@jskit-ai/workspaces-core 0.1.1

package/package.descriptor.mjs

@@ -0,0 +1,300 @@
+export default Object.freeze({
+  packageVersion: 1,
+  packageId: "@jskit-ai/workspaces-core",
+  version: "0.1.1",
+  kind: "runtime",
+  description: "Workspace tenancy runtime plus HTTP routes, role catalog, and workspace config scaffolding.",
+  dependsOn: [
+    "@jskit-ai/users-core"
+  ],
+  capabilities: {
+    provides: [
+      "workspaces.core",
+      "workspaces.server-routes"
+    ],
+    requires: [
+      "users.core"
+    ]
+  },
+  runtime: {
+    server: {
+      providers: [
+        {
+          entrypoint: "src/server/WorkspacesCoreServiceProvider.js",
+          export: "WorkspacesCoreServiceProvider"
+        }
+      ]
+    },
+    client: {
+      providers: []
+    }
+  },
+  metadata: {
+    apiSummary: {
+      surfaces: [
+        {
+          subpath: "./server",
+          summary: "Exports the workspace runtime provider and workspace route registration surface."
+        }
+      ],
+      containerTokens: {
+        server: [],
+        client: []
+      }
+    },
+    server: {
+      routes: [
+        {
+          method: "POST",
+          path: "/api/workspaces",
+          summary: "Create a workspace for the authenticated user."
+        },
+        {
+          method: "GET",
+          path: "/api/workspaces",
+          summary: "List workspaces visible to authenticated user."
+        },
+        {
+          method: "GET",
+          path: "/api/workspace/invitations/pending",
+          summary: "List pending workspace invitations for authenticated user."
+        },
+        {
+          method: "POST",
+          path: "/api/workspace/invitations/redeem",
+          summary: "Accept or refuse a workspace invitation using an invite token."
+        },
+        {
+          method: "GET",
+          path: "/api/w/:workspaceSlug/settings",
+          summary: "Get workspace settings and role catalog by workspace slug."
+        },
+        {
+          method: "PATCH",
+          path: "/api/w/:workspaceSlug/settings",
+          summary: "Update workspace settings by workspace slug."
+        },
+        {
+          method: "GET",
+          path: "/api/w/:workspaceSlug/roles",
+          summary: "Get role catalog by workspace slug."
+        },
+        {
+          method: "GET",
+          path: "/api/w/:workspaceSlug/members",
+          summary: "List members by workspace slug."
+        },
+        {
+          method: "PATCH",
+          path: "/api/w/:workspaceSlug/members/:memberUserId/role",
+          summary: "Update workspace member role by workspace slug."
+        },
+        {
+          method: "GET",
+          path: "/api/w/:workspaceSlug/invites",
+          summary: "List workspace invites by workspace slug."
+        },
+        {
+          method: "POST",
+          path: "/api/w/:workspaceSlug/invites",
+          summary: "Create workspace invite by workspace slug."
+        },
+        {
+          method: "DELETE",
+          path: "/api/w/:workspaceSlug/invites/:inviteId",
+          summary: "Revoke workspace invite by workspace slug."
+        }
+      ]
+    }
+  },
+  mutations: {
+    dependencies: {
+      runtime: {
+        "@jskit-ai/users-core": "0.1.35"
+      },
+      dev: {}
+    },
+    packageJson: {
+      scripts: {
+        "server:app": "SERVER_SURFACE=app node ./bin/server.js",
+        "server:admin": "SERVER_SURFACE=admin node ./bin/server.js"
+      }
+    },
+    procfile: {},
+    files: [
+      {
+        op: "install-migration",
+        from: "templates/migrations/workspaces_core_initial.cjs",
+        toDir: "migrations",
+        extension: ".cjs",
+        reason: "Install workspace tenancy schema migration.",
+        category: "migration",
+        id: "workspaces-core-initial-schema"
+      },
+      {
+        op: "install-migration",
+        from: "templates/migrations/workspaces_core_workspace_settings_single_name_source.cjs",
+        toDir: "migrations",
+        extension: ".cjs",
+        reason: "Remove workspace_settings name/avatar fields so workspace identity data comes from workspaces only.",
+        category: "migration",
+        id: "users-core-workspace-settings-single-name-source"
+      },
+      {
+        op: "install-migration",
+        from: "templates/migrations/workspaces_core_workspaces_drop_color.cjs",
+        toDir: "migrations",
+        extension: ".cjs",
+        reason: "Drop legacy workspaces.color now that workspace theme colors live in workspace_settings.",
+        category: "migration",
+        id: "users-core-workspaces-drop-color"
+      },
+      {
+        from: "templates/packages/main/src/shared/resources/workspaceSettingsFields.js",
+        to: "packages/main/src/shared/resources/workspaceSettingsFields.js",
+        preserveOnRemove: true,
+        reason: "Install app-owned workspace settings field definitions.",
+        category: "workspaces-core",
+        id: "users-core-app-owned-workspace-settings-fields"
+      },
+      {
+        from: "templates/config/roles.js",
+        to: "config/roles.js",
+        preserveOnRemove: true,
+        reason: "Install app-owned role catalog in a dedicated config file.",
+        category: "workspaces-core",
+        id: "users-core-app-owned-role-catalog-config"
+      }
+    ],
+    text: [
+      {
+        op: "append-text",
+        file: "packages/main/src/shared/index.js",
+        position: "top",
+        skipIfContains: "import \"./resources/workspaceSettingsFields.js\";",
+        value: "import \"./resources/workspaceSettingsFields.js\";\n",
+        reason: "Load app-owned workspace settings field definitions inside the main shared module.",
+        category: "workspaces-core",
+        id: "users-core-main-shared-workspace-settings-field-import"
+      },
+      {
+        op: "append-text",
+        file: "config/public.js",
+        position: "top",
+        skipIfContains: "import { roleCatalog } from \"./roles.js\";",
+        value: "import { roleCatalog } from \"./roles.js\";\n",
+        reason: "Load app-owned role catalog from dedicated config file.",
+        category: "workspaces-core",
+        id: "users-core-role-catalog-public-import"
+      },
+      {
+        op: "append-text",
+        file: "config/public.js",
+        position: "top",
+        skipIfContains: "import { surfaceAccessPolicies } from \"./surfaceAccessPolicies.js\";",
+        value: "import { surfaceAccessPolicies } from \"./surfaceAccessPolicies.js\";\n",
+        reason: "Load app-owned surface access policy catalog from dedicated config file.",
+        category: "workspaces-core",
+        id: "users-core-surface-access-policies-public-import"
+      },
+      {
+        op: "append-text",
+        file: "config/surfaceAccessPolicies.js",
+        position: "top",
+        skipIfContains: "export const surfaceAccessPolicies = {};",
+        value: "export const surfaceAccessPolicies = {};\n\n",
+        reason: "Initialize app-owned surface access policy config if missing.",
+        category: "workspaces-core",
+        id: "users-core-surface-access-policies-config-init"
+      },
+      {
+        op: "append-text",
+        file: "config/surfaceAccessPolicies.js",
+        position: "bottom",
+        skipIfContains: "surfaceAccessPolicies.workspace_member = {",
+        value: "\nsurfaceAccessPolicies.workspace_member = {\n  requireAuth: true,\n  requireWorkspaceMembership: true\n};\n",
+        reason: "Register workspace-member surface access policy for workspace surfaces.",
+        category: "workspaces-core",
+        id: "users-core-surface-access-policies-workspace-member"
+      },
+      {
+        op: "append-text",
+        file: "config/public.js",
+        position: "bottom",
+        skipIfContains: "config.surfaceDefinitions.app = {",
+        value:
+          "\nconfig.surfaceDefinitions.app = {\n  id: \"app\",\n  label: \"App\",\n  pagesRoot: \"w/[workspaceSlug]\",\n  enabled: true,\n  requiresAuth: true,\n  requiresWorkspace: true,\n  accessPolicyId: \"workspace_member\",\n  origin: \"\"\n};\n\nconfig.surfaceDefinitions.admin = {\n  id: \"admin\",\n  label: \"Admin\",\n  pagesRoot: \"w/[workspaceSlug]/admin\",\n  enabled: true,\n  requiresAuth: true,\n  requiresWorkspace: true,\n  accessPolicyId: \"workspace_member\",\n  origin: \"\"\n};\n",
+        reason: "Append workspace surface topology when tenancy enables workspace routing.",
+        category: "workspaces-core",
+        id: "users-core-surface-config-workspace",
+        when: {
+          config: "tenancyMode",
+          in: ["personal", "workspaces"]
+        }
+      },
+      {
+        op: "append-text",
+        file: "config/public.js",
+        position: "bottom",
+        skipIfContains: "config.workspaceSwitching =",
+        value:
+          "\nconfig.workspaceSwitching = true;\nconfig.workspaceInvitations = {\n  enabled: true,\n  allowInPersonalMode: true\n};\nconfig.assistantEnabled = false;\nconfig.assistantRequiredPermission = \"\";\nconfig.socialEnabled = false;\nconfig.socialFederationEnabled = false;\n",
+        reason: "Append default workspace feature toggles into app-owned config.",
+        category: "workspaces-core",
+        id: "users-core-public-config"
+      },
+      {
+        op: "append-text",
+        file: "config/public.js",
+        position: "bottom",
+        skipIfContains: "config.roleCatalog = roleCatalog;",
+        value: "\nconfig.roleCatalog = roleCatalog;\n",
+        reason: "Bind app-owned role catalog onto public config.",
+        category: "workspaces-core",
+        id: "users-core-role-catalog-public-config"
+      },
+      {
+        op: "append-text",
+        file: "config/public.js",
+        position: "bottom",
+        skipIfContains: "config.surfaceAccessPolicies = surfaceAccessPolicies;",
+        value: "\nconfig.surfaceAccessPolicies = surfaceAccessPolicies;\n",
+        reason: "Bind app-owned surface access policies onto public config.",
+        category: "workspaces-core",
+        id: "users-core-surface-access-policies-public-config"
+      },
+      {
+        op: "append-text",
+        file: "config/server.js",
+        position: "bottom",
+        skipIfContains: "config.workspaceColor =",
+        value: "\nconfig.workspaceColor = \"#1867C0\";\n",
+        reason: "Append default workspace server settings into app-owned config.",
+        category: "workspaces-core",
+        id: "users-core-server-config"
+      },
+      {
+        op: "append-text",
+        file: "config/server.js",
+        position: "bottom",
+        skipIfContains: "config.workspaceSettings =",
+        value:
+          "\nconfig.workspaceSettings = {\n  defaults: {\n    invitesEnabled: true\n  }\n};\n",
+        reason: "Append app-owned workspace settings defaults into the server config.",
+        category: "workspaces-core",
+        id: "users-core-workspace-settings-server-config"
+      },
+      {
+        op: "append-text",
+        file: "config/server.js",
+        position: "bottom",
+        skipIfContains: "config.workspaceMembers =",
+        value:
+          "\nconfig.workspaceMembers = {\n  defaults: {\n    inviteExpiresInMs: 604800000\n  }\n};\n",
+        reason: "Append app-owned workspace member invite policy defaults into the server config.",
+        category: "workspaces-core",
+        id: "users-core-workspace-members-server-config"
+      }
+    ]
+  }
+});

