@jskit-ai/workspaces-core 0.1.125 → 0.1.128

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/workspaces-core",
-  "version": "0.1.125",
+  "version": "0.1.128",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -17,14 +17,358 @@
     "./shared/resources/workspaceSettingsResource": "./src/shared/resources/workspaceSettingsResource.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.144",
-    "@jskit-ai/database-runtime": "0.1.145",
-    "@jskit-ai/http-runtime": "0.1.144",
-    "@jskit-ai/json-rest-api-core": "0.1.90",
-    "@jskit-ai/kernel": "0.1.146",
-    "@jskit-ai/resource-crud-core": "0.1.89",
-    "@jskit-ai/resource-core": "0.1.89",
-    "@jskit-ai/users-core": "0.1.159",
-    "json-rest-schema": "1.x.x"
+    "@jskit-ai/auth-core": "0.1.148",
+    "@jskit-ai/database-runtime": "0.1.150",
+    "@jskit-ai/http-runtime": "0.1.148",
+    "@jskit-ai/json-rest-api-core": "0.1.94",
+    "@jskit-ai/kernel": "0.1.150",
+    "@jskit-ai/resource-core": "0.1.92",
+    "@jskit-ai/resource-crud-core": "0.1.92",
+    "@jskit-ai/users-core": "0.1.163",
+    "json-rest-schema": "^1.0.17"
+  },
+  "description": "Workspace tenancy runtime plus HTTP routes, role catalog, and workspace config scaffolding.",
+  "jskit": {
+    "kind": "runtime",
+    "capabilities": {
+      "provides": [
+        "workspaces.core",
+        "workspaces.server-routes"
+      ],
+      "requires": [
+        "users.core",
+        "json-rest-api.core"
+      ]
+    },
+    "runtime": {
+      "server": {
+        "providers": [
+          {
+            "entrypoint": "src/server/WorkspacesCoreServiceProvider.js",
+            "export": "WorkspacesCoreServiceProvider"
+          }
+        ]
+      },
+      "client": {
+        "providers": []
+      }
+    },
+    "metadata": {
+      "jskit": {
+        "tableOwnership": {
+          "tables": [
+            {
+              "tableName": "workspaces",
+              "provenance": "runtime-package",
+              "ownerKind": "package-runtime"
+            },
+            {
+              "tableName": "workspace_memberships",
+              "provenance": "runtime-package",
+              "ownerKind": "package-runtime"
+            },
+            {
+              "tableName": "workspace_settings",
+              "provenance": "runtime-package",
+              "ownerKind": "package-runtime"
+            },
+            {
+              "tableName": "workspace_invites",
+              "provenance": "runtime-package",
+              "ownerKind": "package-runtime"
+            }
+          ]
+        }
+      },
+      "apiSummary": {
+        "surfaces": [
+          {
+            "subpath": "./server",
+            "summary": "Exports the workspace runtime provider and workspace route registration surface."
+          }
+        ],
+        "containerTokens": {
+          "server": [
+            "workspaces.server.scope-support"
+          ],
+          "client": []
+        }
+      },
+      "server": {
+        "routes": [
+          {
+            "method": "POST",
+            "path": "/api/workspaces",
+            "summary": "Create a workspace for the authenticated user."
+          },
+          {
+            "method": "GET",
+            "path": "/api/workspaces",
+            "summary": "List workspaces visible to authenticated user."
+          },
+          {
+            "method": "GET",
+            "path": "/api/workspace/invitations/resolve",
+            "summary": "Resolve safe public workspace invitation metadata."
+          },
+          {
+            "method": "GET",
+            "path": "/api/workspace/invitations/pending",
+            "summary": "List pending workspace invitations for authenticated user."
+          },
+          {
+            "method": "POST",
+            "path": "/api/workspace/invitations/redeem",
+            "summary": "Accept or refuse a workspace invitation using an invite token."
+          },
+          {
+            "method": "GET",
+            "path": "/api/w/:workspaceSlug/settings",
+            "summary": "Get workspace settings and role catalog by workspace slug."
+          },
+          {
+            "method": "PATCH",
+            "path": "/api/w/:workspaceSlug/settings",
+            "summary": "Update workspace settings by workspace slug."
+          },
+          {
+            "method": "GET",
+            "path": "/api/w/:workspaceSlug/roles",
+            "summary": "Get role catalog by workspace slug."
+          },
+          {
+            "method": "GET",
+            "path": "/api/w/:workspaceSlug/members",
+            "summary": "List members by workspace slug."
+          },
+          {
+            "method": "PATCH",
+            "path": "/api/w/:workspaceSlug/members/:memberUserId/role",
+            "summary": "Update workspace member role by workspace slug."
+          },
+          {
+            "method": "GET",
+            "path": "/api/w/:workspaceSlug/invites",
