@jskit-ai/workspaces-core 0.1.137 → 0.1.138

package/test/packageMetadata.test.js

@@ -17,20 +17,6 @@ function findRoute(method, routePath) {
     : null;
 }
 
-function findFileMutation(id) {
-  const fileMutations = packageMetadata?.mutations?.files;
-  return Array.isArray(fileMutations)
-    ? fileMutations.find((entry) => String(entry?.id || "").trim() === id) || null
-    : null;
-}
-
-function findSourceMutation(id) {
-  const sourceMutations = packageMetadata?.mutations?.source;
-  return Array.isArray(sourceMutations)
-    ? sourceMutations.find((entry) => String(entry?.id || "").trim() === id) || null
-    : null;
-}
-
 test("workspaces-core packageMetadata advertises public invite resolution route metadata", () => {
   assert.deepEqual(findRoute("GET", "/api/workspace/invitations/resolve"), {
     method: "GET",
@@ -39,55 +25,35 @@ test("workspaces-core packageMetadata advertises public invite resolution route
   });
 });
 
-test("workspaces-core installs an app-owned editable role catalog", async () => {
-  const source = await readFile(path.join(PACKAGE_DIR, "templates", "config", "roles.js"), "utf8");
+test("workspaces-core publishes an app-owned editable role catalog pattern", async () => {
+  const source = await readFile(
+    path.join(PACKAGE_DIR, "patterns", "workspace-server", "example", "config", "roles.js"),
+    "utf8"
+  );
 
   assert.match(source, /export const roleCatalog/);
-  assert.deepEqual(findFileMutation("users-core-app-owned-role-catalog-config"), {
-    from: "templates/config/roles.js",
-    to: "config/roles.js",
-    ownership: "app",
-    preserveOnRemove: true,
-    reason: "Install app-owned role catalog in a dedicated config file.",
-    category: "workspaces-core",
-    id: "users-core-app-owned-role-catalog-config"
-  });
+  assert.equal(Object.hasOwn(packageMetadata, "mutations"), false);
 });
 
-test("workspaces-core installs an app-owned editable workspace invite email template", async () => {
+test("workspaces-core publishes an app-owned editable workspace invite email pattern", async () => {
   const source = await readFile(
-    path.join(PACKAGE_DIR, "templates", "packages", "main", "src", "server", "email", "workspaceInviteEmail.js"),
+    path.join(
+      PACKAGE_DIR,
+      "patterns",
+      "workspace-server",
+      "example",
+      "packages",
+      "main",
+      "src",
+      "server",
+      "email",
+      "workspaceInviteEmail.js"
+    ),
     "utf8"
   );
 
   assert.match(source, /function renderWorkspaceInviteEmail/);
   assert.match(source, /export \{ renderWorkspaceInviteEmail \}/);
   assert.match(source, /inviteUrl/);
-  assert.deepEqual(findFileMutation("workspaces-core-main-workspace-invite-email-template"), {
-    from: "templates/packages/main/src/server/email/workspaceInviteEmail.js",
-    to: "packages/main/src/server/email/workspaceInviteEmail.js",
-    ownership: "app",
-    preserveOnRemove: true,
-    reason: "Install app-owned editable workspace invite email template.",
-    category: "workspaces-core",
-    id: "workspaces-core-main-workspace-invite-email-template"
-  });
-  assert.deepEqual(findSourceMutation("workspaces-core-server-config-workspace-invite-email-import"), {
-    op: "ensure-import",
-    file: "config/server.js",
-    namedImports: ["renderWorkspaceInviteEmail"],
-    from: "../packages/main/src/server/email/workspaceInviteEmail.js",
-    reason: "Load app-owned workspace invite email renderer from packages/main.",
-    category: "workspaces-core",
-    id: "workspaces-core-server-config-workspace-invite-email-import"
-  });
-  assert.deepEqual(findSourceMutation("workspaces-core-server-config-workspace-invite-email-template"), {
-    op: "ensure-assignment",
-    file: "config/server.js",
-    target: "config.workspaceInviteEmailTemplate",
-    value: "renderWorkspaceInviteEmail",
-    reason: "Bind app-owned workspace invite email renderer into server config.",
-    category: "workspaces-core",
-    id: "workspaces-core-server-config-workspace-invite-email-template"
-  });
+  assert.deepEqual(packageMetadata.migrations, { directories: ["migrations"] });
 });

package/test/workspaceActionContextContributor.test.js

@@ -47,8 +47,7 @@ test("workspace action context contributor resolves workspace context for worksp
       requestMeta: {
         request
       }
-    },
-    request
+    }
   });
 
   assert.deepEqual(calls, [
@@ -147,8 +146,7 @@ test("workspace action context contributor always resolves and stores resolved c
       requestMeta: {
         request
       }
-    },
-    request
+    }
   });
 
   assert.deepEqual(calls, [
@@ -224,8 +222,7 @@ test("workspace action context contributor resolves context for workspace-visibl
       requestMeta: {
         request
       }
-    },
-    request
+    }
   });
 
