@beignet/cli 0.0.25 → 0.0.27

package/src/make/tenancy.ts

@@ -0,0 +1,4809 @@
+import { readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import {
+  type BeignetConfig,
+  loadBeignetConfig,
+  type ResolvedBeignetConfig,
+  resolveConfig,
+} from "../config.js";
+import {
+  appendToArrayExpression,
+  arrayInitializerInfo,
+} from "../registry-edits.js";
+import { serverFiles } from "../templates/server.js";
+import {
+  addNamedImport,
+  addNamedTypeImport,
+  aliasModule,
+  appendCreateGatePolicy,
+  appendDeferredPortKey,
+  appendGatePolicyMember,
+  appendSharedErrorEntries,
+  appendTupleTypeMember,
+  assertStandardApp,
+  createRepositoriesReturnBodySource,
+  type DatabaseName,
+  detectResourceDatabase,
+  detectResourcePersistence,
+  detectUiShell,
+  drizzleDialects,
+  drizzleRepositoriesPath,
+  drizzleSchemaIndexPath,
+  fileExists,
+  type GeneratedFile,
+  hasTopLevelObjectProperty,
+  infrastructureDir,
+  insertCreateRepositoriesProperty,
+  insertTypeProperty,
+  type MakeResult,
+  missingCapabilityBuilderFiles,
+  notificationPortWirings,
+  type PlannedGeneratedFile,
+  planGeneratedFiles,
+  type ResourceNames,
+  readOptionalFile,
+  relativeModule,
+  resourceNames,
+  resourceSharedErrorsPath,
+  seedEntrypointPath,
+  typeBodySource,
+  typeHasTopLevelProperty,
+  uniqueStrings,
+  updateDatabaseProviderPick,
+  updateDatabaseResetTables,
+  updateDrizzleSchemaIndexExports,
+  updateOpenApiRouteContracts,
+  updatePackageJson,
+  updatePackageScripts,
+  updateServerRoutes,
+  updateTransactionPortsPick,
+  wirePortProviders,
+  writePlannedGeneratedFile,
+} from "./shared.js";
+
+export type MakeTenancyOptions = {
+  cwd?: string;
+  force?: boolean;
+  dryRun?: boolean;
+  config?: BeignetConfig;
+};
+
+/**
+ * Result returned by `beignet make tenancy`.
+ */
+export type MakeTenancyResult = MakeResult;
+
+const workspaceDeferredPortKeys = ["workspaces", "members", "invites"] as const;
+
+const workspacePortEntries = [
+  { key: "workspaces", type: "WorkspaceRepository" },
+  { key: "members", type: "WorkspaceMemberRepository" },
+  { key: "invites", type: "WorkspaceInviteRepository" },
+] as const;
+
+const workspaceRepositoryFactories = [
+  { key: "workspaces", factory: "createDrizzleWorkspaceRepository" },
+  { key: "members", factory: "createDrizzleWorkspaceMemberRepository" },
+  { key: "invites", factory: "createDrizzleWorkspaceInviteRepository" },
+] as const;
+
+const workspaceContractNames = [
+  "listMyWorkspaces",
+  "createWorkspace",
+  "getCurrentWorkspace",
+  "updateWorkspace",
+  "switchWorkspace",
+  "listMembers",
+  "updateMemberRole",
+  "removeMember",
+  "listInvites",
+  "createInvite",
+  "revokeInvite",
+  "acceptInvite",
+] as const;
+
+export async function makeTenancy(
+  options: MakeTenancyOptions,
+): Promise<MakeTenancyResult> {
+  const targetDir = path.resolve(options.cwd ?? process.cwd());
+  const config = options.config
+    ? resolveConfig(options.config)
+    : await loadBeignetConfig(targetDir);
+  const force = Boolean(options.force);
+  const dryRun = Boolean(options.dryRun);
+
+  await assertStandardApp(targetDir, config);
+
+  const persistence = await detectResourcePersistence(targetDir, config);
+  if (persistence !== "drizzle") {
+    throw new Error(
+      "beignet make tenancy expects a Drizzle-backed Beignet app because workspace and membership state must be durable. Add a database provider first, then run make tenancy again.",
+    );
+  }
+
+  const sharedErrorsFile = resourceSharedErrorsPath(config);
+  if (!(await fileExists(path.join(targetDir, sharedErrorsFile)))) {
+    throw new Error(
+      `beignet make tenancy expects the shared error catalog ${sharedErrorsFile}. Restore the generated shared errors file, then run make tenancy again.`,
+    );
+  }
+
+  const database = await detectResourceDatabase(targetDir, config);
+  const hasShell = await detectUiShell(targetDir, config);
+  const workspaceNames = resourceNames("workspaces");
+
+  const generatedFiles: GeneratedFile[] = [
+    ...(await missingCapabilityBuilderFiles(
+      targetDir,
+      "notifications",
+      config,
+    )),
+    ...tenancyFiles(config, database),
+    ...(hasShell ? tenancyUiFiles(config) : []),
+  ];
+
+  // Plan every write before performing any: replaced starter files first
+  // (the D5 replace-or-abort mechanic), then generated files, then all
+  // string-anchor edits with dryRun: true. An anchor miss or divergent file
+  // aborts before the generator touches the app.
+  const replacementPlans: PlannedGeneratedFile[] = [
+    await planReplacedStarterFile(
+      targetDir,
+      { path: tenantHelperPath(config), content: tenancyTenantHelperFile() },
+      serverFiles.tenantHelper,
+      { force, manual: tenantHelperManualInstructions(config) },
+    ),
+    await planReplacedStarterFile(
+      targetDir,
+      { path: serverContextPath(config), content: tenancyServerContextFile() },
+      serverFiles.serverContext,
+      { force, manual: serverContextManualInstructions(config) },
+    ),
+  ];
+  const plannedFiles = await planGeneratedFiles(targetDir, generatedFiles, {
+    force,
+  });
+  const plannedUpdates = await updateTenancyWiring(
+    targetDir,
+    workspaceNames,
+    config,
+    { dryRun: true, hasShell },
+  );
+  const plannedProviderUpdates = (
+    await wirePortProviders(
+      targetDir,
+      config,
+      notificationPortWirings("make tenancy"),
+      { dryRun: true },
+    )
+  ).updatedFiles;
+  const plannedSeedChanges = await registerTenancySeeds(targetDir, config, {
+    dryRun: true,
+  });
+
+  const allPlannedFiles = [...replacementPlans, ...plannedFiles];
+  const createdFiles = allPlannedFiles
+    .filter((file) => file.result === "created")
+    .map((file) => file.path);
+  const updatedFiles = allPlannedFiles
+    .filter((file) => file.result === "updated")
+    .map((file) => file.path);
+  const skippedFiles = allPlannedFiles
+    .filter((file) => file.result === "skipped")
+    .map((file) => file.path);
+
+  if (dryRun) {
+    updatedFiles.push(
+      ...plannedUpdates,
+      ...plannedProviderUpdates,
+      ...plannedSeedChanges.updatedFiles,
+    );
+  } else {
+    for (const file of allPlannedFiles) {
+      await writePlannedGeneratedFile(targetDir, file);
+    }
+
+    updatedFiles.push(
+      ...(await updateTenancyWiring(targetDir, workspaceNames, config, {
+        dryRun: false,
+        hasShell,
+      })),
+    );
+    updatedFiles.push(
+      ...(
+        await wirePortProviders(
+          targetDir,
+          config,
+          notificationPortWirings("make tenancy"),
+          { dryRun: false },
+        )
+      ).updatedFiles,
+    );
+
+    const seedChanges = await registerTenancySeeds(targetDir, config, {
+      dryRun: false,
+    });
+    updatedFiles.push(...seedChanges.updatedFiles);
+  }
+
+  return {
+    schemaVersion: 1,
+    name: "tenancy",
+    targetDir,
+    dryRun,
+    files: uniqueStrings([
+      ...generatedFiles.map((file) => file.path),
+      tenantHelperPath(config),
+      serverContextPath(config),
+    ]),
+    createdFiles: uniqueStrings(createdFiles),
+    updatedFiles: uniqueStrings(updatedFiles),
+    skippedFiles: uniqueStrings(skippedFiles),
+  };
+}
+
+/**
+ * Post-generate guidance lines for `beignet make tenancy`. The CLI command
+ * wraps these in its standard next-steps formatting.
+ */
+export function makeTenancyNextStepLines(): string[] {
+  return [
+    "Run beignet db generate and beignet db migrate so the workspaces, workspace_members, and workspace_invites tables exist.",
+    "Requests resolve the active workspace from memberships and the beignet-workspace cookie; users without a workspace have no tenant, so point them at Settings > Workspace to create one.",
+    "Run the db:seed script for a demo workspace with a sign-in-able demo admin (demo-admin@example.com).",
+    "Invite emails send through the in-memory mailer in development; swap server/providers.ts to a real mail provider such as @beignet/provider-mail-resend for delivery.",
+    "Membership is resolved with one indexed query per authenticated request; add caching around resolveRequestWorkspace if request volume warrants it.",
+    "Run your app's test, lint, and typecheck commands, then beignet lint and beignet doctor.",
+  ];
+}
+
+export function tenantHelperPath(config: ResolvedBeignetConfig): string {
+  return path.posix.join(
+    path.posix.dirname(config.paths.useCaseBuilder),
+    "tenant.ts",
+  );
+}
+
+export function serverContextPath(config: ResolvedBeignetConfig): string {
+  return path.posix.join(path.posix.dirname(config.paths.server), "context.ts");
+}
+
+function tenantHelperManualInstructions(config: ResolvedBeignetConfig): string {
+  return `${tenantHelperPath(config)} has been customized, so make tenancy cannot replace it safely. Re-run with --force to overwrite it, or update it manually: export WORKSPACE_COOKIE_NAME = "beignet-workspace", replace resolveRequestTenant with an async resolveRequestWorkspace({ auth, req, ports }) that loads ports.members.listByUser(auth.user.id), picks the membership matching the cookie (falling back to the first), and returns { tenant: createTenant(workspaceId), membership }, and keep resolveServiceWorkspace(tenantId) for service contexts.`;
+}
+
+function serverContextManualInstructions(
+  config: ResolvedBeignetConfig,
+): string {
+  return `${serverContextPath(config)} has been customized, so make tenancy cannot replace it safely. Re-run with --force to overwrite it, or update it manually: in the request context call const { tenant, membership } = await resolveRequestWorkspace({ auth, req, ports }) from ${tenantHelperPath(config)}, spread the tenant when present, and set membership on the returned context (and membership: null in the service context).`;
+}
+
+/**
+ * Replace-or-abort planning for starter-owned files (D5).
+ *
+ * The current content is byte-compared against the pristine starter template
+ * and against this generator's own output. A match with the generator output
+ * plans a skip (idempotent re-run); a match with the pristine starter (or a
+ * missing file) plans the replacement; anything else aborts with manual
+ * instructions before any file is written. `--force` overrides.
+ */
+export async function planReplacedStarterFile(
+  targetDir: string,
+  file: GeneratedFile,
+  pristineContent: string,
+  options: { force: boolean; manual: string },
+): Promise<PlannedGeneratedFile> {
+  const existing = await readOptionalFile(path.join(targetDir, file.path));
+
+  if (existing === file.content) {
+    return { ...file, result: "skipped" };
+  }
+  if (existing === undefined) {
+    return { ...file, result: "created" };
+  }
+  if (existing === pristineContent || options.force) {
+    return { ...file, result: "updated" };
+  }
+
+  throw new Error(options.manual);
+}
+
+export async function updateTenancyWiring(
+  targetDir: string,
+  workspaceNames: ResourceNames,
+  config: ResolvedBeignetConfig,
+  options: { dryRun: boolean; hasShell: boolean },
+): Promise<string[]> {
+  const updated = new Set<string>();
+  const editOptions = { dryRun: options.dryRun };
+
+  if (await updatePackageJson(targetDir, editOptions)) {
+    updated.add("package.json");
+  }
+  if (await updateAppContextMembership(targetDir, config, editOptions)) {
+    updated.add(config.paths.appContext);
+  }
+  if (await updateWorkspacePortsIndex(targetDir, config, editOptions)) {
+    updated.add(config.paths.ports);
+  }
+  if (
+    await updateWorkspaceInfrastructurePorts(targetDir, config, editOptions)
+  ) {
+    updated.add(config.paths.infrastructurePorts);
+  }
+  if (
+    await updateDrizzleSchemaIndexExports(
+      targetDir,
+      config,
+      {
+        exports: ["workspaceInvites", "workspaceMembers", "workspaces"],
+        module: "./workspaces",
+      },
+      editOptions,
+    )
+  ) {
+    updated.add(drizzleSchemaIndexPath(config));
+  }
+  if (
+    await updateWorkspaceDrizzleRepositories(targetDir, config, editOptions)
+  ) {
+    updated.add(drizzleRepositoriesPath(config));
+  }
+  if (
+    await updateDatabaseProviderPick(
+      targetDir,
+      config,
+      workspaceDeferredPortKeys,
+      editOptions,
+    )
+  ) {
+    updated.add(path.join(infrastructureDir(config), "db/provider.ts"));
+  }
+  if (
+    await updateTransactionPortsPick(
+      targetDir,
+      config,
+      workspaceDeferredPortKeys,
+      "make tenancy",
+      editOptions,
+    )
+  ) {
+    updated.add(
+      path.join(infrastructureDir(config), "db/transaction-ports.ts"),
+    );
+  }
+  if (
+    await updateDatabaseResetTables(
+      targetDir,
+      config,
+      ["workspace_invites", "workspace_members", "workspaces"],
+      editOptions,
+    )
+  ) {
+    updated.add(path.join(infrastructureDir(config), "db/reset.ts"));
+  }
+  if (await updateWorkspaceSharedErrors(targetDir, config, editOptions)) {
+    updated.add(resourceSharedErrorsPath(config));
+  }
+  if (
+    await updateOpenApiRouteContracts(
+      targetDir,
+      config,
+      {
+        contractNames: workspaceContractNames,
+        contractsModule: aliasModule(
+          path.join(config.paths.features, "workspaces/contracts.ts"),
+        ),
+      },
+      editOptions,
+    )
+  ) {
+    updated.add(config.paths.openapiRoute);
+  }
+
+  const routesFile = await updateServerRoutes(
+    targetDir,
+    workspaceNames,
+    config,
+    editOptions,
+  );
+  if (routesFile) updated.add(routesFile);
+
+  if (options.hasShell) {
+    if (await updateSettingsNavigation(targetDir, editOptions)) {
+      updated.add("components/settings-nav.tsx");
+    }
+  }
+
+  return [...updated];
+}
+
+async function registerTenancySeeds(
+  targetDir: string,
+  config: ResolvedBeignetConfig,
+  options: { dryRun: boolean },
+): Promise<{ updatedFiles: string[] }> {
+  const changes = { updatedFiles: [] as string[] };
+
+  if (
+    await updatePackageScripts(
+      targetDir,
+      { "db:seed": `bun ${seedEntrypointPath(config)}` },
+      options,
+    )
+  ) {
+    changes.updatedFiles.push("package.json");
+  }
+
+  return changes;
+}
+
+export async function updateAppContextMembership(
+  targetDir: string,
+  config: ResolvedBeignetConfig,
+  options: { dryRun: boolean },
+): Promise<boolean> {
+  const filePath = path.join(targetDir, config.paths.appContext);
+  const original = await readFile(filePath, "utf8");
+  let next = addNamedTypeImport(
+    original,
+    "WorkspaceMembershipContext",
+    aliasModule(path.join(config.paths.features, "workspaces/policy.ts")),
+  );
+
+  if (!typeHasTopLevelProperty(next, "AppContext", "membership")) {
+    next = insertTypeProperty(
+      next,
+      "AppContext",
+      "membership?: WorkspaceMembershipContext | null;",
+      `Could not find AppContext in ${config.paths.appContext}. Add membership?: WorkspaceMembershipContext | null; manually, or restore the generated app context before running make tenancy.`,
+    );
+  }
+
+  if (next === original) return false;
+  if (!options.dryRun) await writeFile(filePath, next);
+  return true;
+}
+
+export async function updateWorkspacePortsIndex(
+  targetDir: string,
+  config: ResolvedBeignetConfig,
+  options: { dryRun: boolean },
+): Promise<boolean> {
+  const filePath = path.join(targetDir, config.paths.ports);
+  const original = await readFile(filePath, "utf8");
+  let next = original;
+  const portsModule = relativeModule(
+    config.paths.ports,
+    path.join(config.paths.features, "workspaces/ports.ts"),
+  );
+  const policyModule = relativeModule(
+    config.paths.ports,
+    path.join(config.paths.features, "workspaces/policy.ts"),
+  );
+
+  for (const entry of workspacePortEntries) {
+    next = addNamedTypeImport(next, entry.type, portsModule);
+  }
+  next = addNamedTypeImport(next, "workspacePolicy", policyModule);
+
+  for (const entry of workspacePortEntries) {
+    const property = `${entry.key}: ${entry.type};`;
+    if (!typeHasTopLevelProperty(next, "AppPorts", entry.key)) {
+      next = insertTypeProperty(
+        next,
+        "AppPorts",
+        property,
+        `Could not find AppPorts in ${config.paths.ports}. Add ${property} manually, or restore the generated ports file before running make tenancy.`,
+      );
+    }
+    if (
+      typeBodySource(next, "AppTransactionPorts") !== undefined &&
+      !typeHasTopLevelProperty(next, "AppTransactionPorts", entry.key)
+    ) {
+      next = insertTypeProperty(
+        next,
+        "AppTransactionPorts",
+        property,
+        `Could not find AppTransactionPorts in ${config.paths.ports}. Add ${property} manually, or restore the generated ports file before running make tenancy.`,
+      );
+    }
+  }
+
+  next = appendTupleTypeMember(next, "AppGate", "typeof workspacePolicy");
+  next = appendGatePolicyMember(next, "typeof workspacePolicy");
+
+  if (next === original) return false;
+  if (!options.dryRun) await writeFile(filePath, next);
+  return true;
+}
+
+export async function updateWorkspaceInfrastructurePorts(
+  targetDir: string,
+  config: ResolvedBeignetConfig,
+  options: { dryRun: boolean },
+): Promise<boolean> {
+  const filePath = path.join(targetDir, config.paths.infrastructurePorts);
+  const original = await readFile(filePath, "utf8");
+  let next = original;
+
+  for (const portKey of workspaceDeferredPortKeys) {
+    const appended = appendDeferredPortKey(next, portKey);
+    if (appended === next && !new RegExp(`["']${portKey}["']`).test(next)) {
+      throw new Error(
+        `Could not find the deferred port list in ${config.paths.infrastructurePorts}. Add "${portKey}" manually, or restore the generated infrastructure ports file before running make tenancy.`,
+      );
+    }
+    next = appended;
+  }
+
+  const policyModule = relativeModule(
+    config.paths.infrastructurePorts,
+    path.join(config.paths.features, "workspaces/policy.ts"),
+  );
+  next = addNamedImport(next, "workspacePolicy", policyModule);
+  next = appendCreateGatePolicy(
+    next,
+    "workspacePolicy",
+    `Could not find createGate({ policies: [...] }) in ${config.paths.infrastructurePorts}. Add workspacePolicy to the gate policies manually, or restore the generated infrastructure ports file before running make tenancy.`,
+  );
+
+  if (next === original) return false;
+  if (!options.dryRun) await writeFile(filePath, next);
+  return true;
+}
+
+export async function updateWorkspaceDrizzleRepositories(
+  targetDir: string,
+  config: ResolvedBeignetConfig,
+  options: { dryRun: boolean },
+): Promise<boolean> {
+  const file = drizzleRepositoriesPath(config);
+  const filePath = path.join(targetDir, file);
+  if (!(await fileExists(filePath))) return false;
+
+  const original = await readFile(filePath, "utf8");
+  let next = original;
+  const repositoryModule = relativeModule(
+    file,
+    path.join(
+      infrastructureDir(config),
+      "workspaces/drizzle-workspace-repository.ts",
+    ),
+  );
+
+  for (const entry of workspaceRepositoryFactories) {
+    next = addNamedImport(next, entry.factory, repositoryModule);
+  }
+
+  for (const entry of workspaceRepositoryFactories) {
+    const body = createRepositoriesReturnBodySource(next);
+    const property = `${entry.key}: ${entry.factory}(db),`;
+    if (body === undefined) {
+      throw new Error(
+        `Could not find return { in createRepositories in ${file}. Add ${property} manually, or restore the generated repositories file before running make tenancy.`,
+      );
+    }
+    if (!hasTopLevelObjectProperty(body, entry.key)) {
+      next = insertCreateRepositoriesProperty(
+        next,
+        property,
+        `Could not find return { in createRepositories in ${file}. Add ${property} manually, or restore the generated repositories file before running make tenancy.`,
+      );
+    }
+  }
+
+  if (next === original) return false;
+  if (!options.dryRun) await writeFile(filePath, next);
+  return true;
+}
+
+export async function updateWorkspaceSharedErrors(
