@bugmole/cli 0.4.0

package/src/registry-worker/org/routes.test.ts

@@ -0,0 +1,163 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { call, createTestEnv, seedPlan, seedProject } from "../testing/harness.js";
+
+async function inviteAndJoin(env: Parameters<typeof call>[0], inviter: string, workspaceId: string, who: string, role: string) {
+  const invited = await call(env, "POST", `/api/workspaces/${workspaceId}/invitations`, {
+    as: inviter,
+    body: { email: `${who}@example.com`, role },
+  });
+  assert.equal(invited.status, 201, JSON.stringify(invited.json));
+  const token = invited.json.invitation.acceptUrl.split("/invite/")[1];
+  const accepted = await call(env, "POST", `/api/invitations/${token}/accept`, { as: who });
+  assert.equal(accepted.status, 200, JSON.stringify(accepted.json));
+  return token;
+}
+
+test("an invitation emails a single-use link that adds the person with the invited role", async () => {
+  const { env, email } = createTestEnv({ DASHBOARD_URL: "https://dash.test" });
+  const { owner, workspaceId } = await seedProject(env);
+  const token = await inviteAndJoin(env, owner, workspaceId, "user_bea", "member");
+
+  assert.equal(email.sent.length, 1);
+  assert.equal(email.sent[0].to[0].email, "user_bea@example.com");
+  assert.match(email.sent[0].text, /https:\/\/dash\.test\/invite\//);
+
+  const reused = await call(env, "POST", `/api/invitations/${token}/accept`, { as: "user_cal" });
+  assert.equal(reused.status, 410);
+
+  const members = await call(env, "GET", `/api/workspaces/${workspaceId}/members`, { as: "user_bea" });
+  assert.deepEqual(members.json.members.map((m: { aegisId: string; role: string }) => [m.aegisId, m.role]), [
+    [owner, "owner"],
+    ["user_bea", "member"],
+  ]);
+  assert.deepEqual(members.json.invitations, [], "members don't see pending invitations");
+});
+
+test("roles decide who can run tests, manage the project, and change people", async () => {
+  const { env } = createTestEnv();
+  const { owner, workspaceId, projectId } = await seedProject(env);
+  await seedPlan(env, projectId, owner);
+  await inviteAndJoin(env, owner, workspaceId, "user_member", "member");
+  await inviteAndJoin(env, owner, workspaceId, "user_billing", "billing");
+  await inviteAndJoin(env, owner, workspaceId, "user_admin", "admin");
+
+  const runAs = (who: string, key: string) =>
+    call(env, "POST", `/api/projects/${projectId}/runs`, { as: who, body: { planId: "checkout", idempotencyKey: key } });
+  assert.equal((await runAs("user_member", "a")).status, 201);
+  assert.equal((await runAs("user_billing", "b")).status, 403, "billing managers can't start runs");
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/runs`, { as: "user_billing" })).status, 200, "but can read them");
+
+  const editEnv = (who: string) =>
+    call(env, "POST", `/api/projects/${projectId}/environments`, { as: who, body: { name: `Env ${who}`, baseUrl: "https://example.com" } });
+  assert.equal((await editEnv("user_member")).status, 403, "members don't manage project settings");
+  assert.notEqual((await editEnv("user_admin")).status, 403);
+
+  const promote = (who: string, target: string, role: string) =>
+    call(env, "PATCH", `/api/workspaces/${workspaceId}/members/${target}`, { as: who, body: { role } });
+  assert.equal((await promote("user_member", "user_billing", "admin")).status, 403);
+  assert.equal((await promote("user_admin", "user_member", "owner")).status, 403, "only owners create owners");
+  assert.equal((await promote("user_admin", "user_member", "admin")).status, 200);
+  assert.equal((await promote(owner, owner, "member")).status, 409, "the last owner can't step down");
+
+  const invites = await call(env, "POST", `/api/workspaces/${workspaceId}/invitations`, {
+    as: "user_admin",
+    body: { email: "x@example.com", role: "billing" },
+  });
+  assert.equal(invites.status, 403, "admins can't hand out billing access");
+});
+
+test("removing someone cuts off their API keys and re-registering can't restore access", async () => {
+  const { env } = createTestEnv();
+  const { owner, workspaceId, projectId } = await seedProject(env);
+  await inviteAndJoin(env, owner, workspaceId, "user_leaver", "member");
+  const key = await call(env, "POST", "/api/api-keys", {
+    as: "user_leaver",
+    body: { name: "ci", scopes: ["runs:write", "projects:read", "projects:write"], projectIds: [projectId] },
+  });
+  assert.equal(key.status, 201, JSON.stringify(key.json));
+  const token = key.json.token ?? key.json.apiKey?.token;
+  assert.ok(token);
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/runs`, { token })).status, 200);
+
+  assert.equal((await call(env, "DELETE", `/api/workspaces/${workspaceId}/members/user_leaver`, { as: owner })).status, 200);