package/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@jskit-ai/workspaces-core",
+  "version": "0.1.1",
+  "type": "module",
+  "scripts": {
+    "test": "node --test"
+  },
+  "exports": {
+    "./server/WorkspacesCoreServiceProvider": "./src/server/WorkspacesCoreServiceProvider.js"
+  },
+  "dependencies": {
+    "@jskit-ai/users-core": "0.1.35"
+  }
+}

package/src/server/WorkspacesCoreServiceProvider.js

@@ -0,0 +1,5 @@
+import { UsersWorkspacesServiceProvider } from "@jskit-ai/users-core/server/UsersWorkspacesServiceProvider";
+
+const WorkspacesCoreServiceProvider = UsersWorkspacesServiceProvider;
+
+export { WorkspacesCoreServiceProvider };

package/templates/config/roles.js

@@ -0,0 +1,27 @@
+export const roleCatalog = {
+  workspace: {
+    defaultInviteRole: "member"
+  },
+  roles: {
+    owner: {
+      assignable: false,
+      permissions: ["*"]
+    },
+    admin: {
+      assignable: true,
+      inherits: "member",
+      permissions: [
+        "workspace.roles.view",
+        "workspace.settings.update",
+        "workspace.members.view",
+        "workspace.members.invite",
+        "workspace.members.manage",
+        "workspace.invites.revoke"
+      ]
+    },
+    member: {
+      assignable: true,
+      permissions: ["workspace.settings.view"]
+    }
+  }
+};