+            "summary": "List workspace invites by workspace slug."
+          },
+          {
+            "method": "POST",
+            "path": "/api/w/:workspaceSlug/invites",
+            "summary": "Create workspace invite by workspace slug."
+          },
+          {
+            "method": "DELETE",
+            "path": "/api/w/:workspaceSlug/invites/:inviteId",
+            "summary": "Revoke workspace invite by workspace slug."
+          }
+        ]
+      }
+    },
+    "mutations": {
+      "dependencies": {
+        "runtime": {
+          "@jskit-ai/json-rest-api-core": "0.1.94",
+          "@jskit-ai/resource-core": "0.1.92",
+          "@jskit-ai/resource-crud-core": "0.1.92",
+          "@jskit-ai/users-core": "0.1.163"
+        },
+        "dev": {}
+      },
+      "packageJson": {
+        "scripts": {
+          "server:app": "SERVER_SURFACE=app node ./bin/server.js",
+          "server:admin": "SERVER_SURFACE=admin node ./bin/server.js"
+        }
+      },
+      "procfile": {},
+      "files": [
+        {
+          "op": "install-migration",
+          "from": "templates/migrations/workspaces_core_initial.cjs",
+          "toDir": "migrations",
+          "extension": ".cjs",
+          "reason": "Install workspace tenancy schema migration.",
+          "category": "migration",
+          "id": "workspaces-core-initial-schema"
+        },
+        {
+          "op": "install-migration",
+          "from": "templates/migrations/workspaces_core_workspace_settings_single_name_source.cjs",
+          "toDir": "migrations",
+          "extension": ".cjs",
+          "reason": "Remove workspace_settings name/avatar fields so workspace identity data comes from workspaces only.",
+          "category": "migration",
+          "id": "users-core-workspace-settings-single-name-source"
+        },
+        {
+          "op": "install-migration",
+          "from": "templates/migrations/workspaces_core_workspaces_drop_color.cjs",
+          "toDir": "migrations",
+          "extension": ".cjs",
+          "reason": "Drop workspaces.color now that workspace theme colors live in workspace_settings.",
+          "category": "migration",
+          "id": "users-core-workspaces-drop-color"
+        },
+        {
+          "from": "templates/config/roles.js",
+          "to": "config/roles.js",
+          "ownership": "app",
+          "preserveOnRemove": true,
+          "reason": "Install app-owned role catalog in a dedicated config file.",
+          "category": "workspaces-core",
+          "id": "users-core-app-owned-role-catalog-config"
+        },
+        {
+          "from": "templates/packages/main/src/server/email/workspaceInviteEmail.js",
+          "to": "packages/main/src/server/email/workspaceInviteEmail.js",
+          "ownership": "app",
+          "preserveOnRemove": true,
+          "reason": "Install app-owned editable workspace invite email template.",
+          "category": "workspaces-core",
+          "id": "workspaces-core-main-workspace-invite-email-template"
+        }
+      ],
+      "source": [
+        {
+          "op": "ensure-import",
+          "file": "config/server.js",
+          "namedImports": [
+            "renderWorkspaceInviteEmail"
+          ],
+          "from": "../packages/main/src/server/email/workspaceInviteEmail.js",
+          "reason": "Load app-owned workspace invite email renderer from packages/main.",
+          "category": "workspaces-core",
+          "id": "workspaces-core-server-config-workspace-invite-email-import"
+        },
+        {
+          "op": "ensure-assignment",
+          "file": "config/server.js",
+          "target": "config.workspaceInviteEmailTemplate",
+          "value": "renderWorkspaceInviteEmail",
+          "reason": "Bind app-owned workspace invite email renderer into server config.",
+          "category": "workspaces-core",
+          "id": "workspaces-core-server-config-workspace-invite-email-template"
+        }
+      ],
+      "text": [
+        {
+          "op": "append-text",
+          "file": "config/public.js",
+          "position": "top",
+          "skipIfContains": "import { roleCatalog } from \"./roles.js\";",
+          "value": "import { roleCatalog } from \"./roles.js\";\n",
+          "reason": "Load app-owned role catalog from dedicated config file.",
+          "category": "workspaces-core",
+          "id": "users-core-role-catalog-public-import"
+        },
+        {
+          "op": "append-text",
+          "file": "config/public.js",
+          "position": "top",
+          "skipIfContains": "import { surfaceAccessPolicies } from \"./surfaceAccessPolicies.js\";",
+          "value": "import { surfaceAccessPolicies } from \"./surfaceAccessPolicies.js\";\n",
+          "reason": "Load app-owned surface access policy catalog from dedicated config file.",
+          "category": "workspaces-core",
+          "id": "users-core-surface-access-policies-public-import"