+  targetDir: string,
+  config: ResolvedBeignetConfig,
+  options: { dryRun: boolean },
+): Promise<boolean> {
+  return appendSharedErrorEntries(
+    targetDir,
+    config,
+    [
+      {
+        name: "WorkspaceNotFound",
+        entry: `WorkspaceNotFound: {
+\t\tcode: "WORKSPACE_NOT_FOUND",
+\t\tstatus: 404,
+\t\tmessage: "Workspace not found",
+\t},`,
+      },
+      {
+        name: "WorkspaceSlugTaken",
+        entry: `WorkspaceSlugTaken: {
+\t\tcode: "WORKSPACE_SLUG_TAKEN",
+\t\tstatus: 409,
+\t\tmessage: "A workspace with this slug already exists",
+\t},`,
+      },
+      {
+        name: "WorkspaceRequired",
+        entry: `WorkspaceRequired: {
+\t\tcode: "WORKSPACE_REQUIRED",
+\t\tstatus: 400,
+\t\tmessage: "An active workspace is required",
+\t},`,
+      },
+      {
+        name: "NotAWorkspaceMember",
+        entry: `NotAWorkspaceMember: {
+\t\tcode: "NOT_A_WORKSPACE_MEMBER",
+\t\tstatus: 403,
+\t\tmessage: "You are not a member of this workspace",
+\t},`,
+      },
+      {
+        name: "LastAdminRemoval",
+        entry: `LastAdminRemoval: {
+\t\tcode: "LAST_ADMIN_REMOVAL",
+\t\tstatus: 409,
+\t\tmessage: "A workspace must keep at least one admin",
+\t},`,
+      },
+      {
+        name: "InviteNotFound",
+        entry: `InviteNotFound: {
+\t\tcode: "INVITE_NOT_FOUND",
+\t\tstatus: 404,
+\t\tmessage: "Invite not found",
+\t},`,
+      },
+      {
+        name: "InviteExpired",
+        entry: `InviteExpired: {
+\t\tcode: "INVITE_EXPIRED",
+\t\tstatus: 410,
+\t\tmessage: "Invite has expired",
+\t},`,
+      },
+      {
+        name: "InviteAlreadyAccepted",
+        entry: `InviteAlreadyAccepted: {
+\t\tcode: "INVITE_ALREADY_ACCEPTED",
+\t\tstatus: 409,
+\t\tmessage: "Invite has already been accepted",
+\t},`,
+      },
+      {
+        name: "IdempotencyConflict",
+        entry: `IdempotencyConflict: {
+\t\tcode: "IDEMPOTENCY_CONFLICT",
+\t\tstatus: 409,
+\t\tmessage: "Idempotency key was already used with a different request",
+\t},`,
+      },
+      {
+        name: "IdempotencyInProgress",
+        entry: `IdempotencyInProgress: {
+\t\tcode: "IDEMPOTENCY_IN_PROGRESS",
+\t\tstatus: 409,
+\t\tmessage: "Idempotency key is already being processed",
+\t},`,
+      },
+    ],
+    "make tenancy",
+    options,
+  );
+}
+
+export async function updateSettingsNavigation(
+  targetDir: string,
+  options: { dryRun: boolean },
+): Promise<boolean> {
+  const file = "components/settings-nav.tsx";
+  const filePath = path.join(targetDir, file);
+  const original = await readOptionalFile(filePath);
+  const manual = `Add { href: "/settings/workspace", label: "Workspace" } and { href: "/settings/members", label: "Members" } to the settingsLinks array in ${file} manually, or restore the generated settings navigation before running make tenancy.`;
+  if (original === undefined) {
+    throw new Error(`Could not find ${file}. ${manual}`);
+  }
+
+  const entries = [
+    { href: "/settings/workspace", label: "Workspace" },
+    { href: "/settings/members", label: "Members" },
+  ].filter((entry) => !original.includes(`"${entry.href}"`));
+  if (entries.length === 0) return false;
+
+  const links = arrayInitializerInfo(original, "settingsLinks");
+  if (!links) {
+    throw new Error(
+      `Could not find the settingsLinks array in ${file}. ${manual}`,
+    );
+  }
+
+  const nextArray = appendToArrayExpression(
+    links.text,
+    entries.map(
+      (entry) => `{ href: "${entry.href}", label: "${entry.label}" }`,
+    ),
+  );
+  const next = `${original.slice(0, links.start)}${nextArray}${original.slice(
+    links.end,
+  )}`;
+
+  if (next === original) return false;
+  if (!options.dryRun) await writeFile(filePath, next);
+  return true;
+}
+
+export function tenancyFiles(
+  config: ResolvedBeignetConfig,
+  database: DatabaseName,
+): GeneratedFile[] {
+  const featureDir = (file: string) =>
+    path.join(config.paths.features, "workspaces", file);
+
+  return [
+    { path: featureDir("schemas.ts"), content: tenancySchemasFile() },
+    { path: featureDir("contracts.ts"), content: tenancyContractsFile() },
+    { path: featureDir("policy.ts"), content: tenancyPolicyFile() },
+    { path: featureDir("ports.ts"), content: tenancyPortsFile() },
+    {
+      path: featureDir("use-cases/current-workspace.ts"),
+      content: currentWorkspaceHelperFile(config),
+    },
+    {
+      path: featureDir("use-cases/create-workspace.ts"),
+      content: createWorkspaceUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/get-current-workspace.ts"),
+      content: getCurrentWorkspaceUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/list-my-workspaces.ts"),
+      content: listMyWorkspacesUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/switch-workspace.ts"),
+      content: switchWorkspaceUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/update-workspace.ts"),
+      content: updateWorkspaceUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/list-members.ts"),
+      content: listMembersUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/update-member-role.ts"),
+      content: updateMemberRoleUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/remove-member.ts"),
+      content: removeMemberUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/list-invites.ts"),
+      content: listInvitesUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/create-invite.ts"),
+      content: createInviteUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/revoke-invite.ts"),
+      content: revokeInviteUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/accept-invite.ts"),
+      content: acceptInviteUseCaseFile(),
+    },
+    {
+      path: featureDir("use-cases/index.ts"),
+      content: tenancyUseCasesIndexFile(),
+    },
+    {
+      path: featureDir("notifications/index.ts"),
+      content: tenancyNotificationsFile(),
+    },
+    { path: featureDir("routes.ts"), content: tenancyRoutesFile(config) },
+    { path: featureDir("seeds/index.ts"), content: tenancySeedsFile(config) },
+    {
+      path: seedEntrypointPath(config),
+      content: tenancyServerSeedFile(config),
+    },
+    {
+      path: featureDir("tests/factories/context.ts"),
+      content: tenancyContextFactoryFile(config),
+    },
+    {
+      path: featureDir("tests/factories/workspace.ts"),
+      content: workspaceFactoryFile(config),
+    },
+    {
+      path: featureDir("tests/factories/workspace-member.ts"),
+      content: workspaceMemberFactoryFile(config),
+    },
+    {
+      path: featureDir("tests/factories/workspace-invite.ts"),
+      content: workspaceInviteFactoryFile(config),
+    },
+    {
+      path: featureDir("tests/membership.test.ts"),
+      content: membershipTestFile(config),
+    },
+    {
+      path: featureDir("tests/invites.test.ts"),
+      content: invitesTestFile(),
+    },
+    {
+      path: featureDir("tests/policy.test.ts"),
+      content: policyTestFile(),
+    },
+    {
+      path: path.join(
+        infrastructureDir(config),
+        "workspaces/drizzle-workspace-repository.ts",
+      ),
+      content: workspaceDrizzleRepositoryFile(config, database),
+    },
+    {
+      path: path.join(infrastructureDir(config), "db/schema/workspaces.ts"),
+      content: workspaceDrizzleSchemaFile(database),
+    },
+  ];
+}
+
+export function tenancyUiFiles(config: ResolvedBeignetConfig): GeneratedFile[] {
+  const featureDir = (file: string) =>
+    path.join(config.paths.features, "workspaces", file);
+
+  return [
+    {
+      path: featureDir("client/queries.ts"),
+      content: workspaceClientQueriesFile(),
+    },
+    {
+      path: featureDir("components/workspace-switcher.tsx"),
+      content: workspaceSwitcherComponentFile(),
+    },
+    {
+      path: featureDir("components/workspace-settings-form.tsx"),
+      content: workspaceSettingsFormComponentFile(),
+    },
+    {
+      path: featureDir("components/invite-form.tsx"),
+      content: inviteFormComponentFile(),
+    },
+    {
+      path: featureDir("components/members-settings.tsx"),
+      content: membersSettingsComponentFile(),
+    },
+    {
+      path: featureDir("components/invite-accept.tsx"),
+      content: inviteAcceptComponentFile(),
+    },
+    {
+      path: featureDir("components/index.ts"),
+      content: workspaceComponentsIndexFile(),
+    },
+    {
+      path: "app/(app)/settings/workspace/page.tsx",
+      content: settingsWorkspacePageFile(),
+    },
+    {
+      path: "app/(app)/settings/members/page.tsx",
+      content: settingsMembersPageFile(),
+    },
+    {
+      path: "app/invites/[token]/page.tsx",
+      content: inviteTokenPageFile(),
+    },
+  ];
+}
+
+export function tenancySchemasFile(): string {
+  return `import { z } from "zod";
+
+export const workspaceRoleSchema = z.enum(["admin", "member"]);
+export const inviteStatusSchema = z.enum([
+\t"pending",
+\t"accepted",
+\t"revoked",
+\t"expired",
+]);
+
+export const workspaceNameSchema = z.string().min(1).max(100);
+export const workspaceSlugSchema = z
+\t.string()
+\t.min(1)
+\t.max(60)
+\t.regex(
+\t\t/^[a-z0-9]+(?:-[a-z0-9]+)*$/,
+\t\t"Slugs are lowercase letters, numbers, and dashes.",
+\t);
+
+export const workspaceSchema = z.object({
+\tid: z.string().min(1),
+\tname: workspaceNameSchema,
+\tslug: workspaceSlugSchema,
+\tcreatedAt: z.string(),
+\tupdatedAt: z.string(),
+});
+
+export const workspaceMemberSchema = z.object({
+\tid: z.string().min(1),
+\tworkspaceId: z.string().min(1),
+\tuserId: z.string().min(1),
+\trole: workspaceRoleSchema,
+\tjoinedAt: z.string(),
+});
+
+export const workspaceMemberWithUserSchema = workspaceMemberSchema.extend({
+\tuser: z.object({
+\t\tid: z.string().min(1),
+\t\tname: z.string(),
+\t\temail: z.string().nullable(),
+\t\timage: z.string().nullable(),
+\t}),
+});
+
+export const workspaceInviteSchema = z.object({
+\tid: z.string().min(1),
+\tworkspaceId: z.string().min(1),
+\temail: z.string().email(),
+\trole: workspaceRoleSchema,
+\ttoken: z.string().min(1),
+\tinvitedByUserId: z.string().min(1),
+\tstatus: inviteStatusSchema,
+\texpiresAt: z.string(),
+\tacceptedAt: z.string().nullable(),
+\tcreatedAt: z.string(),
+});
+
+export const workspaceListItemSchema = workspaceSchema.extend({
+\trole: workspaceRoleSchema,
+});
+
+export const listMyWorkspacesOutputSchema = z.object({
+\titems: z.array(workspaceListItemSchema),
+});
+
+export const createWorkspaceInputSchema = z.object({
+\tname: workspaceNameSchema,
+\tslug: workspaceSlugSchema,
+});
+
+export const updateWorkspaceInputSchema = z
+\t.object({
+\t\tname: workspaceNameSchema.optional(),
+\t\tslug: workspaceSlugSchema.optional(),
+\t})
+\t.refine((value) => value.name !== undefined || value.slug !== undefined, {
+\t\tmessage: "Provide a name or slug to update.",
+\t});
+
+export const membershipContextSchema = z.object({
+\tworkspaceId: z.string().min(1),
+\trole: workspaceRoleSchema,
+});
+
+export const currentWorkspaceOutputSchema = z.object({
+\tworkspace: workspaceSchema.nullable(),
+\tmembership: membershipContextSchema.nullable(),
+});
+
+export const switchWorkspaceInputSchema = z.object({
+\tworkspaceId: z.string().min(1),
+});
+
+export const switchWorkspaceOutputSchema = z.object({
+\tworkspaceId: z.string().min(1),
+});
+
+export const listMembersOutputSchema = z.object({
+\titems: z.array(workspaceMemberWithUserSchema),
+});
+
+export const memberUserIdParamsSchema = z.object({
+\tuserId: z.string().min(1),
+});
+
+export const updateMemberRoleInputSchema = z.object({
+\trole: workspaceRoleSchema,
+});
+
+export const listInvitesOutputSchema = z.object({
+\titems: z.array(workspaceInviteSchema),
+});
+
+export const createInviteInputSchema = z.object({
+\temail: z.string().email(),
+\trole: workspaceRoleSchema.default("member"),
+});
+
+export const inviteIdParamsSchema = z.object({
+\tinviteId: z.string().min(1),
+});
+
+export const inviteTokenParamsSchema = z.object({
+\ttoken: z.string().min(1),
+});
+
+export const acceptInviteOutputSchema = z.object({
+\tworkspace: workspaceSchema,
+\tmembership: workspaceMemberSchema,
+});
+
+export type WorkspaceRole = z.infer<typeof workspaceRoleSchema>;
+export type InviteStatus = z.infer<typeof inviteStatusSchema>;
+export type Workspace = z.infer<typeof workspaceSchema>;
+export type WorkspaceMember = z.infer<typeof workspaceMemberSchema>;
+export type WorkspaceMemberWithUser = z.infer<
+\ttypeof workspaceMemberWithUserSchema
+>;
+export type WorkspaceInvite = z.infer<typeof workspaceInviteSchema>;
+export type WorkspaceListItem = z.infer<typeof workspaceListItemSchema>;
+export type CreateWorkspaceInput = z.infer<typeof createWorkspaceInputSchema>;
+export type UpdateWorkspaceInput = z.infer<typeof updateWorkspaceInputSchema>;
+export type CurrentWorkspaceOutput = z.infer<
+\ttypeof currentWorkspaceOutputSchema
+>;
+export type CreateInviteInput = z.infer<typeof createInviteInputSchema>;
+`;
+}
+
+export function tenancyContractsFile(): string {
+  return `import { defineContractGroup } from "@beignet/core/contracts";
+import { z } from "zod";
+import { errors } from "@/features/shared/errors";
+import {
+\tacceptInviteOutputSchema,
+\tcreateInviteInputSchema,
+\tcreateWorkspaceInputSchema,
+\tcurrentWorkspaceOutputSchema,
+\tinviteIdParamsSchema,
+\tinviteTokenParamsSchema,
+\tlistInvitesOutputSchema,
+\tlistMembersOutputSchema,
+\tlistMyWorkspacesOutputSchema,
+\tmemberUserIdParamsSchema,
+\tswitchWorkspaceInputSchema,
+\tswitchWorkspaceOutputSchema,
+\tupdateMemberRoleInputSchema,
+\tupdateWorkspaceInputSchema,
+\tworkspaceInviteSchema,
+\tworkspaceMemberSchema,
+\tworkspaceSchema,
+} from "@/features/workspaces/schemas";
+
+const ErrorResponseSchema = z.object({
+\tcode: z.string(),
+\tmessage: z.string(),
+\trequestId: z.string().optional(),
+});
+
+const workspaces = defineContractGroup()
+\t.namespace("workspaces")
+\t.prefix("/api/workspaces")
+\t.errors({ Unauthorized: errors.Unauthorized })
+\t.responses({
+\t\t500: ErrorResponseSchema,
+\t});
+
+const idempotencyHeadersSchema = z.object({
+\t"idempotency-key": z.string().min(1),
+});
+
+const idempotentWorkspaces = workspaces.headers(idempotencyHeadersSchema);
+
+const idempotencyMeta = {
+\trequired: true as const,
+\theader: "idempotency-key" as const,
+\tscope: "actor" as const,
+\tttlSec: 86_400,
+};
+
+const idempotencyErrors = {
+\tIdempotencyConflict: errors.IdempotencyConflict,
+\tIdempotencyInProgress: errors.IdempotencyInProgress,
+};
+
+export const listMyWorkspaces = workspaces
+\t.get("/")
+\t.meta({ auth: "required" })
+\t.responses({
+\t\t200: listMyWorkspacesOutputSchema,
+\t})
+\t.openapi({ summary: "List my workspaces", tags: ["workspaces"] });
+
+export const createWorkspace = idempotentWorkspaces
+\t.post("/")
+\t.body(createWorkspaceInputSchema)
+\t.meta({ auth: "required", idempotency: idempotencyMeta })
+\t.errors({
+\t\tWorkspaceSlugTaken: errors.WorkspaceSlugTaken,
+\t\t...idempotencyErrors,
+\t})
+\t.responses({
+\t\t201: workspaceSchema,
+\t})
+\t.openapi({ summary: "Create a workspace", tags: ["workspaces"] });
+
+export const getCurrentWorkspace = workspaces
+\t.get("/current")
+\t.meta({ auth: "required" })
+\t.responses({
+\t\t200: currentWorkspaceOutputSchema,
+\t})
+\t.openapi({ summary: "Get the active workspace", tags: ["workspaces"] });
+
+export const updateWorkspace = workspaces
+\t.put("/current")
+\t.body(updateWorkspaceInputSchema)
+\t.meta({ auth: "required" })
+\t.errors({
+\t\tForbidden: errors.Forbidden,
+\t\tWorkspaceNotFound: errors.WorkspaceNotFound,
+\t\tWorkspaceRequired: errors.WorkspaceRequired,
+\t\tWorkspaceSlugTaken: errors.WorkspaceSlugTaken,
+\t})
+\t.responses({
+\t\t200: workspaceSchema,
+\t})
+\t.openapi({ summary: "Update the active workspace", tags: ["workspaces"] });
+
+export const switchWorkspace = workspaces
+\t.post("/switch")
+\t.body(switchWorkspaceInputSchema)
+\t.meta({ auth: "required" })
+\t.errors({
+\t\tNotAWorkspaceMember: errors.NotAWorkspaceMember,
+\t})
+\t.responses({
+\t\t200: switchWorkspaceOutputSchema,
+\t})
+\t.openapi({ summary: "Switch the active workspace", tags: ["workspaces"] });
+
+export const listMembers = workspaces
+\t.get("/current/members")
+\t.meta({ auth: "required" })
+\t.errors({
+\t\tForbidden: errors.Forbidden,
+\t\tWorkspaceNotFound: errors.WorkspaceNotFound,
+\t\tWorkspaceRequired: errors.WorkspaceRequired,
+\t})
+\t.responses({
+\t\t200: listMembersOutputSchema,
+\t})
+\t.openapi({ summary: "List workspace members", tags: ["workspaces"] });
+
+export const updateMemberRole = workspaces
+\t.put("/current/members/:userId")
+\t.pathParams(memberUserIdParamsSchema)
+\t.body(updateMemberRoleInputSchema)
+\t.meta({ auth: "required" })
+\t.errors({
+\t\tForbidden: errors.Forbidden,
+\t\tLastAdminRemoval: errors.LastAdminRemoval,
+\t\tNotAWorkspaceMember: errors.NotAWorkspaceMember,
+\t\tWorkspaceNotFound: errors.WorkspaceNotFound,
+\t\tWorkspaceRequired: errors.WorkspaceRequired,
+\t})
+\t.responses({
+\t\t200: workspaceMemberSchema,
+\t})
+\t.openapi({ summary: "Change a member's role", tags: ["workspaces"] });
+
+export const removeMember = workspaces
+\t.delete("/current/members/:userId")
+\t.pathParams(memberUserIdParamsSchema)
+\t.meta({ auth: "required" })
+\t.errors({
+\t\tForbidden: errors.Forbidden,
+\t\tLastAdminRemoval: errors.LastAdminRemoval,
+\t\tNotAWorkspaceMember: errors.NotAWorkspaceMember,
+\t\tWorkspaceNotFound: errors.WorkspaceNotFound,
+\t\tWorkspaceRequired: errors.WorkspaceRequired,
+\t})
+\t.responses({
+\t\t204: null,
+\t})
+\t.openapi({ summary: "Remove a workspace member", tags: ["workspaces"] });
+
+export const listInvites = workspaces
+\t.get("/current/invites")
+\t.meta({ auth: "required" })
+\t.errors({
+\t\tForbidden: errors.Forbidden,
+\t\tWorkspaceNotFound: errors.WorkspaceNotFound,
+\t\tWorkspaceRequired: errors.WorkspaceRequired,
+\t})
+\t.responses({
+\t\t200: listInvitesOutputSchema,
+\t})
+\t.openapi({ summary: "List workspace invites", tags: ["workspaces"] });
+
+export const createInvite = idempotentWorkspaces
+\t.post("/current/invites")
+\t.body(createInviteInputSchema)
+\t.meta({ auth: "required", idempotency: idempotencyMeta })
+\t.errors({
+\t\tForbidden: errors.Forbidden,
+\t\tWorkspaceNotFound: errors.WorkspaceNotFound,
+\t\tWorkspaceRequired: errors.WorkspaceRequired,
+\t\t...idempotencyErrors,
+\t})
+\t.responses({
+\t\t201: workspaceInviteSchema,
+\t})
+\t.openapi({ summary: "Invite someone to the workspace", tags: ["workspaces"] });
+
+export const revokeInvite = workspaces
+\t.delete("/current/invites/:inviteId")
+\t.pathParams(inviteIdParamsSchema)
+\t.meta({ auth: "required" })
+\t.errors({
+\t\tForbidden: errors.Forbidden,
+\t\tInviteAlreadyAccepted: errors.InviteAlreadyAccepted,
+\t\tInviteNotFound: errors.InviteNotFound,
+\t\tWorkspaceNotFound: errors.WorkspaceNotFound,
+\t\tWorkspaceRequired: errors.WorkspaceRequired,
+\t})
+\t.responses({
+\t\t200: workspaceInviteSchema,
+\t})
+\t.openapi({ summary: "Revoke a workspace invite", tags: ["workspaces"] });
+
+export const acceptInvite = workspaces
+\t.post("/invites/:token/accept")
+\t.pathParams(inviteTokenParamsSchema)
+\t.meta({ auth: "required" })
+\t.errors({
+\t\tInviteAlreadyAccepted: errors.InviteAlreadyAccepted,
+\t\tInviteExpired: errors.InviteExpired,
+\t\tInviteNotFound: errors.InviteNotFound,
+\t\tWorkspaceNotFound: errors.WorkspaceNotFound,
+\t})
+\t.responses({
+\t\t200: acceptInviteOutputSchema,
+\t})
+\t.openapi({ summary: "Accept a workspace invite", tags: ["workspaces"] });
+`;
+}
+
+export function tenancyPolicyFile(): string {
+  return `import {
+\ttype ActivityActor,
+\ttype ActivityTenant,
+\tdefinePolicy,
+\tdeny,
+} from "@beignet/core/ports";
+import type { Workspace, WorkspaceRole } from "@/features/workspaces/schemas";
+
+/**
+ * Active workspace membership carried on the request context.
+ */
+export type WorkspaceMembershipContext = {
+\tworkspaceId: string;
+\trole: WorkspaceRole;
+};
+
+/**
+ * Authorization context for workspace policies. \`tenant.id\` is the active
+ * workspace id; \`membership\` is the actor's membership in that workspace, or
+ * null when the actor has none.