package/templates/migrations/workspaces_core_initial.cjs

@@ -0,0 +1,86 @@
+/**
+ * @param {import('knex').Knex} knex
+ */
+exports.up = async function up(knex) {
+  const hasUsersTable = await knex.schema.hasTable("users");
+  if (!hasUsersTable) {
+    throw new Error("workspaces-core initial migration requires users table.");
+  }
+
+  const hasWorkspacesTable = await knex.schema.hasTable("workspaces");
+  if (!hasWorkspacesTable) {
+    await knex.schema.createTable("workspaces", (table) => {
+      table.increments("id").primary();
+      table.string("slug", 120).notNullable().unique();
+      table.string("name", 160).notNullable();
+      table.integer("owner_user_id").unsigned().notNullable().references("id").inTable("users").onDelete("CASCADE");
+      table.boolean("is_personal").notNullable().defaultTo(true);
+      table.string("avatar_url", 512).notNullable().defaultTo("");
+      table.timestamp("created_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
+      table.timestamp("updated_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
+      table.timestamp("deleted_at", { useTz: false }).nullable();
+    });
+  }
+
+  const hasWorkspaceMembershipsTable = await knex.schema.hasTable("workspace_memberships");
+  if (!hasWorkspaceMembershipsTable) {
+    await knex.schema.createTable("workspace_memberships", (table) => {
+      table.increments("id").primary();
+      table.integer("workspace_id").unsigned().notNullable().references("id").inTable("workspaces").onDelete("CASCADE");
+      table.integer("user_id").unsigned().notNullable().references("id").inTable("users").onDelete("CASCADE");
+      table.string("role_sid", 64).notNullable().defaultTo("member");
+      table.string("status", 32).notNullable().defaultTo("active");
+      table.timestamp("created_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
+      table.timestamp("updated_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
+      table.unique(["workspace_id", "user_id"], "uq_workspace_memberships_workspace_user");
+    });
+  }
+
+  const hasWorkspaceSettingsTable = await knex.schema.hasTable("workspace_settings");
+  if (!hasWorkspaceSettingsTable) {
+    await knex.schema.createTable("workspace_settings", (table) => {
+      table.integer("workspace_id").unsigned().primary().references("id").inTable("workspaces").onDelete("CASCADE");
+      table.string("light_primary_color", 7).notNullable().defaultTo("#1867C0");
+      table.string("light_secondary_color", 7).notNullable().defaultTo("#48A9A6");
+      table.string("light_surface_color", 7).notNullable().defaultTo("#FFFFFF");
+      table.string("light_surface_variant_color", 7).notNullable().defaultTo("#424242");
+      table.string("dark_primary_color", 7).notNullable().defaultTo("#2196F3");
+      table.string("dark_secondary_color", 7).notNullable().defaultTo("#54B6B2");
+      table.string("dark_surface_color", 7).notNullable().defaultTo("#212121");
+      table.string("dark_surface_variant_color", 7).notNullable().defaultTo("#C8C8C8");
+      table.boolean("invites_enabled").notNullable().defaultTo(true);
+      table.timestamp("created_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
+      table.timestamp("updated_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
+    });
+  }
+
+  const hasWorkspaceInvitesTable = await knex.schema.hasTable("workspace_invites");
+  if (!hasWorkspaceInvitesTable) {
+    await knex.schema.createTable("workspace_invites", (table) => {
+      table.increments("id").primary();
+      table.integer("workspace_id").unsigned().notNullable().references("id").inTable("workspaces").onDelete("CASCADE");
+      table.string("email", 255).notNullable();
+      table.string("role_sid", 64).notNullable().defaultTo("member");
+      table.string("status", 32).notNullable().defaultTo("pending");
+      table.string("token_hash", 191).notNullable();
+      table.integer("invited_by_user_id").unsigned().nullable().references("id").inTable("users").onDelete("SET NULL");
+      table.timestamp("expires_at", { useTz: false }).nullable();
+      table.timestamp("accepted_at", { useTz: false }).nullable();
+      table.timestamp("revoked_at", { useTz: false }).nullable();
+      table.timestamp("created_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
+      table.timestamp("updated_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
+      table.unique(["token_hash"], "uq_workspace_invites_token_hash");
+      table.index(["workspace_id", "status"], "idx_workspace_invites_workspace_status");
+    });
+  }
+};
+
+/**
+ * @param {import('knex').Knex} knex
+ */
+exports.down = async function down(knex) {
+  await knex.schema.dropTableIfExists("workspace_invites");
+  await knex.schema.dropTableIfExists("workspace_settings");
+  await knex.schema.dropTableIfExists("workspace_memberships");
+  await knex.schema.dropTableIfExists("workspaces");
+};

package/templates/migrations/workspaces_core_workspace_settings_single_name_source.cjs

@@ -0,0 +1,71 @@
+const WORKSPACE_SETTINGS_TABLE = "workspace_settings";
+const WORKSPACES_TABLE = "workspaces";
+const LEGACY_NAME_COLUMN = "name";
+const LEGACY_AVATAR_COLUMN = "avatar_url";
+
+async function hasTable(knex, tableName) {
+  return knex.schema.hasTable(tableName);
+}
+
+async function hasColumn(knex, tableName, columnName) {
+  return knex.schema.hasColumn(tableName, columnName);
+}
+
+exports.up = async function up(knex) {
+  const hasWorkspaceSettings = await hasTable(knex, WORKSPACE_SETTINGS_TABLE);
+  if (!hasWorkspaceSettings) {
+    return;
+  }
+
+  const hasLegacyName = await hasColumn(knex, WORKSPACE_SETTINGS_TABLE, LEGACY_NAME_COLUMN);
+  const hasLegacyAvatarUrl = await hasColumn(knex, WORKSPACE_SETTINGS_TABLE, LEGACY_AVATAR_COLUMN);
+  if (!hasLegacyName && !hasLegacyAvatarUrl) {
+    return;
+  }
+
+  await knex.schema.alterTable(WORKSPACE_SETTINGS_TABLE, (table) => {
+    if (hasLegacyName) {
+      table.dropColumn(LEGACY_NAME_COLUMN);
+    }
+    if (hasLegacyAvatarUrl) {
+      table.dropColumn(LEGACY_AVATAR_COLUMN);
+    }
+  });
+};
+
+exports.down = async function down(knex) {
+  const hasWorkspaceSettings = await hasTable(knex, WORKSPACE_SETTINGS_TABLE);
+  if (!hasWorkspaceSettings) {
+    return;
+  }
+
+  const hasLegacyName = await hasColumn(knex, WORKSPACE_SETTINGS_TABLE, LEGACY_NAME_COLUMN);
+  const hasLegacyAvatarUrl = await hasColumn(knex, WORKSPACE_SETTINGS_TABLE, LEGACY_AVATAR_COLUMN);
+  if (!hasLegacyName || !hasLegacyAvatarUrl) {
+    await knex.schema.alterTable(WORKSPACE_SETTINGS_TABLE, (table) => {
+      if (!hasLegacyName) {
+        table.string(LEGACY_NAME_COLUMN, 160).notNullable().defaultTo("Workspace");
+      }
+      if (!hasLegacyAvatarUrl) {
+        table.string(LEGACY_AVATAR_COLUMN, 512).notNullable().defaultTo("");
+      }
+    });
+  }
+
+  const hasWorkspaces = await hasTable(knex, WORKSPACES_TABLE);
+  if (!hasWorkspaces) {
+    return;
+  }
+
+  const workspaceRows = await knex(WORKSPACES_TABLE).select("id", "name", "avatar_url");
+  for (const workspaceRow of workspaceRows) {
+    const normalizedName = String(workspaceRow?.name || "").trim() || "Workspace";
+    const normalizedAvatarUrl = String(workspaceRow?.avatar_url || "").trim();
+    await knex(WORKSPACE_SETTINGS_TABLE)
+      .where({ workspace_id: Number(workspaceRow.id) })
+      .update({
+        name: normalizedName,
+        avatar_url: normalizedAvatarUrl
+      });
+  }
+};

