@fonderie/workspaces 1.0.0

package/dist/index.cjs

@@ -0,0 +1,1339 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  EVENT_KEYS: () => EVENT_KEYS,
+  MESSAGE_KEYS: () => MESSAGE_KEYS,
+  WorkspacesModule: () => WorkspacesModule,
+  requireWorkspace: () => requireWorkspace,
+  toInvitationDTO: () => toInvitationDTO,
+  toMemberDTO: () => toMemberDTO,
+  toRoleDTO: () => toRoleDTO,
+  toSettingsDTO: () => toSettingsDTO,
+  toWorkspaceDTO: () => toWorkspaceDTO,
+  withWorkspace: () => withWorkspace
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/config.ts
+var MESSAGE_KEYS = {
+  workspaceInvitation: "workspace-invitation"
+};
+var EVENT_KEYS = {
+  personalWorkspaceCreated: "fonderie.workspace.personal.created"
+};
+
+// src/routes.ts
+var import_middlewares = require("@fonderie/core/middlewares");
+
+// src/middlewares/workspace-context.ts
+var import_core = require("@fonderie/core");
+
+// src/services/members.ts
+var SELECT_MEMBER = `
+	ruw.user_id           AS "userId",
+	ruw.workspace_id      AS "workspaceId",
+	ruw.role_id           AS "roleId",
+	r.name                AS "roleName",
+	ruw.confirmed         AS "confirmed",
+	ruw.created_at        AS "createdAt",
+	u.first_name          AS "firstName",
+	u.last_name           AS "lastName",
+	u.email               AS "email",
+	u.profile_image_url   AS "profileImageUrl"
+`;
+async function getMember(userId, workspaceId, store) {
+  const [row] = await store.query(
+    `SELECT ${SELECT_MEMBER}
+		 FROM fonderie_role_user_workspaces ruw
+		 LEFT JOIN fonderie_roles r ON r.id = ruw.role_id
+		 LEFT JOIN fonderie_users u ON u.id = ruw.user_id
+		 WHERE ruw.user_id      = $1
+		   AND ruw.workspace_id = $2
+		   AND ruw.removed      = false
+		   AND ruw.suspended    = false
+		 LIMIT 1`,
+    [userId, workspaceId]
+  );
+  return row ?? null;
+}
+async function listMembers(workspaceId, store) {
+  return store.query(
+    `SELECT ${SELECT_MEMBER}
+		 FROM fonderie_role_user_workspaces ruw
+		 LEFT JOIN fonderie_roles r ON r.id = ruw.role_id
+		 LEFT JOIN fonderie_users u ON u.id = ruw.user_id
+		 WHERE ruw.workspace_id = $1
+		   AND ruw.removed      = false
+		   AND ruw.suspended    = false
+		 ORDER BY ruw.created_at ASC`,
+    [workspaceId]
+  );
+}
+async function addMember(opts, store) {
+  await store.query(
+    `INSERT INTO fonderie_role_user_workspaces (user_id, workspace_id, role_id, confirmed)
+		 VALUES ($1, $2, $3, $4)
+		 ON CONFLICT (user_id, workspace_id, role_id) DO UPDATE
+		 SET confirmed = $4, removed = false, suspended = false`,
+    [opts.userId, opts.workspaceId, opts.roleId, opts.confirmed ?? true]
+  );
+}
+async function removeMember(userId, workspaceId, store) {
+  await store.query(
+    `UPDATE fonderie_role_user_workspaces
+		 SET removed = true
+		 WHERE user_id      = $1
+		   AND workspace_id = $2`,
+    [userId, workspaceId]
+  );
+}
+async function getUserRoles(userId, workspaceId, store) {
+  return store.query(
+    `SELECT
+		   r.id,
+		   r.name,
+		   r.is_system    AS "isSystem",
+		   r.active,
+		   r.description,
+		   r.workspace_id AS "workspaceId"
+		 FROM fonderie_role_user_workspaces ruw
+		 JOIN fonderie_roles r ON r.id = ruw.role_id
+		 WHERE ruw.user_id      = $1
+		   AND ruw.workspace_id = $2
+		   AND ruw.removed      = false
+		   AND ruw.suspended    = false`,
+    [userId, workspaceId]
+  );
+}
+async function addRoleToMember(userId, workspaceId, roleId, store) {
+  await store.query(
+    `INSERT INTO fonderie_role_user_workspaces (user_id, workspace_id, role_id, confirmed)
+		 VALUES ($1, $2, $3, true)
+		 ON CONFLICT (user_id, workspace_id, role_id) DO UPDATE
+		 SET confirmed = true, removed = false, suspended = false`,
+    [userId, workspaceId, roleId]
+  );
+}
+async function removeRoleFromMember(userId, workspaceId, roleId, store) {
+  const remaining = await store.query(
+    `SELECT COUNT(*) AS count
+		 FROM fonderie_role_user_workspaces
+		 WHERE user_id      = $1
+		   AND workspace_id = $2
+		   AND removed      = false`,
+    [userId, workspaceId]
+  );
+  const count = parseInt(remaining[0]?.count ?? "0", 10);
+  if (count <= 1) throw new Error("Cannot remove last role from member");
+  await store.query(
+    `DELETE FROM fonderie_role_user_workspaces
+		 WHERE user_id      = $1
+		   AND workspace_id = $2
+		   AND role_id      = $3`,
+    [userId, workspaceId, roleId]
+  );
+}
+
+// src/services/workspaces.ts
+var SELECT_WS = `
+	id,
+	name,
+	slug,
+	type,
+	description,
+	motto,
+	phone,
+	business_type AS "businessType",
+	address,
+	plan,
+	owner_id    AS "ownerId",
+	is_personal AS "isPersonal",
+	archived_at AS "archivedAt",
+	archived_by AS "archivedBy",
+	created_at  AS "createdAt",
+	updated_at  AS "updatedAt"
+`;
+var SELECT_WS_W = `
+	w.id,
+	w.name,
+	w.slug,
+	w.type,
+	w.description,
+	w.motto,
+	w.phone,
+	w.business_type AS "businessType",
+	w.address,
+	w.plan,
+	w.owner_id    AS "ownerId",
+	w.is_personal AS "isPersonal",
+	w.archived_at AS "archivedAt",
+	w.archived_by AS "archivedBy",
+	w.created_at  AS "createdAt",
+	w.updated_at  AS "updatedAt"
+`;
+async function findWorkspaceById(id, store) {
+  const [row] = await store.query(
+    `SELECT ${SELECT_WS} FROM fonderie_workspaces WHERE id = $1`,
+    [id]
+  );
+  return row ?? null;
+}
+async function findWorkspacesByUserId(userId, store) {
+  return store.query(
+    `SELECT ${SELECT_WS_W}
+		 FROM fonderie_workspaces w
+		 JOIN fonderie_role_user_workspaces ruw ON ruw.workspace_id = w.id
+		 WHERE ruw.user_id   = $1
+		   AND ruw.removed   = false
+		   AND ruw.suspended = false
+		 GROUP BY w.id
+		 ORDER BY w.created_at ASC`,
+    [userId]
+  );
+}
+async function createWorkspace(opts, store) {
+  const [workspace] = await store.query(
+    `INSERT INTO fonderie_workspaces (name, slug, owner_id, type, description, plan)
+		 VALUES ($1, $2, $3, $4, $5, $6)