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/runs`, { token })).status, 403);
+
+  const reregister = await call(env, "POST", "/api/projects/register", {
+    token,
+    body: { id: projectId, name: "Shop", workspaceId, environment: "staging", storageProvider: "r2" },
+  });
+  assert.equal(reregister.status, 403);
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/runs`, { token })).status, 403);
+});
+
+test("a project id can't be used to move someone else's project", async () => {
+  const { env } = createTestEnv();
+  const { projectId } = await seedProject(env);
+  await call(env, "POST", "/api/workspaces", { as: "user_attacker", body: { id: "evil", name: "Evil" } });
+  const hijack = await call(env, "POST", "/api/projects/register", {
+    as: "user_attacker",
+    body: { id: projectId, name: "Mine now", workspaceId: "evil", environment: "prod", storageProvider: "local" },
+  });
+  assert.equal(hijack.status, 409);
+  const list = await call(env, "GET", "/api/projects", { as: "user_attacker" });
+  assert.deepEqual(list.json.projects, []);
+});
+
+async function claimDevice(env: Parameters<typeof call>[0], who: string, projectId: string, projectName: string, email?: string) {
+  const start = await call(env, "POST", "/api/device-authorizations", {
+    body: { projectId, projectName, environment: "staging", storageProvider: "r2" },
+  });
+  assert.equal(start.status, 201, JSON.stringify(start.json));
+  return call(env, "POST", "/api/device-authorizations/claim", {
+    as: who,
+    body: { attemptId: start.json.attemptId, code: start.json.code, deviceId: projectId, ...(email ? { email } : {}) },
+  });
+}
+
+test("claiming a device authorization names the new workspace, never the raw workspace id", async () => {
+  const { env, db } = createTestEnv();
+  // No email, and no email at all: falls back to the claimed project's own name.
+  const noEmail = await claimDevice(env, "user_device", "mobile-app", "Mobile App");
+  assert.equal(noEmail.status, 200, JSON.stringify(noEmail.json));
+  const row1 = db.db.prepare("SELECT name FROM workspaces WHERE id = ?").get("workspace_user_device") as { name: string };
+  assert.equal(row1.name, "Mobile App workspace", "falls back to the claimed project's name, never the raw workspace id");
+
+  // A free-mail domain says nothing about the person, so it still falls back to the project name.
+  const freeMail = await claimDevice(env, "user_freemail", "storefront", "Storefront", "steve@gmail.com");
+  assert.equal(freeMail.status, 200, JSON.stringify(freeMail.json));
+  const row2 = db.db.prepare("SELECT name FROM workspaces WHERE id = ?").get("workspace_user_freemail") as { name: string };
+  assert.equal(row2.name, "Storefront workspace");
+
+  // A company domain wins over the project name.
+  const companyMail = await claimDevice(env, "user_company", "internal-tool", "Internal Tool", "ada@northwind.io");
+  assert.equal(companyMail.status, 200, JSON.stringify(companyMail.json));
+  const row3 = db.db.prepare("SELECT name FROM workspaces WHERE id = ?").get("workspace_user_company") as { name: string };
+  assert.equal(row3.name, "Northwind");
+});
+
+test("the audit log records changes; export needs the Business plan", async () => {
+  const { env, db } = createTestEnv();
+  const { owner, workspaceId, projectId } = await seedProject(env);
+  await seedPlan(env, projectId, owner);
+  await call(env, "POST", `/api/projects/${projectId}/runs`, { as: owner, body: { planId: "checkout", idempotencyKey: "a" } });
+  await inviteAndJoin(env, owner, workspaceId, "user_member", "member");
+
+  const log = await call(env, "GET", `/api/workspaces/${workspaceId}/audit-log`, { as: owner });
+  assert.equal(log.status, 200);
+  const actions = log.json.entries.map((entry: { action: string }) => entry.action);
+  for (const action of ["workspace.created", "project.created", "run.created", "invitation.created", "invitation.accepted"]) {
+    assert.ok(actions.includes(action), `${action} in ${actions}`);
+  }
+  assert.equal(log.json.historyDays, 7);
+  assert.equal((await call(env, "GET", `/api/workspaces/${workspaceId}/audit-log`, { as: "user_member" })).status, 403);
+
+  const blocked = await call(env, "GET", `/api/workspaces/${workspaceId}/audit-log?format=csv`, { as: owner });
+  assert.equal(blocked.status, 402);
+
+  db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES (?, 'business')").run(workspaceId);
+  const csv = await call(env, "GET", `/api/workspaces/${workspaceId}/audit-log?format=csv`, { as: owner });
+  assert.equal(csv.status, 200);
+  assert.match(csv.headers.get("content-type") ?? "", /text\/csv/);
+  assert.match(String(csv.json), /"run\.created"/);
+});

package/src/registry-worker/org/routes.ts

@@ -0,0 +1,302 @@
+// Workspace members, invitations and the audit log.