package/templates/migrations/workspaces_core_workspaces_drop_color.cjs

@@ -0,0 +1,85 @@
+const WORKSPACES_TABLE = "workspaces";
+const WORKSPACE_SETTINGS_TABLE = "workspace_settings";
+const LEGACY_COLOR_COLUMN = "color";
+const SETTINGS_LIGHT_PRIMARY_COLOR_COLUMN = "light_primary_color";
+const DEFAULT_WORKSPACE_COLOR = "#1867C0";
+
+async function hasTable(knex, tableName) {
+  return knex.schema.hasTable(tableName);
+}
+
+async function hasColumn(knex, tableName, columnName) {
+  return knex.schema.hasColumn(tableName, columnName);
+}
+
+function normalizeHexColor(value) {
+  const normalized = String(value || "").trim().toUpperCase();
+  return /^#[0-9A-F]{6}$/.test(normalized) ? normalized : "";
+}
+
+exports.up = async function up(knex) {
+  const hasWorkspaces = await hasTable(knex, WORKSPACES_TABLE);
+  if (!hasWorkspaces) {
+    return;
+  }
+
+  const hasLegacyColor = await hasColumn(knex, WORKSPACES_TABLE, LEGACY_COLOR_COLUMN);
+  if (!hasLegacyColor) {
+    return;
+  }
+
+  await knex.schema.alterTable(WORKSPACES_TABLE, (table) => {
+    table.dropColumn(LEGACY_COLOR_COLUMN);
+  });
+};
+
+exports.down = async function down(knex) {
+  const hasWorkspaces = await hasTable(knex, WORKSPACES_TABLE);
+  if (!hasWorkspaces) {
+    return;
+  }
+
+  const hasLegacyColor = await hasColumn(knex, WORKSPACES_TABLE, LEGACY_COLOR_COLUMN);
+  if (!hasLegacyColor) {
+    await knex.schema.alterTable(WORKSPACES_TABLE, (table) => {
+      table.string(LEGACY_COLOR_COLUMN, 7).notNullable().defaultTo(DEFAULT_WORKSPACE_COLOR);
+    });
+  }
+
+  const hasWorkspaceSettings = await hasTable(knex, WORKSPACE_SETTINGS_TABLE);
+  if (!hasWorkspaceSettings) {
+    return;
+  }
+
+  const hasLightPrimaryColor = await hasColumn(
+    knex,
+    WORKSPACE_SETTINGS_TABLE,
+    SETTINGS_LIGHT_PRIMARY_COLOR_COLUMN
+  );
+  if (!hasLightPrimaryColor) {
+    return;
+  }
+
+  const workspaceSettingsRows = await knex(WORKSPACE_SETTINGS_TABLE).select(
+    "workspace_id",
+    SETTINGS_LIGHT_PRIMARY_COLOR_COLUMN
+  );
+
+  for (const row of workspaceSettingsRows) {
+    const workspaceId = Number(row?.workspace_id || 0);
+    if (!Number.isInteger(workspaceId) || workspaceId < 1) {
+      continue;
+    }
+
+    const restoredColor = normalizeHexColor(row?.[SETTINGS_LIGHT_PRIMARY_COLOR_COLUMN]);
+    if (!restoredColor) {
+      continue;
+    }
+
+    await knex(WORKSPACES_TABLE)
+      .where({ id: workspaceId })
+      .update({
+        color: restoredColor
+      });
+  }
+};