+        },
+        {
+          "op": "append-text",
+          "file": "config/surfaceAccessPolicies.js",
+          "position": "top",
+          "skipIfContains": "export const surfaceAccessPolicies = {};",
+          "value": "export const surfaceAccessPolicies = {};\n\n",
+          "reason": "Initialize app-owned surface access policy config if missing.",
+          "category": "workspaces-core",
+          "id": "users-core-surface-access-policies-config-init"
+        },
+        {
+          "op": "append-text",
+          "file": "config/surfaceAccessPolicies.js",
+          "position": "bottom",
+          "skipIfContains": "surfaceAccessPolicies.workspace_member = {",
+          "value": "\nsurfaceAccessPolicies.workspace_member = {\n  requireAuth: true,\n  requireWorkspaceMembership: true\n};\n",
+          "reason": "Register workspace-member surface access policy for workspace surfaces.",
+          "category": "workspaces-core",
+          "id": "users-core-surface-access-policies-workspace-member"
+        },
+        {
+          "op": "append-text",
+          "file": "config/public.js",
+          "position": "bottom",
+          "skipIfContains": "config.surfaceDefinitions.app = {",
+          "value": "\nconfig.surfaceDefinitions.app = {\n  id: \"app\",\n  label: \"App\",\n  pagesRoot: \"w/[workspaceSlug]\",\n  enabled: true,\n  requiresAuth: true,\n  requiresWorkspace: true,\n  accessPolicyId: \"workspace_member\",\n  origin: \"\"\n};\n\nconfig.surfaceDefinitions.admin = {\n  id: \"admin\",\n  label: \"Admin\",\n  pagesRoot: \"w/[workspaceSlug]/admin\",\n  enabled: true,\n  requiresAuth: true,\n  requiresWorkspace: true,\n  accessPolicyId: \"workspace_member\",\n  origin: \"\"\n};\n",
+          "reason": "Append workspace surface topology when tenancy enables workspace routing.",
+          "category": "workspaces-core",
+          "id": "users-core-surface-config-workspace",
+          "when": {
+            "config": "tenancyMode",
+            "in": [
+              "personal",
+              "workspaces"
+            ]
+          }
+        },
+        {
+          "op": "append-text",
+          "file": "config/public.js",
+          "position": "bottom",
+          "skipIfContains": "config.workspaceSwitching =",
+          "value": "\nconfig.workspaceSwitching = true;\nconfig.workspaceInvitations = {\n  enabled: true,\n  allowInPersonalMode: true\n};\n",
+          "reason": "Append default workspace feature toggles into app-owned config.",
+          "category": "workspaces-core",
+          "id": "users-core-public-config"
+        },
+        {
+          "op": "append-text",
+          "file": "config/public.js",
+          "position": "bottom",
+          "skipIfContains": "config.roleCatalog = roleCatalog;",
+          "value": "\nconfig.roleCatalog = roleCatalog;\n",
+          "reason": "Bind app-owned role catalog onto public config.",
+          "category": "workspaces-core",
+          "id": "users-core-role-catalog-public-config"
+        },
+        {
+          "op": "append-text",
+          "file": "config/public.js",
+          "position": "bottom",
+          "skipIfContains": "config.surfaceAccessPolicies = surfaceAccessPolicies;",
+          "value": "\nconfig.surfaceAccessPolicies = surfaceAccessPolicies;\n",
+          "reason": "Bind app-owned surface access policies onto public config.",
+          "category": "workspaces-core",
+          "id": "users-core-surface-access-policies-public-config"
+        },
+        {
+          "op": "append-text",
+          "file": "config/server.js",
+          "position": "bottom",
+          "skipIfContains": "config.workspaceColor =",
+          "value": "\nconfig.workspaceColor = \"#1867C0\";\n",
+          "reason": "Append default workspace server settings into app-owned config.",
+          "category": "workspaces-core",
+          "id": "users-core-server-config"
+        },
+        {
+          "op": "append-text",
+          "file": "config/server.js",
+          "position": "bottom",
+          "skipIfContains": "config.workspaceSettings =",
+          "value": "\nconfig.workspaceSettings = {\n  defaults: {\n    invitesEnabled: true\n  }\n};\n",
+          "reason": "Append app-owned workspace settings defaults into the server config.",
+          "category": "workspaces-core",
+          "id": "users-core-workspace-settings-server-config"
+        },
+        {
+          "op": "append-text",
+          "file": "config/server.js",
+          "position": "bottom",
+          "skipIfContains": "config.workspaceMembers =",
+          "value": "\nconfig.workspaceMembers = {\n  defaults: {\n    inviteExpiresInMs: 604800000\n  }\n};\n",
+          "reason": "Append app-owned workspace member invite policy defaults into the server config.",
+          "category": "workspaces-core",
+          "id": "users-core-workspace-members-server-config"
+        }
+      ]
+    }
   }
 }