+		 RETURNING ${SELECT_WS}`,
+    [
+      opts.name,
+      opts.slug,
+      opts.ownerId,
+      opts.type ?? "ORGANIZATION",
+      opts.description ?? null,
+      opts.plan ?? "free"
+    ]
+  );
+  if (!workspace) throw new Error("Failed to create workspace");
+  return workspace;
+}
+async function createPersonalWorkspace(opts, store) {
+  const [workspace] = await store.query(
+    `INSERT INTO fonderie_workspaces (name, slug, owner_id, type, is_personal)
+		 VALUES ($1, $2, $3, 'PERSONAL', true)
+		 ON CONFLICT (owner_id) WHERE is_personal = true DO NOTHING
+		 RETURNING ${SELECT_WS}`,
+    [opts.name, opts.slug, opts.ownerId]
+  );
+  return workspace ?? null;
+}
+async function findPersonalWorkspace(userId, store) {
+  const [row] = await store.query(
+    `SELECT ${SELECT_WS} FROM fonderie_workspaces
+		 WHERE owner_id = $1 AND is_personal = true
+		 LIMIT 1`,
+    [userId]
+  );
+  return row ?? null;
+}
+async function updateWorkspace(id, opts, store) {
+  const sets = ["updated_at = now()"];
+  const params = [id];
+  if (opts.name !== void 0) {
+    params.push(opts.name);
+    sets.push(`name = $${params.length}`);
+  }
+  if (opts.description !== void 0) {
+    params.push(opts.description);
+    sets.push(`description = $${params.length}`);
+  }
+  if (opts.slug !== void 0) {
+    params.push(opts.slug);
+    sets.push(`slug = $${params.length}`);
+  }
+  if (opts.motto !== void 0) {
+    params.push(opts.motto);
+    sets.push(`motto = $${params.length}`);
+  }
+  if (opts.phone !== void 0) {
+    params.push(opts.phone);
+    sets.push(`phone = $${params.length}`);
+  }
+  if (opts.businessType !== void 0) {
+    params.push(opts.businessType);
+    sets.push(`business_type = $${params.length}`);
+  }
+  if (opts.address !== void 0) {
+    params.push(JSON.stringify(opts.address ?? {}));
+    sets.push(`address = $${params.length}::jsonb`);
+  }
+  const [row] = await store.query(
+    `UPDATE fonderie_workspaces
+		 SET ${sets.join(", ")}
+		 WHERE id = $1
+		 RETURNING ${SELECT_WS}`,
+    params
+  );
+  return row ?? null;
+}
+async function archiveWorkspace(id, byUser, store) {
+  await store.query(
+    `UPDATE fonderie_workspaces
+		 SET archived_at = now(), archived_by = $2, updated_at = now()
+		 WHERE id = $1 AND archived_at IS NULL`,
+    [id, byUser]
+  );
+}
+async function restoreWorkspace(id, store) {
+  await store.query(
+    `UPDATE fonderie_workspaces
+		 SET archived_at = NULL, archived_by = NULL, updated_at = now()
+		 WHERE id = $1`,
+    [id]
+  );
+}
+var SETTINGS_DEFAULTS = {
+  locale: "en-US",
+  timezone: "UTC",
+  currency: "USD",
+  dateFormat: "MM/DD/YYYY",
+  timeFormat: "hh:mm A"
+};
+async function getWorkspaceSettings(id, store) {
+  const [row] = await store.query(
+    `SELECT settings FROM fonderie_workspaces WHERE id = $1`,
+    [id]
+  );
+  const raw = row?.settings ?? {};
+  const s = raw["settings"] ?? raw;
+  return {
+    locale: typeof s["locale"] === "string" ? s["locale"] : SETTINGS_DEFAULTS.locale,
+    timezone: typeof s["timezone"] === "string" ? s["timezone"] : SETTINGS_DEFAULTS.timezone,
+    currency: typeof s["currency"] === "string" ? s["currency"] : SETTINGS_DEFAULTS.currency,
+    dateFormat: typeof s["dateFormat"] === "string" ? s["dateFormat"] : SETTINGS_DEFAULTS.dateFormat,
+    timeFormat: typeof s["timeFormat"] === "string" ? s["timeFormat"] : SETTINGS_DEFAULTS.timeFormat
+  };
+}
+async function updateWorkspaceSettings(id, settings, store) {
+  await store.query(
+    `UPDATE fonderie_workspaces
+		 SET settings   = settings || jsonb_build_object('settings', $2::jsonb),
+		     updated_at = now()
+		 WHERE id = $1`,
+    [id, JSON.stringify(settings)]
+  );
+  return getWorkspaceSettings(id, store);
+}
+
+// src/middlewares/workspace-context.ts
+function makeHandler(store) {
+  return async (ctx, next) => {
+    const params = ctx.meta["params"];
+    const workspaceId = params?.["workspaceId"] ?? params?.["id"] ?? ctx.request.headers.get("x-workspace-id") ?? void 0;
+    if (!workspaceId) {
+      if (ctx.user) {
+        const personal = await findPersonalWorkspace(ctx.user.id, store);
+        if (personal) Object.assign(ctx, { workspace: personal });
+      }
+      return next();
+    }
+    const workspace = await findWorkspaceById(workspaceId, store);
+    if (!workspace) {
+      return (0, import_core.setApiResponse)(import_core.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+    }
+    if (ctx.user) {
+      const member = await getMember(ctx.user.id, workspaceId, store);
+      if (!member) {
+        return (0, import_core.setApiResponse)(import_core.HTTP.FORBIDDEN, "FORBIDDEN", "Not a member of this workspace");
+      }
+    }
+    Object.assign(ctx, { workspace });
+    return next();
+  };
+}
+function withWorkspace(store, ctx, next) {
+  const handler = makeHandler(store);
+  if (ctx !== void 0 && next !== void 0) return handler(ctx, next);
+  return handler;
+}
+
+// src/controllers/workspace.controller.ts
+var import_core2 = require("@fonderie/core");
+
+// src/models/workspace.model.ts
+var WorkspaceModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  findById(id) {
+    return findWorkspaceById(id, this.store);
+  }
+  findByUserId(userId) {
+    return findWorkspacesByUserId(userId, this.store);
+  }
+  create(opts) {
+    return createWorkspace(opts, this.store);
+  }
+  createPersonal(opts) {
+    return createPersonalWorkspace(opts, this.store);
+  }
+  findPersonal(userId) {
+    return findPersonalWorkspace(userId, this.store);
+  }
+  update(id, opts) {
+    return updateWorkspace(id, opts, this.store);
+  }
+  archive(id, byUser) {
+    return archiveWorkspace(id, byUser, this.store);
+  }
+  restore(id) {
+    return restoreWorkspace(id, this.store);
+  }
+  getSettings(id) {
+    return getWorkspaceSettings(id, this.store);
+  }
+  updateSettings(id, settings) {
