@jskit-ai/workspaces-core 0.1.137 → 0.1.138

package/src/server/WorkspacesIntegrationsProvider.js

@@ -0,0 +1,74 @@
+import { defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+import { createWorkspaceActionContextContributor } from "./common/contributors/workspaceActionContextContributor.js";
+import { createWorkspaceAuthPolicyContextResolver } from "./common/contributors/workspaceAuthPolicyContextResolver.js";
+import { createWorkspaceRouteVisibilityResolver } from "./common/contributors/workspaceRouteVisibilityResolver.js";
+import {
+  resolveWorkspaceMembershipOptionalSurfaceIdsFromAppConfig,
+  resolveWorkspaceSurfaceIdsFromAppConfig
+} from "./support/workspaceActionSurfaces.js";
+
+const WorkspacesIntegrationsProvider = defineProvider({
+  id: "workspaces.integrations",
+  requires: {
+    actions: "runtime.actions",
+    authExtensions: "auth.extensions",
+    config: "runtime.config",
+    http: "runtime.http",
+    usersExtensions: "users.extensions",
+    workspaces: "workspaces.core"
+  },
+  setup({ actions, authExtensions, config, http, usersExtensions, workspaces }) {
+    const workspaceService = workspaces.services.directory;
+    const membershipOptionalSurfaceIds = resolveWorkspaceMembershipOptionalSurfaceIdsFromAppConfig(config);
+    const workspaceSurfaceIds = resolveWorkspaceSurfaceIdsFromAppConfig(config);
+
+    const actionContext = createWorkspaceActionContextContributor({
+      workspaceMembershipOptionalSurfaceIds: membershipOptionalSurfaceIds,
+      workspaceService,
+      workspaceSurfaceIds
+    });
+    actions.registerContextContributor({
+      id: actionContext.contributorId,
+      contribute: actionContext.contribute
+    });
+
+    const authPolicyResolver = createWorkspaceAuthPolicyContextResolver({
+      workspaceMembershipOptionalSurfaceIds: membershipOptionalSurfaceIds,
+      workspaceService
+    });
+    authExtensions.registerPolicyContextResolver({
+      resolverId: "workspaces.policy",
+      resolveAuthPolicyContext: authPolicyResolver
+    });
+
+    const visibility = createWorkspaceRouteVisibilityResolver({
+      workspaceMembershipOptionalSurfaceIds: membershipOptionalSurfaceIds,
+      workspaceService
+    });
+    http.registerVisibilityResolver({
+      id: visibility.resolverId,
+      resolve: visibility.resolve
+    });
+
+    usersExtensions.registerProfileSyncLifecycleContributor({
+      contributorId: "workspaces.provisioning",
+      order: 100,
+      async afterIdentityProfileSynced({ profile, options } = {}) {
+        await workspaceService.ensureProvisionedWorkspaceForAuthenticatedUser(profile, options);
+      }
+    });
+
+    if (workspaces.invitationsEnabled) {
+      authExtensions.registerInvitationContextResolver({
+        resolverId: "workspaces.invitation",
+        resolveInvitationContext(invitation, options = {}) {
+          return workspaces.services.pendingInvitations.resolveInviteContextForAuth(invitation, options);
+        }
+      });
+    }
+
+    return {};
+  }
+});
+
+export { WorkspacesIntegrationsProvider };

package/src/server/common/contributors/workspaceActionContextContributor.js

@@ -30,38 +30,50 @@ function normalizeWorkspaceSurfaceIds(surfaceIds = []) {
   return normalized;
 }
 
-function createWorkspaceActionContextContributor({ workspaceService, workspaceSurfaceIds = [] } = {}) {
+function createWorkspaceActionContextContributor({
+  workspaceService,
+  workspaceMembershipOptionalSurfaceIds = [],
+  workspaceSurfaceIds = []
+} = {}) {
   const contributorId = "workspaces.context";
+  const workspaceMembershipOptionalSurfaceIdSet = normalizeWorkspaceSurfaceIds(
+    workspaceMembershipOptionalSurfaceIds
+  );
   const workspaceSurfaceIdSet = normalizeWorkspaceSurfaceIds(workspaceSurfaceIds);
 
   requireServiceMethod(workspaceService, "resolveWorkspaceContextForUserBySlug", contributorId);
 
   return Object.freeze({
     contributorId,
-    async contribute({ definition = null, input, context, request } = {}) {
+    async contribute({ definition = null, input, context } = {}) {
       const payload = normalizeObject(input);
       if (!Object.hasOwn(payload, "workspaceSlug")) {
         return {};
       }
 
