@cat-factory/workspaces 0.15.1 → 0.16.0

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { WorkspaceService, type WorkspaceServiceDependencies, } from './modules/workspaces/WorkspaceService.js';
+export { WorkspaceMemberService, type WorkspaceMemberServiceDependencies, } from './modules/workspaces/WorkspaceMemberService.js';
 export { AccountService, type AccountServiceDependencies, type AccountUser, } from './modules/accounts/AccountService.js';
 export { UserService, type UserServiceDependencies, type IdentityProfile, } from './modules/users/UserService.js';
 export { InvitationService, type InvitationServiceDependencies, type CreatedInvitation, } from './modules/invitations/InvitationService.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,GAClC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,cAAc,EACd,KAAK,0BAA0B,EAC/B,KAAK,WAAW,GACjB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,eAAe,GACrB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,iBAAiB,GACvB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,EACrC,KAAK,WAAW,GACjB,MAAM,wCAAwC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,gBAAgB,EAChB,KAAK,4BAA4B,GAClC,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,gDAAgD,CAAA;AACvD,OAAO,EACL,cAAc,EACd,KAAK,0BAA0B,EAC/B,KAAK,WAAW,GACjB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,eAAe,GACrB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,iBAAiB,GACvB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,EACrC,KAAK,WAAW,GACjB,MAAM,wCAAwC,CAAA"}

package/dist/index.js

@@ -1,5 +1,6 @@
 // Public surface of the tenancy base layer.
 export { WorkspaceService, } from './modules/workspaces/WorkspaceService.js';
+export { WorkspaceMemberService, } from './modules/workspaces/WorkspaceMemberService.js';
 export { AccountService, } from './modules/accounts/AccountService.js';
 export { UserService, } from './modules/users/UserService.js';
 export { InvitationService, } from './modules/invitations/InvitationService.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAE5C,OAAO,EACL,gBAAgB,GAEjB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,cAAc,GAGf,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,WAAW,GAGZ,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,iBAAiB,GAGlB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,oBAAoB,GAGrB,MAAM,wCAAwC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAE5C,OAAO,EACL,gBAAgB,GAEjB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACL,sBAAsB,GAEvB,MAAM,gDAAgD,CAAA;AACvD,OAAO,EACL,cAAc,GAGf,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,WAAW,GAGZ,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,iBAAiB,GAGlB,MAAM,4CAA4C,CAAA;AACnD,OAAO,EACL,oBAAoB,GAGrB,MAAM,wCAAwC,CAAA"}

