@jskit-ai/workspaces-core 0.1.137 → 0.1.138

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@jskit-ai/workspaces-core",
-  "version": "0.1.137",
+  "version": "0.1.138",
   "type": "module",
   "scripts": {
     "test": "node --test"
   },
   "exports": {
-    "./server/WorkspacesCoreServiceProvider": "./src/server/WorkspacesCoreServiceProvider.js",
+    "./server/WorkspacesFeature": "./src/server/WorkspacesFeature.js",
+    "./server/WorkspacesIntegrationsProvider": "./src/server/WorkspacesIntegrationsProvider.js",
     "./server/validators/routeParamsValidator": "./src/server/common/validators/routeParamsValidator.js",
     "./server/support/workspaceRouteInput": "./src/server/support/workspaceRouteInput.js",
     "./shared/jsonApiTransports": "./src/shared/jsonApiTransports.js",
@@ -17,14 +18,14 @@
     "./shared/resources/workspaceSettingsResource": "./src/shared/resources/workspaceSettingsResource.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.157",
-    "@jskit-ai/database-runtime": "0.1.159",
-    "@jskit-ai/http-runtime": "0.1.157",
-    "@jskit-ai/json-rest-api-core": "0.1.103",
-    "@jskit-ai/kernel": "0.1.159",
-    "@jskit-ai/resource-core": "0.1.101",
-    "@jskit-ai/resource-crud-core": "0.1.101",
-    "@jskit-ai/users-core": "0.1.172",
+    "@jskit-ai/auth-core": "0.1.158",
+    "@jskit-ai/database-runtime": "0.1.160",
+    "@jskit-ai/http-runtime": "0.1.158",
+    "@jskit-ai/json-rest-api-core": "0.1.104",
+    "@jskit-ai/kernel": "0.1.160",
+    "@jskit-ai/resource-core": "0.1.102",
+    "@jskit-ai/resource-crud-core": "0.1.102",
+    "@jskit-ai/users-core": "0.1.173",
     "json-rest-schema": "^1.0.17"
   },
   "description": "Workspace tenancy runtime plus HTTP routes, role catalog, and workspace config scaffolding.",
@@ -32,20 +33,31 @@
     "kind": "runtime",
     "capabilities": {
       "provides": [
-        "workspaces.core",
-        "workspaces.server-routes"
+        "workspaces.core"
       ],
       "requires": [
+        "auth.extensions",
+        "runtime.actions",
+        "runtime.bootstrap",
+        "runtime.config",
+        "runtime.database",
+        "runtime.env",
+        "runtime.http",
+        "runtime.json-rest-api",
         "users.core",
-        "json-rest-api.core"
+        "users.extensions"
       ]
     },
     "runtime": {
       "server": {
         "providers": [
           {
-            "entrypoint": "src/server/WorkspacesCoreServiceProvider.js",
-            "export": "WorkspacesCoreServiceProvider"
+            "entrypoint": "src/server/WorkspacesFeature.js",
+            "export": "WorkspacesFeature"
+          },
+          {
+            "entrypoint": "src/server/WorkspacesIntegrationsProvider.js",
+            "export": "WorkspacesIntegrationsProvider"
           }
         ]
       },
@@ -58,24 +70,16 @@
         "tableOwnership": {
           "tables": [
             {
-              "tableName": "workspaces",
-              "provenance": "runtime-package",
-              "ownerKind": "package-runtime"
+              "tableName": "workspaces"
             },
             {
-              "tableName": "workspace_memberships",
-              "provenance": "runtime-package",
-              "ownerKind": "package-runtime"
+              "tableName": "workspace_memberships"
             },
             {
-              "tableName": "workspace_settings",
-              "provenance": "runtime-package",
-              "ownerKind": "package-runtime"
+              "tableName": "workspace_settings"
             },
             {
-              "tableName": "workspace_invites",
-              "provenance": "runtime-package",
-              "ownerKind": "package-runtime"
+              "tableName": "workspace_invites"
             }
           ]
         }
@@ -84,15 +88,12 @@
         "surfaces": [
           {
             "subpath": "./server",
-            "summary": "Exports the workspace runtime provider and workspace route registration surface."