+ */
+export type AuthorizationContext = {
+\tactor: ActivityActor;
+\ttenant?: ActivityTenant;
+\tmembership?: WorkspaceMembershipContext | null;
+};
+
+export function membershipFor(
+\tctx: AuthorizationContext,
+\tworkspaceId: string,
+): WorkspaceMembershipContext | null {
+\tif (!ctx.membership) return null;
+\treturn ctx.membership.workspaceId === workspaceId ? ctx.membership : null;
+}
+
+export function isWorkspaceMember(
+\tctx: AuthorizationContext,
+\tworkspaceId: string,
+): boolean {
+\treturn membershipFor(ctx, workspaceId) !== null;
+}
+
+export function isWorkspaceAdmin(
+\tctx: AuthorizationContext,
+\tworkspaceId: string,
+): boolean {
+\treturn membershipFor(ctx, workspaceId)?.role === "admin";
+}
+
+function denyNotMember(workspaceId: string) {
+\treturn deny({
+\t\treason: "You are not a member of this workspace.",
+\t\tcode: "NOT_A_WORKSPACE_MEMBER",
+\t\tdetails: { workspaceId },
+\t});
+}
+
+function denyNotAdmin(workspaceId: string) {
+\treturn deny({
+\t\treason: "Only workspace admins can do this.",
+\t\tcode: "WORKSPACE_ADMIN_REQUIRED",
+\t\tdetails: { workspaceId },
+\t});
+}
+
+export const workspacePolicy = definePolicy({
+\t"workspaces.update": (ctx: AuthorizationContext, workspace: Workspace) => {
+\t\tif (!isWorkspaceMember(ctx, workspace.id))
+\t\t\treturn denyNotMember(workspace.id);
+\t\treturn isWorkspaceAdmin(ctx, workspace.id) || denyNotAdmin(workspace.id);
+\t},
+\t"workspaces.members.view": (
+\t\tctx: AuthorizationContext,
+\t\tworkspace: Workspace,
+\t) => {
+\t\treturn isWorkspaceMember(ctx, workspace.id) || denyNotMember(workspace.id);
+\t},
+\t"workspaces.members.manage": (
+\t\tctx: AuthorizationContext,
+\t\tworkspace: Workspace,
+\t) => {
+\t\tif (!isWorkspaceMember(ctx, workspace.id))
+\t\t\treturn denyNotMember(workspace.id);
+\t\treturn isWorkspaceAdmin(ctx, workspace.id) || denyNotAdmin(workspace.id);
+\t},
+});
+`;
+}
+
+export function tenancyPortsFile(): string {
+  return `import type {
+\tInviteStatus,
+\tWorkspace,
+\tWorkspaceInvite,
+\tWorkspaceMember,
+\tWorkspaceMemberWithUser,
+\tWorkspaceRole,
+} from "@/features/workspaces/schemas";
+
+export type {
+\tInviteStatus,
+\tWorkspace,
+\tWorkspaceInvite,
+\tWorkspaceMember,
+\tWorkspaceMemberWithUser,
+\tWorkspaceRole,
+};
+
+export type WorkspaceMembershipLookup = {
+\tworkspaceId: string;
+\tuserId: string;
+};
+
+export interface WorkspaceRepository {
+\tfindById(id: string): Promise<Workspace | null>;
+\tfindBySlug(slug: string): Promise<Workspace | null>;
+\tfindManyByIds(ids: string[]): Promise<Workspace[]>;
+\tcreate(data: { name: string; slug: string }): Promise<Workspace>;
+\tupdate(
+\t\tid: string,
+\t\tdata: { name?: string; slug?: string },
+\t): Promise<Workspace | null>;
+}
+
+export interface WorkspaceMemberRepository {
+\tfindMembership(
+\t\tlookup: WorkspaceMembershipLookup,
+\t): Promise<WorkspaceMember | null>;
+\tlistByUser(userId: string): Promise<WorkspaceMember[]>;
+\tlistByWorkspace(workspaceId: string): Promise<WorkspaceMemberWithUser[]>;
+\tcreate(data: {
+\t\tworkspaceId: string;
+\t\tuserId: string;
+\t\trole: WorkspaceRole;
+\t}): Promise<WorkspaceMember>;
+\tupdateRole(
+\t\tlookup: WorkspaceMembershipLookup,
+\t\trole: WorkspaceRole,
+\t): Promise<WorkspaceMember | null>;
+\tremove(lookup: WorkspaceMembershipLookup): Promise<boolean>;
+\tcountAdmins(workspaceId: string): Promise<number>;
+}
+
+export interface WorkspaceInviteRepository {
+\tfindByToken(token: string): Promise<WorkspaceInvite | null>;
+\tlistByWorkspace(
+\t\tworkspaceId: string,
+\t\tstatus?: InviteStatus,
+\t): Promise<WorkspaceInvite[]>;
+\tcreate(data: {
+\t\tworkspaceId: string;
+\t\temail: string;
+\t\trole: WorkspaceRole;
+\t\ttoken: string;
+\t\tinvitedByUserId: string;
+\t\texpiresAt: string;
+\t}): Promise<WorkspaceInvite>;
+\tupdateStatus(
+\t\tid: string,
+\t\tstatus: InviteStatus,
+\t\tacceptedAt?: string,
+\t): Promise<WorkspaceInvite | null>;
+}
+`;
+}
+
+export function currentWorkspaceHelperFile(
+  config: ResolvedBeignetConfig,
+): string {
+  return `import { requireTenantId } from "@beignet/core/ports";
+import type { AppContext } from "${aliasModule(config.paths.appContext)}";
+import { appError } from "@/features/shared/errors";
+import type { Workspace } from "@/features/workspaces/ports";
+
+/**
+ * Return the active workspace id from the request tenant or throw the
+ * app-owned \`WorkspaceRequired\` error.
+ */
+export function requireWorkspaceId(ctx: AppContext): string {
+\treturn requireTenantId(ctx, {
+\t\terror: () => appError("WorkspaceRequired"),
+\t});
+}
+
+/**
+ * Load the active workspace or throw. Shared by every use case that operates
+ * on "the current workspace" resolved from the request tenant.
+ */
+export async function requireCurrentWorkspace(
+\tctx: AppContext,
+): Promise<Workspace> {
+\tconst workspaceId = requireWorkspaceId(ctx);
+\tconst workspace = await ctx.ports.workspaces.findById(workspaceId);
+
+\tif (!workspace) {
+\t\tthrow appError("WorkspaceNotFound", { details: { workspaceId } });
+\t}
+
+\treturn workspace;
+}
+`;
+}
+
+export function createWorkspaceUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { appError } from "@/features/shared/errors";
+import {
+\tcreateWorkspaceInputSchema,
+\tworkspaceSchema,
+} from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+
+export const createWorkspaceUseCase = useCase
+\t.command("workspaces.create")
+\t.input(createWorkspaceInputSchema)
+\t.output(workspaceSchema)
+\t.run(async ({ ctx, input }) => {
+\t\tconst userId = requireUserId(ctx);
+
+\t\tconst existing = await ctx.ports.workspaces.findBySlug(input.slug);
+\t\tif (existing) {
+\t\t\tthrow appError("WorkspaceSlugTaken", { details: { slug: input.slug } });
+\t\t}
+
+\t\tconst workspace = await ctx.ports.uow.transaction(async (tx) => {
+\t\t\tconst created = await tx.workspaces.create({
+\t\t\t\tname: input.name,
+\t\t\t\tslug: input.slug,
+\t\t\t});
+
+\t\t\tawait tx.members.create({
+\t\t\t\tworkspaceId: created.id,
+\t\t\t\tuserId,
+\t\t\t\trole: "admin",
+\t\t\t});
+
+\t\t\treturn created;
+\t\t});
+
+\t\tctx.ports.logger.info("Workspace created", {
+\t\t\tworkspaceId: workspace.id,
+\t\t\tslug: workspace.slug,
+\t\t});
+
+\t\treturn workspace;
+\t});
+`;
+}
+
+export function getCurrentWorkspaceUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { z } from "zod";
+import { currentWorkspaceOutputSchema } from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+
+/**
+ * Active workspace and membership for the current request. A user with zero
+ * memberships gets a null workspace so the UI can route to workspace
+ * creation.
+ */
+export const getCurrentWorkspaceUseCase = useCase
+\t.query("workspaces.getCurrent")
+\t.input(z.object({}))
+\t.output(currentWorkspaceOutputSchema)
+\t.run(async ({ ctx }) => {
+\t\trequireUserId(ctx);
+
+\t\tconst workspaceId = ctx.tenant?.id;
+\t\tif (!workspaceId) {
+\t\t\treturn { workspace: null, membership: null };
+\t\t}
+
+\t\tconst workspace = await ctx.ports.workspaces.findById(workspaceId);
+\t\tif (!workspace) {
+\t\t\treturn { workspace: null, membership: null };
+\t\t}
+
+\t\treturn { workspace, membership: ctx.membership ?? null };
+\t});
+`;
+}
+
+export function listMyWorkspacesUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { z } from "zod";
+import { listMyWorkspacesOutputSchema } from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+
+export const listMyWorkspacesUseCase = useCase
+\t.query("workspaces.listMine")
+\t.input(z.object({}))
+\t.output(listMyWorkspacesOutputSchema)
+\t.run(async ({ ctx }) => {
+\t\tconst userId = requireUserId(ctx);
+\t\tconst memberships = await ctx.ports.members.listByUser(userId);
+
+\t\tif (memberships.length === 0) {
+\t\t\treturn { items: [] };
+\t\t}
+
+\t\tconst workspaces = await ctx.ports.workspaces.findManyByIds(
+\t\t\tmemberships.map((membership) => membership.workspaceId),
+\t\t);
+\t\tconst workspacesById = new Map(
+\t\t\tworkspaces.map((workspace) => [workspace.id, workspace]),
+\t\t);
+
+\t\treturn {
+\t\t\titems: memberships.flatMap((membership) => {
+\t\t\t\tconst workspace = workspacesById.get(membership.workspaceId);
+\t\t\t\treturn workspace ? [{ ...workspace, role: membership.role }] : [];
+\t\t\t}),
+\t\t};
+\t});
+`;
+}
+
+export function switchWorkspaceUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { appError } from "@/features/shared/errors";
+import {
+\tswitchWorkspaceInputSchema,
+\tswitchWorkspaceOutputSchema,
+} from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+
+/**
+ * Validates that the actor may switch to the requested workspace. The route
+ * owns the response and sets the \`beignet-workspace\` cookie from this result.
+ */
+export const switchWorkspaceUseCase = useCase
+\t.command("workspaces.switch")
+\t.input(switchWorkspaceInputSchema)
+\t.output(switchWorkspaceOutputSchema)
+\t.run(async ({ ctx, input }) => {
+\t\tconst userId = requireUserId(ctx);
+\t\tconst membership = await ctx.ports.members.findMembership({
+\t\t\tworkspaceId: input.workspaceId,
+\t\t\tuserId,
+\t\t});
+
+\t\tif (!membership) {
+\t\t\tthrow appError("NotAWorkspaceMember", {
+\t\t\t\tdetails: { workspaceId: input.workspaceId },
+\t\t\t});
+\t\t}
+
+\t\treturn { workspaceId: input.workspaceId };
+\t});
+`;
+}
+
+export function updateWorkspaceUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { appError } from "@/features/shared/errors";
+import {
+\tupdateWorkspaceInputSchema,
+\tworkspaceSchema,
+} from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+import { requireCurrentWorkspace } from "./current-workspace";
+
+export const updateWorkspaceUseCase = useCase
+\t.command("workspaces.update")
+\t.input(updateWorkspaceInputSchema)
+\t.output(workspaceSchema)
+\t.run(async ({ ctx, input }) => {
+\t\trequireUserId(ctx);
+\t\tconst workspace = await requireCurrentWorkspace(ctx);
+\t\tawait ctx.gate.authorize("workspaces.update", workspace);
+
+\t\tif (input.slug && input.slug !== workspace.slug) {
+\t\t\tconst taken = await ctx.ports.workspaces.findBySlug(input.slug);
+\t\t\tif (taken) {
+\t\t\t\tthrow appError("WorkspaceSlugTaken", { details: { slug: input.slug } });
+\t\t\t}
+\t\t}
+
+\t\tconst updated = await ctx.ports.workspaces.update(workspace.id, {
+\t\t\t...(input.name !== undefined ? { name: input.name } : {}),
+\t\t\t...(input.slug !== undefined ? { slug: input.slug } : {}),
+\t\t});
+
+\t\tif (!updated) {
+\t\t\tthrow appError("WorkspaceNotFound", {
+\t\t\t\tdetails: { workspaceId: workspace.id },
+\t\t\t});
+\t\t}
+
+\t\treturn updated;
+\t});
+`;
+}
+
+export function listMembersUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { z } from "zod";
+import { listMembersOutputSchema } from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+import { requireCurrentWorkspace } from "./current-workspace";
+
+export const listMembersUseCase = useCase
+\t.query("workspaces.members.list")
+\t.input(z.object({}))
+\t.output(listMembersOutputSchema)
+\t.run(async ({ ctx }) => {
+\t\trequireUserId(ctx);
+\t\tconst workspace = await requireCurrentWorkspace(ctx);
+\t\tawait ctx.gate.authorize("workspaces.members.view", workspace);
+
+\t\treturn {
+\t\t\titems: await ctx.ports.members.listByWorkspace(workspace.id),
+\t\t};
+\t});
+`;
+}
+
+export function updateMemberRoleUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { z } from "zod";
+import { appError } from "@/features/shared/errors";
+import {
+\tupdateMemberRoleInputSchema,
+\tworkspaceMemberSchema,
+} from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+import { requireCurrentWorkspace } from "./current-workspace";
+
+const inputSchema = updateMemberRoleInputSchema.extend({
+\tuserId: z.string().min(1),
+});
+
+export const updateMemberRoleUseCase = useCase
+\t.command("workspaces.members.updateRole")
+\t.input(inputSchema)
+\t.output(workspaceMemberSchema)
+\t.run(async ({ ctx, input }) => {
+\t\trequireUserId(ctx);
+\t\tconst workspace = await requireCurrentWorkspace(ctx);
+\t\tawait ctx.gate.authorize("workspaces.members.manage", workspace);
+
+\t\tconst lookup = { workspaceId: workspace.id, userId: input.userId };
+\t\tconst target = await ctx.ports.members.findMembership(lookup);
+\t\tif (!target) {
+\t\t\tthrow appError("NotAWorkspaceMember", { details: lookup });
+\t\t}
+
+\t\tif (target.role === "admin" && input.role !== "admin") {
+\t\t\tconst adminCount = await ctx.ports.members.countAdmins(workspace.id);
+\t\t\tif (adminCount <= 1) {
+\t\t\t\tthrow appError("LastAdminRemoval", { details: lookup });
+\t\t\t}
+\t\t}
+
+\t\tconst updated = await ctx.ports.members.updateRole(lookup, input.role);
+\t\tif (!updated) {
+\t\t\tthrow appError("NotAWorkspaceMember", { details: lookup });
+\t\t}
+
+\t\treturn updated;
+\t});
+`;
+}
+
+export function removeMemberUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { z } from "zod";
+import { appError } from "@/features/shared/errors";
+import { memberUserIdParamsSchema } from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+import { requireCurrentWorkspace } from "./current-workspace";
+
+export const removeMemberUseCase = useCase
+\t.command("workspaces.members.remove")
+\t.input(memberUserIdParamsSchema)
+\t.output(z.void())
+\t.run(async ({ ctx, input }) => {
+\t\trequireUserId(ctx);
+\t\tconst workspace = await requireCurrentWorkspace(ctx);
+\t\tawait ctx.gate.authorize("workspaces.members.manage", workspace);
+
+\t\tconst lookup = { workspaceId: workspace.id, userId: input.userId };
+\t\tconst target = await ctx.ports.members.findMembership(lookup);
+\t\tif (!target) {
+\t\t\tthrow appError("NotAWorkspaceMember", { details: lookup });
+\t\t}
+
+\t\tif (target.role === "admin") {
+\t\t\tconst adminCount = await ctx.ports.members.countAdmins(workspace.id);
+\t\t\tif (adminCount <= 1) {
+\t\t\t\tthrow appError("LastAdminRemoval", { details: lookup });
+\t\t\t}
+\t\t}
+
+\t\tawait ctx.ports.uow.transaction(async (tx) => {
+\t\t\tconst removed = await tx.members.remove(lookup);
+\t\t\tif (!removed) {
+\t\t\t\tthrow appError("NotAWorkspaceMember", { details: lookup });
+\t\t\t}
+\t\t});
+\t});
+`;
+}
+
+export function listInvitesUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { z } from "zod";
+import { listInvitesOutputSchema } from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+import { requireCurrentWorkspace } from "./current-workspace";
+
+export const listInvitesUseCase = useCase
+\t.query("workspaces.invites.list")
+\t.input(z.object({}))
+\t.output(listInvitesOutputSchema)
+\t.run(async ({ ctx }) => {
+\t\trequireUserId(ctx);
+\t\tconst workspace = await requireCurrentWorkspace(ctx);
+\t\tawait ctx.gate.authorize("workspaces.members.manage", workspace);
+
+\t\treturn {
+\t\t\titems: await ctx.ports.invites.listByWorkspace(workspace.id),
+\t\t};
+\t});
+`;
+}
+
+export function createInviteUseCaseFile(): string {
+  return `import { requireUser } from "@beignet/core/ports";
+import { WorkspaceInviteNotification } from "@/features/workspaces/notifications";
+import {
+\tcreateInviteInputSchema,
+\tworkspaceInviteSchema,
+} from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+import { requireCurrentWorkspace } from "./current-workspace";
+
+const INVITE_TTL_MS = 14 * 24 * 60 * 60 * 1000;
+
+export const createInviteUseCase = useCase
+\t.command("workspaces.invites.create")
+\t.input(createInviteInputSchema)
+\t.output(workspaceInviteSchema)
+\t.run(async ({ ctx, input }) => {
+\t\tconst user = requireUser(ctx);
+\t\tconst workspace = await requireCurrentWorkspace(ctx);
+\t\tawait ctx.gate.authorize("workspaces.members.manage", workspace);
+
+\t\tconst token = crypto.randomUUID();
+\t\tconst expiresAt = new Date(Date.now() + INVITE_TTL_MS).toISOString();
+
+\t\tconst invite = await ctx.ports.invites.create({
+\t\t\tworkspaceId: workspace.id,
+\t\t\temail: input.email,
+\t\t\trole: input.role,
+\t\t\ttoken,
+\t\t\tinvitedByUserId: user.id,
+\t\t\texpiresAt,
+\t\t});
+
+\t\tawait ctx.ports.notifications.send(
+\t\t\tWorkspaceInviteNotification,
+\t\t\t{
+\t\t\t\tinviteId: invite.id,
+\t\t\t\tworkspaceId: workspace.id,
+\t\t\t\tworkspaceName: workspace.name,
+\t\t\t\temail: invite.email,
+\t\t\t\trole: invite.role,
+\t\t\t\ttoken: invite.token,
+\t\t\t\tinvitedByName: user.name ?? undefined,
+\t\t\t},
+\t\t\t{
+\t\t\t\trequestId: ctx.requestId,
+\t\t\t\ttraceId: ctx.traceId,
+\t\t\t},
+\t\t);
+
+\t\treturn invite;
+\t});
+`;
+}
+
+export function revokeInviteUseCaseFile(): string {
+  return `import { requireUserId } from "@beignet/core/ports";
+import { appError } from "@/features/shared/errors";
+import {
+\tinviteIdParamsSchema,
+\tworkspaceInviteSchema,
+} from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+import { requireCurrentWorkspace } from "./current-workspace";
+
+export const revokeInviteUseCase = useCase
+\t.command("workspaces.invites.revoke")
+\t.input(inviteIdParamsSchema)
+\t.output(workspaceInviteSchema)
+\t.run(async ({ ctx, input }) => {
+\t\trequireUserId(ctx);
+\t\tconst workspace = await requireCurrentWorkspace(ctx);
+\t\tawait ctx.gate.authorize("workspaces.members.manage", workspace);
+
+\t\tconst invites = await ctx.ports.invites.listByWorkspace(workspace.id);
+\t\tconst invite = invites.find((candidate) => candidate.id === input.inviteId);
+\t\tif (!invite) {
+\t\t\tthrow appError("InviteNotFound", {
+\t\t\t\tdetails: { inviteId: input.inviteId },
+\t\t\t});
+\t\t}
+\t\tif (invite.status === "accepted") {
+\t\t\tthrow appError("InviteAlreadyAccepted", {
+\t\t\t\tdetails: { inviteId: invite.id },
+\t\t\t});
+\t\t}
+
+\t\tconst revoked = await ctx.ports.invites.updateStatus(invite.id, "revoked");
+\t\tif (!revoked) {
+\t\t\tthrow appError("InviteNotFound", { details: { inviteId: invite.id } });
+\t\t}
+
+\t\treturn revoked;
+\t});
+`;
+}
+
+export function acceptInviteUseCaseFile(): string {
+  return `import { requireUser } from "@beignet/core/ports";
+import { appError } from "@/features/shared/errors";
+import {
+\tacceptInviteOutputSchema,
+\tinviteTokenParamsSchema,
+} from "@/features/workspaces/schemas";
+import { useCase } from "@/lib/use-case";
+
+/**
+ * Accept a workspace invite by token. The token is the capability: any
+ * authenticated user holding a pending, unexpired token may join.
+ */
+export const acceptInviteUseCase = useCase
+\t.command("workspaces.invites.accept")
+\t.input(inviteTokenParamsSchema)
+\t.output(acceptInviteOutputSchema)
+\t.run(async ({ ctx, input }) => {
+\t\tconst user = requireUser(ctx);
+
+\t\tconst invite = await ctx.ports.invites.findByToken(input.token);
+\t\tif (!invite) {
+\t\t\tthrow appError("InviteNotFound");
+\t\t}
+\t\tif (invite.status === "accepted") {
+\t\t\tthrow appError("InviteAlreadyAccepted", {
+\t\t\t\tdetails: { inviteId: invite.id },
+\t\t\t});
+\t\t}
+\t\tif (invite.status !== "pending") {
+\t\t\tthrow appError("InviteNotFound", { details: { inviteId: invite.id } });
+\t\t}
+
+\t\tconst now = new Date();
+\t\tif (Date.parse(invite.expiresAt) <= now.getTime()) {
+\t\t\tawait ctx.ports.invites.updateStatus(invite.id, "expired");
+\t\t\tthrow appError("InviteExpired", { details: { inviteId: invite.id } });
+\t\t}
+
+\t\tconst workspace = await ctx.ports.workspaces.findById(invite.workspaceId);
+\t\tif (!workspace) {
+\t\t\tthrow appError("WorkspaceNotFound", {
+\t\t\t\tdetails: { workspaceId: invite.workspaceId },
+\t\t\t});
+\t\t}
+
+\t\tconst existingMembership = await ctx.ports.members.findMembership({
+\t\t\tworkspaceId: workspace.id,
+\t\t\tuserId: user.id,
+\t\t});
+
+\t\tconst membership = await ctx.ports.uow.transaction(async (tx) => {
+\t\t\tconst member =
+\t\t\t\texistingMembership ??