+    return updateWorkspaceSettings(id, settings, this.store);
+  }
+};
+
+// src/models/member.model.ts
+var MemberModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  get(userId, workspaceId) {
+    return getMember(userId, workspaceId, this.store);
+  }
+  list(workspaceId) {
+    return listMembers(workspaceId, this.store);
+  }
+  add(opts) {
+    return addMember(opts, this.store);
+  }
+  remove(userId, workspaceId) {
+    return removeMember(userId, workspaceId, this.store);
+  }
+  getUserRoles(userId, workspaceId) {
+    return getUserRoles(userId, workspaceId, this.store);
+  }
+  addRole(userId, workspaceId, roleId) {
+    return addRoleToMember(userId, workspaceId, roleId, this.store);
+  }
+  removeRole(userId, workspaceId, roleId) {
+    return removeRoleFromMember(userId, workspaceId, roleId, this.store);
+  }
+};
+
+// src/services/roles.ts
+var SELECT_ROLE = `
+	id,
+	name,
+	is_system    AS "isSystem",
+	active,
+	description,
+	workspace_id AS "workspaceId"
+`;
+async function createRole(opts, store) {
+  const [role] = await store.query(
+    `INSERT INTO fonderie_roles (name, workspace_id, description)
+		 VALUES ($1, $2, $3)
+		 RETURNING ${SELECT_ROLE}`,
+    [opts.name, opts.workspaceId, opts.description ?? null]
+  );
+  if (!role) throw new Error("Failed to create role");
+  return role;
+}
+async function findSystemRole(name, store) {
+  const [row] = await store.query(
+    `SELECT ${SELECT_ROLE} FROM fonderie_roles WHERE name = $1 AND is_system = true LIMIT 1`,
+    [name]
+  );
+  return row ?? null;
+}
+async function getRoleById(id, store) {
+  const [row] = await store.query(
+    `SELECT ${SELECT_ROLE} FROM fonderie_roles WHERE id = $1`,
+    [id]
+  );
+  return row ?? null;
+}
+async function listWorkspaceRoles(workspaceId, store) {
+  return store.query(
+    `SELECT ${SELECT_ROLE}
+		 FROM fonderie_roles
+		 WHERE workspace_id = $1 OR is_system = true
+		 ORDER BY is_system DESC, name ASC`,
+    [workspaceId]
+  );
+}
+async function updateRole(id, opts, store) {
+  const sets = [];
+  const params = [id];
+  if (opts.name !== void 0) {
+    params.push(opts.name);
+    sets.push(`name = $${params.length}`);
+  }
+  if (opts.description !== void 0) {
+    params.push(opts.description);
+    sets.push(`description = $${params.length}`);
+  }
+  if (opts.active !== void 0) {
+    params.push(opts.active);
+    sets.push(`active = $${params.length}`);
+  }
+  if (sets.length === 0) return getRoleById(id, store);
+  const [row] = await store.query(
+    `UPDATE fonderie_roles
+		 SET ${sets.join(", ")}
+		 WHERE id = $1 AND is_system = false
+		 RETURNING ${SELECT_ROLE}`,
+    params
+  );
+  return row ?? null;
+}
+async function deleteRole(id, workspaceId, store) {
+  await store.query(
+    `DELETE FROM fonderie_roles
+		 WHERE id = $1 AND workspace_id = $2 AND is_system = false`,
+    [id, workspaceId]
+  );
+}
+async function setRolePermissions(roleId, workspaceId, permissions, store) {
+  if (permissions.length === 0) {
+    await store.query(
+      `DELETE FROM fonderie_role_permissions WHERE role_id = $1 AND workspace_id = $2`,
+      [roleId, workspaceId]
+    );
+    return;
+  }
+  await store.transaction(async (tx) => {
+    await tx.query(
+      `DELETE FROM fonderie_role_permissions WHERE role_id = $1 AND workspace_id = $2`,
+      [roleId, workspaceId]
+    );
+    for (const p of permissions) {
+      await tx.query(
+        `INSERT INTO fonderie_role_permissions
+				   (role_id, workspace_id, permission_key, can_create, can_read, can_update, can_delete)
+				 VALUES ($1, $2, $3, $4, $5, $6, $7)
+				 ON CONFLICT (role_id, permission_key)
+				 DO UPDATE SET
+				   can_create = $4, can_read = $5,
+				   can_update = $6, can_delete = $7`,
+        [roleId, workspaceId, p.permissionKey, p.canCreate, p.canRead, p.canUpdate, p.canDelete]
+      );
+    }
+  });
+}
+
+// src/models/role.model.ts
+var RoleModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  create(opts) {
+    return createRole(opts, this.store);
+  }
+  findSystem(name) {
+    return findSystemRole(name, this.store);
+  }
+  findById(id) {
+    return getRoleById(id, this.store);
+  }
+  list(workspaceId) {
+    return listWorkspaceRoles(workspaceId, this.store);
+  }
+  update(id, opts) {
+    return updateRole(id, opts, this.store);
+  }
+  delete(id, workspaceId) {
+    return deleteRole(id, workspaceId, this.store);
+  }
+  setPermissions(roleId, workspaceId, permissions) {
+    return setRolePermissions(roleId, workspaceId, permissions, this.store);
+  }
+};
+
+// src/dtos/workspace.ts
+var import_parser = require("@fonderie/core/parser");
+function toWorkspaceDTO(ws) {
+  const addr = ws.address ?? {};
+  return {
+    id: (0, import_parser.stringOrEmpty)(ws.id),
+    name: (0, import_parser.stringOrEmpty)(ws.name),
+    slug: (0, import_parser.stringOrEmpty)(ws.slug),
+    type: (0, import_parser.stringOrEmpty)(ws.type),
+    description: (0, import_parser.stringOrEmpty)(ws.description),
+    motto: (0, import_parser.stringOrEmpty)(ws.motto),
+    phone: (0, import_parser.stringOrEmpty)(ws.phone),
+    businessType: (0, import_parser.stringOrEmpty)(ws.businessType),
+    address: {
+      line1: (0, import_parser.stringOrEmpty)(addr.line1),
+      line2: (0, import_parser.stringOrEmpty)(addr.line2),
+      city: (0, import_parser.stringOrEmpty)(addr.city),
+      state: (0, import_parser.stringOrEmpty)(addr.state),
+      zip: (0, import_parser.stringOrEmpty)(addr.zip),
+      country: (0, import_parser.stringOrEmpty)(addr.country)
+    },
+    plan: (0, import_parser.stringOrEmpty)(ws.plan),
+    ownerId: (0, import_parser.stringOrEmpty)(ws.ownerId),
+    isPersonal: (0, import_parser.booleanOrFalse)(ws.isPersonal),
+    isArchived: ws.archivedAt !== null,
+    archivedAt: (0, import_parser.stringOrEmpty)(ws.archivedAt),
+    createdAt: (0, import_parser.stringOrEmpty)(ws.createdAt),