package/src/server/common/repositories/repositoryUtils.js

@@ -1,24 +1,11 @@
 import {
   normalizeDbRecordId,
-  toInsertDateTime,
-  toNullableDateTime,
   toIsoString,
   createWithTransaction
 } from "@jskit-ai/database-runtime/shared";
 import { isDuplicateEntryError } from "@jskit-ai/database-runtime/shared/duplicateEntry";
 import { normalizeLowerText, normalizeRecordId, normalizeText } from "@jskit-ai/kernel/shared/support/normalize";
 
-function nowDb() {
-  return toInsertDateTime();
-}
-
-function toNullableIso(value) {
-  if (!value) {
-    return null;
-  }
-  return toIsoString(value);
-}
-
 function uniqueSorted(values) {
   return [...new Set(values)].sort((left, right) => String(left).localeCompare(String(right)));
 }
@@ -43,15 +30,12 @@ function toDbJson(value, fallback = {}) {
 }
 
 export {
-  toNullableDateTime,
   toIsoString,
   isDuplicateEntryError,
   normalizeText,
   normalizeLowerText,
   normalizeRecordId,
   normalizeDbRecordId,
-  nowDb,
-  toNullableIso,
   uniqueSorted,
   parseJson,
   toDbJson,

package/src/server/common/repositories/workspaceInvitesRepository.js

@@ -4,7 +4,6 @@ import {
   normalizeRecordId,
   normalizeDbRecordId,
   normalizeText,
-  nowDb,
   isDuplicateEntryError,
   toIsoString
 } from "./repositoryUtils.js";
@@ -55,13 +54,13 @@ function normalizeInvitePatchPayload(payload = {}) {
         : normalizeRecordId(source.invitedByUserId, { fallback: null });
   }
   if (Object.hasOwn(source, "expiresAt")) {
-    normalized.expiresAt = source.expiresAt == null ? null : new Date(source.expiresAt);
+    normalized.expiresAt = source.expiresAt == null ? null : toIsoString(source.expiresAt);
   }
   if (Object.hasOwn(source, "acceptedAt")) {
-    normalized.acceptedAt = source.acceptedAt == null ? null : new Date(source.acceptedAt);
+    normalized.acceptedAt = source.acceptedAt == null ? null : toIsoString(source.acceptedAt);
   }
   if (Object.hasOwn(source, "revokedAt")) {
-    normalized.revokedAt = source.revokedAt == null ? null : new Date(source.revokedAt);
+    normalized.revokedAt = source.revokedAt == null ? null : toIsoString(source.revokedAt);
   }
 
   return normalized;
@@ -208,6 +207,7 @@ function createRepository({ api, knex } = {}) {
     };
 
     try {
+      const createdAt = new Date().toISOString();
       const created = await api.resources.workspaceInvites.post(
         {
           inputRecord: createJsonApiInputRecord(
@@ -217,11 +217,11 @@ function createRepository({ api, knex } = {}) {
               roleSid: createPayload.roleSid,
               status: createPayload.status,
               tokenHash: createPayload.tokenHash,
-              expiresAt: createPayload.expiresAt ?? null,
+              expiresAt: createPayload.expiresAt == null ? null : toIsoString(createPayload.expiresAt),
               acceptedAt: null,
               revokedAt: null,
-              createdAt: new Date(),
-              updatedAt: new Date()
+              createdAt,
+              updatedAt: createdAt
             },
             {
               relationships: createInviteRelationships({
@@ -281,7 +281,7 @@ function createRepository({ api, knex } = {}) {
             RESOURCE_TYPE,
             {
               status: patch.status,
-              updatedAt: nowDb()
+              updatedAt: new Date().toISOString()
             },
             {
               id: row.id
@@ -300,14 +300,15 @@ function createRepository({ api, knex } = {}) {
       return;
     }
 
+    const acceptedAt = new Date().toISOString();
     await api.resources.workspaceInvites.patch(
       {
         inputRecord: createJsonApiInputRecord(
           RESOURCE_TYPE,
           {
             status: "accepted",
-            acceptedAt: new Date(),
-            updatedAt: new Date()
+            acceptedAt,
+            updatedAt: acceptedAt
           },
           {
             id: normalizedInviteId
@@ -325,14 +326,15 @@ function createRepository({ api, knex } = {}) {
       return;
     }
 
+    const revokedAt = new Date().toISOString();
     await api.resources.workspaceInvites.patch(
       {
         inputRecord: createJsonApiInputRecord(
           RESOURCE_TYPE,
           {
             status: "revoked",
-            revokedAt: new Date(),
-            updatedAt: new Date()
+            revokedAt,
+            updatedAt: revokedAt
           },
           {
             id: normalizedInviteId

package/src/server/common/repositories/workspaceMembershipsRepository.js

@@ -136,6 +136,7 @@ function createRepository({ api, knex } = {}) {
     const existing = await findByWorkspaceIdAndUserId(normalizedWorkspaceId, normalizedUserId, options);
     if (existing) {
       if (existing.roleSid !== OWNER_ROLE_ID || existing.status !== "active") {
+        const updatedAt = new Date().toISOString();
         await api.resources.workspaceMemberships.patch(
           {
             inputRecord: createJsonApiInputRecord(
@@ -143,7 +144,7 @@ function createRepository({ api, knex } = {}) {
               {
                 roleSid: OWNER_ROLE_ID,
                 status: "active",
-                updatedAt: new Date()
+                updatedAt
               },
               {
                 id: existing.id
@@ -158,6 +159,7 @@ function createRepository({ api, knex } = {}) {
     }
 
     try {
+      const createdAt = new Date().toISOString();
       await api.resources.workspaceMemberships.post(
         {
           inputRecord: createJsonApiInputRecord(
@@ -165,8 +167,8 @@ function createRepository({ api, knex } = {}) {
             {
               roleSid: OWNER_ROLE_ID,
               status: "active",
-              createdAt: new Date(),
-              updatedAt: new Date()
+              createdAt,
+              updatedAt: createdAt
             },
             {
               relationships: createMembershipRelationships({
@@ -205,6 +207,7 @@ function createRepository({ api, knex } = {}) {
 
     if (!existing) {
       try {
+        const createdAt = new Date().toISOString();
         await api.resources.workspaceMemberships.post(
           {
             inputRecord: createJsonApiInputRecord(
@@ -212,8 +215,8 @@ function createRepository({ api, knex } = {}) {
               {
                 roleSid,
                 status,
-                createdAt: new Date(),
-                updatedAt: new Date()
+                createdAt,
+                updatedAt: createdAt
               },
               {
                 relationships: createMembershipRelationships({
@@ -234,6 +237,7 @@ function createRepository({ api, knex } = {}) {
       return findByWorkspaceIdAndUserId(normalizedWorkspaceId, normalizedUserId, options);
     }
 