+import {
+  type Env,
+  type WorkspaceRole,
+  isWorkspaceRole,
+  memberOfWorkspace,
+  newId,
+  randomToken,
+  requestJson,
+  response,
+  sha256,
+  workspaceRole,
+} from "../core.js";
+import { emailSender, escapeHtml } from "../email/sender.js";
+import { getEntitlements } from "../billing/entitlements.js";
+import { type AuthedRouteContext, matchPath, registerRoutes } from "../routes/index.js";
+import { actorOf, auditCsv, listAudit, recordAudit } from "./audit.js";
+
+const INVITATION_DAYS = 7;
+/** Audit history every plan can see; exports and older history need `auditLogExport`. */
+const BASIC_AUDIT_DAYS = 7;
+
+function dashboardUrl(env: Env): string {
+  return (env.DASHBOARD_URL ?? "https://app.bugmole.com").replace(/\/$/, "");
+}
+
+/** Only owners hand out ownership or billing access. */
+function canGrant(actorRole: WorkspaceRole, role: WorkspaceRole): boolean {
+  if (actorRole === "owner") return true;
+  return actorRole === "admin" && (role === "admin" || role === "member");
+}
+
+async function activeOwnerCount(env: Env, workspaceId: string): Promise<number> {
+  const row = await env.DB.prepare(`
+    SELECT COUNT(*) AS count FROM workspace_memberships
+    WHERE workspace_id = ? AND role = 'owner' AND status = 'active'
+  `).bind(workspaceId).first<{ count: number }>();
+  return row?.count ?? 0;
+}
+
+async function listMembers({ env, principal }: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  const role = await workspaceRole(env, principal.aegisId, workspaceId);
+  if (!role) return response({ error: "Workspace scope is not allowed" }, 403);
+  const members = await env.DB.prepare(`
+    SELECT aegis_id AS aegisId, role, status, invited_by AS invitedBy, created_at AS joinedAt
+    FROM workspace_memberships
+    WHERE workspace_id = ? AND status = 'active'
+    ORDER BY CASE role WHEN 'owner' THEN 0 WHEN 'admin' THEN 1 WHEN 'billing' THEN 2 ELSE 3 END, created_at
+  `).bind(workspaceId).all();
+  const canManage = role === "owner" || role === "admin";
+  const invitations = canManage
+    ? (await env.DB.prepare(`
+        SELECT id, email, role, invited_by AS invitedBy, expires_at AS expiresAt, created_at AS createdAt
+        FROM workspace_invitations
+        WHERE workspace_id = ? AND accepted_at IS NULL AND revoked_at IS NULL AND expires_at > ?
+        ORDER BY created_at DESC
+      `).bind(workspaceId, new Date().toISOString()).all()).results
+    : [];
+  return response({ members: members.results, invitations, viewerRole: role });
+}
+
+async function changeMember(context: AuthedRouteContext, workspaceId: string, aegisId: string): Promise<Response> {
+  const { env, principal, request } = context;
+  const actorRole = await workspaceRole(env, principal.aegisId, workspaceId);
+  if (!actorRole || !(actorRole === "owner" || actorRole === "admin")) {
+    return response({ error: "Only owners and admins can change members" }, 403);
+  }
+  const target = await workspaceRole(env, aegisId, workspaceId);
+  if (!target) return response({ error: "Member not found" }, 404);
+  const body = await requestJson(request);
+  const role = body?.role;
+  if (!isWorkspaceRole(role)) return response({ error: "role must be owner, admin, member, or billing" }, 422);
+  if (!canGrant(actorRole, role) || !canGrant(actorRole, target)) {
+    return response({ error: "Only owners can change owner or billing roles" }, 403);
+  }
+  if (target === "owner" && role !== "owner" && (await activeOwnerCount(env, workspaceId)) <= 1) {
+    return response({ error: "A workspace needs at least one owner" }, 409);
+  }
+  await env.DB.prepare("UPDATE workspace_memberships SET role = ? WHERE workspace_id = ? AND aegis_id = ?")