+    updatedAt: (0, import_parser.stringOrEmpty)(ws.updatedAt)
+  };
+}
+function toRoleDTO(role) {
+  return {
+    id: (0, import_parser.stringOrEmpty)(role.id),
+    name: (0, import_parser.stringOrEmpty)(role.name),
+    isSystem: (0, import_parser.booleanOrFalse)(role.isSystem),
+    active: role.active !== false,
+    description: (0, import_parser.stringOrEmpty)(role.description),
+    workspaceId: (0, import_parser.stringOrEmpty)(role.workspaceId)
+  };
+}
+function toMemberDTO(m) {
+  return {
+    userId: (0, import_parser.stringOrEmpty)(m.userId),
+    workspaceId: (0, import_parser.stringOrEmpty)(m.workspaceId),
+    roleId: (0, import_parser.stringOrEmpty)(m.roleId),
+    roleName: (0, import_parser.stringOrEmpty)(m.roleName),
+    confirmed: (0, import_parser.booleanOrFalse)(m.confirmed),
+    createdAt: (0, import_parser.stringOrEmpty)(m.createdAt)
+  };
+}
+function toInvitationDTO(inv) {
+  return {
+    id: (0, import_parser.stringOrEmpty)(inv.id),
+    workspaceId: (0, import_parser.stringOrEmpty)(inv.workspaceId),
+    email: (0, import_parser.stringOrEmpty)(inv.email),
+    roleId: (0, import_parser.stringOrEmpty)(inv.roleId),
+    token: (0, import_parser.stringOrEmpty)(inv.token),
+    status: (0, import_parser.stringOrEmpty)(inv.status),
+    expiresAt: (0, import_parser.stringOrEmpty)(inv.expiresAt),
+    createdAt: (0, import_parser.stringOrEmpty)(inv.createdAt)
+  };
+}
+function toSettingsDTO(s) {
+  return {
+    locale: (0, import_parser.stringOrEmpty)(s.locale),
+    timezone: (0, import_parser.stringOrEmpty)(s.timezone),
+    currency: (0, import_parser.stringOrEmpty)(s.currency),
+    dateFormat: (0, import_parser.stringOrEmpty)(s.dateFormat),
+    timeFormat: (0, import_parser.stringOrEmpty)(s.timeFormat)
+  };
+}
+
+// src/controllers/workspace.controller.ts
+function workspaceController(store, config) {
+  const workspaces = new WorkspaceModel(store);
+  const members = new MemberModel(store);
+  const roles = new RoleModel(store);
+  return {
+    async list(ctx) {
+      if (!ctx.user)
+        return (0, import_core2.setApiResponse)(import_core2.HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Authentication required");
+      const list = await workspaces.findByUserId(ctx.user.id);
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACES_FETCHED", "Workspaces retrieved successfully.", {
+        workspaces: list.map(toWorkspaceDTO)
+      });
+    },
+    async create(ctx) {
+      const body = ctx.meta["body"];
+      const name = body?.["name"];
+      const description = body?.["description"];
+      const type = body?.["type"];
+      if (typeof name !== "string" || name.trim().length === 0) {
+        return (0, import_core2.setApiResponse)(import_core2.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
+      }
+      if (type === "PERSONAL") {
+        return (0, import_core2.setApiResponse)(
+          import_core2.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "Personal workspaces are created automatically"
+        );
+      }
+      const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+      const workspace = await store.transaction(async (tx) => {
+        const wsOpts = {
+          name: name.trim(),
+          slug,
+          ownerId: ctx.user.id,
+          type: typeof type === "string" ? type : "ORGANIZATION"
+        };
+        if (typeof description === "string") wsOpts.description = description;
+        const wsModel = new WorkspaceModel(tx);
+        const roleModel = new RoleModel(tx);
+        const memModel = new MemberModel(tx);
+        const ws = await wsModel.create(wsOpts);
+        const adminRole = await roleModel.findSystem("ADMIN");
+        if (!adminRole) throw new Error("System ADMIN role not found");
+        await memModel.add({ userId: ctx.user.id, workspaceId: ws.id, roleId: adminRole.id });
+        return ws;
+      });
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.CREATED, "WORKSPACE_CREATED", "Workspace created successfully.", {
+        workspace: toWorkspaceDTO(workspace)
+      });
+    },
+    async get(ctx) {
+      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACE_FETCHED", "Workspace retrieved successfully.", {
+        workspace: toWorkspaceDTO(ctx.workspace)
+      });
+    },
+    async update(ctx) {
+      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const body = ctx.meta["body"];
+      const opts = {};
+      if (typeof body?.["name"] === "string") opts.name = body["name"].trim();
+      if (body?.["description"] !== void 0)
+        opts.description = typeof body["description"] === "string" ? body["description"] : null;
+      if (body?.["motto"] !== void 0)
+        opts.motto = typeof body["motto"] === "string" ? body["motto"] : null;
+      if (body?.["phone"] !== void 0)
+        opts.phone = typeof body["phone"] === "string" ? body["phone"].trim() : null;
+      if (body?.["businessType"] !== void 0)
+        opts.businessType = typeof body["businessType"] === "string" ? body["businessType"] : null;
+      if (body?.["address"] !== void 0 && typeof body["address"] === "object")
+        opts.address = body["address"];
+      const workspace = await workspaces.update(ctx.workspace.id, opts);
+      if (!workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACE_UPDATED", "Workspace updated successfully.", {
+        workspace: toWorkspaceDTO(workspace)
+      });
+    },
+    async archive(ctx) {
+      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (ctx.workspace.isPersonal) {
+        return (0, import_core2.setApiResponse)(
+          import_core2.HTTP.FORBIDDEN,
+          "FORBIDDEN",
+          "Personal workspaces cannot be archived"
+        );
+      }
+      await workspaces.archive(ctx.workspace.id, ctx.user.id);
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACE_ARCHIVED", "Workspace archived successfully.");