package/templates/packages/main/src/shared/resources/workspaceSettingsFields.js

@@ -0,0 +1,197 @@
+// @jskit-contract users.settings-fields.workspace.v1
+// Append-only settings field registrations for workspace settings.
+
+import { Type } from "typebox";
+import { normalizeText } from "@jskit-ai/kernel/shared/actions/textNormalization";
+import {
+  DEFAULT_WORKSPACE_DARK_PALETTE,
+  DEFAULT_WORKSPACE_LIGHT_PALETTE,
+  coerceWorkspaceThemeColor
+} from "@jskit-ai/users-core/shared/settings";
+import {
+  defineField,
+  resetWorkspaceSettingsFields
+} from "@jskit-ai/users-core/shared/resources/workspaceSettingsFields";
+
+function normalizeHexColor(value) {
+  const color = normalizeText(value);
+  return /^#[0-9A-Fa-f]{6}$/.test(color) ? color.toUpperCase() : null;
+}
+
+resetWorkspaceSettingsFields();
+
+defineField({
+  key: "lightPrimaryColor",
+  dbColumn: "light_primary_color",
+  required: true,
+  inputSchema: Type.String({
+    minLength: 7,
+    maxLength: 7,
+    pattern: "^#[0-9A-Fa-f]{6}$",
+    messages: {
+      required: "Light primary color is required.",
+      pattern: "Light primary color must be a hex color like #1867C0.",
+      default: "Light primary color must be a hex color like #1867C0."
+    }
+  }),
+  outputSchema: Type.String({ minLength: 7, maxLength: 7, pattern: "^#[0-9A-Fa-f]{6}$" }),
+  normalizeInput: normalizeHexColor,
+  normalizeOutput: (value) => coerceWorkspaceThemeColor(value, DEFAULT_WORKSPACE_LIGHT_PALETTE.color),
+  resolveDefault: () => DEFAULT_WORKSPACE_LIGHT_PALETTE.color
+});
+
+defineField({
+  key: "lightSecondaryColor",
+  dbColumn: "light_secondary_color",
+  required: true,
+  inputSchema: Type.String({
+    minLength: 7,
+    maxLength: 7,
+    pattern: "^#[0-9A-Fa-f]{6}$",
+    messages: {
+      required: "Light secondary color is required.",
+      pattern: "Light secondary color must be a hex color like #48A9A6.",
+      default: "Light secondary color must be a hex color like #48A9A6."
+    }
+  }),
+  outputSchema: Type.String({ minLength: 7, maxLength: 7, pattern: "^#[0-9A-Fa-f]{6}$" }),
+  normalizeInput: normalizeHexColor,
+  normalizeOutput: (value) => coerceWorkspaceThemeColor(value, DEFAULT_WORKSPACE_LIGHT_PALETTE.secondaryColor),
+  resolveDefault: () => DEFAULT_WORKSPACE_LIGHT_PALETTE.secondaryColor
+});
+
+defineField({
+  key: "lightSurfaceColor",
+  dbColumn: "light_surface_color",
+  required: true,
+  inputSchema: Type.String({
+    minLength: 7,
+    maxLength: 7,
+    pattern: "^#[0-9A-Fa-f]{6}$",
+    messages: {
+      required: "Light surface color is required.",
+      pattern: "Light surface color must be a hex color like #FFFFFF.",
+      default: "Light surface color must be a hex color like #FFFFFF."
+    }
+  }),
+  outputSchema: Type.String({ minLength: 7, maxLength: 7, pattern: "^#[0-9A-Fa-f]{6}$" }),
+  normalizeInput: normalizeHexColor,
+  normalizeOutput: (value) => coerceWorkspaceThemeColor(value, DEFAULT_WORKSPACE_LIGHT_PALETTE.surfaceColor),
+  resolveDefault: () => DEFAULT_WORKSPACE_LIGHT_PALETTE.surfaceColor
+});
+
+defineField({
+  key: "lightSurfaceVariantColor",
+  dbColumn: "light_surface_variant_color",
+  required: true,
+  inputSchema: Type.String({
+    minLength: 7,
+    maxLength: 7,
+    pattern: "^#[0-9A-Fa-f]{6}$",
+    messages: {
+      required: "Light surface variant color is required.",
+      pattern: "Light surface variant color must be a hex color like #424242.",
+      default: "Light surface variant color must be a hex color like #424242."
+    }
+  }),
+  outputSchema: Type.String({ minLength: 7, maxLength: 7, pattern: "^#[0-9A-Fa-f]{6}$" }),
+  normalizeInput: normalizeHexColor,
+  normalizeOutput: (value) => coerceWorkspaceThemeColor(value, DEFAULT_WORKSPACE_LIGHT_PALETTE.surfaceVariantColor),
+  resolveDefault: () => DEFAULT_WORKSPACE_LIGHT_PALETTE.surfaceVariantColor
+});
+
+defineField({
+  key: "darkPrimaryColor",
+  dbColumn: "dark_primary_color",
+  required: true,
+  inputSchema: Type.String({
+    minLength: 7,
+    maxLength: 7,
+    pattern: "^#[0-9A-Fa-f]{6}$",
+    messages: {
+      required: "Dark primary color is required.",
+      pattern: "Dark primary color must be a hex color like #2196F3.",
+      default: "Dark primary color must be a hex color like #2196F3."
+    }
+  }),
+  outputSchema: Type.String({ minLength: 7, maxLength: 7, pattern: "^#[0-9A-Fa-f]{6}$" }),
+  normalizeInput: normalizeHexColor,
+  normalizeOutput: (value) => coerceWorkspaceThemeColor(value, DEFAULT_WORKSPACE_DARK_PALETTE.color),
+  resolveDefault: () => DEFAULT_WORKSPACE_DARK_PALETTE.color
+});
+
+defineField({
+  key: "darkSecondaryColor",
+  dbColumn: "dark_secondary_color",
+  required: true,
+  inputSchema: Type.String({
+    minLength: 7,
+    maxLength: 7,
+    pattern: "^#[0-9A-Fa-f]{6}$",
+    messages: {
+      required: "Dark secondary color is required.",
+      pattern: "Dark secondary color must be a hex color like #54B6B2.",
+      default: "Dark secondary color must be a hex color like #54B6B2."
+    }
+  }),
+  outputSchema: Type.String({ minLength: 7, maxLength: 7, pattern: "^#[0-9A-Fa-f]{6}$" }),
+  normalizeInput: normalizeHexColor,
+  normalizeOutput: (value) => coerceWorkspaceThemeColor(value, DEFAULT_WORKSPACE_DARK_PALETTE.secondaryColor),
+  resolveDefault: () => DEFAULT_WORKSPACE_DARK_PALETTE.secondaryColor
+});
+
+defineField({
+  key: "darkSurfaceColor",
+  dbColumn: "dark_surface_color",
+  required: true,
+  inputSchema: Type.String({
+    minLength: 7,
+    maxLength: 7,
+    pattern: "^#[0-9A-Fa-f]{6}$",
+    messages: {
+      required: "Dark surface color is required.",
+      pattern: "Dark surface color must be a hex color like #212121.",
+      default: "Dark surface color must be a hex color like #212121."
+    }
+  }),
+  outputSchema: Type.String({ minLength: 7, maxLength: 7, pattern: "^#[0-9A-Fa-f]{6}$" }),
+  normalizeInput: normalizeHexColor,
+  normalizeOutput: (value) => coerceWorkspaceThemeColor(value, DEFAULT_WORKSPACE_DARK_PALETTE.surfaceColor),
+  resolveDefault: () => DEFAULT_WORKSPACE_DARK_PALETTE.surfaceColor
+});
+
+defineField({
+  key: "darkSurfaceVariantColor",
+  dbColumn: "dark_surface_variant_color",
+  required: true,
+  inputSchema: Type.String({
+    minLength: 7,
+    maxLength: 7,
+    pattern: "^#[0-9A-Fa-f]{6}$",
+    messages: {
+      required: "Dark surface variant color is required.",
+      pattern: "Dark surface variant color must be a hex color like #C8C8C8.",
+      default: "Dark surface variant color must be a hex color like #C8C8C8."
+    }
+  }),
+  outputSchema: Type.String({ minLength: 7, maxLength: 7, pattern: "^#[0-9A-Fa-f]{6}$" }),
+  normalizeInput: normalizeHexColor,
+  normalizeOutput: (value) => coerceWorkspaceThemeColor(value, DEFAULT_WORKSPACE_DARK_PALETTE.surfaceVariantColor),
+  resolveDefault: () => DEFAULT_WORKSPACE_DARK_PALETTE.surfaceVariantColor
+});
+
+defineField({
+  key: "invitesEnabled",
+  dbColumn: "invites_enabled",
+  required: true,
+  inputSchema: Type.Boolean({
+    messages: {
+      required: "invitesEnabled is required.",
+      default: "invitesEnabled must be a boolean."
+    }
+  }),
+  outputSchema: Type.Boolean(),
+  normalizeInput: (value) => value === true,
+  normalizeOutput: (value) => value !== false,
+  resolveDefault: ({ defaultInvitesEnabled } = {}) => defaultInvitesEnabled !== false
+});