+    .bind(role, workspaceId, aegisId).run();
+  await recordAudit(env, actorOf(principal), {
+    workspaceId, action: "member.role_changed", targetType: "user", targetId: aegisId, data: { from: target, to: role },
+  }, request);
+  return response({ member: { aegisId, role } });
+}
+
+async function removeMember(context: AuthedRouteContext, workspaceId: string, aegisId: string): Promise<Response> {
+  const { env, principal, request } = context;
+  const actorRole = await workspaceRole(env, principal.aegisId, workspaceId);
+  const leaving = aegisId === principal.aegisId;
+  const target = await workspaceRole(env, aegisId, workspaceId);
+  if (!actorRole) return response({ error: "Workspace scope is not allowed" }, 403);
+  if (!target) return response({ error: "Member not found" }, 404);
+  if (!leaving && !(actorRole === "owner" || (actorRole === "admin" && canGrant("admin", target)))) {
+    return response({ error: "You can't remove this member" }, 403);
+  }
+  if (target === "owner" && (await activeOwnerCount(env, workspaceId)) <= 1) {
+    return response({ error: "A workspace needs at least one owner" }, 409);
+  }
+  // The row stays (status 'removed') so re-registering a project from an old
+  // CLI session can't quietly restore access.
+  await env.DB.prepare("UPDATE workspace_memberships SET status = 'removed' WHERE workspace_id = ? AND aegis_id = ?")
+    .bind(workspaceId, aegisId).run();
+  await env.DB.prepare(`
+    UPDATE project_memberships SET status = 'removed'
+    WHERE aegis_id = ? AND project_id IN (SELECT id FROM projects WHERE workspace_id = ?)
+  `).bind(aegisId, workspaceId).run();
+  await recordAudit(env, actorOf(principal), {
+    workspaceId, action: leaving ? "member.left" : "member.removed", targetType: "user", targetId: aegisId, data: { role: target },
+  }, request);
+  return response({ removed: true });
+}
+
+async function inviteMember(context: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  const { env, principal, request } = context;
+  const actorRole = await workspaceRole(env, principal.aegisId, workspaceId);
+  if (!actorRole || !(actorRole === "owner" || actorRole === "admin")) {
+    return response({ error: "Only owners and admins can invite people" }, 403);
+  }
+  const body = await requestJson(request);
+  const email = typeof body?.email === "string" ? body.email.trim().toLowerCase() : "";
+  const role = body?.role ?? "member";
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return response({ error: "A valid email is required" }, 422);
+  if (!isWorkspaceRole(role)) return response({ error: "role must be owner, admin, member, or billing" }, 422);
+  if (!canGrant(actorRole, role)) return response({ error: "Only owners can invite owners or billing managers" }, 403);
+  const workspace = await env.DB.prepare("SELECT name FROM workspaces WHERE id = ?").bind(workspaceId).first<{ name: string }>();
+  if (!workspace) return response({ error: "Workspace not found" }, 404);
+
+  const token = randomToken(32);
+  const id = newId("inv");
+  const expiresAt = new Date(Date.now() + INVITATION_DAYS * 86_400_000).toISOString();
+  // A newer invitation for the same address replaces any open one.
+  await env.DB.batch([
+    env.DB.prepare(`
+      UPDATE workspace_invitations SET revoked_at = CURRENT_TIMESTAMP
+      WHERE workspace_id = ? AND email = ? AND accepted_at IS NULL AND revoked_at IS NULL
+    `).bind(workspaceId, email),
+    env.DB.prepare(`
+      INSERT INTO workspace_invitations (id, workspace_id, email, role, token_hash, invited_by, expires_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `).bind(id, workspaceId, email, role, await sha256(token), principal.aegisId, expiresAt),
+  ]);
+  const acceptUrl = `${dashboardUrl(env)}/invite/${token}`;
+  const name = escapeHtml(workspace.name);
+  try {
+    await emailSender(env).send({
+      to: [{ email }],
+      subject: `You're invited to ${workspace.name} on Bugmole`,
+      tag: "invitation",
+      text: `You've been invited to join ${workspace.name} on Bugmole as ${role}.\n\nAccept: ${acceptUrl}\n\nThis link expires in ${INVITATION_DAYS} days.`,
+      html: `<p>You've been invited to join <strong>${name}</strong> on Bugmole as ${role}.</p><p><a href="${acceptUrl}">Accept the invitation</a></p><p>This link expires in ${INVITATION_DAYS} days.</p>`,
+    });
+  } catch (error) {
+    console.error("[invitations] email failed", error);
+  }
+  await recordAudit(env, actorOf(principal), {
+    workspaceId, action: "invitation.created", targetType: "invitation", targetId: id, data: { email, role },
+  }, request);
+  // The link is returned so an admin can share it directly if email is slow.