+\t\t\t\t(await tx.members.create({
+\t\t\t\t\tworkspaceId: workspace.id,
+\t\t\t\t\tuserId: user.id,
+\t\t\t\t\trole: invite.role,
+\t\t\t\t}));
+
+\t\t\tconst accepted = await tx.invites.updateStatus(
+\t\t\t\tinvite.id,
+\t\t\t\t"accepted",
+\t\t\t\tnow.toISOString(),
+\t\t\t);
+\t\t\tif (!accepted) {
+\t\t\t\tthrow appError("InviteNotFound", { details: { inviteId: invite.id } });
+\t\t\t}
+
+\t\t\treturn member;
+\t\t});
+
+\t\treturn { workspace, membership };
+\t});
+`;
+}
+
+export function tenancyUseCasesIndexFile(): string {
+  return `export { acceptInviteUseCase } from "./accept-invite";
+export { createInviteUseCase } from "./create-invite";
+export { createWorkspaceUseCase } from "./create-workspace";
+export {
+\trequireCurrentWorkspace,
+\trequireWorkspaceId,
+} from "./current-workspace";
+export { getCurrentWorkspaceUseCase } from "./get-current-workspace";
+export { listInvitesUseCase } from "./list-invites";
+export { listMembersUseCase } from "./list-members";
+export { listMyWorkspacesUseCase } from "./list-my-workspaces";
+export { removeMemberUseCase } from "./remove-member";
+export { revokeInviteUseCase } from "./revoke-invite";
+export { switchWorkspaceUseCase } from "./switch-workspace";
+export { updateMemberRoleUseCase } from "./update-member-role";
+export { updateWorkspaceUseCase } from "./update-workspace";
+`;
+}
+
+export function tenancyNotificationsFile(): string {
+  return `import { defineMailNotificationChannel } from "@beignet/core/notifications";
+import { z } from "zod";
+import { env } from "@/lib/env";
+import { defineNotification } from "@/lib/notifications";
+
+const invitePayloadSchema = z.object({
+\tinviteId: z.string().min(1),
+\tworkspaceId: z.string().min(1),
+\tworkspaceName: z.string().min(1),
+\temail: z.string().email(),
+\trole: z.enum(["admin", "member"]),
+\ttoken: z.string().min(1),
+\tinvitedByName: z.string().optional(),
+});
+
+/**
+ * Invitation email sent to the invited address with the accept link.
+ */
+export const WorkspaceInviteNotification = defineNotification(
+\t"workspaces.invite",
+\t{
+\t\tpayload: invitePayloadSchema,
+\t\tdescription: "Workspace invitation email with the accept link.",
+\t\tchannels: {
+\t\t\temail: defineMailNotificationChannel(({ payload }) => {
+\t\t\t\tconst acceptUrl = \`\${env.APP_URL}/invites/\${encodeURIComponent(payload.token)}\`;
+\t\t\t\tconst inviter = payload.invitedByName ?? "A workspace admin";
+
+\t\t\t\treturn {
+\t\t\t\t\tto: payload.email,
+\t\t\t\t\tsubject: \`You're invited to \${payload.workspaceName}\`,
+\t\t\t\t\ttext: [
+\t\t\t\t\t\t\`\${inviter} invited you to join \${payload.workspaceName} as a \${payload.role}.\`,
+\t\t\t\t\t\t"",
+\t\t\t\t\t\t\`Accept the invite: \${acceptUrl}\`,
+\t\t\t\t\t].join("\\n"),
+\t\t\t\t};
+\t\t\t}),
+\t\t},
+\t},
+);
+`;
+}
+
+export function tenancyRoutesFile(config: ResolvedBeignetConfig): string {
+  const routeFilePath = path.join(
+    config.paths.features,
+    "workspaces/routes.ts",
+  );
+
+  return `import { defineRouteGroup } from "@beignet/next";
+import type { AppContext } from "${relativeModule(routeFilePath, config.paths.appContext)}";
+import * as workspaceContracts from "@/features/workspaces/contracts";
+import * as workspaceUseCases from "@/features/workspaces/use-cases";
+import { WORKSPACE_COOKIE_NAME } from "@/lib/tenant";
+
+const WORKSPACE_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
+
+function workspaceCookie(workspaceId: string): string {
+\treturn [
+\t\t\`\${WORKSPACE_COOKIE_NAME}=\${encodeURIComponent(workspaceId)}\`,
+\t\t"Path=/",
+\t\t"SameSite=Lax",
+\t\t"HttpOnly",
+\t\t\`Max-Age=\${WORKSPACE_COOKIE_MAX_AGE_SECONDS}\`,
+\t].join("; ");
+}
+
+export const workspaceRoutes = defineRouteGroup<AppContext>()({
+\tname: "workspaces",
+\troutes: [
+\t\t{
+\t\t\tcontract: workspaceContracts.listMyWorkspaces,
+\t\t\tuseCase: workspaceUseCases.listMyWorkspacesUseCase,
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.createWorkspace,
+\t\t\tuseCase: workspaceUseCases.createWorkspaceUseCase,
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.getCurrentWorkspace,
+\t\t\tuseCase: workspaceUseCases.getCurrentWorkspaceUseCase,
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.updateWorkspace,
+\t\t\tuseCase: workspaceUseCases.updateWorkspaceUseCase,
+\t\t},
+\t\t// Full \`handle\` escape hatch: the route owns the response so it can set
+\t\t// the active-workspace cookie that \`resolveRequestWorkspace\` reads.
+\t\t{
+\t\t\tcontract: workspaceContracts.switchWorkspace,
+\t\t\thandle: async ({ ctx, body }) => {
+\t\t\t\tconst result = await workspaceUseCases.switchWorkspaceUseCase.run({
+\t\t\t\t\tctx,
+\t\t\t\t\tinput: body,
+\t\t\t\t});
+
+\t\t\t\treturn {
+\t\t\t\t\tstatus: 200,
+\t\t\t\t\theaders: {
+\t\t\t\t\t\t"set-cookie": workspaceCookie(result.workspaceId),
+\t\t\t\t\t},
+\t\t\t\t\tbody: result,
+\t\t\t\t};
+\t\t\t},
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.listMembers,
+\t\t\tuseCase: workspaceUseCases.listMembersUseCase,
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.updateMemberRole,
+\t\t\tuseCase: workspaceUseCases.updateMemberRoleUseCase,
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.removeMember,
+\t\t\tuseCase: workspaceUseCases.removeMemberUseCase,
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.listInvites,
+\t\t\tuseCase: workspaceUseCases.listInvitesUseCase,
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.createInvite,
+\t\t\tuseCase: workspaceUseCases.createInviteUseCase,
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.revokeInvite,
+\t\t\tuseCase: workspaceUseCases.revokeInviteUseCase,
+\t\t},
+\t\t{
+\t\t\tcontract: workspaceContracts.acceptInvite,
+\t\t\tuseCase: workspaceUseCases.acceptInviteUseCase,
+\t\t},
+\t],
+});
+`;
+}
+
+export function tenancySeedsFile(config: ResolvedBeignetConfig): string {
+  return `import { defineSeed, type SeedDef } from "@beignet/core/testing";
+import type { AppContext } from "${aliasModule(config.paths.appContext)}";
+
+export const DEMO_WORKSPACE_SLUG = "demo";
+export const DEMO_ADMIN_EMAIL = "demo-admin@example.com";
+export const DEMO_ADMIN_PASSWORD = "demo-password-1234";
+
+/**
+ * Context the workspace seed runs with: the app service context plus the
+ * Better Auth user id for the demo admin. The composing seed script
+ * (server/seed.ts) creates the user through Better Auth and passes its id,
+ * because user ids are not reachable through app ports.
+ */
+export type WorkspaceSeedContext = AppContext & {
+\tdemoAdminUserId: string;
+};
+
+/**
+ * Demo workspace with the demo admin as its only member. Idempotent: skips
+ * when the demo workspace slug already exists.
+ */
+export const WorkspaceDemoSeed = defineSeed<
+\t"workspaces.demo",
+\tWorkspaceSeedContext
+>("workspaces.demo", {
+\tdescription: "Demo workspace with the demo admin as its only member.",
+\tasync run(ctx) {
+\t\tif (await ctx.ports.workspaces.findBySlug(DEMO_WORKSPACE_SLUG)) {
+\t\t\treturn;
+\t\t}
+
+\t\tconst workspace = await ctx.ports.workspaces.create({
+\t\t\tname: "Demo Workspace",
+\t\t\tslug: DEMO_WORKSPACE_SLUG,
+\t\t});
+\t\tawait ctx.ports.members.create({
+\t\t\tworkspaceId: workspace.id,
+\t\t\tuserId: ctx.demoAdminUserId,
+\t\t\trole: "admin",
+\t\t});
+\t},
+});
+
+export const workspaceSeeds = [
+\tWorkspaceDemoSeed,
+] as const satisfies readonly SeedDef<WorkspaceSeedContext>[];
+`;
+}
+
+export function tenancyServerSeedFile(config: ResolvedBeignetConfig): string {
+  const seedFilePath = seedEntrypointPath(config);
+
+  return `import { createServiceActor } from "@beignet/core/ports";
+import { runSeeds } from "@beignet/core/testing";
+import {
+\tDEMO_ADMIN_EMAIL,
+\tDEMO_ADMIN_PASSWORD,
+\ttype WorkspaceSeedContext,
+\tworkspaceSeeds,
+} from "@/features/workspaces/seeds";
+import { auth } from "@/lib/better-auth";
+import { getServer } from "${relativeModule(seedFilePath, config.paths.server)}";
+
+/**
+ * Demo dataset composition. The demo admin is created through Better Auth so
+ * it owns password hashing and the account rows; the workspace seed receives
+ * the resolved user id through its seed context. Idempotent: rerunning
+ * against a seeded database changes nothing. Other generators and
+ * \`beignet make seed\` append their feature seed registries to this list;
+ * plain \`AppContext\` seeds run fine with the extended workspace context.
+ */
+const seeds = [...workspaceSeeds] as const;
+
+async function ensureDemoAdminUserId(): Promise<string> {
+\ttry {
+\t\tconst signedUp = await auth.api.signUpEmail({
+\t\t\tbody: {
+\t\t\t\temail: DEMO_ADMIN_EMAIL,
+\t\t\t\tname: "Demo Admin",
+\t\t\t\tpassword: DEMO_ADMIN_PASSWORD,
+\t\t\t},
+\t\t});
+\t\treturn signedUp.user.id;
+\t} catch {
+\t\t// The demo admin already exists; sign in with the demo credentials to
+\t\t// resolve its id.
+\t\tconst signedIn = await auth.api.signInEmail({
+\t\t\tbody: {
+\t\t\t\temail: DEMO_ADMIN_EMAIL,
+\t\t\t\tpassword: DEMO_ADMIN_PASSWORD,
+\t\t\t},
+\t\t});
+\t\treturn signedIn.user.id;
+\t}
+}
+
+const demoAdminUserId = await ensureDemoAdminUserId();
+const server = await getServer();
+
+try {
+\tawait server.runServiceContext(
+\t\t{ actor: createServiceActor("beignet-seed") },
+\t\tasync (ctx) => {
+\t\t\tawait runSeeds<WorkspaceSeedContext>({
+\t\t\t\tseeds,
+\t\t\t\tctx: { ...ctx, demoAdminUserId },
+\t\t\t});
+\t\t},
+\t);
+
+\tconsole.log("Database seeded.");
+\tconsole.log(
+\t\t\`Demo admin: \${DEMO_ADMIN_EMAIL} (password "\${DEMO_ADMIN_PASSWORD}")\`,
+\t);
+} finally {
+\tawait server.stop();
+}
+`;
+}
+
+export function tenancyContextFactoryFile(
+  config: ResolvedBeignetConfig,
+): string {
+  return `import { createTenant } from "@beignet/core/ports";
+import {
+\tcreateTestAnonymousActor,
+\tcreateTestUserActor,
+} from "@beignet/core/ports/testing";
+import {
+\tcreateTestContextFactory,
+\tcreateTestPorts,
+\ttype TestPortsFixture,
+} from "@beignet/core/testing";
+import type { AppContext } from "${aliasModule(config.paths.appContext)}";
+import type { WorkspaceMembershipContext } from "@/features/workspaces/policy";
+import type {
+\tWorkspace,
+\tWorkspaceInvite,
+\tWorkspaceInviteRepository,
+\tWorkspaceMember,
+\tWorkspaceMemberRepository,
+\tWorkspaceMemberWithUser,
+\tWorkspaceRepository,
+} from "@/features/workspaces/ports";
+import { appPorts } from "@/infra/app-ports";
+import type { AppTransactionPorts } from "@/ports";
+
+export type MemoryWorkspacePorts = {
+\tworkspaces: WorkspaceRepository;
+\tmembers: WorkspaceMemberRepository;
+\tinvites: WorkspaceInviteRepository;
+};
+
+/**
+ * In-memory implementations of the three workspace repository ports, shared
+ * by the workspace tests and usable from any test that needs tenancy state.
+ */
+export function createMemoryWorkspacePorts(): MemoryWorkspacePorts {
+\tconst workspaces = new Map<string, Workspace>();
+\tconst members = new Map<string, WorkspaceMember>();
+\tconst invites = new Map<string, WorkspaceInvite>();
+\tlet joinSequence = 0;
+
+\tconst memberKey = (lookup: { workspaceId: string; userId: string }) =>
+\t\t\`\${lookup.workspaceId}:\${lookup.userId}\`;
+
+\treturn {
+\t\tworkspaces: {
+\t\t\tasync findById(id) {
+\t\t\t\treturn workspaces.get(id) ?? null;
+\t\t\t},
+\t\t\tasync findBySlug(slug) {
+\t\t\t\treturn (
+\t\t\t\t\t[...workspaces.values()].find(
+\t\t\t\t\t\t(workspace) => workspace.slug === slug,
+\t\t\t\t\t) ?? null
+\t\t\t\t);
+\t\t\t},
+\t\t\tasync findManyByIds(ids) {
+\t\t\t\treturn ids.flatMap((id) => {
+\t\t\t\t\tconst workspace = workspaces.get(id);
+\t\t\t\t\treturn workspace ? [workspace] : [];
+\t\t\t\t});
+\t\t\t},
+\t\t\tasync create(data) {
+\t\t\t\tconst now = new Date().toISOString();
+\t\t\t\tconst workspace: Workspace = {
+\t\t\t\t\tid: crypto.randomUUID(),
+\t\t\t\t\tname: data.name,
+\t\t\t\t\tslug: data.slug,
+\t\t\t\t\tcreatedAt: now,
+\t\t\t\t\tupdatedAt: now,
+\t\t\t\t};
+\t\t\t\tworkspaces.set(workspace.id, workspace);
+\t\t\t\treturn workspace;
+\t\t\t},
+\t\t\tasync update(id, data) {
+\t\t\t\tconst existing = workspaces.get(id);
+\t\t\t\tif (!existing) return null;
+\t\t\t\tconst next: Workspace = {
+\t\t\t\t\t...existing,
+\t\t\t\t\t...(data.name !== undefined ? { name: data.name } : {}),
+\t\t\t\t\t...(data.slug !== undefined ? { slug: data.slug } : {}),
+\t\t\t\t\tupdatedAt: new Date().toISOString(),
+\t\t\t\t};
+\t\t\t\tworkspaces.set(id, next);
+\t\t\t\treturn next;
+\t\t\t},
+\t\t},
+\t\tmembers: {
+\t\t\tasync findMembership(lookup) {
+\t\t\t\treturn members.get(memberKey(lookup)) ?? null;
+\t\t\t},
+\t\t\tasync listByUser(userId) {
+\t\t\t\treturn [...members.values()]
+\t\t\t\t\t.filter((member) => member.userId === userId)
+\t\t\t\t\t.sort((left, right) => left.joinedAt.localeCompare(right.joinedAt));
+\t\t\t},
+\t\t\tasync listByWorkspace(workspaceId) {
+\t\t\t\treturn [...members.values()]
+\t\t\t\t\t.filter((member) => member.workspaceId === workspaceId)
+\t\t\t\t\t.sort((left, right) => left.joinedAt.localeCompare(right.joinedAt))
+\t\t\t\t\t.map(
+\t\t\t\t\t\t(member): WorkspaceMemberWithUser => ({
+\t\t\t\t\t\t\t...member,
+\t\t\t\t\t\t\tuser: {
+\t\t\t\t\t\t\t\tid: member.userId,
+\t\t\t\t\t\t\t\tname: member.userId,
+\t\t\t\t\t\t\t\temail: \`\${member.userId}@example.com\`,
+\t\t\t\t\t\t\t\timage: null,
+\t\t\t\t\t\t\t},
+\t\t\t\t\t\t}),
+\t\t\t\t\t);
+\t\t\t},
+\t\t\tasync create(data) {
+\t\t\t\tjoinSequence += 1;
+\t\t\t\tconst member: WorkspaceMember = {
+\t\t\t\t\tid: crypto.randomUUID(),
+\t\t\t\t\tworkspaceId: data.workspaceId,
+\t\t\t\t\tuserId: data.userId,
+\t\t\t\t\trole: data.role,
+\t\t\t\t\tjoinedAt: new Date(joinSequence).toISOString(),
+\t\t\t\t};
+\t\t\t\tmembers.set(memberKey(data), member);
+\t\t\t\treturn member;
+\t\t\t},
+\t\t\tasync updateRole(lookup, role) {
+\t\t\t\tconst existing = members.get(memberKey(lookup));
+\t\t\t\tif (!existing) return null;
+\t\t\t\tconst next = { ...existing, role };
+\t\t\t\tmembers.set(memberKey(lookup), next);
+\t\t\t\treturn next;
+\t\t\t},
+\t\t\tasync remove(lookup) {
+\t\t\t\treturn members.delete(memberKey(lookup));
+\t\t\t},
+\t\t\tasync countAdmins(workspaceId) {
+\t\t\t\treturn [...members.values()].filter(
+\t\t\t\t\t(member) =>
+\t\t\t\t\t\tmember.workspaceId === workspaceId && member.role === "admin",
+\t\t\t\t).length;
+\t\t\t},
+\t\t},
+\t\tinvites: {
+\t\t\tasync findByToken(token) {
+\t\t\t\treturn (
+\t\t\t\t\t[...invites.values()].find((invite) => invite.token === token) ??
+\t\t\t\t\tnull
+\t\t\t\t);
+\t\t\t},
+\t\t\tasync listByWorkspace(workspaceId, status) {
+\t\t\t\treturn [...invites.values()]
+\t\t\t\t\t.filter(
+\t\t\t\t\t\t(invite) =>
+\t\t\t\t\t\t\tinvite.workspaceId === workspaceId &&
+\t\t\t\t\t\t\t(!status || invite.status === status),
+\t\t\t\t\t)
+\t\t\t\t\t.sort((left, right) =>
+\t\t\t\t\t\tright.createdAt.localeCompare(left.createdAt),
+\t\t\t\t\t);
+\t\t\t},
+\t\t\tasync create(data) {
+\t\t\t\tconst invite: WorkspaceInvite = {
+\t\t\t\t\tid: crypto.randomUUID(),
+\t\t\t\t\tworkspaceId: data.workspaceId,
+\t\t\t\t\temail: data.email,
+\t\t\t\t\trole: data.role,
+\t\t\t\t\ttoken: data.token,
+\t\t\t\t\tinvitedByUserId: data.invitedByUserId,
+\t\t\t\t\tstatus: "pending",
+\t\t\t\t\texpiresAt: data.expiresAt,
+\t\t\t\t\tacceptedAt: null,
+\t\t\t\t\tcreatedAt: new Date().toISOString(),
+\t\t\t\t};
+\t\t\t\tinvites.set(invite.id, invite);
+\t\t\t\treturn invite;
+\t\t\t},
+\t\t\tasync updateStatus(id, status, acceptedAt) {
+\t\t\t\tconst existing = invites.get(id);
+\t\t\t\tif (!existing) return null;
+\t\t\t\tconst next: WorkspaceInvite = {
+\t\t\t\t\t...existing,
+\t\t\t\t\tstatus,
+\t\t\t\t\tacceptedAt: acceptedAt ?? null,
+\t\t\t\t};
+\t\t\t\tinvites.set(id, next);
+\t\t\t\treturn next;
+\t\t\t},
+\t\t},
+\t};
+}
+
+export type WorkspaceContextOptions = {
+\t/** Omit to create an anonymous context. */
+\tuserId?: string;
+\tuserName?: string;
+\tuserEmail?: string;
+\t/** Active workspace (ctx.tenant.id). */
+\tworkspaceId?: string;
+\t/** Membership in the active workspace; defaults to null. */
+\tmembership?: WorkspaceMembershipContext | null;
+};
+
+export type WorkspaceTestFixture = TestPortsFixture<
+\tAppContext["ports"],
+\tAppTransactionPorts
+> & {
+\trepositories: MemoryWorkspacePorts;
+\tcreateContext: (options?: WorkspaceContextOptions) => AppContext;
+};
+
+/**
+ * Use-case fixture: memory workspace repositories, the real app gate, and
+ * memory ports for everything else.
+ */
+export function createWorkspaceFixture(): WorkspaceTestFixture {
+\tconst repositories = createMemoryWorkspacePorts();
+\tconst fixture = createTestPorts<AppContext["ports"], AppTransactionPorts>({
+\t\tbase: appPorts,
+\t\toverrides: {
+\t\t\tgate: appPorts.gate,
+\t\t\t...repositories,
+\t\t},
+\t});
+
+\tconst createContext = (
+\t\toptions: WorkspaceContextOptions = {},
+\t): AppContext => {
+\t\tconst actor = options.userId
+\t\t\t? createTestUserActor(options.userId, {
+\t\t\t\t\tdisplayName: options.userName,
+\t\t\t\t})
+\t\t\t: createTestAnonymousActor();
+\t\tconst factory = createTestContextFactory<AppContext, AppContext["ports"]>({
+\t\t\tports: fixture.ports,
+\t\t\tactor,
+\t\t\ttenant: options.workspaceId ? createTenant(options.workspaceId) : null,
+\t\t\tauth: options.userId
+\t\t\t\t? {
+\t\t\t\t\t\tuser: {
+\t\t\t\t\t\t\tid: options.userId,
+\t\t\t\t\t\t\tname: options.userName ?? options.userId,
+\t\t\t\t\t\t\temail: options.userEmail ?? \`\${options.userId}@example.com\`,
+\t\t\t\t\t\t},
+\t\t\t\t\t\tsession: { id: \`session_\${options.userId}\` },
+\t\t\t\t\t}
+\t\t\t\t: null,
+\t\t\trequestId: "test-request",
+\t\t\ttraceId: "test-trace",
+\t\t\textra: { membership: options.membership ?? null },
+\t\t});
+
+\t\treturn factory();
+\t};
+
+\treturn {
+\t\t...fixture,
+\t\trepositories,
+\t\tcreateContext,
+\t};
+}
+`;
+}
+
+export function workspaceFactoryFile(config: ResolvedBeignetConfig): string {
+  return `import { createFactory } from "@beignet/core/testing";
+import type { AppContext } from "${aliasModule(config.paths.appContext)}";
+import type { Workspace } from "@/features/workspaces/schemas";
+
+/**
+ * Builds full workspace entities for policy tests and persists name + slug
+ * through the workspace repository port.