+            "summary": "Exports the explicit workspace feature, integrations, services, repositories, actions, and routes."
           }
         ],
-        "containerTokens": {
-          "server": [
-            "workspaces.server.scope-support"
-          ],
-          "client": []
-        }
+        "capabilities": [
+          "workspaces.core"
+        ]
       },
       "server": {
         "routes": [
@@ -164,210 +165,9 @@
         ]
       }
     },
-    "mutations": {
-      "dependencies": {
-        "runtime": {
-          "@jskit-ai/json-rest-api-core": "0.1.103",
-          "@jskit-ai/resource-core": "0.1.101",
-          "@jskit-ai/resource-crud-core": "0.1.101",
-          "@jskit-ai/users-core": "0.1.172"
-        },
-        "dev": {}
-      },
-      "packageJson": {
-        "scripts": {
-          "server:app": "SERVER_SURFACE=app node ./bin/server.js",
-          "server:admin": "SERVER_SURFACE=admin node ./bin/server.js"
-        }
-      },
-      "procfile": {},
-      "files": [
-        {
-          "op": "install-migration",
-          "from": "templates/migrations/workspaces_core_initial.cjs",
-          "toDir": "migrations",
-          "extension": ".cjs",
-          "reason": "Install workspace tenancy schema migration.",
-          "category": "migration",
-          "id": "workspaces-core-initial-schema"
-        },
-        {
-          "op": "install-migration",
-          "from": "templates/migrations/workspaces_core_workspace_settings_single_name_source.cjs",
-          "toDir": "migrations",
-          "extension": ".cjs",
-          "reason": "Remove workspace_settings name/avatar fields so workspace identity data comes from workspaces only.",
-          "category": "migration",
-          "id": "users-core-workspace-settings-single-name-source"
-        },
-        {
-          "op": "install-migration",
-          "from": "templates/migrations/workspaces_core_workspaces_drop_color.cjs",
-          "toDir": "migrations",
-          "extension": ".cjs",
-          "reason": "Drop workspaces.color now that workspace theme colors live in workspace_settings.",
-          "category": "migration",
-          "id": "users-core-workspaces-drop-color"
-        },
-        {
-          "from": "templates/config/roles.js",
-          "to": "config/roles.js",
-          "ownership": "app",
-          "preserveOnRemove": true,
-          "reason": "Install app-owned role catalog in a dedicated config file.",
-          "category": "workspaces-core",
-          "id": "users-core-app-owned-role-catalog-config"
-        },
-        {
-          "from": "templates/packages/main/src/server/email/workspaceInviteEmail.js",
-          "to": "packages/main/src/server/email/workspaceInviteEmail.js",
-          "ownership": "app",
-          "preserveOnRemove": true,
-          "reason": "Install app-owned editable workspace invite email template.",
-          "category": "workspaces-core",
-          "id": "workspaces-core-main-workspace-invite-email-template"
-        }
-      ],
-      "source": [
-        {
-          "op": "ensure-import",
-          "file": "config/server.js",
-          "namedImports": [
-            "renderWorkspaceInviteEmail"
-          ],
-          "from": "../packages/main/src/server/email/workspaceInviteEmail.js",
-          "reason": "Load app-owned workspace invite email renderer from packages/main.",
-          "category": "workspaces-core",
-          "id": "workspaces-core-server-config-workspace-invite-email-import"
-        },
-        {
-          "op": "ensure-assignment",
-          "file": "config/server.js",
-          "target": "config.workspaceInviteEmailTemplate",
-          "value": "renderWorkspaceInviteEmail",
-          "reason": "Bind app-owned workspace invite email renderer into server config.",
-          "category": "workspaces-core",
-          "id": "workspaces-core-server-config-workspace-invite-email-template"