+  return response({ invitation: { id, email, role, expiresAt, acceptUrl } }, 201);
+}
+
+async function revokeInvitation(context: AuthedRouteContext, workspaceId: string, invitationId: string): Promise<Response> {
+  const { env, principal, request } = context;
+  if (!(await memberOfWorkspace(env, principal, workspaceId, "members.manage"))) {
+    return response({ error: "Only owners and admins can revoke invitations" }, 403);
+  }
+  const result = await env.DB.prepare(`
+    UPDATE workspace_invitations SET revoked_at = CURRENT_TIMESTAMP
+    WHERE id = ? AND workspace_id = ? AND accepted_at IS NULL AND revoked_at IS NULL
+  `).bind(invitationId, workspaceId).run();
+  if (!result.meta?.changes) return response({ error: "Invitation not found" }, 404);
+  await recordAudit(env, actorOf(principal), {
+    workspaceId, action: "invitation.revoked", targetType: "invitation", targetId: invitationId,
+  }, request);
+  return response({ revoked: true });
+}
+
+type InvitationRow = {
+  id: string;
+  workspaceId: string;
+  workspaceName: string;
+  email: string;
+  role: string;
+  expiresAt: string;
+  acceptedAt: string | null;
+  revokedAt: string | null;
+};
+
+async function findInvitation(env: Env, token: string): Promise<InvitationRow | null> {
+  return env.DB.prepare(`
+    SELECT i.id, i.workspace_id AS workspaceId, w.name AS workspaceName, i.email, i.role,
+           i.expires_at AS expiresAt, i.accepted_at AS acceptedAt, i.revoked_at AS revokedAt
+    FROM workspace_invitations i JOIN workspaces w ON w.id = i.workspace_id
+    WHERE i.token_hash = ?
+  `).bind(await sha256(token)).first<InvitationRow>();
+}
+
+function invitationState(invitation: InvitationRow): "open" | "accepted" | "revoked" | "expired" {
+  if (invitation.acceptedAt) return "accepted";
+  if (invitation.revokedAt) return "revoked";
+  return Date.parse(invitation.expiresAt) <= Date.now() ? "expired" : "open";
+}
+
+async function previewInvitation({ env }: AuthedRouteContext, token: string): Promise<Response> {
+  const invitation = await findInvitation(env, token);
+  if (!invitation) return response({ error: "Invitation not found" }, 404);
+  return response({
+    invitation: {
+      workspaceId: invitation.workspaceId,
+      workspaceName: invitation.workspaceName,
+      email: invitation.email,
+      role: invitation.role,
+      expiresAt: invitation.expiresAt,
+      state: invitationState(invitation),
+    },
+  });
+}
+
+async function acceptInvitation(context: AuthedRouteContext, token: string): Promise<Response> {
+  const { env, principal, request } = context;
+  if (principal.apiKeyId) return response({ error: "Invitations are accepted by a person, not an API key" }, 403);
+  const invitation = await findInvitation(env, token);
+  if (!invitation) return response({ error: "Invitation not found" }, 404);
+  const state = invitationState(invitation);
+  if (state !== "open") return response({ error: `This invitation is ${state}` }, 410);
+  const claimed = await env.DB.prepare(`
+    UPDATE workspace_invitations SET accepted_at = CURRENT_TIMESTAMP, accepted_by = ?
+    WHERE id = ? AND accepted_at IS NULL AND revoked_at IS NULL
+  `).bind(principal.aegisId, invitation.id).run();
+  if (claimed.meta?.changes !== 1) return response({ error: "This invitation was already used" }, 409);
+  await env.DB.batch([
+    env.DB.prepare("INSERT INTO aegis_users (id) VALUES (?) ON CONFLICT(id) DO NOTHING").bind(principal.aegisId),
+    // Accepting never lowers an existing role.
+    env.DB.prepare(`
+      INSERT INTO workspace_memberships (workspace_id, aegis_id, role, status, invited_by, created_at)
+      SELECT ?, ?, ?, 'active', invited_by, ? FROM workspace_invitations WHERE id = ?