+    },
+    async restore(ctx) {
+      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      await workspaces.restore(ctx.workspace.id);
+      return (0, import_core2.setApiResponse)(import_core2.HTTP.OK, "WORKSPACE_RESTORED", "Workspace restored successfully.");
+    },
+    async getSettings(ctx) {
+      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const settings = await workspaces.getSettings(ctx.workspace.id);
+      return (0, import_core2.setApiResponse)(
+        import_core2.HTTP.OK,
+        "SETTINGS_FETCHED",
+        "Workspace settings retrieved successfully.",
+        {
+          settings: toSettingsDTO(settings)
+        }
+      );
+    },
+    async updateSettings(ctx) {
+      if (!ctx.workspace) return (0, import_core2.setApiResponse)(import_core2.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const body = ctx.meta["body"];
+      if (!body || Object.keys(body).length === 0) {
+        return (0, import_core2.setApiResponse)(import_core2.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "No settings provided");
+      }
+      const patch = {};
+      for (const key of ["locale", "timezone", "currency", "dateFormat", "timeFormat"]) {
+        if (typeof body[key] === "string") patch[key] = body[key];
+      }
+      const settings = await workspaces.updateSettings(ctx.workspace.id, patch);
+      return (0, import_core2.setApiResponse)(
+        import_core2.HTTP.OK,
+        "SETTINGS_UPDATED",
+        "Workspace settings updated successfully.",
+        {
+          settings: toSettingsDTO(settings)
+        }
+      );
+    }
+  };
+}
+
+// src/controllers/member.controller.ts
+var import_core3 = require("@fonderie/core");
+function memberController(store) {
+  const members = new MemberModel(store);
+  return {
+    async list(ctx) {
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const list = await members.list(ctx.workspace.id);
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "MEMBERS_FETCHED", "Members retrieved successfully.", {
+        members: list.map(toMemberDTO)
+      });
+    },
+    async remove(ctx) {
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (ctx.workspace.isPersonal) {
+        return (0, import_core3.setApiResponse)(
+          import_core3.HTTP.FORBIDDEN,
+          "FORBIDDEN",
+          "Personal workspaces do not support member management"
+        );
+      }
+      const params = ctx.meta["params"];
+      const userId = params?.["userId"];
+      if (!userId)
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+      if (userId === ctx.user?.id) {
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "INVALID_OPERATION", "Cannot remove yourself");
+      }
+      await members.remove(userId, ctx.workspace.id);
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "MEMBER_REMOVED", "Member removed successfully.");
+    },
+    async getUserRoles(ctx) {
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const params = ctx.meta["params"];
+      const userId = params?.["userId"];
+      if (!userId)
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+      const roles = await members.getUserRoles(userId, ctx.workspace.id);
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "ROLES_FETCHED", "Member roles retrieved successfully.", {
+        roles: roles.map(toRoleDTO)
+      });
+    },
+    async addRole(ctx) {
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const params = ctx.meta["params"];
+      const body = ctx.meta["body"];
+      const userId = params?.["userId"];
+      const roleId = body?.["roleId"] ?? params?.["roleId"];
+      if (!userId)
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+      if (!roleId)
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+      await members.addRole(userId, ctx.workspace.id, roleId);
+      return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "ROLE_ASSIGNED", "Role assigned successfully.");
+    },
+    async removeRole(ctx) {
+      if (!ctx.workspace) return (0, import_core3.setApiResponse)(import_core3.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const params = ctx.meta["params"];
+      const userId = params?.["userId"];
+      const roleId = params?.["roleId"];
+      if (!userId)
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "userId is required");
+      if (!roleId)
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+      try {
+        await members.removeRole(userId, ctx.workspace.id, roleId);
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.OK, "ROLE_REMOVED", "Role removed successfully.");
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Failed";
+        return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "OPERATION_FAILED", message);
+      }
+    }
+  };
+}
+
+// src/controllers/role.controller.ts
+var import_core4 = require("@fonderie/core");
+function roleController(store) {
+  const roles = new RoleModel(store);
+  return {
+    async create(ctx) {
+      if (!ctx.workspace) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      }
+      const body = ctx.meta["body"];
+      const name = body?.["name"];
+      const description = body?.["description"];
+      if (typeof name !== "string" || name.trim().length === 0) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "name is required");
+      }
+      try {
+        const opts = {
+          name: name.trim(),
+          workspaceId: ctx.workspace.id
+        };
+        if (typeof description === "string") {
+          opts.description = description;
+        }
+        const role = await roles.create(opts);
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.CREATED, "ROLE_CREATED", "Role created successfully.", {
+          role: toRoleDTO(role)
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Failed to create role";
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.BAD_REQUEST, "OPERATION_FAILED", message);