-        }
-      ],
-      "text": [
-        {
-          "op": "append-text",
-          "file": "config/public.js",
-          "position": "top",
-          "skipIfContains": "import { roleCatalog } from \"./roles.js\";",
-          "value": "import { roleCatalog } from \"./roles.js\";\n",
-          "reason": "Load app-owned role catalog from dedicated config file.",
-          "category": "workspaces-core",
-          "id": "users-core-role-catalog-public-import"
-        },
-        {
-          "op": "append-text",
-          "file": "config/public.js",
-          "position": "top",
-          "skipIfContains": "import { surfaceAccessPolicies } from \"./surfaceAccessPolicies.js\";",
-          "value": "import { surfaceAccessPolicies } from \"./surfaceAccessPolicies.js\";\n",
-          "reason": "Load app-owned surface access policy catalog from dedicated config file.",
-          "category": "workspaces-core",
-          "id": "users-core-surface-access-policies-public-import"
-        },
-        {
-          "op": "append-text",
-          "file": "config/surfaceAccessPolicies.js",
-          "position": "top",
-          "skipIfContains": "export const surfaceAccessPolicies = {};",
-          "value": "export const surfaceAccessPolicies = {};\n\n",
-          "reason": "Initialize app-owned surface access policy config if missing.",
-          "category": "workspaces-core",
-          "id": "users-core-surface-access-policies-config-init"
-        },
-        {
-          "op": "append-text",
-          "file": "config/surfaceAccessPolicies.js",
-          "position": "bottom",
-          "skipIfContains": "surfaceAccessPolicies.workspace_member = {",
-          "value": "\nsurfaceAccessPolicies.workspace_member = {\n  requireAuth: true,\n  requireWorkspaceMembership: true\n};\n",
-          "reason": "Register workspace-member surface access policy for workspace surfaces.",
-          "category": "workspaces-core",
-          "id": "users-core-surface-access-policies-workspace-member"
-        },
-        {
-          "op": "append-text",
-          "file": "config/public.js",
-          "position": "bottom",
-          "skipIfContains": "config.surfaceDefinitions.app = {",
-          "value": "\nconfig.surfaceDefinitions.app = {\n  id: \"app\",\n  label: \"App\",\n  pagesRoot: \"w/[workspaceSlug]\",\n  enabled: true,\n  requiresAuth: true,\n  requiresWorkspace: true,\n  accessPolicyId: \"workspace_member\",\n  origin: \"\"\n};\n\nconfig.surfaceDefinitions.admin = {\n  id: \"admin\",\n  label: \"Admin\",\n  pagesRoot: \"w/[workspaceSlug]/admin\",\n  enabled: true,\n  requiresAuth: true,\n  requiresWorkspace: true,\n  accessPolicyId: \"workspace_member\",\n  origin: \"\"\n};\n",
-          "reason": "Append workspace surface topology when tenancy enables workspace routing.",
-          "category": "workspaces-core",
-          "id": "users-core-surface-config-workspace",
-          "when": {
-            "config": "tenancyMode",
-            "in": [
-              "personal",
-              "workspaces"
-            ]
-          }
-        },
-        {
-          "op": "append-text",
-          "file": "config/public.js",
-          "position": "bottom",
-          "skipIfContains": "config.workspaceSwitching =",
-          "value": "\nconfig.workspaceSwitching = true;\nconfig.workspaceInvitations = {\n  enabled: true,\n  allowInPersonalMode: true\n};\n",
-          "reason": "Append default workspace feature toggles into app-owned config.",
-          "category": "workspaces-core",
-          "id": "users-core-public-config"
-        },
-        {
-          "op": "append-text",
-          "file": "config/public.js",
-          "position": "bottom",
-          "skipIfContains": "config.roleCatalog = roleCatalog;",
-          "value": "\nconfig.roleCatalog = roleCatalog;\n",
-          "reason": "Bind app-owned role catalog onto public config.",
-          "category": "workspaces-core",