+      const request = context?.requestMeta?.request || null;
       const actionSurfaces = Array.isArray(definition?.surfaces) ? definition.surfaces : [];
       const hasWorkspaceActionSurface = actionSurfaces.some((surfaceId) => workspaceSurfaceIdSet.has(surfaceId));
       const routeSurfaceId = normalizeSurfaceId(request?.routeOptions?.config?.surface);
+      const activeSurfaceId = routeSurfaceId || normalizeSurfaceId(context?.surface);
       const hasWorkspaceSurface = workspaceSurfaceIdSet.has(routeSurfaceId);
       const routeVisibilityInput =
-        request && request.routeOptions && request.routeOptions.config
-          ? request.routeOptions.config.visibility
-          : ROUTE_VISIBILITY_PUBLIC;
+        context?.routeVisibility ?? request?.routeOptions?.config?.visibility ?? ROUTE_VISIBILITY_PUBLIC;
       const routeVisibility = checkRouteVisibility(routeVisibilityInput);
       const hasWorkspaceRouteVisibility = WORKSPACE_VISIBILITY_ACTION_CONTEXT_SET.has(routeVisibility);
       if (!hasWorkspaceActionSurface && !hasWorkspaceRouteVisibility && !hasWorkspaceSurface) {
         return {};
       }
 
+      const resolveOptions = { request };
+      if (workspaceMembershipOptionalSurfaceIdSet.has(activeSurfaceId)) {
+        resolveOptions.requireMembership = false;
+      }
+
       const resolvedWorkspaceContext = await workspaceService.resolveWorkspaceContextForUserBySlug(
         resolveActionUser(context, payload),
         payload.workspaceSlug,
-        { request }
+        resolveOptions
       );
 
       const contribution = {

package/src/server/common/contributors/workspaceAuthPolicyContextResolver.js

@@ -1,12 +1,22 @@
 import { normalizeText } from "@jskit-ai/kernel/shared/support/normalize";
+import { normalizeSurfaceId } from "@jskit-ai/kernel/shared/surface/registry";
 
-function createWorkspaceAuthPolicyContextResolver({ workspaceService } = {}) {
+function createWorkspaceAuthPolicyContextResolver({
+  workspaceService,
+  workspaceMembershipOptionalSurfaceIds = []
+} = {}) {
   if (!workspaceService || typeof workspaceService.resolveWorkspaceContextForUserBySlug !== "function") {
     throw new Error(
       "workspace auth policy context resolver requires workspaceService.resolveWorkspaceContextForUserBySlug()."
     );
   }
 
+  const membershipOptionalSurfaceIds = new Set(
+    (Array.isArray(workspaceMembershipOptionalSurfaceIds) ? workspaceMembershipOptionalSurfaceIds : [])
+      .map((entry) => normalizeSurfaceId(entry))
+      .filter(Boolean)
+  );
+
   return async function resolveWorkspaceAuthPolicyContext({ request, actor, meta } = {}) {
     const contextPolicy = normalizeText(meta?.contextPolicy || "none").toLowerCase() || "none";
     const permission = normalizeText(meta?.permission);
@@ -19,9 +29,20 @@ function createWorkspaceAuthPolicyContextResolver({ workspaceService } = {}) {
       return {};
     }
 
-    const resolvedWorkspaceContext = await workspaceService.resolveWorkspaceContextForUserBySlug(actor, workspaceSlug, {
-      request
-    });
+    const resolveOptions = { request };
+    const activeSurfaceId = normalizeSurfaceId(request?.routeOptions?.config?.surface);
+    if (
+      (contextPolicy === "optional" && !permission) ||
+      membershipOptionalSurfaceIds.has(activeSurfaceId)
+    ) {
+      resolveOptions.requireMembership = false;
+    }
+
+    const resolvedWorkspaceContext = await workspaceService.resolveWorkspaceContextForUserBySlug(
+      actor,
+      workspaceSlug,
+      resolveOptions
+    );
 