package/dist/modules/workspaces/WorkspaceMemberService.d.ts

@@ -0,0 +1,73 @@
+import type { WorkspaceAccessMode, WorkspaceMember, WorkspaceRole, Workspace } from '@cat-factory/kernel';
+import type { GroupCacheHandle, MembershipRepository, UserRepository, WorkspaceAccessCacheValue, WorkspaceMemberRepository, WorkspaceRepository } from '@cat-factory/kernel';
+import type { Clock } from '@cat-factory/kernel';
+export interface WorkspaceMemberServiceDependencies {
+    workspaceMemberRepository: WorkspaceMemberRepository;
+    workspaceRepository: WorkspaceRepository;
+    /** Enforces the "target must belong to the owning account" rule (account membership is a prerequisite). */
+    membershipRepository: MembershipRepository;
+    clock: Clock;
+    /** Optional: resolve member display details (name/email/avatar) for the roster. */
+    userRepository?: UserRepository;
+    /**
+     * The `workspaceAccess` cache slice. When wired, every roster/access-mode write invalidates the
+     * board's group so the gate re-resolves on the next request. Optional — absent (tests / no cache)
+     * ⇒ the write skips invalidation (the gate reads live).
+     */
+    workspaceAccessCache?: GroupCacheHandle<WorkspaceAccessCacheValue>;
+}
+/** Manages a board's explicit member roster and its account/restricted access mode. */
+export declare class WorkspaceMemberService {
+    private readonly members;
+    private readonly workspaces;
+    private readonly memberships;
+    private readonly clock;
+    private readonly users?;
+    private readonly cache?;
+    constructor(deps: WorkspaceMemberServiceDependencies);
+    /**
+     * The board's roster, enriched with each member's display details (name/email/avatar) via ONE
+     * batched `listByIds` — the {@link AccountService.members} pattern, never a per-member point-read.
+     * 404s a non-existent board (an empty roster and a missing board must not read the same to the
+     * caller).
+     */
+    list(workspaceId: string): Promise<WorkspaceMember[]>;
+    /**
+     * Add (or re-role, upsert semantics) a member. The target MUST already belong to the board's
+     * owning account — a `restricted` board narrows WITHIN an account, it never grants across the
+     * account boundary; a non-account-member is a {@link ValidationError}. A legacy board
+     * (`account_id IS NULL`) is auto-healed into an account first ({@link ensureAccountScoped}).
+     */
+    add(workspaceId: string, userId: string, role: WorkspaceRole, addedByUserId: string | null): Promise<WorkspaceMember>;
+    /** Change an existing member's role (404 when they hold no row). Preserves the audit metadata. */
+    setRole(workspaceId: string, userId: string, role: WorkspaceRole): Promise<WorkspaceMember>;
+    /** Remove a member's row. Idempotent (removing an absent row is a no-op). */
+    remove(workspaceId: string, userId: string): Promise<void>;
+    /**
+     * Flip a board's access mode (`account` ⇄ `restricted`). Returns the updated board so the SPA can
+     * patch it in place. Auto-heals a legacy board first ({@link ensureAccountScoped}) — an access
+     * mode on an unscoped board is a silent no-op (resolution's legacy branch ignores it), so the
+     * flip only means something once the board is account-scoped. Invalidates the access cache — the
+     * mode is a direct input to resolution for every user.
+     */
+    setAccessMode(workspaceId: string, mode: WorkspaceAccessMode): Promise<Workspace>;
+    /**
+     * The board's owning account id — auto-healing a legacy (`account_id IS NULL`) board on the way.
+     * Member management requires an account: a `restricted` board narrows WITHIN an account, and an
+     * unscoped board is invisible to resolution's account tier (only its owner sees it), so a roster
+     * / access-mode change on it would silently do nothing. Rather than refuse (the old behaviour) we
+     * LINK the board to an account and proceed — "drop support for legacy boards" means heal them.
+     *
+     * The adopt target is the board OWNER's sole account: on a legacy board the owner is the only
+     * principal resolution lets reach member management (the account-admin escape hatch does not
+     * apply to the `account_id IS NULL` branch), so the caller here IS the owner. Ambiguous — no
+     * owner, or the owner belongs to several accounts — throws a {@link ValidationError} telling the
+     * caller to link the board explicitly (auto-heal never guesses which account to expose a board
+     * to). On heal we also (re)assert the owner's `admin` member row so a follow-up flip to
+     * `restricted` can't lock the owner out, mirroring the creator auto-enroll in `WorkspaceService`.
+     */
+    private ensureAccountScoped;
+    /** Drop the board's cached access decisions after a write commits (no-op when unwired). */
+    private invalidate;
+}
+//# sourceMappingURL=WorkspaceMemberService.d.ts.map

package/dist/modules/workspaces/WorkspaceMemberService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceMemberService.d.ts","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,SAAS,EACV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,yBAAyB,EAEzB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAqBhD,MAAM,WAAW,kCAAkC;IACjD,yBAAyB,EAAE,yBAAyB,CAAA;IACpD,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,2GAA2G;IAC3G,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,KAAK,EAAE,KAAK,CAAA;IACZ,mFAAmF;IACnF,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,gBAAgB,CAAC,yBAAyB,CAAC,CAAA;CACnE;AAED,uFAAuF;AACvF,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAO;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAA6C;IAEpE,YAAY,IAAI,EAAE,kCAAkC,EAOnD;IAED;;;;;OAKG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAe1D;IAED;;;;;OAKG;IACG,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,EACnB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,eAAe,CAAC,CAiB1B;IAED,kGAAkG;IAC5F,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,CAAC,CAO1B;IAED,6EAA6E;IACvE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG/D;IAED;;;;;;OAMG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAKtF;IAED;;;;;;;;;;;;;;OAcG;YACW,mBAAmB;IAkCjC,2FAA2F;YAC7E,UAAU;CAGzB"}

