWorkerCallCount,
+                        postgresWorkerWaitMs: Math.round(diagnostics.postgresWorkerWaitMs),
+                    } : {}),
+                    ...(request.operation === 'planning-bootstrap' ? planningDiagnostics : {}),
+                },
+            },
+        };
+    });
+}
+export function cloudCollectionReadRoute(operation) {
+    return ROUTE_BY_OPERATION[operation];
+}

package/dist/server/cloudCollectionReadPool.d.ts

@@ -0,0 +1,52 @@
+import type { CloudCollectionReadRequest, CloudCollectionReadResponse } from './cloudCollectionRead.js';
+export interface CloudCollectionReadPoolOptions {
+    projectRoot: string;
+    tenantId: string;
+    connectionString: string;
+    size?: number;
+    requestTimeoutMs?: number;
+    workerFactory?: () => CloudCollectionReadWorker;
+}
+export interface CloudCollectionReadWorker {
+    postMessage(message: unknown): void;
+    terminate(): Promise<number>;
+    on(event: 'message', listener: (message: CloudCollectionReadWorkerResponse) => void): this;
+    on(event: 'error', listener: (error: unknown) => void): this;
+    on(event: 'exit', listener: (code: number) => void): this;
+}
+export type CloudCollectionReadWorkerResponse = {
+    type: 'ready';
+} | {
+    type: 'result';
+    requestId: number;
+    response: CloudCollectionReadResponse;
+} | {
+    type: 'error';
+    requestId: number;
+    error: string;
+};
+export declare class CloudCollectionReadPool {
+    private readonly slots;
+    private readonly queue;
+    private readonly requestTimeoutMs;
+    private readonly desiredSize;
+    private readonly workerData;
+    private readonly workerFactory;
+    private nextRequestId;
+    private closing;
+    constructor(options: CloudCollectionReadPoolOptions);
+    execute(request: CloudCollectionReadRequest): Promise<CloudCollectionReadResponse>;
+    close(): Promise<void>;
+    private spawnSlot;
+    private handleMessage;
+    private handleWorkerFailure;
+    private ensureSlots;
+    private pump;
+}
+export declare function resolveCloudCollectionReadPoolSize(env?: NodeJS.ProcessEnv): number;
+export declare function shouldUseCloudCollectionReadPool(input: {
+    runtimeMode: 'local' | 'cloud';
+    databaseProvider: 'sqlite' | 'postgres';
+    connectionString?: string;
+    workerCount: number;
+}): boolean;