package/test/exportsContract.test.js

@@ -0,0 +1,41 @@
+import assert from "node:assert/strict";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { evaluatePackageExportsContract } from "../../../tooling/test-support/exportsContract.mjs";
+
+const TEST_DIRECTORY = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(TEST_DIRECTORY, "..", "..", "..");
+const PACKAGE_DIR = path.join(REPO_ROOT, "packages", "workspaces-core");
+
+test("workspaces-core exports are explicit and aligned with production usage", () => {
+  const result = evaluatePackageExportsContract({
+    repoRoot: REPO_ROOT,
+    packageDir: PACKAGE_DIR,
+    packageId: "@jskit-ai/workspaces-core",
+    requiredExports: [
+      "./server/WorkspacesCoreServiceProvider"
+    ]
+  });
+
+  assert.deepEqual(
+    result.wildcardExports,
+    [],
+    `workspaces-core exports must be explicit. Remove wildcard keys: ${result.wildcardExports.join(", ")}`
+  );
+  assert.deepEqual(
+    result.missingRequiredExports,
+    [],
+    `workspaces-core required exports missing: ${result.missingRequiredExports.join(", ")}`
+  );
+  assert.deepEqual(
+    result.missingExports,
+    [],
+    `workspaces-core imports missing from package exports:\n${result.missingExports.join("\n")}`
+  );
+  assert.deepEqual(
+    result.staleExports,
+    [],
+    `Stale workspaces-core exports found. Remove stale keys: ${result.staleExports.join(", ")}`
+  );
+});