+    const updatedAt = new Date().toISOString();
     await api.resources.workspaceMemberships.patch(
       {
         inputRecord: createJsonApiInputRecord(
@@ -241,7 +245,7 @@ function createRepository({ api, knex } = {}) {
           {
             roleSid,
             status,
-            updatedAt: new Date()
+            updatedAt
           },
           {
             id: existing.id

package/src/server/common/repositories/workspacesRepository.js

@@ -137,14 +137,15 @@ function createRepository({ api, knex } = {}) {
     };
 
     try {
+      const createdAt = new Date().toISOString();
       const created = await api.resources.workspaces.post(
         {
           inputRecord: createJsonApiInputRecord(
             RESOURCE_TYPE,
             {
               ...createPayload,
-              createdAt: new Date(),
-              updatedAt: new Date()
+              createdAt,
+              updatedAt: createdAt
             },
             {
               relationships: createWorkspaceRelationships({ ownerUserId })
@@ -181,7 +182,7 @@ function createRepository({ api, knex } = {}) {
     const sourcePatch = patch && typeof patch === "object" && !Array.isArray(patch) ? patch : {};
     const workspacePatch = {
       ...sourcePatch,
-      updatedAt: new Date()
+      updatedAt: new Date().toISOString()
     };
     const relationships = createWorkspaceRelationships(sourcePatch);
 

package/src/server/workspaceSettings/workspaceSettingsRepository.js

@@ -1,6 +1,5 @@
 import {
   normalizeRecordId,
-  nowDb,
   isDuplicateEntryError,
   createWithTransaction
 } from "../common/repositories/repositoryUtils.js";
@@ -142,7 +141,7 @@ function createRepository({ api, knex } = {}) {
           RESOURCE_TYPE,
           {
             ...updatePayload,
-            updatedAt: nowDb()
+            updatedAt: new Date().toISOString()
           },
           {
             id: normalizedWorkspaceId

package/test/{packageDescriptor.test.js → packageMetadata.test.js}

@@ -3,33 +3,35 @@ import path from "node:path";
 import test from "node:test";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
-import descriptor from "../package.descriptor.mjs";
+import packageJson from "../package.json" with { type: "json" };
+
+const packageMetadata = packageJson.jskit;
 
 const TEST_DIRECTORY = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_DIR = path.resolve(TEST_DIRECTORY, "..");
 
 function findRoute(method, routePath) {
-  const routes = descriptor?.metadata?.server?.routes;
+  const routes = packageMetadata?.metadata?.server?.routes;
   return Array.isArray(routes)
     ? routes.find((entry) => entry?.method === method && entry?.path === routePath) || null
     : null;
 }
 
 function findFileMutation(id) {
-  const fileMutations = descriptor?.mutations?.files;
+  const fileMutations = packageMetadata?.mutations?.files;
   return Array.isArray(fileMutations)
     ? fileMutations.find((entry) => String(entry?.id || "").trim() === id) || null
     : null;
 }
 
 function findSourceMutation(id) {
-  const sourceMutations = descriptor?.mutations?.source;
+  const sourceMutations = packageMetadata?.mutations?.source;
   return Array.isArray(sourceMutations)
     ? sourceMutations.find((entry) => String(entry?.id || "").trim() === id) || null
     : null;
 }
 
-test("workspaces-core descriptor advertises public invite resolution route metadata", () => {
+test("workspaces-core packageMetadata advertises public invite resolution route metadata", () => {
   assert.deepEqual(findRoute("GET", "/api/workspace/invitations/resolve"), {
     method: "GET",
     path: "/api/workspace/invitations/resolve",

package/test/workspaceInternalCrudResources.test.js

@@ -48,8 +48,8 @@ test("workspace memberships derived bodies accept normalized internal writes", a
   assert.equal(String(create.value.userId), "9");
   assert.equal(create.value.roleSid, "OWNER");
   assert.equal(create.value.status, "ACTIVE");
-  assert.equal(typeof create.value.createdAt, "object");
-  assert.equal(typeof create.value.updatedAt, "object");
+  assert.equal(create.value.createdAt, "2026-05-02T10:11:12.000Z");
+  assert.equal(create.value.updatedAt, "2026-05-02T10:11:12.000Z");
 
   const patch = await parseBody(workspaceMembershipsResource.operations.patch, {
     roleSid: "ADMIN",
@@ -59,7 +59,7 @@ test("workspace memberships derived bodies accept normalized internal writes", a
   assert.equal(patch.ok, true);
   assert.equal(patch.value.roleSid, "ADMIN");
   assert.equal(patch.value.status, "ACTIVE");
-  assert.equal(typeof patch.value.updatedAt, "object");
+  assert.equal(patch.value.updatedAt, "2026-05-02T10:11:12.000Z");
 });
 
 test("workspace invites derived bodies keep lifecycle fields available for internal writes", async () => {
@@ -83,8 +83,8 @@ test("workspace invites derived bodies keep lifecycle fields available for inter
   assert.equal(create.value.status, "PENDING");
   assert.equal(create.value.tokenHash, "invite-token-hash");
   assert.equal(String(create.value.invitedByUserId), "9");
-  assert.equal(typeof create.value.createdAt, "object");
-  assert.equal(typeof create.value.updatedAt, "object");
+  assert.equal(create.value.createdAt, "2026-05-02T10:11:12.000Z");
+  assert.equal(create.value.updatedAt, "2026-05-02T10:11:12.000Z");
 