+      ON CONFLICT(workspace_id, aegis_id) DO UPDATE SET
+        status = 'active',
+        role = CASE WHEN workspace_memberships.status = 'active' THEN workspace_memberships.role ELSE excluded.role END
+    `).bind(invitation.workspaceId, principal.aegisId, invitation.role, new Date().toISOString(), invitation.id),
+  ]);
+  await recordAudit(env, actorOf(principal), {
+    workspaceId: invitation.workspaceId, action: "invitation.accepted", targetType: "invitation", targetId: invitation.id,
+    data: { role: invitation.role },
+  }, request);
+  return response({ workspace: { id: invitation.workspaceId, name: invitation.workspaceName }, role: invitation.role });
+}
+
+async function auditLog(context: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  const { env, principal, url } = context;
+  if (!(await memberOfWorkspace(env, principal, workspaceId, "audit.read"))) {
+    return response({ error: "Only owners and admins can view the audit log" }, 403);
+  }
+  const entitlements = await getEntitlements(env, workspaceId);
+  const csv = url.searchParams.get("format") === "csv";
+  if (csv && !entitlements.features.auditLogExport) {
+    return response({ error: "Audit log export is available on the Business plan", code: "plan_feature", feature: "auditLogExport" }, 402);
+  }
+  const fullHistory = entitlements.features.auditLogExport;
+  const basicSince = new Date(Date.now() - BASIC_AUDIT_DAYS * 86_400_000).toISOString();
+  const requestedSince = url.searchParams.get("since") ?? undefined;
+  const since = fullHistory ? requestedSince : requestedSince && requestedSince > basicSince ? requestedSince : basicSince;
+  const before = url.searchParams.get("before") ?? undefined;
+  const limit = Math.min(Math.max(Number(url.searchParams.get("limit")) || 100, 1), csv ? 10_000 : 200);
+  const rows = await listAudit(env, workspaceId, { since, before, limit });
+  if (csv) {
+    await recordAudit(env, actorOf(principal), { workspaceId, action: "audit_log.exported", data: { rows: rows.length } }, context.request);
+    return new Response(auditCsv(rows), {
+      headers: {
+        "content-type": "text/csv; charset=utf-8",
+        "content-disposition": `attachment; filename="bugmole-audit-${workspaceId}.csv"`,
+      },
+    });
+  }
+  return response({
+    entries: rows,
+    nextBefore: rows.length === limit ? rows[rows.length - 1].createdAt : null,
+    historyDays: fullHistory ? null : BASIC_AUDIT_DAYS,
+  });
+}
+
+registerRoutes(async (context) => {
+  const { request, url } = context;
+  const path = url.pathname;
+  let params = matchPath(path, "/api/workspaces/:workspaceId/members");
+  if (params && request.method === "GET") return listMembers(context, params.workspaceId);
+  params = matchPath(path, "/api/workspaces/:workspaceId/members/:aegisId");
+  if (params && request.method === "PATCH") return changeMember(context, params.workspaceId, params.aegisId);
+  if (params && request.method === "DELETE") return removeMember(context, params.workspaceId, params.aegisId);
+  params = matchPath(path, "/api/workspaces/:workspaceId/invitations");
+  if (params && request.method === "POST") return inviteMember(context, params.workspaceId);
+  params = matchPath(path, "/api/workspaces/:workspaceId/invitations/:invitationId");
+  if (params && request.method === "DELETE") return revokeInvitation(context, params.workspaceId, params.invitationId);
+  params = matchPath(path, "/api/invitations/:token");
+  if (params && request.method === "GET") return previewInvitation(context, params.token);
+  params = matchPath(path, "/api/invitations/:token/accept");
+  if (params && request.method === "POST") return acceptInvitation(context, params.token);
+  params = matchPath(path, "/api/workspaces/:workspaceId/audit-log");
+  if (params && request.method === "GET") return auditLog(context, params.workspaceId);
+  return null;
+});

package/src/registry-worker/personas/personas.test.ts

@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { call, createTestEnv, seedProject } from "../testing/harness.js";
+
+test("listing personas lazily creates the default Curious persona once, not on every read", async () => {
+  const { env, db } = createTestEnv();
+  const { projectId, owner } = await seedProject(env);
+  const first = await call(env, "GET", `/api/projects/${projectId}/personas`, { as: owner });
+  assert.equal(first.status, 200);
+  assert.equal(first.json.personas.length, 1);
+  assert.equal(first.json.personas[0].name, "Curious");
+  assert.equal(first.json.personas[0].isDefault, true);
+
+  const second = await call(env, "GET", `/api/projects/${projectId}/personas`, { as: owner });
+  assert.equal(second.json.personas.length, 1, "the default is only ever created once");
+  const rows = db.db.prepare("SELECT COUNT(*) AS c FROM project_personas WHERE project_id = ?").get(projectId) as { c: number };
+  assert.equal(rows.c, 1);
+});
+