+      }
+    },
+    async list(ctx) {
+      if (!ctx.workspace) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      }
+      const list = await roles.list(ctx.workspace.id);
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLES_FETCHED", "Roles retrieved successfully.", {
+        roles: list.map(toRoleDTO)
+      });
+    },
+    async get(ctx) {
+      if (!ctx.workspace) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      }
+      const params = ctx.meta["params"];
+      const roleId = params?.["roleId"];
+      if (!roleId) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+      }
+      const role = await roles.findById(roleId);
+      if (!role) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found");
+      }
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLE_FETCHED", "Role retrieved successfully.", {
+        role: toRoleDTO(role)
+      });
+    },
+    async update(ctx) {
+      if (!ctx.workspace) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      }
+      const params = ctx.meta["params"];
+      const body = ctx.meta["body"];
+      const roleId = params?.["roleId"];
+      if (!roleId) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+      }
+      const opts = {};
+      if (typeof body?.["name"] === "string") {
+        opts.name = body["name"];
+      }
+      if (typeof body?.["description"] === "string") {
+        opts.description = body["description"];
+      }
+      if (body?.["description"] === null) {
+        opts.description = null;
+      }
+      if (typeof body?.["active"] === "boolean") {
+        opts.active = body["active"];
+      }
+      const role = await roles.update(roleId, opts);
+      if (!role) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Role not found or is a system role");
+      }
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLE_UPDATED", "Role updated successfully.", {
+        role: toRoleDTO(role)
+      });
+    },
+    async remove(ctx) {
+      if (!ctx.workspace) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      }
+      const params = ctx.meta["params"];
+      const roleId = params?.["roleId"];
+      if (!roleId) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+      }
+      await roles.delete(roleId, ctx.workspace.id);
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "ROLE_DELETED", "Role deleted successfully.");
+    },
+    async setPermissions(ctx) {
+      if (!ctx.workspace) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      }
+      const params = ctx.meta["params"];
+      const body = ctx.meta["body"];
+      const roleId = params?.["roleId"];
+      if (!roleId) {
+        return (0, import_core4.setApiResponse)(import_core4.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "roleId is required");
+      }
+      const perms = body?.["permissions"];
+      if (!Array.isArray(perms)) {
+        return (0, import_core4.setApiResponse)(
+          import_core4.HTTP.UNPROCESSABLE,
+          "INVALID_PARAMETER",
+          "permissions array is required"
+        );
+      }
+      const normalized = perms.map((p) => {
+        const perm = p;
+        return {
+          permissionKey: String(perm["permissionKey"] ?? ""),
+          canCreate: Boolean(perm["canCreate"]),
+          canRead: Boolean(perm["canRead"]),
+          canUpdate: Boolean(perm["canUpdate"]),
+          canDelete: Boolean(perm["canDelete"])
+        };
+      }).filter((p) => p.permissionKey.length > 0);
+      await roles.setPermissions(roleId, ctx.workspace.id, normalized);
+      return (0, import_core4.setApiResponse)(import_core4.HTTP.OK, "PERMISSIONS_SET", "Role permissions updated successfully.");
+    }
+  };
+}
+
+// src/controllers/invitation.controller.ts
+var import_core5 = require("@fonderie/core");
+var import_events = require("@fonderie/events");
+var import_billing = require("@fonderie/billing");
+
+// src/services/invitations.ts
+var import_node_crypto = require("crypto");
+function generateToken() {
+  return (0, import_node_crypto.randomBytes)(32).toString("hex");
+}
+function generatePin() {
+  return Math.floor(1e5 + Math.random() * 9e5).toString();
+}
+function parseTtl(ttl) {
+  const units = {
+    s: 1e3,
+    m: 6e4,
+    h: 36e5,
+    d: 864e5
+  };
+  const match = ttl.match(/^(\d+)([smhd])$/);
+  if (!match) return 7 * 864e5;
+  const [, n, unit] = match;
+  return parseInt(n, 10) * (units[unit] ?? 0);
+}
+var SELECT_INV = `
+	id,
+	workspace_id AS "workspaceId",
+	email,
+	role_id      AS "roleId",
+	token,
+	pin,
+	status,
+	expires_at   AS "expiresAt",
+	created_at   AS "createdAt"
+`;
+async function createInvitation(opts, store) {
+  const token = generateToken();
+  const pin = generatePin();
+  const expiresAt = new Date(Date.now() + parseTtl(opts.ttl ?? "7d"));
+  const [invitation] = await store.query(
+    `INSERT INTO fonderie_workspace_invitations
+		   (workspace_id, email, role_id, token, pin, expires_at)
+		 VALUES ($1, $2, $3, $4, $5, $6)
+		 ON CONFLICT DO NOTHING
+		 RETURNING ${SELECT_INV}`,
+    [opts.workspaceId, opts.email, opts.roleId, token, pin, expiresAt]
+  );
+  if (!invitation) {
+    const [updated] = await store.query(
+      `UPDATE fonderie_workspace_invitations
+			 SET token = $4, pin = $5, expires_at = $6, role_id = $3, status = 'PENDING'
+			 WHERE workspace_id = $1 AND email = $2 AND status = 'PENDING'
+			 RETURNING ${SELECT_INV}`,
+      [opts.workspaceId, opts.email, opts.roleId, token, pin, expiresAt]
+    );
+    if (!updated) throw new Error("Failed to create invitation");
+    return updated;
+  }
+  return invitation;
+}
+async function listInvitations(workspaceId, store) {
+  return store.query(
+    `SELECT ${SELECT_INV}
+		 FROM fonderie_workspace_invitations
+		 WHERE workspace_id = $1 AND status = 'PENDING'
+		 ORDER BY created_at DESC`,
+    [workspaceId]