     return {
       workspace: resolvedWorkspaceContext?.workspace || null,

package/src/server/common/contributors/workspaceRouteVisibilityResolver.js

@@ -1,4 +1,5 @@
 import { normalizeOpaqueId, normalizeRecordId, normalizeText } from "@jskit-ai/kernel/shared/support/normalize";
+import { normalizeSurfaceId } from "@jskit-ai/kernel/shared/surface/registry";
 
 function buildVisibilityContribution({ visibility, scopeOwnerId = null, userId = null } = {}) {
   const requiresActorScope = visibility === "workspace_user";
@@ -17,11 +18,20 @@ function buildVisibilityContribution({ visibility, scopeOwnerId = null, userId =
   return contribution;
 }
 
-function createWorkspaceRouteVisibilityResolver({ workspaceService } = {}) {
+function createWorkspaceRouteVisibilityResolver({
+  workspaceService,
+  workspaceMembershipOptionalSurfaceIds = []
+} = {}) {
   if (!workspaceService || typeof workspaceService.resolveWorkspaceContextForUserBySlug !== "function") {
     throw new Error("workspace route visibility resolver requires workspaceService.resolveWorkspaceContextForUserBySlug().");
   }
 
+  const membershipOptionalSurfaceIds = new Set(
+    (Array.isArray(workspaceMembershipOptionalSurfaceIds) ? workspaceMembershipOptionalSurfaceIds : [])
+      .map((entry) => normalizeSurfaceId(entry))
+      .filter(Boolean)
+  );
+
   return Object.freeze({
     resolverId: "workspaces.visibility",
     async resolve({ visibility, context, request, input } = {}) {
@@ -46,9 +56,17 @@ function createWorkspaceRouteVisibilityResolver({ workspaceService } = {}) {
             : {};
         }
 
-        const resolvedWorkspaceContext = await workspaceService.resolveWorkspaceContextForUserBySlug(actor, workspaceSlug, {
-          request
-        });
+        const activeSurfaceId = normalizeSurfaceId(
+          request?.routeOptions?.config?.surface || context?.surface
+        );
+        const resolvedWorkspaceContext = await workspaceService.resolveWorkspaceContextForUserBySlug(
+          actor,
+          workspaceSlug,
+          {
+            request,
+            ...(membershipOptionalSurfaceIds.has(activeSurfaceId) ? { requireMembership: false } : {})
+          }
+        );
         const resolvedWorkspaceOwnerId = normalizeRecordId(resolvedWorkspaceContext?.workspace?.id, { fallback: null });
         if (!resolvedWorkspaceOwnerId) {
           return visibility === "workspace_user"

package/src/server/common/services/workspaceContextService.js

@@ -215,6 +215,7 @@ function createService({
   }
 
   async function resolveWorkspaceContextForUserBySlug(user, workspaceSlug, options = {}) {
+    const requireMembership = options?.requireMembership !== false;
     const normalizedUserId = normalizeRecordId(user?.id, { fallback: null });
     if (!normalizedUserId) {
       throw new AppError(401, "Authentication required.");
@@ -249,12 +250,16 @@ function createService({
       membership = await workspaceMembershipsRepository.ensureOwnerMembership(workspace.id, normalizedUserId, options);
     }
 
-    if (!membership || normalizeLowerText(membership.status) !== "active") {
+    if ((!membership || normalizeLowerText(membership.status) !== "active") && requireMembership) {
       throw new AppError(403, "You do not have access to this workspace.");
     }
 
+    if (!membership || normalizeLowerText(membership.status) !== "active") {
+      membership = null;
+    }
+
     const workspaceSettings = await ensureWorkspaceSettingsForWorkspace(workspace, options);
-    const permissions = buildPermissionsFromMembership(membership, appConfig);
+    const permissions = membership ? buildPermissionsFromMembership(membership, appConfig) : [];
 
     return {
       workspace,

package/src/server/common/support/realtimeServiceEvents.js

@@ -1,91 +1,132 @@
+import { normalizeDbRecordId } from "@jskit-ai/database-runtime/shared";
+import { createEntityChangedActionEvent } from "@jskit-ai/kernel/server/actions";
 import { normalizeRecordId } from "@jskit-ai/kernel/shared/support/normalize";
-import { deepFreeze } from "./deepFreeze.js";
+import { resolveWorkspace } from "../../support/resolveWorkspace.js";
 