   const patch = await parseBody(workspaceInvitesResource.operations.patch, {
     status: "ACCEPTED",
@@ -93,6 +93,6 @@ test("workspace invites derived bodies keep lifecycle fields available for inter
   });
   assert.equal(patch.ok, true);
   assert.equal(patch.value.status, "ACCEPTED");
-  assert.equal(typeof patch.value.acceptedAt, "object");
-  assert.equal(typeof patch.value.updatedAt, "object");
+  assert.equal(patch.value.acceptedAt, "2026-05-11T00:00:00.000Z");
+  assert.equal(patch.value.updatedAt, "2026-05-11T00:00:00.000Z");
 });

package/test/workspaceInvitesRepository.test.js

@@ -233,8 +233,8 @@ test("workspaceInvitesRepository.markAcceptedById uses the internal invite resou
 
   const payload = state.patchPayloads[0];
   assert.equal(payload.attributes?.status, "accepted");
-  assert.equal(typeof payload.attributes?.acceptedAt, "object");
-  assert.equal(typeof payload.attributes?.updatedAt, "object");
+  assert.equal(typeof payload.attributes?.acceptedAt, "string");
+  assert.equal(payload.attributes?.updatedAt, payload.attributes?.acceptedAt);
 });
 
 test("workspaceInvitesRepository.listPendingByWorkspaceIdWithWorkspace keeps workspace join fields outside the base resource contract", async () => {

package/test/workspaceMembershipsRepository.test.js

@@ -191,7 +191,7 @@ test("workspaceMembershipsRepository.ensureOwnerMembership upgrades an existing
 
   assert.equal(state.patchPayload.attributes?.roleSid, "owner");
   assert.equal(state.patchPayload.attributes?.status, "active");
-  assert.equal(typeof state.patchPayload.attributes?.updatedAt, "object");
+  assert.equal(typeof state.patchPayload.attributes?.updatedAt, "string");
   assert.deepEqual(membership, {
     id: "11",
     workspaceId: "7",

package/test/workspacesRepository.test.js

@@ -232,8 +232,8 @@ test("workspacesRepository.insert writes canonical fields through json-rest-api"
   assert.equal(state.postPayload.attributes?.name, "TonyMobily3");
   assert.equal(state.postPayload.attributes?.isPersonal, false);
   assert.equal(state.postPayload.attributes?.avatarUrl, "");
-  assert.equal(typeof state.postPayload.attributes?.createdAt, "object");
-  assert.equal(typeof state.postPayload.attributes?.updatedAt, "object");
+  assert.equal(typeof state.postPayload.attributes?.createdAt, "string");
+  assert.equal(state.postPayload.attributes?.updatedAt, state.postPayload.attributes?.createdAt);
   assert.equal(inserted.id, "1");
   assert.equal(inserted.ownerUserId, "9");
 });
@@ -290,7 +290,7 @@ test("workspacesRepository.updateById patches canonical fields and updatedAt", a
 
   assert.equal(state.patchPayload.id, "7");
   assert.equal(state.patchPayload.attributes?.name, "TonyMobily 4");
-  assert.equal(typeof state.patchPayload.attributes?.updatedAt, "object");
+  assert.equal(typeof state.patchPayload.attributes?.updatedAt, "string");
 });
 
 test("workspacesRepository.listForUserId keeps membership fields outside the canonical workspace row", async () => {