-          "id": "users-core-role-catalog-public-config"
-        },
-        {
-          "op": "append-text",
-          "file": "config/public.js",
-          "position": "bottom",
-          "skipIfContains": "config.surfaceAccessPolicies = surfaceAccessPolicies;",
-          "value": "\nconfig.surfaceAccessPolicies = surfaceAccessPolicies;\n",
-          "reason": "Bind app-owned surface access policies onto public config.",
-          "category": "workspaces-core",
-          "id": "users-core-surface-access-policies-public-config"
-        },
-        {
-          "op": "append-text",
-          "file": "config/server.js",
-          "position": "bottom",
-          "skipIfContains": "config.workspaceColor =",
-          "value": "\nconfig.workspaceColor = \"#1867C0\";\n",
-          "reason": "Append default workspace server settings into app-owned config.",
-          "category": "workspaces-core",
-          "id": "users-core-server-config"
-        },
-        {
-          "op": "append-text",
-          "file": "config/server.js",
-          "position": "bottom",
-          "skipIfContains": "config.workspaceSettings =",
-          "value": "\nconfig.workspaceSettings = {\n  defaults: {\n    invitesEnabled: true\n  }\n};\n",
-          "reason": "Append app-owned workspace settings defaults into the server config.",
-          "category": "workspaces-core",
-          "id": "users-core-workspace-settings-server-config"
-        },
-        {
-          "op": "append-text",
-          "file": "config/server.js",
-          "position": "bottom",
-          "skipIfContains": "config.workspaceMembers =",
-          "value": "\nconfig.workspaceMembers = {\n  defaults: {\n    inviteExpiresInMs: 604800000\n  }\n};\n",
-          "reason": "Append app-owned workspace member invite policy defaults into the server config.",
-          "category": "workspaces-core",
-          "id": "users-core-workspace-members-server-config"
-        }
+    "migrations": {
+      "directories": [
+        "migrations"
       ]
     }
   }

package/patterns/workspace-server/PATTERN.md

@@ -0,0 +1,60 @@
+---
+id: workspaces/workspace-server
+title: Workspace tenancy server composition
+summary: Configure roles, workspace access policy, invitations, and app-owned invitation email rendering around JSKIT workspace runtime APIs.
+keywords: access, invite, membership, multitenancy, policy, role, tenancy, workspace
+requires: @jskit-ai/workspaces-core, @jskit-ai/users-core
+---
+
+# Workspace tenancy server composition
+
+## Use when
+
+Use this pattern when records, routes, or navigation belong to a selected
+workspace and membership or role affects access.
+
+## Do not use when
+
+Do not use workspace tenancy for a genuinely single-owner product or as a
+substitute for a simpler domain ownership column.
+
+## Product decisions
+
+Choose workspace creation policy, roles, invitation policy, expiry, email copy,
+member permissions, personal-workspace behavior, and surface access rules.
+
+## Framework APIs
+
+Use workspace routes, resources, scope helpers, tenancy profiles, and settings
+contracts exported by `@jskit-ai/workspaces-core`.
+
+## Invariants
+
+- Workspace membership and role are checked before scoped application actions.
+- Role ids are stable product vocabulary shared by server and client config.
+- Invitation tokens remain secret; emails receive only the intended link.
+- Workspace scope reaches repository queries, not just route parsing.
+- Package-owned migrations run directly from the installed package graph.
+
+## Example files
+
+`example/config/roles.js` is a concrete role catalogue.
+`example/packages/main/src/server/email/workspaceInviteEmail.js` demonstrates an
+app-owned invitation renderer. Compose both through normal application config.
+
+## Variation points
+
+Change roles, invitation policy and copy, defaults, access policies, surface
+ids, and product-specific workspace settings.