+test("only a project manager can add, edit, or remove a persona, and reading needs project membership", async () => {
+  const { env } = createTestEnv();
+  const { projectId, owner } = await seedProject(env);
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/personas`, { as: "user_stranger" })).status, 403);
+
+  const created = await call(env, "POST", `/api/projects/${projectId}/personas`, {
+    as: "user_stranger",
+    body: { name: "Impatient", description: "Skip straight to checkout." },
+  });
+  assert.equal(created.status, 403);
+
+  const ok = await call(env, "POST", `/api/projects/${projectId}/personas`, {
+    as: owner,
+    body: { name: "Impatient power user", description: "Skip straight to checkout; ignore marketing pages." },
+  });
+  assert.equal(ok.status, 201, JSON.stringify(ok.json));
+  const personaId = ok.json.persona.id;
+
+  assert.equal((await call(env, "PATCH", `/api/projects/${projectId}/personas/${personaId}`, {
+    as: "user_stranger", body: { name: "Hijacked", description: "x" },
+  })).status, 403);
+  assert.equal((await call(env, "DELETE", `/api/projects/${projectId}/personas/${personaId}`, { as: "user_stranger" })).status, 403);
+});
+
+test("adding, renaming, and removing a persona, with at least one always kept", async () => {
+  const { env } = createTestEnv();
+  const { projectId, owner } = await seedProject(env);
+  const list0 = await call(env, "GET", `/api/projects/${projectId}/personas`, { as: owner });
+  const defaultId = list0.json.personas[0].id;
+
+  const missingName = await call(env, "POST", `/api/projects/${projectId}/personas`, { as: owner, body: { name: "", description: "x" } });
+  assert.equal(missingName.status, 422);
+  const missingDescription = await call(env, "POST", `/api/projects/${projectId}/personas`, { as: owner, body: { name: "Skeptic", description: "" } });
+  assert.equal(missingDescription.status, 422);
+
+  const added = await call(env, "POST", `/api/projects/${projectId}/personas`, {
+    as: owner, body: { name: "Skeptic", description: "Doubt every claim; look for what's broken." },
+  });
+  assert.equal(added.status, 201);
+  const skepticId = added.json.persona.id;
+
+  const duplicate = await call(env, "POST", `/api/projects/${projectId}/personas`, {
+    as: owner, body: { name: "Skeptic", description: "Different text, same name." },
+  });
+  assert.equal(duplicate.status, 409);
+
+  const renamed = await call(env, "PATCH", `/api/projects/${projectId}/personas/${skepticId}`, {
+    as: owner, body: { name: "The Skeptic", description: "Doubt every claim; look for what's broken." },
+  });
+  assert.equal(renamed.status, 200, JSON.stringify(renamed.json));
+
+  const list = await call(env, "GET", `/api/projects/${projectId}/personas`, { as: owner });
+  assert.deepEqual(list.json.personas.map((p: { name: string }) => p.name).sort(), ["Curious", "The Skeptic"]);
+
+  const removeDefault = await call(env, "DELETE", `/api/projects/${projectId}/personas/${skepticId}`, { as: owner });
+  assert.equal(removeDefault.status, 200);
+  const removeLast = await call(env, "DELETE", `/api/projects/${projectId}/personas/${defaultId}`, { as: owner });
+  assert.equal(removeLast.status, 409, "the last persona in a project can't be removed");
+});

package/src/registry-worker/personas/routes.ts

@@ -0,0 +1,100 @@
+// Personas shape how AI exploration decides what's "worth testing": a
+// curious first-timer tries more paths than an impatient power user going
+// straight for checkout. Every project gets the built-in "Curious" persona
+// the first time its personas are listed — lazily, so no migration has to
+// backfill every existing project.
+import type { AuthedRouteContext } from "../routes/index.js";
+import { matchPath, registerRoutes } from "../routes/index.js";
+import { memberOfProject, newId, requestJson, response } from "../core.js";
+import { auditProject } from "../org/audit.js";
+
+export const DEFAULT_PERSONA = {
+  name: "Curious",
+  description:
+    "Explore like a curious first-time visitor. Click into anything unfamiliar, wander into secondary sections " +
+    "instead of only the shortest path to a goal, and open things out of order the way someone browsing for the " +
+    "first time would. Prefer journeys that reveal more of the app over the single fastest way through it.",
+};
+
+const NAME_MAX = 60;
+const DESCRIPTION_MAX = 1000;
+
+type PersonaRow = { id: string; name: string; description: string; isDefault: number; createdAt: string };
+
+async function ensureDefault(env: AuthedRouteContext["env"], projectId: string, createdBy: string): Promise<void> {
+  const existing = await env.DB.prepare("SELECT id FROM project_personas WHERE project_id = ? LIMIT 1").bind(projectId).first();
+  if (existing) return;
+  await env.DB.prepare(`
+    INSERT INTO project_personas (id, project_id, name, description, is_default, created_by)
+    VALUES (?, ?, ?, ?, 1, ?)