package/package.descriptor.mjs

@@ -1,352 +0,0 @@
-export default Object.freeze({
-  packageVersion: 1,
-  packageId: "@jskit-ai/workspaces-core",
-  version: "0.1.125",
-  kind: "runtime",
-  description: "Workspace tenancy runtime plus HTTP routes, role catalog, and workspace config scaffolding.",
-  dependsOn: [
-    "@jskit-ai/json-rest-api-core",
-    "@jskit-ai/resource-core",
-    "@jskit-ai/resource-crud-core",
-    "@jskit-ai/users-core"
-  ],
-  capabilities: {
-    provides: [
-      "workspaces.core",
-      "workspaces.server-routes"
-    ],
-    requires: [
-      "users.core",
-      "json-rest-api.core"
-    ]
-  },
-  runtime: {
-    server: {
-      providers: [
-        {
-          entrypoint: "src/server/WorkspacesCoreServiceProvider.js",
-          export: "WorkspacesCoreServiceProvider"
-        }
-      ]
-    },
-    client: {
-      providers: []
-    }
-  },
-  metadata: {
-    jskit: {
-      tableOwnership: {
-        tables: [
-          {
-            tableName: "workspaces",
-            provenance: "runtime-package",
-            ownerKind: "package-runtime"
-          },
-          {
-            tableName: "workspace_memberships",
-            provenance: "runtime-package",
-            ownerKind: "package-runtime"
-          },
-          {
-            tableName: "workspace_settings",
-            provenance: "runtime-package",
-            ownerKind: "package-runtime"
-          },
-          {
-            tableName: "workspace_invites",
-            provenance: "runtime-package",
-            ownerKind: "package-runtime"
-          }
-        ]
-      }
-    },
-    apiSummary: {
-      surfaces: [
-        {
-          subpath: "./server",
-          summary: "Exports the workspace runtime provider and workspace route registration surface."
-        }
-      ],
-      containerTokens: {
-        server: [
-          "workspaces.server.scope-support"
-        ],
-        client: []
-      }
-    },
-    server: {
-      routes: [
-        {
-          method: "POST",
-          path: "/api/workspaces",
-          summary: "Create a workspace for the authenticated user."
-        },
-        {
-          method: "GET",
-          path: "/api/workspaces",
-          summary: "List workspaces visible to authenticated user."
-        },
-        {
-          method: "GET",
-          path: "/api/workspace/invitations/resolve",
-          summary: "Resolve safe public workspace invitation metadata."
-        },
-        {
-          method: "GET",
-          path: "/api/workspace/invitations/pending",
-          summary: "List pending workspace invitations for authenticated user."
-        },
-        {
-          method: "POST",
-          path: "/api/workspace/invitations/redeem",
-          summary: "Accept or refuse a workspace invitation using an invite token."
-        },
-        {
-          method: "GET",
-          path: "/api/w/:workspaceSlug/settings",
-          summary: "Get workspace settings and role catalog by workspace slug."
-        },
-        {
-          method: "PATCH",
-          path: "/api/w/:workspaceSlug/settings",
-          summary: "Update workspace settings by workspace slug."
-        },
-        {
-          method: "GET",
-          path: "/api/w/:workspaceSlug/roles",
-          summary: "Get role catalog by workspace slug."
-        },
-        {
-          method: "GET",
-          path: "/api/w/:workspaceSlug/members",
-          summary: "List members by workspace slug."
-        },
-        {
-          method: "PATCH",
-          path: "/api/w/:workspaceSlug/members/:memberUserId/role",
-          summary: "Update workspace member role by workspace slug."
-        },
-        {
-          method: "GET",
-          path: "/api/w/:workspaceSlug/invites",
-          summary: "List workspace invites by workspace slug."
-        },
-        {
-          method: "POST",
-          path: "/api/w/:workspaceSlug/invites",
-          summary: "Create workspace invite by workspace slug."
-        },
-        {
-          method: "DELETE",
-          path: "/api/w/:workspaceSlug/invites/:inviteId",
-          summary: "Revoke workspace invite by workspace slug."
-        }
-      ]
-    }
-  },
-  mutations: {
-    dependencies: {
-      runtime: {
-        "@jskit-ai/json-rest-api-core": "0.1.90",
-        "@jskit-ai/resource-core": "0.1.89",
-        "@jskit-ai/resource-crud-core": "0.1.89",
-        "@jskit-ai/users-core": "0.1.159"
-      },
-      dev: {}
-    },
-    packageJson: {
-      scripts: {
-        "server:app": "SERVER_SURFACE=app node ./bin/server.js",
-        "server:admin": "SERVER_SURFACE=admin node ./bin/server.js"
-      }
-    },
-    procfile: {},
-    files: [
-      {
-        op: "install-migration",
-        from: "templates/migrations/workspaces_core_initial.cjs",
-        toDir: "migrations",
-        extension: ".cjs",
-        reason: "Install workspace tenancy schema migration.",
-        category: "migration",
-        id: "workspaces-core-initial-schema"
-      },
-      {
-        op: "install-migration",
-        from: "templates/migrations/workspaces_core_workspace_settings_single_name_source.cjs",
-        toDir: "migrations",
-        extension: ".cjs",
-        reason: "Remove workspace_settings name/avatar fields so workspace identity data comes from workspaces only.",
-        category: "migration",
-        id: "users-core-workspace-settings-single-name-source"
-      },
-      {
-        op: "install-migration",
-        from: "templates/migrations/workspaces_core_workspaces_drop_color.cjs",
-        toDir: "migrations",
-        extension: ".cjs",
-        reason: "Drop workspaces.color now that workspace theme colors live in workspace_settings.",
-        category: "migration",
-        id: "users-core-workspaces-drop-color"
-      },
-      {
-        from: "templates/config/roles.js",
-        to: "config/roles.js",
-        ownership: "app",
-        preserveOnRemove: true,
-        reason: "Install app-owned role catalog in a dedicated config file.",
-        category: "workspaces-core",
-        id: "users-core-app-owned-role-catalog-config"
-      },
-      {
-        from: "templates/packages/main/src/server/email/workspaceInviteEmail.js",
-        to: "packages/main/src/server/email/workspaceInviteEmail.js",
-        ownership: "app",
-        preserveOnRemove: true,
-        reason: "Install app-owned editable workspace invite email template.",