+  );
+}
+async function cancelInvitation(invitationId, workspaceId, store) {
+  await store.query(
+    `UPDATE fonderie_workspace_invitations
+		 SET status = 'CANCELLED'
+		 WHERE id = $1 AND workspace_id = $2 AND status = 'PENDING'`,
+    [invitationId, workspaceId]
+  );
+}
+async function acceptInvitationByPin(opts, store) {
+  const [inv] = await store.query(
+    `SELECT id, workspace_id AS "workspaceId", role_id AS "roleId", expires_at AS "expiresAt"
+		 FROM fonderie_workspace_invitations
+		 WHERE pin = $1 AND status = 'PENDING'`,
+    [opts.pin]
+  );
+  if (!inv) throw new Error("Invalid PIN");
+  if (/* @__PURE__ */ new Date() > new Date(inv.expiresAt)) throw new Error("Invitation expired");
+  await store.transaction(async (tx) => {
+    await Promise.all([
+      tx.query(
+        `INSERT INTO fonderie_role_user_workspaces (user_id, workspace_id, role_id, confirmed)
+				 VALUES ($1, $2, $3, true)
+				 ON CONFLICT (user_id, workspace_id, role_id) DO UPDATE
+				 SET confirmed = true, removed = false`,
+        [opts.userId, inv.workspaceId, inv.roleId]
+      ),
+      tx.query(`UPDATE fonderie_workspace_invitations SET status = 'ACCEPTED' WHERE id = $1`, [
+        inv.id
+      ])
+    ]);
+  });
+  return { workspaceId: inv.workspaceId, roleId: inv.roleId };
+}
+
+// src/models/invitation.model.ts
+var InvitationModel = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  create(opts) {
+    return createInvitation(opts, this.store);
+  }
+  list(workspaceId) {
+    return listInvitations(workspaceId, this.store);
+  }
+  cancel(invitationId, workspaceId) {
+    return cancelInvitation(invitationId, workspaceId, this.store);
+  }
+  acceptByPin(opts) {
+    return acceptInvitationByPin(opts, this.store);
+  }
+};
+
+// src/controllers/invitation.controller.ts
+function invitationController(store, ttl, bus) {
+  const invitations = new InvitationModel(store);
+  return {
+    async list(ctx) {
+      if (!ctx.workspace) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const list = await invitations.list(ctx.workspace.id);
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "INVITATIONS_FETCHED", "Invitations retrieved successfully.", {
+        invitations: list.map(toInvitationDTO)
+      });
+    },
+    async invite(ctx) {
+      if (!ctx.workspace) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      if (ctx.workspace.isPersonal) {
+        return (0, import_core5.setApiResponse)(
+          import_core5.HTTP.FORBIDDEN,
+          "FORBIDDEN",
+          "Personal workspaces do not support invitations"
+        );
+      }
+      const body = ctx.meta["body"];
+      const entries = Array.isArray(body) ? body : [body];
+      if (!entries.length) {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "at least one invite is required");
+      }
+      for (const entry of entries) {
+        if (typeof entry?.["email"] !== "string") {
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "email is required for every invite");
+        }
+      }
+      const seatLimit = (0, import_billing.getPlanLimit)(ctx, "seats");
+      if (seatLimit !== null) {
+        const [countRow] = await store.query(
+          `SELECT COUNT(*) AS count FROM fonderie_role_user_workspaces
+					 WHERE workspace_id = $1 AND removed = false AND suspended = false`,
+          [ctx.workspace.id]
+        );
+        const total = parseInt(countRow.count, 10);
+        const occupied = ctx.workspace.isPersonal ? total : Math.max(0, total - 1);
+        if (occupied + entries.length > seatLimit) {
+          return (0, import_core5.setApiResponse)(
+            import_core5.HTTP.PAYMENT_REQUIRED,
+            "SEAT_LIMIT_REACHED",
+            `Your plan allows ${seatLimit} seat${seatLimit === 1 ? "" : "s"}. Upgrade to invite more members.`,
+            { limit: seatLimit }
+          );
+        }
+      }
+      let defaultRoleId;
+      const needsDefault = entries.some((e) => !e["roleId"]);
+      if (needsDefault) {
+        const [row] = await store.query(
+          `SELECT id FROM fonderie_roles
+					 WHERE name = 'ADMIN' AND workspace_id = $1 LIMIT 1`,
+          [ctx.workspace.id]
+        );
+        defaultRoleId = row?.id;
+        if (!defaultRoleId) {
+          return (0, import_core5.setApiResponse)(import_core5.HTTP.SERVER_ERROR, "SERVER_ERROR", "Default role not found");
+        }
+      }
+      const results = await Promise.all(
+        entries.map(async (entry) => {
+          const email = entry["email"];
+          const resolvedRoleId = entry["roleId"] ?? defaultRoleId;
+          const invitation = await invitations.create({
+            workspaceId: ctx.workspace.id,
+            email,
+            roleId: resolvedRoleId,
+            ttl
+          });
+          bus?.emit(import_events.NOTIFICATION_EVENT, {
+            type: MESSAGE_KEYS.workspaceInvitation,
+            recipient: { email, phone: null, deviceToken: null },
+            data: { token: invitation.token, pin: invitation.pin }
+          }).catch(() => {
+          });
+          return { invitationId: invitation.id, email };
+        })
+      );
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.CREATED, "INVITATIONS_SENT", "Invitations sent successfully.", {
+        invitations: results
+      });
+    },
+    async cancel(ctx) {
+      if (!ctx.workspace) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const params = ctx.meta["params"];
+      const invitationId = params?.["inviteId"];
+      if (!invitationId)
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "inviteId is required");
+      await invitations.cancel(invitationId, ctx.workspace.id);
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "INVITATION_CANCELLED", "Invitation cancelled successfully.");
+    },
+    async accept(ctx) {
+      const body = ctx.meta["body"];
+      const pin = body?.["pin"];