+ */
+export const workspaceFactory = createFactory<
+\t"workspaces.workspace",
+\tWorkspace,
+\tAppContext,
+\tWorkspace
+>("workspaces.workspace", {
+\tdefaults: ({ sequence, clock }): Workspace => ({
+\t\tid: \`00000000-0000-4000-8000-\${String(sequence).padStart(12, "0")}\`,
+\t\tname: \`Workspace \${sequence}\`,
+\t\tslug: \`workspace-\${sequence}\`,
+\t\tcreatedAt: clock.now().toISOString(),
+\t\tupdatedAt: clock.now().toISOString(),
+\t}),
+\tpersist: (ctx, value) =>
+\t\tctx.ports.workspaces.create({ name: value.name, slug: value.slug }),
+});
+`;
+}
+
+export function workspaceMemberFactoryFile(
+  config: ResolvedBeignetConfig,
+): string {
+  return `import { createFactory } from "@beignet/core/testing";
+import type { AppContext } from "${aliasModule(config.paths.appContext)}";
+import type {
+\tWorkspaceMember,
+\tWorkspaceRole,
+} from "@/features/workspaces/schemas";
+
+type WorkspaceMemberSeed = {
+\tworkspaceId: string;
+\tuserId: string;
+\trole: WorkspaceRole;
+};
+
+export const workspaceMemberFactory = createFactory<
+\t"workspaces.member",
+\tWorkspaceMemberSeed,
+\tAppContext,
+\tWorkspaceMember
+>("workspaces.member", {
+\tdefaults: ({ sequence }): WorkspaceMemberSeed => ({
+\t\tworkspaceId: "workspace-1",
+\t\tuserId: \`user-\${sequence}\`,
+\t\trole: "member",
+\t}),
+\tpersist: (ctx, value) => ctx.ports.members.create(value),
+});
+`;
+}
+
+export function workspaceInviteFactoryFile(
+  config: ResolvedBeignetConfig,
+): string {
+  return `import { createFactory } from "@beignet/core/testing";
+import type { AppContext } from "${aliasModule(config.paths.appContext)}";
+import type {
+\tWorkspaceInvite,
+\tWorkspaceRole,
+} from "@/features/workspaces/schemas";
+
+type WorkspaceInviteSeed = {
+\tworkspaceId: string;
+\temail: string;
+\trole: WorkspaceRole;
+\ttoken: string;
+\tinvitedByUserId: string;
+\texpiresAt: string;
+};
+
+export const workspaceInviteFactory = createFactory<
+\t"workspaces.invite",
+\tWorkspaceInviteSeed,
+\tAppContext,
+\tWorkspaceInvite
+>("workspaces.invite", {
+\tdefaults: ({ sequence, clock }): WorkspaceInviteSeed => ({
+\t\tworkspaceId: "workspace-1",
+\t\temail: \`invitee-\${sequence}@example.com\`,
+\t\trole: "member",
+\t\ttoken: \`invite-token-\${sequence}\`,
+\t\tinvitedByUserId: "user-1",
+\t\texpiresAt: new Date(
+\t\t\tclock.now().getTime() + 14 * 24 * 60 * 60 * 1000,
+\t\t).toISOString(),
+\t}),
+\tpersist: (ctx, value) => ctx.ports.invites.create(value),
+});
+`;
+}
+
+export function membershipTestFile(config: ResolvedBeignetConfig): string {
+  const tenantModule = aliasModule(tenantHelperPath(config));
+
+  return `import { describe, expect, test } from "bun:test";
+import type { AuthSession } from "@/ports/auth";
+import {
+\tcreateWorkspaceUseCase,
+\tlistMyWorkspacesUseCase,
+\tremoveMemberUseCase,
+\tswitchWorkspaceUseCase,
+\tupdateMemberRoleUseCase,
+} from "@/features/workspaces/use-cases";
+import { resolveRequestWorkspace, WORKSPACE_COOKIE_NAME } from "${tenantModule}";
+import { createWorkspaceFixture } from "./factories/context";
+import { workspaceFactory } from "./factories/workspace";
+import { workspaceMemberFactory } from "./factories/workspace-member";
+
+function authFor(userId: string): AuthSession {
+\treturn {
+\t\tuser: { id: userId, name: userId, email: \`\${userId}@example.com\` },
+\t\tsession: { id: \`session_\${userId}\` },
+\t};
+}
+
+describe("createWorkspaceUseCase", () => {
+\ttest("creates the workspace with the creator as admin", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst ctx = fixture.createContext({ userId: "user-amelia" });
+
+\t\tconst workspace = await createWorkspaceUseCase.run({
+\t\t\tctx,
+\t\t\tinput: { name: "Acme", slug: "acme" },
+\t\t});
+
+\t\texpect(workspace).toMatchObject({ name: "Acme", slug: "acme" });
+\t\tawait expect(
+\t\t\tfixture.repositories.members.findMembership({
+\t\t\t\tworkspaceId: workspace.id,
+\t\t\t\tuserId: "user-amelia",
+\t\t\t}),
+\t\t).resolves.toMatchObject({ role: "admin" });
+\t});
+
+\ttest("rejects duplicate slugs", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst ctx = fixture.createContext({ userId: "user-amelia" });
+\t\tawait createWorkspaceUseCase.run({
+\t\t\tctx,
+\t\t\tinput: { name: "Acme", slug: "acme" },
+\t\t});
+
+\t\tawait expect(
+\t\t\tcreateWorkspaceUseCase.run({
+\t\t\t\tctx,
+\t\t\t\tinput: { name: "Acme Again", slug: "acme" },
+\t\t\t}),
+\t\t).rejects.toMatchObject({ code: "WORKSPACE_SLUG_TAKEN", status: 409 });
+\t});
+
+\ttest("requires an authenticated user", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst ctx = fixture.createContext();
+
+\t\tawait expect(
+\t\t\tcreateWorkspaceUseCase.run({
+\t\t\t\tctx,
+\t\t\t\tinput: { name: "Acme", slug: "acme" },
+\t\t\t}),
+\t\t).rejects.toMatchObject({ code: "UNAUTHORIZED" });
+\t});
+});
+
+describe("listMyWorkspacesUseCase", () => {
+\ttest("lists the actor's workspaces with membership roles", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst ctx = fixture.createContext({ userId: "user-amelia" });
+\t\tconst first = await workspaceFactory.create(ctx);
+\t\tconst second = await workspaceFactory.create(ctx);
+\t\tawait workspaceMemberFactory.create(ctx, {
+\t\t\tworkspaceId: first.id,
+\t\t\tuserId: "user-amelia",
+\t\t\trole: "admin",
+\t\t});
+\t\tawait workspaceMemberFactory.create(ctx, {
+\t\t\tworkspaceId: second.id,
+\t\t\tuserId: "user-amelia",
+\t\t\trole: "member",
+\t\t});
+\t\tawait workspaceMemberFactory.create(ctx, {
+\t\t\tworkspaceId: second.id,
+\t\t\tuserId: "user-other",
+\t\t\trole: "admin",
+\t\t});
+
+\t\tconst listed = await listMyWorkspacesUseCase.run({ ctx, input: {} });
+
+\t\texpect(listed.items).toHaveLength(2);
+\t\texpect(listed.items).toEqual(
+\t\t\texpect.arrayContaining([
+\t\t\t\texpect.objectContaining({ id: first.id, role: "admin" }),
+\t\t\t\texpect.objectContaining({ id: second.id, role: "member" }),
+\t\t\t]),
+\t\t);
+\t});
+});
+
+describe("switchWorkspaceUseCase", () => {
+\ttest("allows members and rejects non-members", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst ctx = fixture.createContext({ userId: "user-amelia" });
+\t\tconst workspace = await workspaceFactory.create(ctx);
+\t\tawait workspaceMemberFactory.create(ctx, {
+\t\t\tworkspaceId: workspace.id,
+\t\t\tuserId: "user-amelia",
+\t\t\trole: "member",
+\t\t});
+
+\t\tawait expect(
+\t\t\tswitchWorkspaceUseCase.run({
+\t\t\t\tctx,
+\t\t\t\tinput: { workspaceId: workspace.id },
+\t\t\t}),
+\t\t).resolves.toEqual({ workspaceId: workspace.id });
+
+\t\tconst intruderCtx = fixture.createContext({ userId: "user-intruder" });
+\t\tawait expect(
+\t\t\tswitchWorkspaceUseCase.run({
+\t\t\t\tctx: intruderCtx,
+\t\t\t\tinput: { workspaceId: workspace.id },
+\t\t\t}),
+\t\t).rejects.toMatchObject({ code: "NOT_A_WORKSPACE_MEMBER", status: 403 });
+\t});
+});
+
+describe("resolveRequestWorkspace", () => {
+\ttest("resolves the active workspace from memberships and the cookie", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst ctx = fixture.createContext({ userId: "user-amelia" });
+\t\tconst first = await workspaceFactory.create(ctx);
+\t\tconst second = await workspaceFactory.create(ctx);
+\t\tawait workspaceMemberFactory.create(ctx, {
+\t\t\tworkspaceId: first.id,
+\t\t\tuserId: "user-amelia",
+\t\t\trole: "admin",
+\t\t});
+\t\tawait workspaceMemberFactory.create(ctx, {
+\t\t\tworkspaceId: second.id,
+\t\t\tuserId: "user-amelia",
+\t\t\trole: "member",
+\t\t});
+
+\t\tconst withoutCookie = await resolveRequestWorkspace({
+\t\t\tauth: authFor("user-amelia"),
+\t\t\treq: { headers: new Headers() },
+\t\t\tports: fixture.ports,
+\t\t});
+\t\texpect(withoutCookie.tenant?.id).toBe(first.id);
+\t\texpect(withoutCookie.membership).toMatchObject({
+\t\t\tworkspaceId: first.id,
+\t\t\trole: "admin",
+\t\t});
+
+\t\tconst withCookie = await resolveRequestWorkspace({
+\t\t\tauth: authFor("user-amelia"),
+\t\t\treq: {
+\t\t\t\theaders: new Headers({
+\t\t\t\t\tcookie: \`\${WORKSPACE_COOKIE_NAME}=\${encodeURIComponent(second.id)}\`,
+\t\t\t\t}),
+\t\t\t},
+\t\t\tports: fixture.ports,
+\t\t});
+\t\texpect(withCookie.tenant?.id).toBe(second.id);
+\t\texpect(withCookie.membership).toMatchObject({
+\t\t\tworkspaceId: second.id,
+\t\t\trole: "member",
+\t\t});
+\t});
+
+\ttest("resolves no workspace for anonymous or membership-less users", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+
+\t\tawait expect(
+\t\t\tresolveRequestWorkspace({
+\t\t\t\tauth: null,
+\t\t\t\treq: { headers: new Headers() },
+\t\t\t\tports: fixture.ports,
+\t\t\t}),
+\t\t).resolves.toEqual({ tenant: undefined, membership: null });
+
+\t\tawait expect(
+\t\t\tresolveRequestWorkspace({
+\t\t\t\tauth: authFor("user-lonely"),
+\t\t\t\treq: { headers: new Headers() },
+\t\t\t\tports: fixture.ports,
+\t\t\t}),
+\t\t).resolves.toEqual({ tenant: undefined, membership: null });
+\t});
+});
+
+describe("member management", () => {
+\tasync function seedWorkspace(fixture: ReturnType<typeof createWorkspaceFixture>) {
+\t\tconst seedCtx = fixture.createContext({ userId: "user-admin" });
+\t\tconst workspace = await workspaceFactory.create(seedCtx);
+\t\tawait workspaceMemberFactory.create(seedCtx, {
+\t\t\tworkspaceId: workspace.id,
+\t\t\tuserId: "user-admin",
+\t\t\trole: "admin",
+\t\t});
+\t\tawait workspaceMemberFactory.create(seedCtx, {
+\t\t\tworkspaceId: workspace.id,
+\t\t\tuserId: "user-member",
+\t\t\trole: "member",
+\t\t});
+\t\treturn workspace;
+\t}
+
+\ttest("admins can promote members", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst ctx = fixture.createContext({
+\t\t\tuserId: "user-admin",
+\t\t\tworkspaceId: workspace.id,
+\t\t\tmembership: { workspaceId: workspace.id, role: "admin" },
+\t\t});
+
+\t\tconst updated = await updateMemberRoleUseCase.run({
+\t\t\tctx,
+\t\t\tinput: { userId: "user-member", role: "admin" },
+\t\t});
+
+\t\texpect(updated.role).toBe("admin");
+\t\tawait expect(
+\t\t\tfixture.repositories.members.countAdmins(workspace.id),
+\t\t).resolves.toBe(2);
+\t});
+
+\ttest("refuses to demote or remove the last admin", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst ctx = fixture.createContext({
+\t\t\tuserId: "user-admin",
+\t\t\tworkspaceId: workspace.id,
+\t\t\tmembership: { workspaceId: workspace.id, role: "admin" },
+\t\t});
+
+\t\tawait expect(
+\t\t\tupdateMemberRoleUseCase.run({
+\t\t\t\tctx,
+\t\t\t\tinput: { userId: "user-admin", role: "member" },
+\t\t\t}),
+\t\t).rejects.toMatchObject({ code: "LAST_ADMIN_REMOVAL", status: 409 });
+\t\tawait expect(
+\t\t\tremoveMemberUseCase.run({ ctx, input: { userId: "user-admin" } }),
+\t\t).rejects.toMatchObject({ code: "LAST_ADMIN_REMOVAL", status: 409 });
+\t});
+
+\ttest("members cannot manage roles or remove members", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst ctx = fixture.createContext({
+\t\t\tuserId: "user-member",
+\t\t\tworkspaceId: workspace.id,
+\t\t\tmembership: { workspaceId: workspace.id, role: "member" },
+\t\t});
+
+\t\tawait expect(
+\t\t\tupdateMemberRoleUseCase.run({
+\t\t\t\tctx,
+\t\t\t\tinput: { userId: "user-admin", role: "member" },
+\t\t\t}),
+\t\t).rejects.toMatchObject({ code: "FORBIDDEN", status: 403 });
+\t\tawait expect(
+\t\t\tremoveMemberUseCase.run({ ctx, input: { userId: "user-admin" } }),
+\t\t).rejects.toMatchObject({ code: "FORBIDDEN", status: 403 });
+\t});
+
+\ttest("removes members and rejects unknown targets", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst ctx = fixture.createContext({
+\t\t\tuserId: "user-admin",
+\t\t\tworkspaceId: workspace.id,
+\t\t\tmembership: { workspaceId: workspace.id, role: "admin" },
+\t\t});
+
+\t\tawait removeMemberUseCase.run({ ctx, input: { userId: "user-member" } });
+\t\tawait expect(
+\t\t\tfixture.repositories.members.findMembership({
+\t\t\t\tworkspaceId: workspace.id,
+\t\t\t\tuserId: "user-member",
+\t\t\t}),
+\t\t).resolves.toBeNull();
+
+\t\tawait expect(
+\t\t\tremoveMemberUseCase.run({ ctx, input: { userId: "user-ghost" } }),
+\t\t).rejects.toMatchObject({ code: "NOT_A_WORKSPACE_MEMBER" });
+\t});
+});
+`;
+}
+
+export function invitesTestFile(): string {
+  return `import { describe, expect, test } from "bun:test";
+import { createInvite } from "@/features/workspaces/contracts";
+import {
+\tacceptInviteUseCase,
+\tcreateInviteUseCase,
+\trevokeInviteUseCase,
+} from "@/features/workspaces/use-cases";
+import {
+\tcreateWorkspaceFixture,
+\ttype WorkspaceTestFixture,
+} from "./factories/context";
+import { workspaceFactory } from "./factories/workspace";
+import { workspaceInviteFactory } from "./factories/workspace-invite";
+import { workspaceMemberFactory } from "./factories/workspace-member";
+
+async function seedWorkspace(fixture: WorkspaceTestFixture) {
+\tconst seedCtx = fixture.createContext({ userId: "user-admin" });
+\tconst workspace = await workspaceFactory.create(seedCtx, {
+\t\tname: "Acme",
+\t\tslug: "acme",
+\t});
+\tawait workspaceMemberFactory.create(seedCtx, {
+\t\tworkspaceId: workspace.id,
+\t\tuserId: "user-admin",
+\t\trole: "admin",
+\t});
+\treturn workspace;
+}
+
+describe("createInviteUseCase", () => {
+\ttest("creates a pending invite and sends the invite email", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst ctx = fixture.createContext({
+\t\t\tuserId: "user-admin",
+\t\t\tuserName: "Amelia",
+\t\t\tworkspaceId: workspace.id,
+\t\t\tmembership: { workspaceId: workspace.id, role: "admin" },
+\t\t});
+
+\t\tconst invite = await createInviteUseCase.run({
+\t\t\tctx,
+\t\t\tinput: { email: "taylor@example.com", role: "member" },
+\t\t});
+
+\t\texpect(invite).toMatchObject({
+\t\t\tworkspaceId: workspace.id,
+\t\t\temail: "taylor@example.com",
+\t\t\trole: "member",
+\t\t\tstatus: "pending",
+\t\t\tinvitedByUserId: "user-admin",
+\t\t});
+\t\texpect(invite.token.length).toBeGreaterThan(0);
+
+\t\texpect(fixture.notifications.deliveries).toMatchObject([
+\t\t\t{
+\t\t\t\tnotificationName: "workspaces.invite",
+\t\t\t\tpayload: {
+\t\t\t\t\tinviteId: invite.id,
+\t\t\t\t\tworkspaceName: "Acme",
+\t\t\t\t\temail: "taylor@example.com",
+\t\t\t\t\ttoken: invite.token,
+\t\t\t\t},
+\t\t\t},
+\t\t]);
+\t});
+
+\ttest("denies non-admin members", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst seedCtx = fixture.createContext({ userId: "user-admin" });
+\t\tawait workspaceMemberFactory.create(seedCtx, {
+\t\t\tworkspaceId: workspace.id,
+\t\t\tuserId: "user-member",
+\t\t\trole: "member",
+\t\t});
+\t\tconst ctx = fixture.createContext({
+\t\t\tuserId: "user-member",
+\t\t\tworkspaceId: workspace.id,
+\t\t\tmembership: { workspaceId: workspace.id, role: "member" },
+\t\t});
+
+\t\tawait expect(
+\t\t\tcreateInviteUseCase.run({
+\t\t\t\tctx,
+\t\t\t\tinput: { email: "x@example.com", role: "member" },
+\t\t\t}),
+\t\t).rejects.toMatchObject({ code: "FORBIDDEN", status: 403 });
+\t\texpect(fixture.notifications.deliveries).toHaveLength(0);
+\t});
+
+\ttest("declares required idempotency on the contract", () => {
+\t\texpect(createInvite.metadata.idempotency).toMatchObject({
+\t\t\trequired: true,
+\t\t\tscope: "actor",
+\t\t});
+\t});
+});
+
+describe("acceptInviteUseCase", () => {
+\ttest("creates the membership and marks the invite accepted", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst seedCtx = fixture.createContext({ userId: "user-admin" });
+\t\tconst invite = await workspaceInviteFactory.create(seedCtx, {
+\t\t\tworkspaceId: workspace.id,
+\t\t\temail: "priya@example.com",
+\t\t\tinvitedByUserId: "user-admin",
+\t\t});
+
+\t\tconst ctx = fixture.createContext({
+\t\t\tuserId: "user-priya",
+\t\t\tuserName: "Priya",
+\t\t});
+\t\tconst result = await acceptInviteUseCase.run({
+\t\t\tctx,
+\t\t\tinput: { token: invite.token },
+\t\t});
+
+\t\texpect(result.workspace.id).toBe(workspace.id);
+\t\texpect(result.membership).toMatchObject({
+\t\t\tworkspaceId: workspace.id,
+\t\t\tuserId: "user-priya",
+\t\t\trole: "member",
+\t\t});
+
+\t\tconst reloaded = await fixture.repositories.invites.findByToken(
+\t\t\tinvite.token,
+\t\t);
+\t\texpect(reloaded?.status).toBe("accepted");
+\t\texpect(reloaded?.acceptedAt).not.toBeNull();
+\t});
+
+\ttest("rejects an already accepted invite", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst seedCtx = fixture.createContext({ userId: "user-admin" });
+\t\tconst invite = await workspaceInviteFactory.create(seedCtx, {
+\t\t\tworkspaceId: workspace.id,
+\t\t\tinvitedByUserId: "user-admin",
+\t\t});
+
+\t\tconst ctx = fixture.createContext({ userId: "user-priya" });
+\t\tawait acceptInviteUseCase.run({ ctx, input: { token: invite.token } });
+
+\t\tawait expect(
+\t\t\tacceptInviteUseCase.run({ ctx, input: { token: invite.token } }),
+\t\t).rejects.toMatchObject({ code: "INVITE_ALREADY_ACCEPTED", status: 409 });
+\t});
+
+\ttest("expires stale invites and rejects them", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst seedCtx = fixture.createContext({ userId: "user-admin" });
+\t\tconst invite = await workspaceInviteFactory.create(seedCtx, {
+\t\t\tworkspaceId: workspace.id,
+\t\t\tinvitedByUserId: "user-admin",
+\t\t\texpiresAt: new Date(Date.now() - 1000).toISOString(),
+\t\t});
+
+\t\tconst ctx = fixture.createContext({ userId: "user-priya" });
+\t\tawait expect(
+\t\t\tacceptInviteUseCase.run({ ctx, input: { token: invite.token } }),
+\t\t).rejects.toMatchObject({ code: "INVITE_EXPIRED", status: 410 });
+
+\t\tconst reloaded = await fixture.repositories.invites.findByToken(
+\t\t\tinvite.token,
+\t\t);
+\t\texpect(reloaded?.status).toBe("expired");
+\t});
+
+\ttest("rejects unknown tokens", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst ctx = fixture.createContext({ userId: "user-priya" });
+
+\t\tawait expect(
+\t\t\tacceptInviteUseCase.run({ ctx, input: { token: "nope" } }),
+\t\t).rejects.toMatchObject({ code: "INVITE_NOT_FOUND", status: 404 });
+\t});
+});
+
+describe("revokeInviteUseCase", () => {
+\ttest("revokes pending invites and rejects unknown invites", async () => {
+\t\tconst fixture = createWorkspaceFixture();
+\t\tconst workspace = await seedWorkspace(fixture);
+\t\tconst seedCtx = fixture.createContext({ userId: "user-admin" });
+\t\tconst invite = await workspaceInviteFactory.create(seedCtx, {
+\t\t\tworkspaceId: workspace.id,
+\t\t\tinvitedByUserId: "user-admin",
+\t\t});
+\t\tconst ctx = fixture.createContext({
+\t\t\tuserId: "user-admin",
+\t\t\tworkspaceId: workspace.id,
+\t\t\tmembership: { workspaceId: workspace.id, role: "admin" },
+\t\t});
+
+\t\tconst revoked = await revokeInviteUseCase.run({
+\t\t\tctx,
+\t\t\tinput: { inviteId: invite.id },
+\t\t});
+\t\texpect(revoked.status).toBe("revoked");
+
+\t\tawait expect(
+\t\t\trevokeInviteUseCase.run({ ctx, input: { inviteId: "missing" } }),
+\t\t).rejects.toMatchObject({ code: "INVITE_NOT_FOUND" });
+\t});
+});
+`;
+}
+
+export function policyTestFile(): string {
+  return `import { describe, expect, it } from "bun:test";
+import { createPolicyTester } from "@beignet/core/ports/testing";
+import { workspacePolicy } from "@/features/workspaces/policy";
+import { workspaceFactory } from "./factories/workspace";
+
+const abilities = [
+\t"workspaces.update",
+\t"workspaces.members.view",
+\t"workspaces.members.manage",
+] as const;
+
+describe("workspacePolicy", () => {
+\tit("documents the admin/member/anonymous matrix per ability", async () => {
+\t\tconst tester = createPolicyTester({ policies: [workspacePolicy] });
+\t\tconst workspace = workspaceFactory.build({ id: "ws-1" });
+
+\t\tconst adminCtx = {
+\t\t\tactor: { type: "user" as const, id: "user-admin" },
+\t\t\tmembership: { workspaceId: "ws-1", role: "admin" as const },
+\t\t};
+\t\tconst memberCtx = {
+\t\t\tactor: { type: "user" as const, id: "user-member" },
+\t\t\tmembership: { workspaceId: "ws-1", role: "member" as const },
+\t\t};
+\t\tconst otherWorkspaceCtx = {
+\t\t\tactor: { type: "user" as const, id: "user-other" },
+\t\t\tmembership: { workspaceId: "ws-2", role: "admin" as const },
+\t\t};
+\t\tconst anonymousCtx = {
+\t\t\tactor: { type: "anonymous" as const },
+\t\t\tmembership: null,
+\t\t};
+
+\t\tawait expect(
+\t\t\ttester.assertMatrix([
+\t\t\t\t// Admin-only abilities.