package/test/workspacesRouteRequestInputValidator.test.js

@@ -0,0 +1,474 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { UsersCoreServiceProvider } from "../../users-core/src/server/UsersCoreServiceProvider.js";
+import { resolveTenancyProfile } from "../../users-core/src/shared/tenancyProfile.js";
+import { WorkspacesCoreServiceProvider } from "../src/server/WorkspacesCoreServiceProvider.js";
+
+function createReplyDouble() {
+  return {
+    statusCode: 200,
+    payload: null,
+    redirectedTo: "",
+    code(value) {
+      this.statusCode = value;
+      return this;
+    },
+    send(value) {
+      this.payload = value;
+      return this;
+    },
+    redirect(value) {
+      this.redirectedTo = String(value || "");
+      return this;
+    }
+  };
+}
+
+function findRoute(routes, { method, path }) {
+  return routes.find((route) => route.method === method && route.path === path) || null;
+}
+
+async function registerRoutes({
+  authService = {},
+  consoleService = null,
+  workspaceEnabled = true,
+  workspaceTenancyEnabled = true,
+  workspaceInvitationsEnabled = true,
+  workspaceSelfCreateEnabled = true
+} = {}) {
+  const registeredRoutes = [];
+  const router = {
+    register(method, path, route, handler) {
+      registeredRoutes.push({
+        ...route,
+        method,
+        path,
+        handler
+      });
+    }
+  };
+
+  const bindings = new Map([
+    ["jskit.http.router", router],
+    ["authService", authService],
+    [
+      "users.accountProfile.service",
+      {
+        async readAvatar() {
+          return {
+            mimeType: "image/png",
+            buffer: Buffer.from([])
+          };
+        }
+      }
+    ],
+    ["actionExecutor", {}],
+    ["users.workspace.enabled", workspaceEnabled],
+    ["users.workspace.tenancy.enabled", workspaceTenancyEnabled],
+    ["users.workspace.invitations.enabled", workspaceInvitationsEnabled],
+    ["users.workspace.self-create.enabled", workspaceSelfCreateEnabled]
+  ]);
+
+  if (consoleService) {
+    bindings.set("consoleService", consoleService);
+  }
+
+  const app = {
+    has(token) {
+      return bindings.has(token);
+    },
+    make(token) {
+      if (!bindings.has(token)) {
+        throw new Error(`Missing test binding for token: ${String(token)}`);
+      }
+      return bindings.get(token);
+    }
+  };
+
+  const usersCoreProvider = new UsersCoreServiceProvider();
+  const workspacesCoreProvider = new WorkspacesCoreServiceProvider();
+  await usersCoreProvider.boot(app);
+  await workspacesCoreProvider.boot(app);
+
+  return registeredRoutes;
+}
+
+async function registerRoutesForMode({
+  tenancyMode = "none",
+  tenancyPolicy = {}
+} = {}) {
+  const tenancyProfile = resolveTenancyProfile({
+    tenancyMode,
+    tenancyPolicy
+  });
+  return registerRoutes({
+    workspaceEnabled: tenancyProfile.workspace.enabled === true,
+    workspaceTenancyEnabled: tenancyProfile.mode === "workspaces",
+    workspaceInvitationsEnabled:
+      tenancyProfile.workspace.enabled === true && tenancyProfile.mode !== "none",
+    workspaceSelfCreateEnabled: tenancyProfile.workspace.allowSelfCreate === true
+  });
+}
+
+function createActionRequest({ input = {}, executeAction, file = null }) {
+  return {
+    input,
+    executeAction,
+    file,
+    user: {
+      id: 42
+    }
+  };
+}
+
+test("workspace and settings routes attach only the shared transport normalizers they actually use", async () => {
+  const routes = await registerRoutes();
+
+  const workspaceSettings = findRoute(routes, {
+    method: "GET",
+    path: "/api/w/:workspaceSlug/settings"
+  });
+  const workspacePatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug"
+  });
+  const workspaceSettingsPatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug/settings"
+  });
+  const workspaceMemberRole = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug/members/:memberUserId/role"
+  });
+  const workspaceMemberDelete = findRoute(routes, {
+    method: "DELETE",
+    path: "/api/w/:workspaceSlug/members/:memberUserId"
+  });
+  const workspaceInviteDelete = findRoute(routes, {
+    method: "DELETE",
+    path: "/api/w/:workspaceSlug/invites/:inviteId"
+  });
+
+  assert.equal(typeof workspaceSettings?.paramsValidator?.normalize, "function");
+  assert.equal(typeof workspacePatch?.bodyValidator?.normalize, "function");
+  assert.equal(typeof workspaceSettingsPatch?.bodyValidator?.normalize, "function");
+  assert.equal(typeof workspaceMemberRole?.paramsValidator?.normalize, "function");
+  assert.equal(typeof workspaceMemberRole?.bodyValidator?.normalize, "function");
+  assert.equal(typeof workspaceMemberDelete?.paramsValidator?.normalize, "function");
+  assert.equal(typeof workspaceInviteDelete?.paramsValidator?.normalize, "function");
+});
+
+test("workspace core/settings routes mount one canonical workspace endpoint", async () => {
+  const routes = await registerRoutes();
+  const workspace = findRoute(routes, {
+    method: "GET",
+    path: "/api/w/:workspaceSlug"
+  });
+  const workspacePatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug"
+  });
+  const workspaceSettings = findRoute(routes, {
+    method: "GET",
+    path: "/api/w/:workspaceSlug/settings"
+  });
+  const workspaceSettingsPatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug/settings"
+  });
+  const adminWorkspaceSettings = findRoute(routes, {
+    method: "GET",
+    path: "/api/admin/w/:workspaceSlug/workspace/settings"
+  });
+  const consoleWorkspaceSettings = findRoute(routes, {
+    method: "GET",
+    path: "/api/console/w/:workspaceSlug/workspace/settings"
+  });
+
+  assert.ok(workspace);
+  assert.equal(workspace?.visibility, "workspace");
+  assert.equal(workspacePatch?.visibility, "workspace");
+  assert.equal(workspace?.surface, "");
+  assert.equal(workspacePatch?.surface, "");
+  assert.ok(workspaceSettings);
+  assert.equal(workspaceSettings?.visibility, "workspace");
+  assert.equal(workspaceSettingsPatch?.visibility, "workspace");
+  assert.equal(workspaceSettings?.surface, "");
+  assert.equal(workspaceSettingsPatch?.surface, "");
+  assert.equal(adminWorkspaceSettings, null);
+  assert.equal(consoleWorkspaceSettings, null);
+});
+
+test("workspaces-core boot skips workspace routes when workspace policy is disabled", async () => {
+  const routes = await registerRoutes({
+    workspaceEnabled: false,
+    workspaceTenancyEnabled: false,
+    workspaceInvitationsEnabled: false,
+    workspaceSelfCreateEnabled: false
+  });
+
+  assert.equal(findRoute(routes, { method: "GET", path: "/api/workspaces" }), null);
+  assert.equal(findRoute(routes, { method: "POST", path: "/api/workspaces" }), null);
+  assert.equal(findRoute(routes, { method: "GET", path: "/api/w/:workspaceSlug" }), null);
+  assert.equal(findRoute(routes, { method: "PATCH", path: "/api/w/:workspaceSlug" }), null);
+  assert.equal(findRoute(routes, { method: "GET", path: "/api/w/:workspaceSlug/settings" }), null);
+  assert.equal(findRoute(routes, { method: "GET", path: "/api/settings" })?.path, "/api/settings");
+});
+
+test("workspaces-core boot skips workspace create route when self-create policy is disabled", async () => {
+  const routes = await registerRoutes({
+    workspaceEnabled: true,
+    workspaceTenancyEnabled: true,
+    workspaceInvitationsEnabled: true,
+    workspaceSelfCreateEnabled: false
+  });
+
+  assert.equal(findRoute(routes, { method: "POST", path: "/api/workspaces" }), null);
+  assert.equal(findRoute(routes, { method: "GET", path: "/api/workspaces" })?.path, "/api/workspaces");
+});
+
+test("workspaces-core route registration follows tenancy mode matrix", async () => {
+  const noneRoutes = await registerRoutesForMode({
+    tenancyMode: "none"
+  });
+  const personalRoutes = await registerRoutesForMode({
+    tenancyMode: "personal"
+  });
+  const workspaceRoutes = await registerRoutesForMode({