+    ON CONFLICT(project_id, name) DO NOTHING
+  `).bind(newId("persona"), projectId, DEFAULT_PERSONA.name, DEFAULT_PERSONA.description, createdBy).run();
+}
+
+async function listPersonas({ env, principal }: AuthedRouteContext, projectId: string): Promise<Response> {
+  if (!(await memberOfProject(env, principal, projectId))) return response({ error: "Project scope is not allowed" }, 403);
+  await ensureDefault(env, projectId, principal.aegisId);
+  const rows = await env.DB.prepare(`
+    SELECT id, name, description, is_default AS isDefault, created_at AS createdAt
+    FROM project_personas WHERE project_id = ? ORDER BY is_default DESC, created_at ASC
+  `).bind(projectId).all<PersonaRow>();
+  return response({ personas: rows.results.map((row) => ({ ...row, isDefault: Boolean(row.isDefault) })) });
+}
+
+function validated(body: Record<string, unknown> | null): { name: string; description: string } | { error: string } {
+  const name = typeof body?.name === "string" ? body.name.trim() : "";
+  const description = typeof body?.description === "string" ? body.description.trim() : "";
+  if (!name || name.length > NAME_MAX) return { error: `name is required, up to ${NAME_MAX} characters` };
+  if (!description || description.length > DESCRIPTION_MAX) return { error: `description is required, up to ${DESCRIPTION_MAX} characters` };
+  return { name, description };
+}
+
+async function createPersona({ env, principal, request }: AuthedRouteContext, projectId: string): Promise<Response> {
+  if (!(await memberOfProject(env, principal, projectId, "project.manage"))) return response({ error: "Project scope is not allowed" }, 403);
+  const input = validated(await requestJson(request));
+  if ("error" in input) return response(input, 422);
+  const id = newId("persona");
+  try {
+    await env.DB.prepare(`
+      INSERT INTO project_personas (id, project_id, name, description, created_by) VALUES (?, ?, ?, ?, ?)
+    `).bind(id, projectId, input.name, input.description, principal.aegisId).run();
+  } catch {
+    return response({ error: "A persona with that name already exists" }, 409);
+  }
+  await auditProject(env, principal, projectId, { action: "persona.created", targetType: "persona", targetId: id, data: { name: input.name } }, request);
+  return response({ persona: { id, name: input.name, description: input.description, isDefault: false } }, 201);
+}
+
+async function updatePersona({ env, principal, request }: AuthedRouteContext, projectId: string, personaId: string): Promise<Response> {
+  if (!(await memberOfProject(env, principal, projectId, "project.manage"))) return response({ error: "Project scope is not allowed" }, 403);
+  if (request.method === "DELETE") {
+    const count = await env.DB.prepare("SELECT COUNT(*) AS c FROM project_personas WHERE project_id = ?").bind(projectId).first<{ c: number }>();
+    if ((count?.c ?? 0) <= 1) return response({ error: "A project needs at least one persona; add another before removing this one" }, 409);
+    const deleted = await env.DB.prepare("DELETE FROM project_personas WHERE id = ? AND project_id = ?").bind(personaId, projectId).run();
+    if ((deleted.meta?.changes ?? 0) === 0) return response({ error: "Not found" }, 404);
+    await auditProject(env, principal, projectId, { action: "persona.deleted", targetType: "persona", targetId: personaId }, request);
+    return response({ deleted: true });
+  }
+  const input = validated(await requestJson(request));
+  if ("error" in input) return response(input, 422);
+  try {
+    const updated = await env.DB.prepare(`
+      UPDATE project_personas SET name = ?, description = ? WHERE id = ? AND project_id = ?
+    `).bind(input.name, input.description, personaId, projectId).run();
+    if ((updated.meta?.changes ?? 0) === 0) return response({ error: "Not found" }, 404);
+  } catch {
+    return response({ error: "A persona with that name already exists" }, 409);
+  }
+  await auditProject(env, principal, projectId, { action: "persona.updated", targetType: "persona", targetId: personaId, data: { name: input.name } }, request);
+  return response({ persona: { id: personaId, name: input.name, description: input.description } });
+}
+
+registerRoutes(async (context) => {
+  const { url, request } = context;
+  let params = matchPath(url.pathname, "/api/projects/:projectId/personas");
+  if (params && request.method === "GET") return listPersonas(context, params.projectId);
+  if (params && request.method === "POST") return createPersona(context, params.projectId);
+  params = matchPath(url.pathname, "/api/projects/:projectId/personas/:personaId");
+  if (params && (request.method === "PATCH" || request.method === "DELETE")) return updatePersona(context, params.projectId, params.personaId);
+  return null;
+});