+\t\t\t\t...(
+\t\t\t\t\t["workspaces.update", "workspaces.members.manage"] as const
+\t\t\t\t).flatMap((ability) => [
+\t\t\t\t\t{
+\t\t\t\t\t\tname: \`admins are allowed \${ability}\`,
+\t\t\t\t\t\tctx: adminCtx,
+\t\t\t\t\t\tability,
+\t\t\t\t\t\tsubject: workspace,
+\t\t\t\t\t\texpected: "allow" as const,
+\t\t\t\t\t},
+\t\t\t\t\t{
+\t\t\t\t\t\tname: \`members are denied \${ability}\`,
+\t\t\t\t\t\tctx: memberCtx,
+\t\t\t\t\t\tability,
+\t\t\t\t\t\tsubject: workspace,
+\t\t\t\t\t\texpected: "deny" as const,
+\t\t\t\t\t\tcode: "WORKSPACE_ADMIN_REQUIRED",
+\t\t\t\t\t},
+\t\t\t\t]),
+\t\t\t\t// Any member may view members.
+\t\t\t\t{
+\t\t\t\t\tname: "members can view members",
+\t\t\t\t\tctx: memberCtx,
+\t\t\t\t\tability: "workspaces.members.view",
+\t\t\t\t\tsubject: workspace,
+\t\t\t\t\texpected: "allow",
+\t\t\t\t},
+\t\t\t\t// Cross-workspace admins and anonymous visitors are non-members.
+\t\t\t\t...abilities.flatMap((ability) => [
+\t\t\t\t\t{
+\t\t\t\t\t\tname: \`another workspace's admin is denied \${ability}\`,
+\t\t\t\t\t\tctx: otherWorkspaceCtx,
+\t\t\t\t\t\tability,
+\t\t\t\t\t\tsubject: workspace,
+\t\t\t\t\t\texpected: "deny" as const,
+\t\t\t\t\t\tcode: "NOT_A_WORKSPACE_MEMBER",
+\t\t\t\t\t},
+\t\t\t\t\t{
+\t\t\t\t\t\tname: \`anonymous visitors are denied \${ability}\`,
+\t\t\t\t\t\tctx: anonymousCtx,
+\t\t\t\t\t\tability,
+\t\t\t\t\t\tsubject: workspace,
+\t\t\t\t\t\texpected: "deny" as const,
+\t\t\t\t\t\tcode: "NOT_A_WORKSPACE_MEMBER",
+\t\t\t\t\t},
+\t\t\t\t]),
+\t\t\t]),
+\t\t).resolves.toBeUndefined();
+\t});
+});
+`;
+}
+
+export function workspaceDrizzleSchemaFile(database: DatabaseName): string {
+  const dialect = drizzleDialects[database];
+  const column =
+    database === "mysql"
+      ? (columnName: string) => `varchar("${columnName}", { length: 255 })`
+      : (columnName: string) => `text("${columnName}")`;
+  const imports =
+    database === "mysql"
+      ? "index, mysqlTable, uniqueIndex, varchar"
+      : `index, ${dialect.tableFunction}, text, uniqueIndex`;
+
+  return `import { ${imports} } from "${dialect.columnModule}";
+import type {
+\tInviteStatus,
+\tWorkspaceRole,
+} from "@/features/workspaces/schemas";
+
+export const workspaces = ${dialect.tableFunction}(
+\t"workspaces",
+\t{
+\t\tid: ${column("id")}.primaryKey(),
+\t\tname: ${column("name")}.notNull(),
+\t\tslug: ${column("slug")}.notNull(),
+\t\tcreatedAt: ${column("created_at")}.notNull(),
+\t\tupdatedAt: ${column("updated_at")}.notNull(),
+\t},
+\t(table) => ({
+\t\tslugUnique: uniqueIndex("workspaces_slug_unique").on(table.slug),
+\t}),
+);
+
+export const workspaceMembers = ${dialect.tableFunction}(
+\t"workspace_members",
+\t{
+\t\tid: ${column("id")}.primaryKey(),
+\t\tworkspaceId: ${column("workspace_id")}.notNull(),
+\t\tuserId: ${column("user_id")}.notNull(),
+\t\trole: ${column("role")}.$type<WorkspaceRole>().notNull(),
+\t\tjoinedAt: ${column("joined_at")}.notNull(),
+\t},
+\t(table) => ({
+\t\tworkspaceUserUnique: uniqueIndex(
+\t\t\t"workspace_members_workspace_user_unique",
+\t\t).on(table.workspaceId, table.userId),
+\t\tuserIdx: index("workspace_members_user_idx").on(table.userId),
+\t}),
+);
+
+export const workspaceInvites = ${dialect.tableFunction}(
+\t"workspace_invites",
+\t{
+\t\tid: ${column("id")}.primaryKey(),
+\t\tworkspaceId: ${column("workspace_id")}.notNull(),
+\t\temail: ${column("email")}.notNull(),
+\t\trole: ${column("role")}.$type<WorkspaceRole>().notNull(),
+\t\ttoken: ${column("token")}.notNull(),
+\t\tinvitedByUserId: ${column("invited_by_user_id")}.notNull(),
+\t\tstatus: ${column("status")}.$type<InviteStatus>().notNull(),
+\t\texpiresAt: ${column("expires_at")}.notNull(),
+\t\tacceptedAt: ${column("accepted_at")},
+\t\tcreatedAt: ${column("created_at")}.notNull(),
+\t},
+\t(table) => ({
+\t\ttokenUnique: uniqueIndex("workspace_invites_token_unique").on(
+\t\t\ttable.token,
+\t\t),
+\t\tworkspaceStatusIdx: index("workspace_invites_workspace_status_idx").on(
+\t\t\ttable.workspaceId,
+\t\t\ttable.status,
+\t\t),
+\t}),
+);
+`;
+}
+
+export function workspaceDrizzleRepositoryFile(
+  config: ResolvedBeignetConfig,
+  database: DatabaseName,
+): string {
+  const dialect = drizzleDialects[database];
+  const portsModule = aliasModule(
+    path.join(config.paths.features, "workspaces/ports.ts"),
+  );
+
+  const workspaceCreate = dialect.supportsReturning
+    ? `\t\t\tconst [row] = await db
+\t\t\t\t.insert(schema.workspaces)
+\t\t\t\t.values(values)
+\t\t\t\t.returning();
+
+\t\t\tif (!row) {
+\t\t\t\tthrow new Error("Failed to create workspace.");
+\t\t\t}
+
+\t\t\treturn toWorkspace(row);`
+    : `\t\t\tawait db.insert(schema.workspaces).values(values);
+
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaces)
+\t\t\t\t.where(eq(schema.workspaces.id, values.id))
+\t\t\t\t.limit(1);
+
+\t\t\tif (!row) {
+\t\t\t\tthrow new Error("Failed to create workspace.");
+\t\t\t}
+
+\t\t\treturn toWorkspace(row);`;
+
+  const workspaceUpdate = dialect.supportsReturning
+    ? `\t\t\tconst [row] = await db
+\t\t\t\t.update(schema.workspaces)
+\t\t\t\t.set(updates)
+\t\t\t\t.where(eq(schema.workspaces.id, id))
+\t\t\t\t.returning();
+
+\t\t\treturn row ? toWorkspace(row) : null;`
+    : `\t\t\tawait db
+\t\t\t\t.update(schema.workspaces)
+\t\t\t\t.set(updates)
+\t\t\t\t.where(eq(schema.workspaces.id, id));
+
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaces)
+\t\t\t\t.where(eq(schema.workspaces.id, id))
+\t\t\t\t.limit(1);
+
+\t\t\treturn row ? toWorkspace(row) : null;`;
+
+  const memberCreate = dialect.supportsReturning
+    ? `\t\t\tconst [row] = await db
+\t\t\t\t.insert(schema.workspaceMembers)
+\t\t\t\t.values(values)
+\t\t\t\t.returning();
+
+\t\t\tif (!row) {
+\t\t\t\tthrow new Error("Failed to create workspace membership.");
+\t\t\t}
+
+\t\t\treturn toMember(row);`
+    : `\t\t\tawait db.insert(schema.workspaceMembers).values(values);
+
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaceMembers)
+\t\t\t\t.where(eq(schema.workspaceMembers.id, values.id))
+\t\t\t\t.limit(1);
+
+\t\t\tif (!row) {
+\t\t\t\tthrow new Error("Failed to create workspace membership.");
+\t\t\t}
+
+\t\t\treturn toMember(row);`;
+
+  const memberUpdateRole = dialect.supportsReturning
+    ? `\t\t\tconst [row] = await db
+\t\t\t\t.update(schema.workspaceMembers)
+\t\t\t\t.set({ role })
+\t\t\t\t.where(membershipWhere(lookup))
+\t\t\t\t.returning();
+
+\t\t\treturn row ? toMember(row) : null;`
+    : `\t\t\tawait db
+\t\t\t\t.update(schema.workspaceMembers)
+\t\t\t\t.set({ role })
+\t\t\t\t.where(membershipWhere(lookup));
+
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaceMembers)
+\t\t\t\t.where(membershipWhere(lookup))
+\t\t\t\t.limit(1);
+
+\t\t\treturn row ? toMember(row) : null;`;
+
+  const memberRemove = dialect.supportsReturning
+    ? `\t\t\tconst rows = await db
+\t\t\t\t.delete(schema.workspaceMembers)
+\t\t\t\t.where(membershipWhere(lookup))
+\t\t\t\t.returning({ id: schema.workspaceMembers.id });
+
+\t\t\treturn rows.length > 0;`
+    : `\t\t\tconst [existing] = await db
+\t\t\t\t.select({ id: schema.workspaceMembers.id })
+\t\t\t\t.from(schema.workspaceMembers)
+\t\t\t\t.where(membershipWhere(lookup))
+\t\t\t\t.limit(1);
+\t\t\tif (!existing) return false;
+
+\t\t\tawait db
+\t\t\t\t.delete(schema.workspaceMembers)
+\t\t\t\t.where(membershipWhere(lookup));
+
+\t\t\treturn true;`;
+
+  const inviteCreate = dialect.supportsReturning
+    ? `\t\t\tconst [row] = await db
+\t\t\t\t.insert(schema.workspaceInvites)
+\t\t\t\t.values(values)
+\t\t\t\t.returning();
+
+\t\t\tif (!row) {
+\t\t\t\tthrow new Error("Failed to create workspace invite.");
+\t\t\t}
+
+\t\t\treturn toInvite(row);`
+    : `\t\t\tawait db.insert(schema.workspaceInvites).values(values);
+
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaceInvites)
+\t\t\t\t.where(eq(schema.workspaceInvites.id, values.id))
+\t\t\t\t.limit(1);
+
+\t\t\tif (!row) {
+\t\t\t\tthrow new Error("Failed to create workspace invite.");
+\t\t\t}
+
+\t\t\treturn toInvite(row);`;
+
+  const inviteUpdateStatus = dialect.supportsReturning
+    ? `\t\t\tconst [row] = await db
+\t\t\t\t.update(schema.workspaceInvites)
+\t\t\t\t.set({ status, acceptedAt: acceptedAt ?? null })
+\t\t\t\t.where(eq(schema.workspaceInvites.id, id))
+\t\t\t\t.returning();
+
+\t\t\treturn row ? toInvite(row) : null;`
+    : `\t\t\tawait db
+\t\t\t\t.update(schema.workspaceInvites)
+\t\t\t\t.set({ status, acceptedAt: acceptedAt ?? null })
+\t\t\t\t.where(eq(schema.workspaceInvites.id, id));
+
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaceInvites)
+\t\t\t\t.where(eq(schema.workspaceInvites.id, id))
+\t\t\t\t.limit(1);
+
+\t\t\treturn row ? toInvite(row) : null;`;
+
+  return `import type { ${dialect.dbTypeName} } from "@beignet/provider-db-drizzle/${dialect.subpath}";
+import { and, asc, count, desc, eq, inArray } from "drizzle-orm";
+import type {
+\tWorkspace,
+\tWorkspaceInvite,
+\tWorkspaceInviteRepository,
+\tWorkspaceMember,
+\tWorkspaceMemberRepository,
+\tWorkspaceMembershipLookup,
+\tWorkspaceMemberWithUser,
+\tWorkspaceRepository,
+} from "${portsModule}";
+import * as schema from "@/infra/db/schema";
+
+type WorkspaceRow = typeof schema.workspaces.$inferSelect;
+type MemberRow = typeof schema.workspaceMembers.$inferSelect;
+type InviteRow = typeof schema.workspaceInvites.$inferSelect;
+
+function toWorkspace(row: WorkspaceRow): Workspace {
+\treturn {
+\t\tid: row.id,
+\t\tname: row.name,
+\t\tslug: row.slug,
+\t\tcreatedAt: row.createdAt,
+\t\tupdatedAt: row.updatedAt,
+\t};
+}
+
+function toMember(row: MemberRow): WorkspaceMember {
+\treturn {
+\t\tid: row.id,
+\t\tworkspaceId: row.workspaceId,
+\t\tuserId: row.userId,
+\t\trole: row.role,
+\t\tjoinedAt: row.joinedAt,
+\t};
+}
+
+function toInvite(row: InviteRow): WorkspaceInvite {
+\treturn {
+\t\tid: row.id,
+\t\tworkspaceId: row.workspaceId,
+\t\temail: row.email,
+\t\trole: row.role,
+\t\ttoken: row.token,
+\t\tinvitedByUserId: row.invitedByUserId,
+\t\tstatus: row.status,
+\t\texpiresAt: row.expiresAt,
+\t\tacceptedAt: row.acceptedAt,
+\t\tcreatedAt: row.createdAt,
+\t};
+}
+
+function membershipWhere(lookup: WorkspaceMembershipLookup) {
+\treturn and(
+\t\teq(schema.workspaceMembers.workspaceId, lookup.workspaceId),
+\t\teq(schema.workspaceMembers.userId, lookup.userId),
+\t);
+}
+
+export function createDrizzleWorkspaceRepository(
+\tdb: ${dialect.dbTypeName}<typeof schema>,
+): WorkspaceRepository {
+\treturn {
+\t\tasync findById(id) {
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaces)
+\t\t\t\t.where(eq(schema.workspaces.id, id))
+\t\t\t\t.limit(1);
+
+\t\t\treturn row ? toWorkspace(row) : null;
+\t\t},
+
+\t\tasync findBySlug(slug) {
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaces)
+\t\t\t\t.where(eq(schema.workspaces.slug, slug))
+\t\t\t\t.limit(1);
+
+\t\t\treturn row ? toWorkspace(row) : null;
+\t\t},
+
+\t\tasync findManyByIds(ids) {
+\t\t\tif (ids.length === 0) return [];
+
+\t\t\tconst rows = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaces)
+\t\t\t\t.where(inArray(schema.workspaces.id, ids));
+
+\t\t\treturn rows.map(toWorkspace);
+\t\t},
+
+\t\tasync create(data) {
+\t\t\tconst now = new Date().toISOString();
+\t\t\tconst values = {
+\t\t\t\tid: crypto.randomUUID(),
+\t\t\t\tname: data.name,
+\t\t\t\tslug: data.slug,
+\t\t\t\tcreatedAt: now,
+\t\t\t\tupdatedAt: now,
+\t\t\t};
+
+${workspaceCreate}
+\t\t},
+
+\t\tasync update(id, data) {
+\t\t\tconst updates: Partial<typeof schema.workspaces.$inferInsert> = {
+\t\t\t\tupdatedAt: new Date().toISOString(),
+\t\t\t};
+\t\t\tif (data.name !== undefined) updates.name = data.name;
+\t\t\tif (data.slug !== undefined) updates.slug = data.slug;
+
+${workspaceUpdate}
+\t\t},
+\t};
+}
+
+export function createDrizzleWorkspaceMemberRepository(
+\tdb: ${dialect.dbTypeName}<typeof schema>,
+): WorkspaceMemberRepository {
+\treturn {
+\t\tasync findMembership(lookup) {
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaceMembers)
+\t\t\t\t.where(membershipWhere(lookup))
+\t\t\t\t.limit(1);
+
+\t\t\treturn row ? toMember(row) : null;
+\t\t},
+
+\t\tasync listByUser(userId) {
+\t\t\tconst rows = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaceMembers)
+\t\t\t\t.where(eq(schema.workspaceMembers.userId, userId))
+\t\t\t\t.orderBy(asc(schema.workspaceMembers.joinedAt));
+
+\t\t\treturn rows.map(toMember);
+\t\t},
+
+\t\tasync listByWorkspace(workspaceId) {
+\t\t\tconst rows = await db
+\t\t\t\t.select({
+\t\t\t\t\tmember: schema.workspaceMembers,
+\t\t\t\t\tuser: {
+\t\t\t\t\t\tid: schema.user.id,
+\t\t\t\t\t\tname: schema.user.name,
+\t\t\t\t\t\temail: schema.user.email,
+\t\t\t\t\t\timage: schema.user.image,
+\t\t\t\t\t},
+\t\t\t\t})
+\t\t\t\t.from(schema.workspaceMembers)
+\t\t\t\t.innerJoin(
+\t\t\t\t\tschema.user,
+\t\t\t\t\teq(schema.workspaceMembers.userId, schema.user.id),
+\t\t\t\t)
+\t\t\t\t.where(eq(schema.workspaceMembers.workspaceId, workspaceId))
+\t\t\t\t.orderBy(asc(schema.workspaceMembers.joinedAt));
+
+\t\t\treturn rows.map(
+\t\t\t\t(row): WorkspaceMemberWithUser => ({
+\t\t\t\t\t...toMember(row.member),
+\t\t\t\t\tuser: {
+\t\t\t\t\t\tid: row.user.id,
+\t\t\t\t\t\tname: row.user.name,
+\t\t\t\t\t\temail: row.user.email,
+\t\t\t\t\t\timage: row.user.image,
+\t\t\t\t\t},
+\t\t\t\t}),
+\t\t\t);
+\t\t},
+
+\t\tasync create(data) {
+\t\t\tconst values = {
+\t\t\t\tid: crypto.randomUUID(),
+\t\t\t\tworkspaceId: data.workspaceId,
+\t\t\t\tuserId: data.userId,
+\t\t\t\trole: data.role,
+\t\t\t\tjoinedAt: new Date().toISOString(),
+\t\t\t};
+
+${memberCreate}
+\t\t},
+
+\t\tasync updateRole(lookup, role) {
+${memberUpdateRole}
+\t\t},
+
+\t\tasync remove(lookup) {
+${memberRemove}
+\t\t},
+
+\t\tasync countAdmins(workspaceId) {
+\t\t\tconst [row] = await db
+\t\t\t\t.select({ total: count() })
+\t\t\t\t.from(schema.workspaceMembers)
+\t\t\t\t.where(
+\t\t\t\t\tand(
+\t\t\t\t\t\teq(schema.workspaceMembers.workspaceId, workspaceId),
+\t\t\t\t\t\teq(schema.workspaceMembers.role, "admin"),
+\t\t\t\t\t),
+\t\t\t\t);
+
+\t\t\treturn row?.total ?? 0;
+\t\t},
+\t};
+}
+
+export function createDrizzleWorkspaceInviteRepository(
+\tdb: ${dialect.dbTypeName}<typeof schema>,
+): WorkspaceInviteRepository {
+\treturn {
+\t\tasync findByToken(token) {
+\t\t\tconst [row] = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaceInvites)
+\t\t\t\t.where(eq(schema.workspaceInvites.token, token))
+\t\t\t\t.limit(1);
+
+\t\t\treturn row ? toInvite(row) : null;
+\t\t},
+
+\t\tasync listByWorkspace(workspaceId, status) {
+\t\t\tconst where = status
+\t\t\t\t? and(
+\t\t\t\t\t\teq(schema.workspaceInvites.workspaceId, workspaceId),
+\t\t\t\t\t\teq(schema.workspaceInvites.status, status),
+\t\t\t\t\t)
+\t\t\t\t: eq(schema.workspaceInvites.workspaceId, workspaceId);
+
+\t\t\tconst rows = await db
+\t\t\t\t.select()
+\t\t\t\t.from(schema.workspaceInvites)
+\t\t\t\t.where(where)
+\t\t\t\t.orderBy(desc(schema.workspaceInvites.createdAt));
+
+\t\t\treturn rows.map(toInvite);
+\t\t},
+
+\t\tasync create(data) {
+\t\t\tconst values = {
+\t\t\t\tid: crypto.randomUUID(),
+\t\t\t\tworkspaceId: data.workspaceId,
+\t\t\t\temail: data.email,
+\t\t\t\trole: data.role,
+\t\t\t\ttoken: data.token,
+\t\t\t\tinvitedByUserId: data.invitedByUserId,
+\t\t\t\tstatus: "pending" as const,
+\t\t\t\texpiresAt: data.expiresAt,
+\t\t\t\tacceptedAt: null,
+\t\t\t\tcreatedAt: new Date().toISOString(),
+\t\t\t};
+
+${inviteCreate}
+\t\t},
+
+\t\tasync updateStatus(id, status, acceptedAt) {
+${inviteUpdateStatus}
+\t\t},
+\t};
+}
+`;
+}
+
+export function tenancyTenantHelperFile(): string {
+  return `import {
+\ttype ActivityTenant,
+\ttype AuthRequestLike,
+\tcreateTenant,
+\tisUnboundPort,
+} from "@beignet/core/ports";
+import type { WorkspaceMembershipContext } from "@/features/workspaces/policy";
+import type { AppPorts } from "@/ports";
+import type { AuthSession } from "@/ports/auth";
+
+/**
+ * Cookie set by POST /api/workspaces/switch to pick the active workspace.