package/dist/modules/workspaces/WorkspaceMemberService.js

@@ -0,0 +1,147 @@
+import { NotFoundError, ValidationError, assertFound, requireWorkspace } from '@cat-factory/kernel';
+/** Manages a board's explicit member roster and its account/restricted access mode. */
+export class WorkspaceMemberService {
+    members;
+    workspaces;
+    memberships;
+    clock;
+    users;
+    cache;
+    constructor(deps) {
+        this.members = deps.workspaceMemberRepository;
+        this.workspaces = deps.workspaceRepository;
+        this.memberships = deps.membershipRepository;
+        this.clock = deps.clock;
+        this.users = deps.userRepository;
+        this.cache = deps.workspaceAccessCache;
+    }
+    /**
+     * The board's roster, enriched with each member's display details (name/email/avatar) via ONE
+     * batched `listByIds` — the {@link AccountService.members} pattern, never a per-member point-read.
+     * 404s a non-existent board (an empty roster and a missing board must not read the same to the
+     * caller).
+     */
+    async list(workspaceId) {
+        await requireWorkspace(this.workspaces, workspaceId);
+        const rows = await this.members.listByWorkspace(workspaceId);
+        if (!this.users || rows.length === 0)
+            return rows.map(toWire);
+        const records = await this.users.listByIds(rows.map((m) => m.userId));
+        const byId = new Map(records.map((u) => [u.id, u]));
+        return rows.map((m) => {
+            const user = byId.get(m.userId);
+            return {
+                ...toWire(m),
+                name: user?.name ?? null,
+                email: user?.email ?? null,
+                avatarUrl: user?.avatarUrl ?? null,
+            };
+        });
+    }
+    /**
+     * Add (or re-role, upsert semantics) a member. The target MUST already belong to the board's
+     * owning account — a `restricted` board narrows WITHIN an account, it never grants across the
+     * account boundary; a non-account-member is a {@link ValidationError}. A legacy board
+     * (`account_id IS NULL`) is auto-healed into an account first ({@link ensureAccountScoped}).
+     */
+    async add(workspaceId, userId, role, addedByUserId) {
+        const accountId = await this.ensureAccountScoped(workspaceId);
+        if (!(await this.memberships.get(accountId, userId))) {
+            throw new ValidationError('A workspace member must first belong to the board’s owning account');
+        }
+        // Upsert preserves the ORIGINAL grant metadata on conflict (both repos `ON CONFLICT DO UPDATE`
+        // only `role`), so a re-add of an existing member must return THOSE stored values — never a
+        // fresh `createdAt` / `addedBy` the persisted row (and every later read) wouldn't reflect.
+        const existing = await this.members.get(workspaceId, userId);
+        const record = existing
+            ? { ...existing, role }
+            : { workspaceId, userId, role, createdAt: this.clock.now(), addedByUserId };
+        await this.members.upsert(record);
+        await this.invalidate(workspaceId);
+        return toWire(record);
+    }
+    /** Change an existing member's role (404 when they hold no row). Preserves the audit metadata. */
+    async setRole(workspaceId, userId, role) {
+        const existing = await this.members.get(workspaceId, userId);
+        if (!existing)
+            throw new NotFoundError('Workspace member', userId);
+        const record = { ...existing, role };
+        await this.members.upsert(record);
+        await this.invalidate(workspaceId);
+        return toWire(record);
+    }
+    /** Remove a member's row. Idempotent (removing an absent row is a no-op). */
+    async remove(workspaceId, userId) {
+        await this.members.remove(workspaceId, userId);
+        await this.invalidate(workspaceId);
+    }
+    /**
+     * Flip a board's access mode (`account` ⇄ `restricted`). Returns the updated board so the SPA can
+     * patch it in place. Auto-heals a legacy board first ({@link ensureAccountScoped}) — an access
+     * mode on an unscoped board is a silent no-op (resolution's legacy branch ignores it), so the
+     * flip only means something once the board is account-scoped. Invalidates the access cache — the
+     * mode is a direct input to resolution for every user.
+     */
+    async setAccessMode(workspaceId, mode) {
+        await this.ensureAccountScoped(workspaceId);
+        await this.workspaces.setAccessMode(workspaceId, mode);
+        await this.invalidate(workspaceId);
+        return requireWorkspace(this.workspaces, workspaceId);
+    }
+    /**
+     * The board's owning account id — auto-healing a legacy (`account_id IS NULL`) board on the way.
+     * Member management requires an account: a `restricted` board narrows WITHIN an account, and an
+     * unscoped board is invisible to resolution's account tier (only its owner sees it), so a roster
+     * / access-mode change on it would silently do nothing. Rather than refuse (the old behaviour) we
+     * LINK the board to an account and proceed — "drop support for legacy boards" means heal them.
+     *
+     * The adopt target is the board OWNER's sole account: on a legacy board the owner is the only
+     * principal resolution lets reach member management (the account-admin escape hatch does not
+     * apply to the `account_id IS NULL` branch), so the caller here IS the owner. Ambiguous — no
+     * owner, or the owner belongs to several accounts — throws a {@link ValidationError} telling the
+     * caller to link the board explicitly (auto-heal never guesses which account to expose a board
+     * to). On heal we also (re)assert the owner's `admin` member row so a follow-up flip to
+     * `restricted` can't lock the owner out, mirroring the creator auto-enroll in `WorkspaceService`.
+     */
+    async ensureAccountScoped(workspaceId) {
+        const row = assertFound(await this.workspaces.accessRowOf(workspaceId), 'Workspace', workspaceId);
+        if (row.accountId !== null)
+            return row.accountId;
+        const { ownerUserId } = row;
+        if (!ownerUserId) {
+            throw new ValidationError('This board is not linked to an account and has no owner to link it through — assign it to an account first');
+        }
+        const accounts = await this.memberships.listByUser(ownerUserId);
+        if (accounts.length !== 1) {
+            throw new ValidationError('This board is not linked to an account — link it to one of its owner’s accounts to manage members');
+        }
+        const accountId = accounts[0].accountId;
+        await this.workspaces.linkAccount(workspaceId, accountId);
+        // Keep the owner in admin control post-heal (a restricted board reads member rows only). System
+        // grant ⇒ `addedByUserId: null`; upsert preserves an existing row's audit metadata.
+        await this.members.upsert({
+            workspaceId,
+            userId: ownerUserId,
+            role: 'admin',
+            createdAt: this.clock.now(),
+            addedByUserId: null,
+        });
+        await this.invalidate(workspaceId);
+        return accountId;
+    }
+    /** Drop the board's cached access decisions after a write commits (no-op when unwired). */
+    async invalidate(workspaceId) {
+        await this.cache?.invalidateGroup(workspaceId);
+    }
+}
+/** Map a persistence record to its wire shape (audit `addedByUserId` → `addedBy`). */
+function toWire(record) {
+    return {
+        workspaceId: record.workspaceId,
+        userId: record.userId,
+        role: record.role,
+        createdAt: record.createdAt,
+        addedBy: record.addedByUserId,
+    };
+}
+//# sourceMappingURL=WorkspaceMemberService.js.map