+    tenancyMode: "workspaces"
+  });
+  const workspaceSelfCreateRoutes = await registerRoutesForMode({
+    tenancyMode: "workspaces",
+    tenancyPolicy: {
+      workspace: {
+        allowSelfCreate: true
+      }
+    }
+  });
+
+  assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/workspaces" }), null);
+  assert.equal(findRoute(noneRoutes, { method: "POST", path: "/api/workspaces" }), null);
+  assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/w/:workspaceSlug" }), null);
+  assert.equal(findRoute(noneRoutes, { method: "PATCH", path: "/api/w/:workspaceSlug" }), null);
+  assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/w/:workspaceSlug/settings" }), null);
+  assert.equal(findRoute(noneRoutes, { method: "GET", path: "/api/workspace/invitations/pending" }), null);
+
+  assert.equal(findRoute(personalRoutes, { method: "GET", path: "/api/workspaces" })?.path, "/api/workspaces");
+  assert.equal(findRoute(personalRoutes, { method: "POST", path: "/api/workspaces" }), null);
+  assert.equal(
+    findRoute(personalRoutes, { method: "GET", path: "/api/w/:workspaceSlug" })?.path,
+    "/api/w/:workspaceSlug"
+  );
+  assert.equal(
+    findRoute(personalRoutes, { method: "PATCH", path: "/api/w/:workspaceSlug" })?.path,
+    "/api/w/:workspaceSlug"
+  );
+  assert.equal(
+    findRoute(personalRoutes, { method: "GET", path: "/api/w/:workspaceSlug/settings" })?.path,
+    "/api/w/:workspaceSlug/settings"
+  );
+  assert.equal(
+    findRoute(personalRoutes, { method: "GET", path: "/api/workspace/invitations/pending" })?.path,
+    "/api/workspace/invitations/pending"
+  );
+
+  assert.equal(findRoute(workspaceRoutes, { method: "GET", path: "/api/workspaces" })?.path, "/api/workspaces");
+  assert.equal(findRoute(workspaceRoutes, { method: "POST", path: "/api/workspaces" }), null);
+  assert.equal(
+    findRoute(workspaceRoutes, { method: "GET", path: "/api/w/:workspaceSlug" })?.path,
+    "/api/w/:workspaceSlug"
+  );
+  assert.equal(
+    findRoute(workspaceRoutes, { method: "PATCH", path: "/api/w/:workspaceSlug" })?.path,
+    "/api/w/:workspaceSlug"
+  );
+  assert.equal(
+    findRoute(workspaceRoutes, { method: "GET", path: "/api/w/:workspaceSlug/settings" })?.path,
+    "/api/w/:workspaceSlug/settings"
+  );
+  assert.equal(
+    findRoute(workspaceRoutes, { method: "GET", path: "/api/workspace/invitations/pending" })?.path,
+    "/api/workspace/invitations/pending"
+  );
+
+  assert.equal(
+    findRoute(workspaceSelfCreateRoutes, { method: "POST", path: "/api/workspaces" })?.path,
+    "/api/workspaces"
+  );
+});
+
+test("workspaces-core boot skips invitation redeem/list routes when workspace invitations are disabled", async () => {
+  const routes = await registerRoutes({
+    workspaceEnabled: true,
+    workspaceTenancyEnabled: true,
+    workspaceInvitationsEnabled: false,
+    workspaceSelfCreateEnabled: false
+  });
+
+  assert.equal(findRoute(routes, { method: "GET", path: "/api/workspace/invitations/pending" }), null);
+  assert.equal(findRoute(routes, { method: "POST", path: "/api/workspace/invitations/redeem" }), null);
+  assert.equal(findRoute(routes, { method: "GET", path: "/api/w/:workspaceSlug/invites" }), null);
+  assert.equal(findRoute(routes, { method: "POST", path: "/api/w/:workspaceSlug/invites" }), null);
+  assert.equal(findRoute(routes, { method: "DELETE", path: "/api/w/:workspaceSlug/invites/:inviteId" }), null);
+});
+
+test("workspace invite and member handlers build action input from request.input", async () => {
+  const routes = await registerRoutes();
+  const workspaceCreate = findRoute(routes, {
+    method: "POST",
+    path: "/api/workspaces"
+  });
+  const workspaceInviteRedeem = findRoute(routes, {
+    method: "POST",
+    path: "/api/workspace/invitations/redeem"
+  });
+  const workspaceMemberRolePatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug/members/:memberUserId/role"
+  });
+  const workspaceMemberDelete = findRoute(routes, {
+    method: "DELETE",
+    path: "/api/w/:workspaceSlug/members/:memberUserId"
+  });
+  const workspaceInviteCreate = findRoute(routes, {
+    method: "POST",
+    path: "/api/w/:workspaceSlug/invites"
+  });
+  const workspaceInviteDelete = findRoute(routes, {
+    method: "DELETE",
+    path: "/api/w/:workspaceSlug/invites/:inviteId"
+  });
+  const calls = [];
+  const executeAction = async (payload) => {
+    calls.push(payload);
+    return {};
+  };
+
+  await workspaceCreate.handler(
+    createActionRequest({
+      input: {
+        body: { name: "Operations", slug: "operations" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
+  await workspaceInviteRedeem.handler(
+    createActionRequest({
+      input: {
+        body: { token: "token-1", decision: "accept" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
+  await workspaceMemberRolePatch.handler(
+    createActionRequest({
+      input: {
+        params: { workspaceSlug: "acme", memberUserId: "12" },
+        body: { roleSid: "admin" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
+  await workspaceInviteCreate.handler(
+    createActionRequest({
+      input: {
+        params: { workspaceSlug: "acme" },
+        body: { email: "user@example.com", roleSid: "member" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
+  await workspaceMemberDelete.handler(
+    createActionRequest({
+      input: {
+        params: { workspaceSlug: "acme", memberUserId: "44" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
+  await workspaceInviteDelete.handler(
+    createActionRequest({
+      input: {
+        params: { workspaceSlug: "acme", inviteId: "55" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
+
+  assert.deepEqual(calls[0], {
+    actionId: "workspace.workspaces.create",
+    input: { name: "Operations", slug: "operations" }
+  });
+  assert.deepEqual(calls[1].input, { payload: { token: "token-1", decision: "accept" } });
+  assert.deepEqual(calls[2].input, { workspaceSlug: "acme", memberUserId: "12", roleSid: "admin" });
+  assert.deepEqual(calls[3].input, { workspaceSlug: "acme", email: "user@example.com", roleSid: "member" });
+  assert.deepEqual(calls[4].input, { workspaceSlug: "acme", memberUserId: "44" });
+  assert.deepEqual(calls[5].input, { workspaceSlug: "acme", inviteId: "55" });
+});
+
+test("workspace settings route handlers build action input from request.input", async () => {
+  const routes = await registerRoutes();
+  const workspaceSettingsPatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug/settings"
+  });
+  const calls = [];
+  const executeAction = async (payload) => {
+    calls.push(payload);
+    return {};
+  };
+
+  await workspaceSettingsPatch.handler(
+    createActionRequest({
+      input: {
+        params: { workspaceSlug: "acme" },
+        body: { lightPrimaryColor: "#0F6B54" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
+
+  assert.deepEqual(calls[0], {
+    actionId: "workspace.settings.update",
+    input: { workspaceSlug: "acme", patch: { lightPrimaryColor: "#0F6B54" } }
+  });
+});
+
+test("workspace route handlers build action input from request.input", async () => {
+  const routes = await registerRoutes();
+  const workspacePatch = findRoute(routes, {
+    method: "PATCH",
+    path: "/api/w/:workspaceSlug"
+  });
+  const calls = [];
+  const executeAction = async (payload) => {
+    calls.push(payload);
+    return {};
+  };
+
+  await workspacePatch.handler(
+    createActionRequest({
+      input: {
+        params: { workspaceSlug: "acme" },
+        body: { name: "Acme", avatarUrl: "https://example.com/acme.png" }
+      },
+      executeAction
+    }),
+    createReplyDouble()
+  );
+
+  assert.deepEqual(calls[0], {
+    actionId: "workspace.workspaces.update",
+    input: {
+      workspaceSlug: "acme",
+      patch: { name: "Acme", avatarUrl: "https://example.com/acme.png" }
+    }
+  });
+});