+
+## Verification
+
+Test create/list/select, member and non-member access, each role boundary,
+invitation expiry/redemption, cross-workspace isolation, and email output.
+
+## Avoid
+
+- synthetic membership workarounds
+- authorizing from client navigation state
+- embedding invitation templates or secrets in package metadata
+- source-appending install commands

package/src/server/WorkspacesFeature.js

@@ -0,0 +1,226 @@
+import { toDatabaseDateTimeUtc } from "@jskit-ai/database-runtime/shared";
+import {
+  addResourceIfMissing,
+  createJsonRestResourceScopeOptions
+} from "@jskit-ai/json-rest-api-core/server/jsonRestApiHost";
+import { defineFeature } from "@jskit-ai/kernel/server/features";
+import { workspaceInvitesResource } from "../shared/resources/workspaceInvitesResource.js";
+import { workspaceMembershipsResource } from "../shared/resources/workspaceMembershipsResource.js";
+import { workspaceResource } from "../shared/resources/workspaceResource.js";
+import { workspaceSettingsResource } from "../shared/resources/workspaceSettingsResource.js";
+import { createWorkspaceRoleCatalog } from "../shared/roles.js";
+import { resolveTenancyProfile } from "../shared/tenancyProfile.js";
+import { createRepository as createWorkspaceInvitesRepository } from "./common/repositories/workspaceInvitesRepository.js";
+import { createRepository as createWorkspaceMembershipsRepository } from "./common/repositories/workspaceMembershipsRepository.js";
+import { createRepository as createWorkspacesRepository } from "./common/repositories/workspacesRepository.js";
+import { createService as createWorkspaceService } from "./common/services/workspaceContextService.js";
+import { createWorkspaceBootstrapContributor } from "./workspaceBootstrapContributor.js";
+import { registerWorkspaceDirectoryRoutes } from "./workspaceDirectory/bootWorkspaceDirectoryRoutes.js";
+import { buildWorkspaceDirectoryActions } from "./workspaceDirectory/workspaceDirectoryActions.js";
+import { renderDefaultWorkspaceInviteEmail } from "./workspaceMembers/defaultWorkspaceInviteEmail.js";
+import { registerWorkspaceMembersRoutes } from "./workspaceMembers/bootWorkspaceMembers.js";
+import { buildWorkspaceMembersActions } from "./workspaceMembers/workspaceMembersActions.js";
+import { createWorkspaceInviteUrlBuilder } from "./workspaceMembers/workspaceInviteUrls.js";
+import { createService as createWorkspaceMembersService } from "./workspaceMembers/workspaceMembersService.js";
+import { registerWorkspacePendingInvitationsRoutes } from "./workspacePendingInvitations/bootWorkspacePendingInvitations.js";
+import { buildWorkspacePendingInvitationsActions } from "./workspacePendingInvitations/workspacePendingInvitationsActions.js";
+import { createService as createWorkspacePendingInvitationsService } from "./workspacePendingInvitations/workspacePendingInvitationsService.js";
+import { registerWorkspaceSettingsRoutes } from "./workspaceSettings/bootWorkspaceSettings.js";
+import { createRepository as createWorkspaceSettingsRepository } from "./workspaceSettings/workspaceSettingsRepository.js";
+import { buildWorkspaceSettingsActions } from "./workspaceSettings/workspaceSettingsActions.js";
+import { createService as createWorkspaceSettingsService } from "./workspaceSettings/workspaceSettingsService.js";
+import { resolveWorkspaceInvitationsPolicy } from "./support/workspaceInvitationsPolicy.js";
+import { workspaceSlugParamsValidator } from "./common/validators/routeParamsValidator.js";
+import { buildWorkspaceInputFromRouteParams } from "./support/workspaceRouteInput.js";