-function resolveActorScopedEntityId({ options } = {}) {
-  return normalizeRecordId(options?.context?.actor?.id, { fallback: "" });
+function resultValue({ result } = {}) {
+  return result?.value ?? result ?? {};
 }
 
-function resolveWorkspaceSlugPayload({ args } = {}) {
+function actorId({ context } = {}) {
+  return context?.actor?.id;
+}
+
+function workspaceId(execution = {}) {
+  return resolveWorkspace(execution.context, execution.input)?.id || resultValue(execution)?.workspaceId;
+}
+
+function workspaceSlugPayload(execution = {}) {
   return {
-    workspaceSlug: String(args?.[0]?.slug || "").trim()
+    workspaceSlug: String(
+      resolveWorkspace(execution.context, execution.input)?.slug || execution.input?.workspaceSlug || ""
+    ).trim()
   };
 }
 
-const ACCOUNT_SETTINGS_AND_BOOTSTRAP_EVENTS = deepFreeze([
-  {
-    type: "entity.changed",
-    source: "account",
-    entity: "settings",
-    operation: "updated",
-    entityId: resolveActorScopedEntityId,
-    realtime: {
-      event: "account.settings.changed",
-      audience: "actor_user"
-    }
-  },
-  {
-    type: "entity.changed",
-    source: "users",
-    entity: "bootstrap",
-    operation: "updated",
-    entityId: resolveActorScopedEntityId,
-    realtime: {
-      event: "users.bootstrap.changed",
-      audience: "actor_user"
-    }
+const INVITE_RECIPIENT_BOOTSTRAP_AUDIENCE = Object.freeze({
+  preset: "event_scope",
+  async userQuery({ knex, event } = {}) {
+    if (typeof knex !== "function") return [];
+    const inviteId = normalizeRecordId(event?.entityId, { fallback: null });
+    if (!inviteId) return [];
+    const row = await knex("workspace_invites as wi")
+      .join("users as up", "up.email", "wi.email")
+      .where("wi.id", inviteId)
+      .first("up.id as user_id");
+    const userId = normalizeDbRecordId(row?.user_id, { fallback: null });
+    return userId ? [{ userId }] : [];
   }
-]);
+});
 