+ */
+export const WORKSPACE_COOKIE_NAME = "beignet-workspace";
+
+export type WorkspaceResolution = {
+\ttenant?: ActivityTenant;
+\tmembership: WorkspaceMembershipContext | null;
+};
+
+export type ResolveRequestWorkspaceInput = {
+\tauth: AuthSession | null;
+\treq: AuthRequestLike;
+\tports: Pick<AppPorts, "members">;
+};
+
+/**
+ * Resolve the active workspace and membership for a request.
+ *
+ * Authenticated users resolve through their memberships, with the
+ * \`beignet-workspace\` cookie choosing among them and the first membership as
+ * the fallback. Anonymous requests and users with zero memberships get no
+ * tenant so the UI can route to workspace creation.
+ */
+export async function resolveRequestWorkspace({
+\tauth,
+\treq,
+\tports,
+}: ResolveRequestWorkspaceInput): Promise<WorkspaceResolution> {
+\tif (!auth) {
+\t\treturn { tenant: undefined, membership: null };
+\t}
+
+\t// Focused test apps built on createTestPorts may leave the workspace ports
+\t// unbound; they resolve no workspace instead of failing on first use.
+\tif (isUnboundPort(ports.members)) {
+\t\treturn { tenant: undefined, membership: null };
+\t}
+
+\tconst memberships = await ports.members.listByUser(auth.user.id);
+\tif (memberships.length === 0) {
+\t\treturn { tenant: undefined, membership: null };
+\t}
+
+\tconst cookieWorkspaceId = readWorkspaceCookie(req);
+\tconst active =
+\t\tmemberships.find(
+\t\t\t(membership) => membership.workspaceId === cookieWorkspaceId,
+\t\t) ?? memberships[0];
+\tif (!active) {
+\t\treturn { tenant: undefined, membership: null };
+\t}
+
+\treturn {
+\t\ttenant: createTenant(active.workspaceId),
+\t\tmembership: { workspaceId: active.workspaceId, role: active.role },
+\t};
+}
+
+/**
+ * Resolve a workspace for service work (schedules, tasks, outbox drains).
+ * Service work either targets an explicit workspace or iterates workspaces
+ * itself.
+ */
+export function resolveServiceWorkspace(workspaceId: string | undefined): {
+\ttenant?: ActivityTenant;
+} {
+\tconst normalized = normalizeWorkspaceId(workspaceId);
+\treturn { tenant: normalized ? createTenant(normalized) : undefined };
+}
+
+function readWorkspaceCookie(req: AuthRequestLike): string | undefined {
+\tconst header = req.headers.get("cookie");
+\tif (!header) return undefined;
+
+\tfor (const part of header.split(";")) {
+\t\tconst separator = part.indexOf("=");
+\t\tif (separator === -1) continue;
+\t\tconst name = part.slice(0, separator).trim();
+\t\tif (name !== WORKSPACE_COOKIE_NAME) continue;
+\t\tconst value = part.slice(separator + 1).trim();
+\t\treturn normalizeWorkspaceId(decodeURIComponent(value));
+\t}
+
+\treturn undefined;
+}
+
+function normalizeWorkspaceId(value: unknown): string | undefined {
+\treturn typeof value === "string" && value.trim().length > 0
+\t\t? value.trim()
+\t\t: undefined;
+}
+`;
+}
+
+export function tenancyServerContextFile(): string {
+  return `import "@beignet/core/server-only";
+import {
+\ttype ActivityActor,
+\tcreateAnonymousActor,
+\tcreateServiceActor,
+\tcreateUserActor,
+} from "@beignet/core/ports";
+import { defineServerContext } from "@beignet/core/server";
+import type { TraceContext } from "@beignet/core/tracing";
+import type { AppContext, AppRuntimePorts } from "@/app-context";
+import { resolveRequestWorkspace, resolveServiceWorkspace } from "@/lib/tenant";
+
+export type AppServiceContextInput =
+\t| {
+\t\t\tactor?: ActivityActor;
+\t\t\ttenantId?: string;
+\t  }
+\t| undefined;
+
+/**
+ * Context blueprint shared by the runtime server and route tests. The active
+ * workspace becomes \`ctx.tenant\` and the actor's membership in it becomes
+ * \`ctx.membership\`.
+ */
+export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
+\tgate: (ports) => ports.gate,
+\trequest: async ({ req, ports, requestId, trace }) => {
+\t\tconst auth = await ports.auth.getSession(req);
+\t\tconst { tenant, membership } = await resolveRequestWorkspace({
+\t\t\tauth,
+\t\t\treq,
+\t\t\tports,
+\t\t});
+
+\t\treturn {
+\t\t\trequestId,
+\t\t\tactor: auth
+\t\t\t\t? createUserActor(auth.user.id, {
+\t\t\t\t\t\tdisplayName: auth.user.name,
+\t\t\t\t\t\tmetadata: membership
+\t\t\t\t\t\t\t? { membershipRole: membership.role }
+\t\t\t\t\t\t\t: undefined,
+\t\t\t\t\t})
+\t\t\t\t: createAnonymousActor(),
+\t\t\tauth,
+\t\t\t...trace,
+\t\t\tports,
+\t\t\t...(tenant ? { tenant } : {}),
+\t\t\tmembership,
+\t\t};
+\t},
+\tservice: ({
+\t\tports,
+\t\tinput,
+\t\trequestId,
+\t\ttrace,
+\t}: {
+\t\tports: AppRuntimePorts;
+\t\tinput: AppServiceContextInput;
+\t\trequestId: string;
+\t\ttrace: TraceContext;
+\t}) => {
+\t\tconst { tenant } = resolveServiceWorkspace(input?.tenantId);
+
+\t\treturn {
+\t\t\trequestId,
+\t\t\tactor: input?.actor ?? createServiceActor("beignet-service"),
+\t\t\tauth: null,
+\t\t\t...trace,
+\t\t\tports,
+\t\t\t...(tenant ? { tenant } : {}),
+\t\t\tmembership: null,
+\t\t};
+\t},
+});
+`;
+}
+
+export function workspaceClientQueriesFile(): string {
+  return `import type { QueryClient } from "@tanstack/react-query";
+import { rq } from "@/client";
+import {
+\tacceptInvite,
+\tcreateInvite,
+\tcreateWorkspace,
+\tgetCurrentWorkspace,
+\tlistInvites,
+\tlistMembers,
+\tlistMyWorkspaces,
+\tremoveMember,
+\trevokeInvite,
+\tswitchWorkspace,
+\tupdateMemberRole,
+\tupdateWorkspace,
+} from "@/features/workspaces/contracts";
+
+export function currentWorkspaceQueryOptions() {
+\treturn rq(getCurrentWorkspace).queryOptions();
+}
+
+export function myWorkspacesQueryOptions() {
+\treturn rq(listMyWorkspaces).queryOptions();
+}
+
+export function membersQueryOptions(options?: { enabled?: boolean }) {
+\treturn rq(listMembers).queryOptions(options);
+}
+
+export function invitesQueryOptions(options?: { enabled?: boolean }) {
+\treturn rq(listInvites).queryOptions(options);
+}
+
+export function createWorkspaceMutationOptions() {
+\treturn rq(createWorkspace).mutationOptions();
+}
+
+export function updateWorkspaceMutationOptions() {
+\treturn rq(updateWorkspace).mutationOptions();
+}
+
+export function switchWorkspaceMutationOptions() {
+\treturn rq(switchWorkspace).mutationOptions();
+}
+
+export function updateMemberRoleMutationOptions() {
+\treturn rq(updateMemberRole).mutationOptions();
+}
+
+export function removeMemberMutationOptions() {
+\treturn rq(removeMember).mutationOptions();
+}
+
+export function createInviteMutationOptions() {
+\treturn rq(createInvite).mutationOptions();
+}
+
+export function revokeInviteMutationOptions() {
+\treturn rq(revokeInvite).mutationOptions();
+}
+
+export function acceptInviteMutationOptions() {
+\treturn rq(acceptInvite).mutationOptions();
+}
+
+export function invalidateWorkspaces(queryClient: QueryClient) {
+\treturn Promise.all([
+\t\trq(getCurrentWorkspace).invalidate(queryClient),
+\t\trq(listMyWorkspaces).invalidate(queryClient),
+\t]);
+}
+
+export function invalidateMembers(queryClient: QueryClient) {
+\treturn rq(listMembers).invalidate(queryClient);
+}
+
+export function invalidateInvites(queryClient: QueryClient) {
+\treturn rq(listInvites).invalidate(queryClient);
+}
+`;
+}
+
+export function workspaceSwitcherComponentFile(): string {
+  return `"use client";
+
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { CheckIcon, ChevronsUpDownIcon } from "lucide-react";
+import { useRouter } from "next/navigation";
+import {
+\tDropdownMenu,
+\tDropdownMenuContent,
+\tDropdownMenuItem,
+\tDropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+import {
+\tcurrentWorkspaceQueryOptions,
+\tmyWorkspacesQueryOptions,
+\tswitchWorkspaceMutationOptions,
+} from "@/features/workspaces/client/queries";
+import { cn } from "@/lib/utils";
+
+function WorkspaceMark({ name }: { name: string }) {
+\treturn (
+\t\t<span className="inline-flex size-6 shrink-0 items-center justify-center rounded bg-primary font-bold text-[11px] text-primary-foreground">
+\t\t\t{(name || "?").slice(0, 1).toUpperCase()}
+\t\t</span>
+\t);
+}
+
+/**
+ * Lists the actor's workspaces and switches the active one through
+ * POST /api/workspaces/switch, which sets the \`beignet-workspace\` cookie.
+ */
+export function WorkspaceSwitcher() {
+\tconst router = useRouter();
+\tconst queryClient = useQueryClient();
+\tconst currentQuery = useQuery(currentWorkspaceQueryOptions());
+\tconst workspacesQuery = useQuery(myWorkspacesQueryOptions());
+
+\tconst switchMutation = useMutation({
+\t\t...switchWorkspaceMutationOptions(),
+\t\tonSuccess: async () => {
+\t\t\tawait queryClient.invalidateQueries();
+\t\t\trouter.refresh();
+\t\t},
+\t});
+
+\tconst current = currentQuery.data?.workspace ?? null;
+\tconst workspaces = workspacesQuery.data?.items ?? [];
+
+\treturn (
+\t\t<DropdownMenu>
+\t\t\t<DropdownMenuTrigger
+\t\t\t\tclassName="flex h-9 w-full items-center gap-2 rounded-md border px-2 text-left text-sm font-medium hover:bg-muted"
+\t\t\t\taria-label="Switch workspace"
+\t\t\t\tdisabled={switchMutation.isPending}
+\t\t\t>
+\t\t\t\t<WorkspaceMark name={current?.name ?? "?"} />
+\t\t\t\t<span className="flex-1 truncate">
+\t\t\t\t\t{current?.name ?? "Select workspace"}
+\t\t\t\t</span>
+\t\t\t\t<ChevronsUpDownIcon className="size-3.5 text-muted-foreground" />
+\t\t\t</DropdownMenuTrigger>
+\t\t\t<DropdownMenuContent align="start" className="w-56">
+\t\t\t\t<p className="px-2 py-1.5 text-xs font-medium text-muted-foreground">
+\t\t\t\t\tWorkspaces
+\t\t\t\t</p>
+\t\t\t\t{workspaces.map((workspace) => (
+\t\t\t\t\t<DropdownMenuItem
+\t\t\t\t\t\tkey={workspace.id}
+\t\t\t\t\t\tonSelect={() => {
+\t\t\t\t\t\t\tif (workspace.id === current?.id) return;
+\t\t\t\t\t\t\tswitchMutation.mutate({
+\t\t\t\t\t\t\t\tbody: { workspaceId: workspace.id },
+\t\t\t\t\t\t\t});
+\t\t\t\t\t\t}}
+\t\t\t\t\t>
+\t\t\t\t\t\t<WorkspaceMark name={workspace.name} />
+\t\t\t\t\t\t<span className="flex-1 truncate">{workspace.name}</span>
+\t\t\t\t\t\t<CheckIcon
+\t\t\t\t\t\t\tclassName={cn(
+\t\t\t\t\t\t\t\t"size-4",
+\t\t\t\t\t\t\t\tworkspace.id === current?.id ? "opacity-100" : "opacity-0",
+\t\t\t\t\t\t\t)}
+\t\t\t\t\t\t/>
+\t\t\t\t\t</DropdownMenuItem>
+\t\t\t\t))}
+\t\t\t\t{workspaces.length === 0 ? (
+\t\t\t\t\t<DropdownMenuItem disabled>No workspaces yet</DropdownMenuItem>
+\t\t\t\t) : null}
+\t\t\t</DropdownMenuContent>
+\t\t</DropdownMenu>
+\t);
+}
+`;
+}
+
+export function workspaceSettingsFormComponentFile(): string {
+  return `"use client";
+
+import { rootFormError } from "@beignet/react-hook-form";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { useRouter } from "next/navigation";
+import { rhf } from "@/client/forms";
+import { Button } from "@/components/ui/button";
+import {
+\tCard,
+\tCardContent,
+\tCardDescription,
+\tCardHeader,
+\tCardTitle,
+} from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import {
+\tcreateWorkspaceMutationOptions,
+\tcurrentWorkspaceQueryOptions,
+\tinvalidateWorkspaces,
+\tupdateWorkspaceMutationOptions,
+} from "@/features/workspaces/client/queries";
+import { createWorkspace, updateWorkspace } from "@/features/workspaces/contracts";
+
+const createWorkspaceForm = rhf(createWorkspace);
+const updateWorkspaceForm = rhf(updateWorkspace);
+
+function CreateWorkspaceCard() {
+\tconst router = useRouter();
+\tconst queryClient = useQueryClient();
+\tconst form = createWorkspaceForm.useForm({
+\t\tdefaultValues: { name: "", slug: "" },
+\t});
+
+\tconst createMutation = useMutation({
+\t\t...createWorkspaceMutationOptions(),
+\t\tonSuccess: async () => {
+\t\t\tawait invalidateWorkspaces(queryClient);
+\t\t\trouter.refresh();
+\t\t},
+\t\tonError: (error) => {
+\t\t\tform.setError(
+\t\t\t\t"root",
+\t\t\t\trootFormError(error, "Could not create the workspace."),
+\t\t\t);
+\t\t},
+\t});
+
+\tconst onSubmit = form.handleSubmit((body) => {
+\t\tform.clearErrors("root");
+\t\tcreateMutation.mutate({ idempotencyKey: crypto.randomUUID(), body });
+\t});
+
+\treturn (
+\t\t<Card>
+\t\t\t<CardHeader>
+\t\t\t\t<CardTitle>Create a workspace</CardTitle>
+\t\t\t\t<CardDescription>
+\t\t\t\t\tYou have no active workspace yet. Create one to get started.
+\t\t\t\t</CardDescription>
+\t\t\t</CardHeader>
+\t\t\t<CardContent>
+\t\t\t\t<form className="flex max-w-sm flex-col gap-4" onSubmit={onSubmit}>
+\t\t\t\t\t<div className="flex flex-col gap-2">
+\t\t\t\t\t\t<Label htmlFor="workspace-name">Name</Label>
+\t\t\t\t\t\t<Input
+\t\t\t\t\t\t\tid="workspace-name"
+\t\t\t\t\t\t\tplaceholder="Acme"
+\t\t\t\t\t\t\trequired
+\t\t\t\t\t\t\t{...form.register("name")}
+\t\t\t\t\t\t/>
+\t\t\t\t\t</div>
+\t\t\t\t\t<div className="flex flex-col gap-2">
+\t\t\t\t\t\t<Label htmlFor="workspace-slug">Slug</Label>
+\t\t\t\t\t\t<Input
+\t\t\t\t\t\t\tid="workspace-slug"
+\t\t\t\t\t\t\tplaceholder="acme"
+\t\t\t\t\t\t\trequired
+\t\t\t\t\t\t\t{...form.register("slug")}
+\t\t\t\t\t\t/>
+\t\t\t\t\t\t{form.formState.errors.slug ? (
+\t\t\t\t\t\t\t<p className="text-sm text-destructive">
+\t\t\t\t\t\t\t\t{form.formState.errors.slug.message}
+\t\t\t\t\t\t\t</p>
+\t\t\t\t\t\t) : null}
+\t\t\t\t\t</div>
+\t\t\t\t\t{form.formState.errors.root ? (
+\t\t\t\t\t\t<p className="text-sm text-destructive">
+\t\t\t\t\t\t\t{form.formState.errors.root.message}
+\t\t\t\t\t\t</p>
+\t\t\t\t\t) : null}
+\t\t\t\t\t<Button type="submit" disabled={createMutation.isPending}>
+\t\t\t\t\t\t{createMutation.isPending ? "Creating..." : "Create workspace"}
+\t\t\t\t\t</Button>
+\t\t\t\t</form>
+\t\t\t</CardContent>
+\t\t</Card>
+\t);
+}
+
+export function WorkspaceSettingsForm() {
+\tconst router = useRouter();
+\tconst queryClient = useQueryClient();
+\tconst currentQuery = useQuery(currentWorkspaceQueryOptions());
+\tconst workspace = currentQuery.data?.workspace ?? null;
+\tconst isAdmin = currentQuery.data?.membership?.role === "admin";
+
+\tconst form = updateWorkspaceForm.useForm({
+\t\tvalues: {
+\t\t\tname: workspace?.name ?? "",
+\t\t\tslug: workspace?.slug ?? "",
+\t\t},
+\t});
+
+\tconst updateMutation = useMutation({
+\t\t...updateWorkspaceMutationOptions(),
+\t\tonSuccess: async () => {
+\t\t\tawait invalidateWorkspaces(queryClient);
+\t\t\trouter.refresh();
+\t\t},
+\t\tonError: (error) => {
+\t\t\tform.setError(
+\t\t\t\t"root",
+\t\t\t\trootFormError(error, "Could not update the workspace."),
+\t\t\t);
+\t\t},
+\t});
+
+\tif (currentQuery.isPending) {
+\t\treturn <p className="text-sm text-muted-foreground">Loading...</p>;
+\t}
+
+\tif (!workspace) {
+\t\treturn <CreateWorkspaceCard />;
+\t}
+
+\tif (!isAdmin) {
+\t\treturn (
+\t\t\t<Card>
+\t\t\t\t<CardHeader>
+\t\t\t\t\t<CardTitle>{workspace.name}</CardTitle>
+\t\t\t\t\t<CardDescription>
+\t\t\t\t\t\tOnly workspace admins can change workspace settings.
+\t\t\t\t\t</CardDescription>
+\t\t\t\t</CardHeader>
+\t\t\t</Card>
+\t\t);
+\t}
+
+\tconst onSubmit = form.handleSubmit((body) => {
+\t\tform.clearErrors("root");
+\t\tupdateMutation.mutate({ body });
+\t});
+
+\treturn (
+\t\t<Card>
+\t\t\t<CardHeader>
+\t\t\t\t<CardTitle>Workspace</CardTitle>
+\t\t\t\t<CardDescription>
+\t\t\t\t\tRename the workspace or change its slug.