+import { resolveWorkspace } from "./support/resolveWorkspace.js";
+
+function requirePositiveInteger(value, label) {
+  const normalized = Number(value);
+  if (!Number.isInteger(normalized) || normalized < 1) {
+    throw new TypeError(`${label} must be a positive integer.`);
+  }
+  return normalized;
+}
+
+function requireBoolean(value, label) {
+  if (typeof value !== "boolean") {
+    throw new TypeError(`${label} must be boolean.`);
+  }
+  return value;
+}
+
+function resolveInviteEmailTemplate(config) {
+  const template =
+    config.workspaceInviteEmailTemplate ||
+    config.workspaceInviteEmailRenderer ||
+    config.workspaceInvitations?.emailTemplate ||
+    config.workspaceInvitations?.emailRenderer;
+  return typeof template === "function" ? template : renderDefaultWorkspaceInviteEmail;
+}
+
+async function installWorkspaceResources(jsonRestApi) {
+  const scopeOptions = { writeSerializers: { "datetime-utc": toDatabaseDateTimeUtc } };
+  await addResourceIfMissing(
+    jsonRestApi,
+    "workspaces",
+    createJsonRestResourceScopeOptions(workspaceResource, scopeOptions)
+  );
+  await addResourceIfMissing(
+    jsonRestApi,
+    "workspaceMemberships",
+    createJsonRestResourceScopeOptions(workspaceMembershipsResource, scopeOptions)
+  );
+  await addResourceIfMissing(
+    jsonRestApi,
+    "workspaceInvites",
+    createJsonRestResourceScopeOptions(workspaceInvitesResource, scopeOptions)
+  );
+  await addResourceIfMissing(
+    jsonRestApi,
+    "workspaceSettings",
+    createJsonRestResourceScopeOptions(workspaceSettingsResource, scopeOptions)
+  );
+}
+
+function createWorkspacesRuntime({ config, database, env, jsonRestApi } = {}) {
+  const tenancyProfile = resolveTenancyProfile(config);
+  const invitationsPolicy = resolveWorkspaceInvitationsPolicy({ config, appConfig: config, tenancyProfile });
+  const invitationsEnabled = invitationsPolicy.enabled === true;
+  const roleCatalog = createWorkspaceRoleCatalog(config);
+  const workspaceSettingsRepository = createWorkspaceSettingsRepository({
+    api: jsonRestApi,
+    knex: database.knex,
+    defaultInvitesEnabled: requireBoolean(
+      config?.workspaceSettings?.defaults?.invitesEnabled,
+      "runtime.config.workspaceSettings.defaults.invitesEnabled"
+    )
+  });
+  const workspacesRepository = createWorkspacesRepository({ api: jsonRestApi, knex: database.knex });
+  const workspaceMembershipsRepository = createWorkspaceMembershipsRepository({
+    api: jsonRestApi,
+    knex: database.knex
+  });
+  const workspaceInvitesRepository = createWorkspaceInvitesRepository({
+    api: jsonRestApi,
+    knex: database.knex
+  });
+  const workspaceService = createWorkspaceService({
+    appConfig: config,
+    workspacesRepository,
+    workspaceMembershipsRepository,
+    workspaceSettingsRepository
+  });
+  const workspacePendingInvitationsService = createWorkspacePendingInvitationsService({
+    workspaceInvitesRepository,
+    workspaceMembershipsRepository
+  });
+  const workspaceMembersService = createWorkspaceMembersService({
+    workspaceMembershipsRepository,
+    workspaceInvitesRepository,
+    inviteExpiresInMs: requirePositiveInteger(
+      config?.workspaceMembers?.defaults?.inviteExpiresInMs,
+      "runtime.config.workspaceMembers.defaults.inviteExpiresInMs"
+    ),
+    roleCatalog,
+    workspaceInvitationsEnabled: invitationsEnabled,
+    inviteUrlBuilder: createWorkspaceInviteUrlBuilder({ appConfig: config, env }),
+    workspaceInviteMailer: config?.workspaceInviteMailer || null,