 function createWorkspaceEntityAndBootstrapEvents({
   workspaceEntity,
   workspaceOperation,
   workspaceRealtimeEvent,
-  workspaceEntityId = ({ args }) => args?.[0]?.id,
-  bootstrapEntityId = ({ args }) => args?.[0]?.id,
+  bootstrapEntityId = workspaceId,
   bootstrapAudience = "event_scope"
 } = {}) {
-  const normalizedWorkspaceEntity = String(workspaceEntity || "").trim();
-  const normalizedWorkspaceOperation = String(workspaceOperation || "")
-    .trim()
-    .toLowerCase();
-  const normalizedWorkspaceRealtimeEvent = String(workspaceRealtimeEvent || "").trim();
-  if (!normalizedWorkspaceEntity || !normalizedWorkspaceOperation || !normalizedWorkspaceRealtimeEvent) {
-    throw new Error(
-      "createWorkspaceEntityAndBootstrapEvents requires workspaceEntity, workspaceOperation, and workspaceRealtimeEvent."
-    );
-  }
-  if (typeof workspaceEntityId !== "function") {
-    throw new Error("createWorkspaceEntityAndBootstrapEvents requires workspaceEntityId to be a function.");
-  }
-  if (typeof bootstrapEntityId !== "function") {
-    throw new Error("createWorkspaceEntityAndBootstrapEvents requires bootstrapEntityId to be a function.");
-  }
-
-  return deepFreeze([
-    {
-      type: "entity.changed",
+  return Object.freeze([
+    createEntityChangedActionEvent({
       source: "workspace",
-      entity: normalizedWorkspaceEntity,
-      operation: normalizedWorkspaceOperation,
-      entityId: (payload = {}) => normalizeRecordId(workspaceEntityId(payload), { fallback: "" }),
+      entity: workspaceEntity,
+      operation: workspaceOperation,
+      entityId: workspaceId,
       realtime: {
-        event: normalizedWorkspaceRealtimeEvent,
-        payload: resolveWorkspaceSlugPayload,
-        audience: "event_scope"
+        event: workspaceRealtimeEvent,
+        audience: "event_scope",
+        payload: workspaceSlugPayload
       }
-    },
-    {
-      type: "entity.changed",
+    }),
+    createEntityChangedActionEvent({
       source: "users",
       entity: "bootstrap",
       operation: "updated",
-      entityId: (payload = {}) => normalizeRecordId(bootstrapEntityId(payload), { fallback: "" }),
+      entityId: bootstrapEntityId,
       realtime: {
         event: "users.bootstrap.changed",
         audience: bootstrapAudience
       }
+    })
+  ]);
+}
+
+function createActorEvent({ source, entity, realtimeEvent }) {
+  return createEntityChangedActionEvent({
+    source,
+    entity,
+    operation: "updated",
+    entityId: actorId,
+    realtime: { event: realtimeEvent, audience: "actor_user" }
+  });
+}
+
+function createWorkspaceAudienceEvent({ entity, realtimeEvent }) {
+  return createEntityChangedActionEvent({
+    source: "workspace",
+    entity,
+    operation: "updated",
+    entityId: ({ result }) => result?.value?.workspaceId ?? result?.workspaceId,
+    realtime: {
+      event: realtimeEvent,
+      audience: ({ result }) => ({ workspaceId: result?.value?.workspaceId ?? result?.workspaceId })
     }
+  });
+}
+
+function onlyAccepted(builder) {
+  return (execution) => execution.input?.decision === "accept" ? builder(execution) : null;
+}
+
+function createInviteDecisionEvents() {
+  return Object.freeze([
+    createActorEvent({
+      source: "workspace",
+      entity: "invitation",
+      realtimeEvent: "workspace.invitations.pending.changed"
+    }),
+    createActorEvent({
+      source: "users",
+      entity: "bootstrap",
+      realtimeEvent: "users.bootstrap.changed"
+    }),
+    onlyAccepted(createActorEvent({
+      source: "workspace",
+      entity: "directory",
+      realtimeEvent: "workspaces.changed"
+    })),
+    onlyAccepted(createWorkspaceAudienceEvent({
+      entity: "member",
+      realtimeEvent: "workspace.members.changed"
+    })),
+    createWorkspaceAudienceEvent({
+      entity: "invite",
+      realtimeEvent: "workspace.invites.changed"
+    })
   ]);
 }
 
-export { ACCOUNT_SETTINGS_AND_BOOTSTRAP_EVENTS, createWorkspaceEntityAndBootstrapEvents };
+export {
+  INVITE_RECIPIENT_BOOTSTRAP_AUDIENCE,
+  createInviteDecisionEvents,
+  createWorkspaceEntityAndBootstrapEvents
+};

package/src/server/support/workspaceActionSurfaces.js

@@ -23,6 +23,22 @@ function resolveWorkspaceSurfaceIdsFromAppConfig(appConfig = {}) {
   return resolveSurfaceIdsFromAppConfig(appConfig, (definition) => definition.requiresWorkspace === true);
 }
 
+function resolveWorkspaceMembershipOptionalSurfaceIdsFromAppConfig(appConfig = {}) {
+  const policies = isRecord(appConfig?.surfaceAccessPolicies) ? appConfig.surfaceAccessPolicies : {};
+
+  return resolveSurfaceIdsFromAppConfig(appConfig, (definition) => {
+    if (definition.requiresWorkspace !== true) {
+      return false;
+    }
+
+    const policyId = String(definition.accessPolicyId || "")
+      .trim()
+      .toLowerCase();
+    const policy = policyId && isRecord(policies[policyId]) ? policies[policyId] : {};
+    return Object.hasOwn(policy, "requireWorkspaceMembership") && policy.requireWorkspaceMembership === false;
+  });
+}
+
 function resolveSurfaceIdsFromAppConfig(appConfig = {}, predicate) {
   const source = isRecord(appConfig?.surfaceDefinitions) ? appConfig.surfaceDefinitions : {};
   const resolved = [];
@@ -73,17 +89,6 @@ function materializeWorkspaceActionSurfaces(actions = [], { workspaceSurfaceIds
   return Object.freeze(materialized.map((entry) => Object.freeze({ ...entry })));
 }
 