+\t\t\t\t</CardDescription>
+\t\t\t</CardHeader>
+\t\t\t<CardContent>
+\t\t\t\t<form className="flex max-w-sm flex-col gap-4" onSubmit={onSubmit}>
+\t\t\t\t\t<div className="flex flex-col gap-2">
+\t\t\t\t\t\t<Label htmlFor="workspace-name">Name</Label>
+\t\t\t\t\t\t<Input id="workspace-name" {...form.register("name")} />
+\t\t\t\t\t\t{form.formState.errors.name ? (
+\t\t\t\t\t\t\t<p className="text-sm text-destructive">
+\t\t\t\t\t\t\t\t{form.formState.errors.name.message}
+\t\t\t\t\t\t\t</p>
+\t\t\t\t\t\t) : null}
+\t\t\t\t\t</div>
+\t\t\t\t\t<div className="flex flex-col gap-2">
+\t\t\t\t\t\t<Label htmlFor="workspace-slug">Slug</Label>
+\t\t\t\t\t\t<Input id="workspace-slug" {...form.register("slug")} />
+\t\t\t\t\t\t{form.formState.errors.slug ? (
+\t\t\t\t\t\t\t<p className="text-sm text-destructive">
+\t\t\t\t\t\t\t\t{form.formState.errors.slug.message}
+\t\t\t\t\t\t\t</p>
+\t\t\t\t\t\t) : null}
+\t\t\t\t\t</div>
+\t\t\t\t\t{form.formState.errors.root ? (
+\t\t\t\t\t\t<p className="text-sm text-destructive">
+\t\t\t\t\t\t\t{form.formState.errors.root.message}
+\t\t\t\t\t\t</p>
+\t\t\t\t\t) : null}
+\t\t\t\t\t<Button type="submit" disabled={updateMutation.isPending}>
+\t\t\t\t\t\t{updateMutation.isPending ? "Saving..." : "Save"}
+\t\t\t\t\t</Button>
+\t\t\t\t</form>
+\t\t\t</CardContent>
+\t\t</Card>
+\t);
+}
+`;
+}
+
+export function inviteFormComponentFile(): string {
+  return `"use client";
+
+import { rootFormError } from "@beignet/react-hook-form";
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { rhf } from "@/client/forms";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import {
+\tcreateInviteMutationOptions,
+\tinvalidateInvites,
+} from "@/features/workspaces/client/queries";
+import { createInvite } from "@/features/workspaces/contracts";
+
+const createInviteForm = rhf(createInvite);
+
+const roleSelectClassName =
+\t"h-9 rounded-md border border-input bg-transparent px-2 text-sm shadow-xs";
+
+export function InviteForm() {
+\tconst queryClient = useQueryClient();
+\tconst form = createInviteForm.useForm({
+\t\tdefaultValues: { email: "", role: "member" },
+\t});
+
+\tconst inviteMutation = useMutation({
+\t\t...createInviteMutationOptions(),
+\t\tonSuccess: async () => {
+\t\t\tform.reset({ email: "", role: "member" });
+\t\t\tawait invalidateInvites(queryClient);
+\t\t},
+\t\tonError: (error) => {
+\t\t\tform.setError("root", rootFormError(error, "Could not send the invite."));
+\t\t},
+\t});
+
+\tconst onSubmit = form.handleSubmit((body) => {
+\t\tform.clearErrors("root");
+\t\tinviteMutation.mutate({ idempotencyKey: crypto.randomUUID(), body });
+\t});
+
+\treturn (
+\t\t<form className="flex flex-col gap-2" onSubmit={onSubmit}>
+\t\t\t<div className="flex flex-wrap items-end gap-2">
+\t\t\t\t<div className="flex min-w-52 flex-1 flex-col gap-2">
+\t\t\t\t\t<Label htmlFor="invite-email">Invite by email</Label>
+\t\t\t\t\t<Input
+\t\t\t\t\t\tid="invite-email"
+\t\t\t\t\t\ttype="email"
+\t\t\t\t\t\tplaceholder="teammate@example.com"
+\t\t\t\t\t\trequired
+\t\t\t\t\t\t{...form.register("email")}
+\t\t\t\t\t/>
+\t\t\t\t</div>
+\t\t\t\t<select
+\t\t\t\t\tclassName={roleSelectClassName}
+\t\t\t\t\taria-label="Invite role"
+\t\t\t\t\t{...form.register("role")}
+\t\t\t\t>
+\t\t\t\t\t<option value="member">Member</option>
+\t\t\t\t\t<option value="admin">Admin</option>
+\t\t\t\t</select>
+\t\t\t\t<Button type="submit" disabled={inviteMutation.isPending}>
+\t\t\t\t\t{inviteMutation.isPending ? "Sending..." : "Send invite"}
+\t\t\t\t</Button>
+\t\t\t</div>
+\t\t\t{form.formState.errors.email ? (
+\t\t\t\t<p className="text-sm text-destructive">
+\t\t\t\t\t{form.formState.errors.email.message}
+\t\t\t\t</p>
+\t\t\t) : null}
+\t\t\t{form.formState.errors.root ? (
+\t\t\t\t<p className="text-sm text-destructive">
+\t\t\t\t\t{form.formState.errors.root.message}
+\t\t\t\t</p>
+\t\t\t) : null}
+\t\t</form>
+\t);
+}
+`;
+}
+
+export function membersSettingsComponentFile(): string {
+  return `"use client";
+
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { useState } from "react";
+import { authClient } from "@/client/auth-client";
+import { Button } from "@/components/ui/button";
+import {
+\tCard,
+\tCardContent,
+\tCardHeader,
+\tCardTitle,
+} from "@/components/ui/card";
+import { Separator } from "@/components/ui/separator";
+import {
+\tcurrentWorkspaceQueryOptions,
+\tinvalidateInvites,
+\tinvalidateMembers,
+\tinvitesQueryOptions,
+\tmembersQueryOptions,
+\tremoveMemberMutationOptions,
+\trevokeInviteMutationOptions,
+\tupdateMemberRoleMutationOptions,
+} from "@/features/workspaces/client/queries";
+import { InviteForm } from "@/features/workspaces/components/invite-form";
+import type { WorkspaceMemberWithUser } from "@/features/workspaces/schemas";
+
+const roleSelectClassName =
+\t"h-8 rounded-md border border-input bg-transparent px-2 text-sm shadow-xs";
+
+function errorMessage(error: unknown, fallback: string): string {
+\tif (error && typeof error === "object" && "message" in error) {
+\t\tconst message = (error as { message?: unknown }).message;
+\t\tif (typeof message === "string" && message.length > 0) return message;
+\t}
+\treturn fallback;
+}
+
+function MemberRow({
+\tmember,
+\tisSelf,
+\tcanManage,
+\tonError,
+}: {
+\tmember: WorkspaceMemberWithUser;
+\tisSelf: boolean;
+\tcanManage: boolean;
+\tonError: (message: string) => void;
+}) {
+\tconst queryClient = useQueryClient();
+
+\tconst roleMutation = useMutation({
+\t\t...updateMemberRoleMutationOptions(),
+\t\tonSuccess: async () => {
+\t\t\tawait invalidateMembers(queryClient);
+\t\t},
+\t\tonError: (error) =>
+\t\t\tonError(errorMessage(error, "Could not change the member role.")),
+\t});
+\tconst removeMutation = useMutation({
+\t\t...removeMemberMutationOptions(),
+\t\tonSuccess: async () => {
+\t\t\tawait invalidateMembers(queryClient);
+\t\t},
+\t\tonError: (error) =>
+\t\t\tonError(errorMessage(error, "Could not remove the member.")),
+\t});
+
+\treturn (
+\t\t<div className="flex flex-wrap items-center gap-3 py-2">
+\t\t\t<span className="inline-flex size-8 shrink-0 items-center justify-center rounded-full bg-muted text-sm font-medium">
+\t\t\t\t{(member.user.name || member.user.email || "?")
+\t\t\t\t\t.slice(0, 1)
+\t\t\t\t\t.toUpperCase()}
+\t\t\t</span>
+\t\t\t<div className="min-w-0 flex-1">
+\t\t\t\t<p className="truncate text-sm font-medium">
+\t\t\t\t\t{member.user.name}
+\t\t\t\t\t{isSelf ? (
+\t\t\t\t\t\t<span className="text-xs text-muted-foreground"> (you)</span>
+\t\t\t\t\t) : null}
+\t\t\t\t</p>
+\t\t\t\t<p className="truncate text-xs text-muted-foreground">
+\t\t\t\t\t{member.user.email}
+\t\t\t\t</p>
+\t\t\t</div>
+\t\t\t{canManage ? (
+\t\t\t\t<>
+\t\t\t\t\t<select
+\t\t\t\t\t\tclassName={roleSelectClassName}
+\t\t\t\t\t\taria-label="Member role"
+\t\t\t\t\t\tvalue={member.role}
+\t\t\t\t\t\tdisabled={roleMutation.isPending}
+\t\t\t\t\t\tonChange={(event) => {
+\t\t\t\t\t\t\tconst role =
+\t\t\t\t\t\t\t\tevent.currentTarget.value === "admin" ? "admin" : "member";
+\t\t\t\t\t\t\tif (role === member.role) return;
+\t\t\t\t\t\t\troleMutation.mutate({
+\t\t\t\t\t\t\t\tpath: { userId: member.userId },
+\t\t\t\t\t\t\t\tbody: { role },
+\t\t\t\t\t\t\t});
+\t\t\t\t\t\t}}
+\t\t\t\t\t>
+\t\t\t\t\t\t<option value="member">Member</option>
+\t\t\t\t\t\t<option value="admin">Admin</option>
+\t\t\t\t\t</select>
+\t\t\t\t\t<Button
+\t\t\t\t\t\ttype="button"
+\t\t\t\t\t\tvariant="destructive"
+\t\t\t\t\t\tsize="sm"
+\t\t\t\t\t\tdisabled={removeMutation.isPending}
+\t\t\t\t\t\tonClick={() =>
+\t\t\t\t\t\t\tremoveMutation.mutate({ path: { userId: member.userId } })
+\t\t\t\t\t\t}
+\t\t\t\t\t>
+\t\t\t\t\t\tRemove
+\t\t\t\t\t</Button>
+\t\t\t\t</>
+\t\t\t) : (
+\t\t\t\t<span className="rounded-md bg-muted px-2 py-0.5 text-xs font-medium capitalize">
+\t\t\t\t\t{member.role}
+\t\t\t\t</span>
+\t\t\t)}
+\t\t</div>
+\t);
+}
+
+export function MembersSettings() {
+\tconst session = authClient.useSession();
+\tconst queryClient = useQueryClient();
+\tconst [actionError, setActionError] = useState<string | null>(null);
+
+\tconst currentQuery = useQuery(currentWorkspaceQueryOptions());
+\tconst isAdmin = currentQuery.data?.membership?.role === "admin";
+\tconst hasWorkspace = Boolean(currentQuery.data?.workspace);
+\tconst currentUserId = session.data?.user.id;
+
+\tconst membersQuery = useQuery(membersQueryOptions({ enabled: hasWorkspace }));
+\tconst invitesQuery = useQuery(
+\t\tinvitesQueryOptions({ enabled: hasWorkspace && isAdmin }),
+\t);
+
+\tconst revokeMutation = useMutation({
+\t\t...revokeInviteMutationOptions(),
+\t\tonSuccess: async () => {
+\t\t\tawait invalidateInvites(queryClient);
+\t\t},
+\t\tonError: (error) =>
+\t\t\tsetActionError(errorMessage(error, "Could not revoke the invite.")),
+\t});
+
+\tif (currentQuery.isPending) {
+\t\treturn <p className="text-sm text-muted-foreground">Loading...</p>;
+\t}
+
+\tif (!hasWorkspace || !currentUserId) {
+\t\treturn (
+\t\t\t<p className="text-sm text-muted-foreground">
+\t\t\t\tCreate or pick a workspace to manage members.
+\t\t\t</p>
+\t\t);
+\t}
+
+\tconst invites = invitesQuery.data?.items ?? [];
+\tconst pendingInvites = invites.filter(
+\t\t(invite) => invite.status === "pending",
+\t);
+
+\treturn (
+\t\t<div className="flex max-w-2xl flex-col gap-4">
+\t\t\t<Card>
+\t\t\t\t<CardHeader>
+\t\t\t\t\t<CardTitle>Members</CardTitle>
+\t\t\t\t</CardHeader>
+\t\t\t\t<CardContent>
+\t\t\t\t\t{membersQuery.isPending ? (
+\t\t\t\t\t\t<p className="text-sm text-muted-foreground">
+\t\t\t\t\t\t\tLoading members...
+\t\t\t\t\t\t</p>
+\t\t\t\t\t) : null}
+\t\t\t\t\t{membersQuery.isError ? (
+\t\t\t\t\t\t<p className="text-sm text-destructive">
+\t\t\t\t\t\t\tCould not load members.
+\t\t\t\t\t\t</p>
+\t\t\t\t\t) : null}
+\t\t\t\t\t<div className="flex flex-col divide-y divide-border">
+\t\t\t\t\t\t{membersQuery.data?.items.map((member) => (
+\t\t\t\t\t\t\t<MemberRow
+\t\t\t\t\t\t\t\tkey={member.id}
+\t\t\t\t\t\t\t\tmember={member}
+\t\t\t\t\t\t\t\tisSelf={member.userId === currentUserId}
+\t\t\t\t\t\t\t\tcanManage={isAdmin}
+\t\t\t\t\t\t\t\tonError={setActionError}
+\t\t\t\t\t\t\t/>
+\t\t\t\t\t\t))}
+\t\t\t\t\t</div>
+\t\t\t\t\t{actionError ? (
+\t\t\t\t\t\t<p className="mt-2 text-sm text-destructive">{actionError}</p>
+\t\t\t\t\t) : null}
+\t\t\t\t</CardContent>
+\t\t\t</Card>
+
+\t\t\t{isAdmin ? (
+\t\t\t\t<Card>
+\t\t\t\t\t<CardHeader>
+\t\t\t\t\t\t<CardTitle>Invites</CardTitle>
+\t\t\t\t\t</CardHeader>
+\t\t\t\t\t<CardContent className="flex flex-col gap-3">
+\t\t\t\t\t\t<InviteForm />
+\t\t\t\t\t\t<Separator />
+\t\t\t\t\t\t{invitesQuery.isPending ? (
+\t\t\t\t\t\t\t<p className="text-sm text-muted-foreground">
+\t\t\t\t\t\t\t\tLoading invites...
+\t\t\t\t\t\t\t</p>
+\t\t\t\t\t\t) : null}
+\t\t\t\t\t\t{pendingInvites.length === 0 && !invitesQuery.isPending ? (
+\t\t\t\t\t\t\t<p className="text-sm text-muted-foreground">
+\t\t\t\t\t\t\t\tNo pending invites.
+\t\t\t\t\t\t\t</p>
+\t\t\t\t\t\t) : null}
+\t\t\t\t\t\t{pendingInvites.map((invite) => (
+\t\t\t\t\t\t\t<div
+\t\t\t\t\t\t\t\tkey={invite.id}
+\t\t\t\t\t\t\t\tclassName="flex flex-wrap items-center gap-3"
+\t\t\t\t\t\t\t>
+\t\t\t\t\t\t\t\t<div className="min-w-0 flex-1">
+\t\t\t\t\t\t\t\t\t<p className="truncate text-sm font-medium">
+\t\t\t\t\t\t\t\t\t\t{invite.email}
+\t\t\t\t\t\t\t\t\t</p>
+\t\t\t\t\t\t\t\t\t<p className="text-xs text-muted-foreground">
+\t\t\t\t\t\t\t\t\t\t{invite.role} - expires{" "}
+\t\t\t\t\t\t\t\t\t\t{new Date(invite.expiresAt).toLocaleDateString()}
+\t\t\t\t\t\t\t\t\t</p>
+\t\t\t\t\t\t\t\t</div>
+\t\t\t\t\t\t\t\t<Button
+\t\t\t\t\t\t\t\t\ttype="button"
+\t\t\t\t\t\t\t\t\tvariant="outline"
+\t\t\t\t\t\t\t\t\tsize="sm"
+\t\t\t\t\t\t\t\t\tdisabled={revokeMutation.isPending}
+\t\t\t\t\t\t\t\t\tonClick={() =>
+\t\t\t\t\t\t\t\t\t\trevokeMutation.mutate({
+\t\t\t\t\t\t\t\t\t\t\tpath: { inviteId: invite.id },
+\t\t\t\t\t\t\t\t\t\t})
+\t\t\t\t\t\t\t\t\t}
+\t\t\t\t\t\t\t\t>
+\t\t\t\t\t\t\t\t\tRevoke
+\t\t\t\t\t\t\t\t</Button>
+\t\t\t\t\t\t\t</div>
+\t\t\t\t\t\t))}
+\t\t\t\t\t</CardContent>
+\t\t\t\t</Card>
+\t\t\t) : (
+\t\t\t\t<p className="text-sm text-muted-foreground">
+\t\t\t\t\tOnly workspace admins can manage roles and invites.
+\t\t\t\t</p>
+\t\t\t)}
+\t\t</div>
+\t);
+}
+`;
+}
+
+export function inviteAcceptComponentFile(): string {
+  return `"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+import { authClient } from "@/client/auth-client";
+import { Button } from "@/components/ui/button";
+import {
+\tCard,
+\tCardContent,
+\tCardDescription,
+\tCardHeader,
+\tCardTitle,
+} from "@/components/ui/card";
+import {
+\tacceptInviteMutationOptions,
+\tinvalidateWorkspaces,
+\tswitchWorkspaceMutationOptions,
+} from "@/features/workspaces/client/queries";
+
+function errorMessage(error: unknown, fallback: string): string {
+\tif (error && typeof error === "object" && "message" in error) {
+\t\tconst message = (error as { message?: unknown }).message;
+\t\tif (typeof message === "string" && message.length > 0) return message;
+\t}
+\treturn fallback;
+}
+
+export function InviteAccept({ token }: { token: string }) {
+\tconst session = authClient.useSession();
+\tconst router = useRouter();
+\tconst queryClient = useQueryClient();
+\tconst [error, setError] = useState<string | null>(null);
+
+\tconst switchMutation = useMutation({
+\t\t...switchWorkspaceMutationOptions(),
+\t\tonSettled: async () => {
+\t\t\tawait queryClient.invalidateQueries();
+\t\t\trouter.push("/dashboard");
+\t\t\trouter.refresh();
+\t\t},
+\t});
+
+\tconst acceptMutation = useMutation({
+\t\t...acceptInviteMutationOptions(),
+\t\tonSuccess: async (result) => {
+\t\t\tawait invalidateWorkspaces(queryClient);
+\t\t\tswitchMutation.mutate({ body: { workspaceId: result.workspace.id } });
+\t\t},
+\t\tonError: (mutationError) =>
+\t\t\tsetError(errorMessage(mutationError, "Could not accept the invite.")),
+\t});
+
+\tif (session.isPending) {
+\t\treturn (
+\t\t\t<main className="grid min-h-svh place-items-center p-6">
+\t\t\t\t<p className="text-sm text-muted-foreground">Loading...</p>
+\t\t\t</main>
+\t\t);
+\t}
+
+\tif (!session.data?.user) {
+\t\treturn (
+\t\t\t<main className="grid min-h-svh place-items-center p-6">
+\t\t\t\t<Card className="w-full max-w-sm">
+\t\t\t\t\t<CardHeader>
+\t\t\t\t\t\t<CardTitle>Workspace invite</CardTitle>
+\t\t\t\t\t\t<CardDescription>
+\t\t\t\t\t\t\tSign in to accept this invite. New here? Create an account
+\t\t\t\t\t\t\tfirst, then reopen the invite link.
+\t\t\t\t\t\t</CardDescription>
+\t\t\t\t\t</CardHeader>
+\t\t\t\t\t<CardContent className="flex gap-2">
+\t\t\t\t\t\t<Button asChild>
+\t\t\t\t\t\t\t<Link href="/sign-in">Sign in</Link>
+\t\t\t\t\t\t</Button>
+\t\t\t\t\t\t<Button asChild variant="outline">
+\t\t\t\t\t\t\t<Link href="/sign-up">Create account</Link>
+\t\t\t\t\t\t</Button>
+\t\t\t\t\t</CardContent>
+\t\t\t\t</Card>
+\t\t\t</main>
+\t\t);
+\t}
+
+\tconst pending = acceptMutation.isPending || switchMutation.isPending;
+
+\treturn (
+\t\t<main className="grid min-h-svh place-items-center p-6">
+\t\t\t<Card className="w-full max-w-sm">
+\t\t\t\t<CardHeader>
+\t\t\t\t\t<CardTitle>Workspace invite</CardTitle>
+\t\t\t\t\t<CardDescription>
+\t\t\t\t\t\tAccept this invite to join the workspace as{" "}
+\t\t\t\t\t\t{session.data.user.name || session.data.user.email}.
+\t\t\t\t\t</CardDescription>
+\t\t\t\t</CardHeader>
+\t\t\t\t<CardContent className="flex flex-col gap-3">
+\t\t\t\t\t{error ? <p className="text-sm text-destructive">{error}</p> : null}
+\t\t\t\t\t<Button
+\t\t\t\t\t\ttype="button"
+\t\t\t\t\t\tdisabled={pending}
+\t\t\t\t\t\tonClick={() => {
+\t\t\t\t\t\t\tsetError(null);
+\t\t\t\t\t\t\tacceptMutation.mutate({ path: { token } });
+\t\t\t\t\t\t}}
+\t\t\t\t\t>
+\t\t\t\t\t\t{pending ? "Joining..." : "Accept invite"}
+\t\t\t\t\t</Button>
+\t\t\t\t</CardContent>
+\t\t\t</Card>
+\t\t</main>
+\t);
+}
+`;
+}
+
+export function workspaceComponentsIndexFile(): string {
+  return `export { InviteAccept } from "./invite-accept";
+export { InviteForm } from "./invite-form";
+export { MembersSettings } from "./members-settings";
+export { WorkspaceSettingsForm } from "./workspace-settings-form";
+export { WorkspaceSwitcher } from "./workspace-switcher";
+`;
+}
+
+export function settingsWorkspacePageFile(): string {
+  return `import {
+\tWorkspaceSettingsForm,
+\tWorkspaceSwitcher,
+} from "@/features/workspaces/components";
+
+export default function SettingsWorkspacePage() {
+\treturn (
+\t\t<div className="flex flex-col gap-4">
+\t\t\t<div className="max-w-xs">
+\t\t\t\t<WorkspaceSwitcher />
+\t\t\t</div>
+\t\t\t<WorkspaceSettingsForm />
+\t\t</div>
+\t);
+}
+`;
+}
+
+export function settingsMembersPageFile(): string {
+  return `import { MembersSettings } from "@/features/workspaces/components";
+
+export default function SettingsMembersPage() {
+\treturn <MembersSettings />;
+}
+`;
+}
+
+export function inviteTokenPageFile(): string {
+  return `import { InviteAccept } from "@/features/workspaces/components";
+
+export default async function InvitePage({
+\tparams,
+}: {
+\tparams: Promise<{ token: string }>;
+}) {
+\tconst { token } = await params;
+
+\treturn <InviteAccept token={token} />;
+}
+`;
+}