+      if (typeof pin !== "string") {
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "pin is required");
+      }
+      try {
+        const { workspaceId } = await invitations.acceptByPin({ pin, userId: ctx.user.id });
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "INVITATION_ACCEPTED", "Invitation accepted successfully.", {
+          workspaceId
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Invalid invitation";
+        return (0, import_core5.setApiResponse)(import_core5.HTTP.BAD_REQUEST, "INVITATION_FAILED", message);
+      }
+    }
+  };
+}
+
+// src/routes.ts
+function buildWorkspaceRoutes(store, config, bus) {
+  const ttl = config.invitationTtl ?? "7d";
+  const wsCtx = withWorkspace(store);
+  const workspace = workspaceController(store, config);
+  const member = memberController(store);
+  const role = roleController(store);
+  const invitation = invitationController(store, ttl, bus);
+  return [
+    // ── Workspace creation + listing (no workspace context required)
+    ["POST", "/workspaces", import_middlewares.requireAuth, workspace.create],
+    ["GET", "/workspaces", import_middlewares.requireAuth, workspace.list],
+    // ── Members (workspace resolved from X-Workspace-ID header)
+    ["GET", "/workspaces/members", import_middlewares.requireAuth, wsCtx, member.list],
+    ["DELETE", "/workspaces/members/:userId", import_middlewares.requireAuth, wsCtx, member.remove],
+    ["GET", "/workspaces/members/:userId/roles", import_middlewares.requireAuth, wsCtx, member.getUserRoles],
+    ["POST", "/workspaces/members/:userId/roles", import_middlewares.requireAuth, wsCtx, member.addRole],
+    ["DELETE", "/workspaces/members/:userId/roles/:roleId", import_middlewares.requireAuth, wsCtx, member.removeRole],
+    // ── Invitations
+    ["GET", "/workspaces/invitations", import_middlewares.requireAuth, wsCtx, invitation.list],
+    ["POST", "/workspaces/invitations", import_middlewares.requireAuth, wsCtx, invitation.invite],
+    ["DELETE", "/workspaces/invitations/:inviteId", import_middlewares.requireAuth, wsCtx, invitation.cancel],
+    ["POST", "/workspaces/invitations/accept", import_middlewares.requireAuth, invitation.accept],
+    // ── Roles
+    ["POST", "/workspaces/roles", import_middlewares.requireAuth, wsCtx, role.create],
+    ["GET", "/workspaces/roles", import_middlewares.requireAuth, wsCtx, role.list],
+    ["GET", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, role.get],
+    ["PUT", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, role.update],
+    ["DELETE", "/workspaces/roles/:roleId", import_middlewares.requireAuth, wsCtx, role.remove],
+    ["POST", "/workspaces/roles/:roleId/permissions", import_middlewares.requireAuth, wsCtx, role.setPermissions],
+    // ── Workspace lifecycle
+    ["POST", "/workspaces/archive", import_middlewares.requireAuth, wsCtx, workspace.archive],
+    ["POST", "/workspaces/restore", import_middlewares.requireAuth, wsCtx, workspace.restore],
+    ["GET", "/workspaces/settings", import_middlewares.requireAuth, wsCtx, workspace.getSettings],
+    ["PUT", "/workspaces/settings", import_middlewares.requireAuth, wsCtx, workspace.updateSettings],
+    // ── Path-based lookup by ID (admin / cross-workspace use)
+    ["GET", "/workspaces/:id", import_middlewares.requireAuth, wsCtx, workspace.get],
+    // ── Update current workspace — ID resolved from X-Workspace-ID header
+    // (or personal workspace fallback when header is absent)
+    ["PUT", "/workspaces", import_middlewares.requireAuth, wsCtx, workspace.update]
+  ];
+}
+
+// src/module.ts
+var AUTH_USER_REGISTERED = "fonderie.user.registered";
+var WorkspacesModule = class {
+  constructor(store, config = {}, bus) {
+    this.store = store;
+    this.config = config;
+    this.bus = bus;
+  }
+  store;
+  config;
+  bus;
+  name = "@fonderie/workspaces";
+  deps = ["@fonderie/auth", "@fonderie/billing"];
+  install(app) {
+    if (this.bus && this.config.personalWorkspace !== false) {
+      this.bus.on(
+        AUTH_USER_REGISTERED,
+        (payload) => this.provisionPersonalWorkspace(payload),
+        "workspaces"
+      );
+    }
+    const routes = buildWorkspaceRoutes(this.store, this.config, this.bus);
+    for (const [method, path, ...handlers] of routes) {
+      app.addRoute(method, path, ...handlers);
+    }
+  }
+  async provisionPersonalWorkspace(payload) {
+    const name = "My Workspace";
+    const slug = `${payload.userId}-personal`;
+    let workspaceId;
+    await this.store.transaction(async (tx) => {
+      const wsModel = new WorkspaceModel(tx);
+      const roleModel = new RoleModel(tx);
+      const memModel = new MemberModel(tx);
+      const ws = await wsModel.createPersonal({ name, slug, ownerId: payload.userId });
+      if (!ws) return;
+      workspaceId = ws.id;
+      const adminRole = await roleModel.findSystem("ADMIN");
+      if (!adminRole) throw new Error("System ADMIN role not found");
+      await memModel.add({
+        userId: payload.userId,
+        workspaceId: ws.id,
+        roleId: adminRole.id,
+        confirmed: true
+      });
+    });
+    if (workspaceId) {
+      this.bus?.emit(EVENT_KEYS.personalWorkspaceCreated, {
+        workspaceId,
+        userId: payload.userId
+      }).catch(() => {
+      });
+    }
+  }
+};
+
+// src/middlewares/require-workspace.ts
+var import_core6 = require("@fonderie/core");
+var requireWorkspace = async (ctx, next) => {
+  if (!ctx.workspace) {
+    return (0, import_core6.setApiResponse)(import_core6.HTTP.BAD_REQUEST, "WORKSPACE_REQUIRED", "Workspace context required");
+  }
+  return next();
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  EVENT_KEYS,
+  MESSAGE_KEYS,
+  WorkspacesModule,
+  requireWorkspace,
+  toInvitationDTO,
+  toMemberDTO,
+  toRoleDTO,
+  toSettingsDTO,
+  toWorkspaceDTO,
+  withWorkspace
+});
+//# sourceMappingURL=index.cjs.map