-function registerWorkspaceActionSurfaceSources(app) {
-  if (!app || typeof app.actionSurfaceSource !== "function") {
-    return;
-  }
-
-  app.actionSurfaceSource("workspace", ({ scope }) => {
-    const appConfig = scope?.has?.("appConfig") ? scope.make("appConfig") : {};
-    return resolveWorkspaceSurfaceIdsFromAppConfig(appConfig);
-  });
-}
-
 function materializeWorkspaceActionSurfacesFromAppConfig(actions = [], { appConfig = {} } = {}) {
   const workspaceSurfaceIds = resolveWorkspaceSurfaceIdsFromAppConfig(appConfig);
   return materializeWorkspaceActionSurfaces(actions, { workspaceSurfaceIds });
@@ -111,8 +116,8 @@ function resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig(appConfig = {}) {
 
 export {
   resolveWorkspaceSurfaceIdsFromAppConfig,
+  resolveWorkspaceMembershipOptionalSurfaceIdsFromAppConfig,
   resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig,
   materializeWorkspaceActionSurfaces,
-  materializeWorkspaceActionSurfacesFromAppConfig,
-  registerWorkspaceActionSurfaceSources
+  materializeWorkspaceActionSurfacesFromAppConfig
 };

package/src/server/workspaceDirectory/bootWorkspaceDirectoryRoutes.js

@@ -25,17 +25,11 @@ function resolveWorkspaceRecordId(record = {}, context = {}) {
   throw new Error("Workspace JSON:API response requires workspace id.");
 }
 
-function bootWorkspaceDirectoryRoutes(app) {
-  if (!app || typeof app.make !== "function" || typeof app.has !== "function") {
-    throw new Error("bootWorkspaceDirectoryRoutes requires application make()/has().");
+function registerWorkspaceDirectoryRoutes(router, { config = {}, workspaceSelfCreateEnabled = false } = {}) {
+  if (!router || typeof router.register !== "function") {
+    throw new TypeError("registerWorkspaceDirectoryRoutes requires router.register().");
   }
-
-  const router = app.make("jskit.http.router");
-  const appConfig = app.has("appConfig") ? app.make("appConfig") : {};
-  const workspaceRouteSurfaceId = resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig(appConfig);
-  const workspaceSelfCreateEnabled = app.has("workspaces.self-create.enabled")
-    ? app.make("workspaces.self-create.enabled") === true
-    : false;
+  const workspaceRouteSurfaceId = resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig(config);
 
   if (workspaceSelfCreateEnabled) {
     router.register(
@@ -157,4 +151,4 @@ function bootWorkspaceDirectoryRoutes(app) {
   );
 }
 
-export { bootWorkspaceDirectoryRoutes };
+export { registerWorkspaceDirectoryRoutes };

package/src/server/workspaceDirectory/workspaceDirectoryActions.js

@@ -16,13 +16,13 @@ const workspaceUpdateInputValidator = composeSchemaDefinitions([
   context: "workspaceDirectoryActions.workspaceUpdateInputValidator"
 });
 