-        category: "workspaces-core",
-        id: "workspaces-core-main-workspace-invite-email-template"
-      }
-    ],
-    source: [
-      {
-        op: "ensure-import",
-        file: "config/server.js",
-        namedImports: ["renderWorkspaceInviteEmail"],
-        from: "../packages/main/src/server/email/workspaceInviteEmail.js",
-        reason: "Load app-owned workspace invite email renderer from packages/main.",
-        category: "workspaces-core",
-        id: "workspaces-core-server-config-workspace-invite-email-import"
-      },
-      {
-        op: "ensure-assignment",
-        file: "config/server.js",
-        target: "config.workspaceInviteEmailTemplate",
-        value: "renderWorkspaceInviteEmail",
-        reason: "Bind app-owned workspace invite email renderer into server config.",
-        category: "workspaces-core",
-        id: "workspaces-core-server-config-workspace-invite-email-template"
-      }
-    ],
-    text: [
-      {
-        op: "append-text",
-        file: "config/public.js",
-        position: "top",
-        skipIfContains: "import { roleCatalog } from \"./roles.js\";",
-        value: "import { roleCatalog } from \"./roles.js\";\n",
-        reason: "Load app-owned role catalog from dedicated config file.",
-        category: "workspaces-core",
-        id: "users-core-role-catalog-public-import"
-      },
-      {
-        op: "append-text",
-        file: "config/public.js",
-        position: "top",
-        skipIfContains: "import { surfaceAccessPolicies } from \"./surfaceAccessPolicies.js\";",
-        value: "import { surfaceAccessPolicies } from \"./surfaceAccessPolicies.js\";\n",
-        reason: "Load app-owned surface access policy catalog from dedicated config file.",
-        category: "workspaces-core",
-        id: "users-core-surface-access-policies-public-import"
-      },
-      {
-        op: "append-text",
-        file: "config/surfaceAccessPolicies.js",
-        position: "top",
-        skipIfContains: "export const surfaceAccessPolicies = {};",
-        value: "export const surfaceAccessPolicies = {};\n\n",
-        reason: "Initialize app-owned surface access policy config if missing.",
-        category: "workspaces-core",
-        id: "users-core-surface-access-policies-config-init"
-      },
-      {
-        op: "append-text",
-        file: "config/surfaceAccessPolicies.js",
-        position: "bottom",
-        skipIfContains: "surfaceAccessPolicies.workspace_member = {",
-        value: "\nsurfaceAccessPolicies.workspace_member = {\n  requireAuth: true,\n  requireWorkspaceMembership: true\n};\n",
-        reason: "Register workspace-member surface access policy for workspace surfaces.",
-        category: "workspaces-core",
-        id: "users-core-surface-access-policies-workspace-member"
-      },
-      {
-        op: "append-text",
-        file: "config/public.js",
-        position: "bottom",
-        skipIfContains: "config.surfaceDefinitions.app = {",
-        value:
-          "\nconfig.surfaceDefinitions.app = {\n  id: \"app\",\n  label: \"App\",\n  pagesRoot: \"w/[workspaceSlug]\",\n  enabled: true,\n  requiresAuth: true,\n  requiresWorkspace: true,\n  accessPolicyId: \"workspace_member\",\n  origin: \"\"\n};\n\nconfig.surfaceDefinitions.admin = {\n  id: \"admin\",\n  label: \"Admin\",\n  pagesRoot: \"w/[workspaceSlug]/admin\",\n  enabled: true,\n  requiresAuth: true,\n  requiresWorkspace: true,\n  accessPolicyId: \"workspace_member\",\n  origin: \"\"\n};\n",
-        reason: "Append workspace surface topology when tenancy enables workspace routing.",
-        category: "workspaces-core",
-        id: "users-core-surface-config-workspace",
-        when: {
-          config: "tenancyMode",
-          in: ["personal", "workspaces"]
-        }
-      },
-      {
-        op: "append-text",
-        file: "config/public.js",
-        position: "bottom",
-        skipIfContains: "config.workspaceSwitching =",
-        value:
-          "\nconfig.workspaceSwitching = true;\nconfig.workspaceInvitations = {\n  enabled: true,\n  allowInPersonalMode: true\n};\n",
-        reason: "Append default workspace feature toggles into app-owned config.",
-        category: "workspaces-core",
-        id: "users-core-public-config"
-      },
-      {
-        op: "append-text",
-        file: "config/public.js",
-        position: "bottom",
-        skipIfContains: "config.roleCatalog = roleCatalog;",
-        value: "\nconfig.roleCatalog = roleCatalog;\n",
-        reason: "Bind app-owned role catalog onto public config.",
-        category: "workspaces-core",
-        id: "users-core-role-catalog-public-config"
-      },
-      {
-        op: "append-text",
-        file: "config/public.js",
-        position: "bottom",
-        skipIfContains: "config.surfaceAccessPolicies = surfaceAccessPolicies;",
-        value: "\nconfig.surfaceAccessPolicies = surfaceAccessPolicies;\n",
-        reason: "Bind app-owned surface access policies onto public config.",
-        category: "workspaces-core",
-        id: "users-core-surface-access-policies-public-config"
-      },
-      {
-        op: "append-text",
-        file: "config/server.js",
-        position: "bottom",
-        skipIfContains: "config.workspaceColor =",
-        value: "\nconfig.workspaceColor = \"#1867C0\";\n",
-        reason: "Append default workspace server settings into app-owned config.",
-        category: "workspaces-core",
-        id: "users-core-server-config"
-      },
-      {
-        op: "append-text",
-        file: "config/server.js",
-        position: "bottom",
-        skipIfContains: "config.workspaceSettings =",
-        value:
-          "\nconfig.workspaceSettings = {\n  defaults: {\n    invitesEnabled: true\n  }\n};\n",
-        reason: "Append app-owned workspace settings defaults into the server config.",
-        category: "workspaces-core",
-        id: "users-core-workspace-settings-server-config"
-      },
-      {
-        op: "append-text",
-        file: "config/server.js",
-        position: "bottom",
-        skipIfContains: "config.workspaceMembers =",
-        value:
-          "\nconfig.workspaceMembers = {\n  defaults: {\n    inviteExpiresInMs: 604800000\n  }\n};\n",
-        reason: "Append app-owned workspace member invite policy defaults into the server config.",
-        category: "workspaces-core",
-        id: "users-core-workspace-members-server-config"
-      }
-    ]
-  }
-});