package/dist/modules/workspaces/WorkspaceMemberService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceMemberService.js","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceMemberService.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAoCnG,uFAAuF;AACvF,MAAM,OAAO,sBAAsB;IAChB,OAAO,CAA2B;IAClC,UAAU,CAAqB;IAC/B,WAAW,CAAsB;IACjC,KAAK,CAAO;IACZ,KAAK,CAAiB;IACtB,KAAK,CAA8C;IAEpE,YAAY,IAAwC;QAClD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,yBAAyB,CAAA;QAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAA;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAA;QAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,cAAc,CAAA;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAA;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,MAAM,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;QAC5D,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QACrE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YAC/B,OAAO;gBACL,GAAG,MAAM,CAAC,CAAC,CAAC;gBACZ,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;gBACxB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI;gBAC1B,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;aACnC,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CACP,WAAmB,EACnB,MAAc,EACd,IAAmB,EACnB,aAA4B;QAE5B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAC7D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CACvB,oEAAoE,CACrE,CAAA;QACH,CAAC;QACD,+FAA+F;QAC/F,4FAA4F;QAC5F,2FAA2F;QAC3F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC5D,MAAM,MAAM,GAA0B,QAAQ;YAC5C,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE;YACvB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAA;QAC7E,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,MAAc,EACd,IAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC5D,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;QAClE,MAAM,MAAM,GAA0B,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,MAAc;QAC9C,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,IAAyB;QAChE,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAC3C,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACtD,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IACvD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,mBAAmB,CAAC,WAAmB;QACnD,MAAM,GAAG,GAAG,WAAW,CACrB,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,EAC9C,WAAW,EACX,WAAW,CACZ,CAAA;QACD,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,SAAS,CAAA;QAChD,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAA;QAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CACvB,4GAA4G,CAC7G,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,mGAAmG,CACpG,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,SAAS,CAAA;QACxC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QACzD,gGAAgG;QAChG,oFAAoF;QACpF,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACxB,WAAW;YACX,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3B,aAAa,EAAE,IAAI;SACpB,CAAC,CAAA;QACF,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAClC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,2FAA2F;IACnF,KAAK,CAAC,UAAU,CAAC,WAAmB;QAC1C,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,WAAW,CAAC,CAAA;IAChD,CAAC;CACF;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,MAA6B;IAC3C,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,aAAa;KAC9B,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/workspaces",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "Tenancy base services (workspaces and accounts) for the Agent Architecture Board.",
   "repository": {
     "type": "git",
@@ -24,8 +24,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@cat-factory/contracts": "0.143.0",
-    "@cat-factory/kernel": "0.137.0"
+    "@cat-factory/contracts": "0.145.0",
+    "@cat-factory/kernel": "0.138.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",