-const workspaceDirectoryActions = Object.freeze([
+const workspaceDirectoryActionSpecifications = Object.freeze([
   {
     id: "workspace.workspaces.create",
     version: 1,
     kind: "command",
     channels: ["api", "assistant_tool", "automation", "internal"],
-    surfacesFrom: "enabled",
+    surfaces: ["*"],
     permission: {
       require: "authenticated"
     },
@@ -38,8 +38,8 @@ const workspaceDirectoryActions = Object.freeze([
         description: "Create a workspace for the authenticated user."
       }
     },
-    async execute(input, context, deps) {
-      return returnJsonApiData(await deps.workspaceService.createWorkspaceForAuthenticatedUser(resolveActionUser(context, input), input, {
+    async run(workspaceService, input, context) {
+      return returnJsonApiData(await workspaceService.createWorkspaceForAuthenticatedUser(resolveActionUser(context, input), input, {
         request: resolveRequest(context),
         context
       }));
@@ -50,7 +50,7 @@ const workspaceDirectoryActions = Object.freeze([
     version: 1,
     kind: "query",
     channels: ["api", "automation", "internal"],
-    surfacesFrom: "enabled",
+    surfaces: ["*"],
     permission: {
       require: "authenticated"
     },
@@ -61,9 +61,9 @@ const workspaceDirectoryActions = Object.freeze([
       actionName: "workspace.workspaces.list"
     },
     observability: {},
-    async execute(input, context, deps) {
+    async run(workspaceService, input, context) {
       return returnJsonApiData({
-        items: await deps.workspaceService.listWorkspacesForAuthenticatedUser(resolveActionUser(context, input), {
+        items: await workspaceService.listWorkspacesForAuthenticatedUser(resolveActionUser(context, input), {
           request: resolveRequest(context),
           context
         }),
@@ -76,7 +76,7 @@ const workspaceDirectoryActions = Object.freeze([
     version: 1,
     kind: "query",
     channels: ["api", "automation", "internal"],
-    surfacesFrom: "workspace",
+    surfaces: ["*"],
     permission: {
       require: "any",
       permissions: ["workspace.settings.view", "workspace.settings.update"]
@@ -88,8 +88,8 @@ const workspaceDirectoryActions = Object.freeze([
       actionName: "workspace.workspaces.read"
     },
     observability: {},
-    async execute(input, context, deps) {
-      return returnJsonApiData(await deps.workspaceService.getWorkspaceForAuthenticatedUser(
+    async run(workspaceService, input, context) {
+      return returnJsonApiData(await workspaceService.getWorkspaceForAuthenticatedUser(
         resolveActionUser(context, input),
         input.workspaceSlug,
         {
@@ -104,7 +104,7 @@ const workspaceDirectoryActions = Object.freeze([
     version: 1,
     kind: "command",
     channels: ["api", "assistant_tool", "automation", "internal"],
-    surfacesFrom: "workspace",
+    surfaces: ["*"],
     permission: {
       require: "all",
       permissions: ["workspace.settings.update"]
@@ -121,9 +121,9 @@ const workspaceDirectoryActions = Object.freeze([
         description: "Update workspace profile fields."
       }
     },
-    async execute(input, context, deps) {
+    async run(workspaceService, input, context) {
       const { workspaceSlug, ...patch } = input;
-      return returnJsonApiData(await deps.workspaceService.updateWorkspaceForAuthenticatedUser(
+      return returnJsonApiData(await workspaceService.updateWorkspaceForAuthenticatedUser(
         resolveActionUser(context, input),
         workspaceSlug,
         patch,
@@ -136,4 +136,14 @@ const workspaceDirectoryActions = Object.freeze([
   }
 ]);
 
-export { workspaceDirectoryActions };
+function buildWorkspaceDirectoryActions({ workspaceService } = {}) {
+  if (!workspaceService) throw new TypeError("buildWorkspaceDirectoryActions requires workspaceService.");
+  return workspaceDirectoryActionSpecifications.map(({ run, ...definition }) => Object.freeze({
+    ...definition,
+    execute(input, context) {
+      return run(workspaceService, input, context);
+    }
+  }));
+}
+
+export { workspaceDirectoryActionSpecifications, buildWorkspaceDirectoryActions };

package/src/server/workspaceMembers/bootWorkspaceMembers.js

@@ -28,18 +28,11 @@ function resolveWorkspaceAggregateRecordId(record = {}, context = {}) {
   throw new Error("Workspace JSON:API response requires workspace id.");
 }
 
-function bootWorkspaceMembers(app) {
-  if (!app || typeof app.make !== "function") {
-    throw new Error("bootWorkspaceMembers requires application make().");
+function registerWorkspaceMembersRoutes(router, { config = {}, workspaceInvitationsEnabled = false } = {}) {
+  if (!router || typeof router.register !== "function") {
+    throw new TypeError("registerWorkspaceMembersRoutes requires router.register().");
   }
-
-  const router = app.make("jskit.http.router");
-  const appConfig = typeof app.has === "function" && app.has("appConfig") ? app.make("appConfig") : {};
-  const workspaceInvitationsEnabled =
-    typeof app.has === "function" && app.has("workspaces.invitations.enabled")
-      ? app.make("workspaces.invitations.enabled") === true
-      : false;
-  const workspaceRouteSurfaceId = resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig(appConfig);
+  const workspaceRouteSurfaceId = resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig(config);
 
   router.register(
     "GET",
@@ -271,4 +264,4 @@ function bootWorkspaceMembers(app) {
   }
 }
 
-export { bootWorkspaceMembers };
+export { registerWorkspaceMembersRoutes };