+    workspaceInviteEmailTemplate: resolveInviteEmailTemplate(config)
+  });
+  const workspaceSettingsService = createWorkspaceSettingsService({
+    workspaceSettingsRepository,
+    workspaceInvitationsEnabled: invitationsEnabled,
+    roleCatalog
+  });
+
+  return Object.freeze({
+    config,
+    enabled: tenancyProfile.workspace.enabled === true,
+    invitationsEnabled,
+    selfCreateEnabled: tenancyProfile.workspace.allowSelfCreate === true,
+    scope: Object.freeze({
+      params: workspaceSlugParamsValidator,
+      buildInputFromRouteParams: buildWorkspaceInputFromRouteParams,
+      resolveWorkspace
+    }),
+    tenancyProfile,
+    repositories: Object.freeze({
+      workspaceInvites: workspaceInvitesRepository,
+      workspaceMemberships: workspaceMembershipsRepository,
+      workspaceSettings: workspaceSettingsRepository,
+      workspaces: workspacesRepository
+    }),
+    services: Object.freeze({
+      directory: workspaceService,
+      members: workspaceMembersService,
+      pendingInvitations: workspacePendingInvitationsService,
+      settings: workspaceSettingsService
+    })
+  });
+}
+
+const WorkspacesFeature = defineFeature({
+  id: "workspaces.core",
+  domain: "workspace",
+  requires: {
+    bootstrap: "runtime.bootstrap",
+    config: "runtime.config",
+    database: "runtime.database",
+    env: "runtime.env",
+    http: "runtime.http",
+    jsonRestApi: "runtime.json-rest-api",
+    users: "users.core"
+  },
+  provides: {
+    workspaces: "workspaces.core"
+  },
+  async setup({ bootstrap, config, database, env, http, jsonRestApi, users }) {
+    await installWorkspaceResources(jsonRestApi);
+    const workspaces = createWorkspacesRuntime({ config, database, env, jsonRestApi });
+
+    bootstrap.register({
+      id: "workspaces.bootstrap",
+      order: 200,
+      contribute: createWorkspaceBootstrapContributor({
+        appConfig: config,
+        tenancyProfile: workspaces.tenancyProfile,
+        userProfilesRepository: users.repositories.userProfiles,
+        workspaceInvitationsEnabled: workspaces.invitationsEnabled,
+        workspacePendingInvitationsService: workspaces.services.pendingInvitations,
+        workspaceService: workspaces.services.directory
+      }).contribute
+    });
+
+    if (workspaces.enabled) {
+      registerWorkspaceDirectoryRoutes(http.router, {
+        config,
+        workspaceSelfCreateEnabled: workspaces.selfCreateEnabled
+      });
+      registerWorkspaceSettingsRoutes(http.router, { config });
+      registerWorkspaceMembersRoutes(http.router, {
+        config,
+        workspaceInvitationsEnabled: workspaces.invitationsEnabled
+      });
+      if (workspaces.invitationsEnabled) {
+        registerWorkspacePendingInvitationsRoutes(http.router);
+      }
+    }
+
+    return { workspaces };
+  },
+  actions({ workspaces }) {
+    if (!workspaces.enabled) return [];
+    return [
+      ...buildWorkspaceDirectoryActions({ workspaceService: workspaces.services.directory }),
+      ...buildWorkspaceSettingsActions({ workspaceSettingsService: workspaces.services.settings }),
+      ...buildWorkspaceMembersActions({ workspaceMembersService: workspaces.services.members }),
+      ...(workspaces.invitationsEnabled
+        ? buildWorkspacePendingInvitationsActions({
+            workspacePendingInvitationsService: workspaces.services.pendingInvitations
+          })
+        : [])
+    ];
+  }
+});
+
+export { WorkspacesFeature, createWorkspacesRuntime, installWorkspaceResources };