   assert.deepEqual(calls, [
@@ -306,8 +303,7 @@ test("workspace action context contributor resolves context for workspace surfac
       requestMeta: {
         request
       }
-    },
-    request
+    }
   });
 
   assert.deepEqual(calls, [
@@ -342,3 +338,48 @@ test("workspace action context contributor resolves context for workspace surfac
     permissions: ["crud.breeds.list"]
   });
 });
+
+test("workspace action context contributor permits missing membership only for an explicitly optional active surface", async () => {
+  const calls = [];
+  const contributor = createWorkspaceActionContextContributor({
+    workspaceService: {
+      async resolveWorkspaceContextForUserBySlug(user, workspaceSlug, options) {
+        calls.push({ user, workspaceSlug, options });
+        return {
+          workspace: { id: 77, slug: "acme" },
+          membership: null,
+          permissions: []
+        };
+      }
+    },
+    workspaceMembershipOptionalSurfaceIds: ["app"],
+    workspaceSurfaceIds: ["admin", "app"]
+  });
+  const request = {
+    user: { id: 42 },
+    routeOptions: {
+      config: {
+        surface: "app",
+        visibility: "public"
+      }
+    }
+  };
+
+  const contribution = await contributor.contribute({
+    definition: {
+      id: "customer.pets.list",
+      surfaces: ["app"]
+    },
+    input: { workspaceSlug: "acme" },
+    context: {
+      requestMeta: { request },
+      surface: "app"
+    }
+  });
+
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].options.requireMembership, false);
+  assert.deepEqual(contribution.workspace, { id: 77, slug: "acme" });
+  assert.equal(contribution.membership, null);
+  assert.deepEqual(contribution.permissions, []);
+});

package/test/workspaceActionSurfaces.test.js

@@ -2,9 +2,44 @@ import assert from "node:assert/strict";
 import test from "node:test";
 import {
   materializeWorkspaceActionSurfacesFromAppConfig,
-  resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig
+  resolveDefaultWorkspaceRouteSurfaceIdFromAppConfig,
+  resolveWorkspaceMembershipOptionalSurfaceIdsFromAppConfig
 } from "../src/server/support/workspaceActionSurfaces.js";
 
+test("resolveWorkspaceMembershipOptionalSurfaceIdsFromAppConfig honors explicit surface policy overrides", () => {
+  const surfaceIds = resolveWorkspaceMembershipOptionalSurfaceIdsFromAppConfig({
+    surfaceAccessPolicies: {
+      workspace_authenticated: {
+        requireWorkspaceMembership: false
+      },
+      workspace_member: {
+        requireWorkspaceMembership: true
+      }
+    },
+    surfaceDefinitions: {
+      app: {
+        id: "app",
+        enabled: true,
+        requiresWorkspace: true,
+        accessPolicyId: "workspace_authenticated"
+      },
+      admin: {
+        id: "admin",
+        enabled: true,
+        requiresWorkspace: true,
+        accessPolicyId: "workspace_member"
+      },
+      implicit: {
+        id: "implicit",
+        enabled: true,
+        requiresWorkspace: true
+      }
+    }
+  });
+
+  assert.deepEqual(surfaceIds, ["app"]);
+});
+
 test("materializeWorkspaceActionSurfacesFromAppConfig resolves workspace surfaces from appConfig", () => {
   const actionDefinitions = [
     {

package/test/workspaceAuthPolicyContextResolver.test.js

@@ -117,3 +117,64 @@ test("workspace auth policy context resolver skips workspace lookup when workspa
   assert.equal(called, false);
   assert.deepEqual(resolved, {});
 });
+
+test("workspace auth policy context resolver treats optional context as membership-optional", async () => {
+  const calls = [];
+  const request = {
+    params: { workspaceSlug: "acme" }
+  };
+  const actor = { id: 7 };
+  const resolver = createWorkspaceAuthPolicyContextResolver({
+    workspaceService: {
+      async resolveWorkspaceContextForUserBySlug(resolvedActor, workspaceSlug, options) {
+        calls.push({ resolvedActor, workspaceSlug, options });
+        return {
+          workspace: { id: 11, slug: workspaceSlug },
+          membership: null,
+          permissions: []
+        };
+      }
+    }
+  });
+
+  const resolved = await resolver({
+    request,
+    actor,
+    meta: { contextPolicy: "optional" }
+  });
+
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].options.requireMembership, false);
+  assert.equal(resolved.membership, null);
+  assert.deepEqual(resolved.permissions, []);
+});
+
+test("workspace auth policy honors membership-optional workspace surfaces", async () => {
+  const calls = [];
+  const request = {
+    params: { workspaceSlug: "dog-and-groom" },
+    routeOptions: { config: { surface: "customer" } }
+  };
+  const resolver = createWorkspaceAuthPolicyContextResolver({
+    workspaceMembershipOptionalSurfaceIds: ["customer"],
+    workspaceService: {
+      async resolveWorkspaceContextForUserBySlug(actor, workspaceSlug, options) {
+        calls.push({ actor, workspaceSlug, options });
+        return {
+          workspace: { id: 11, slug: workspaceSlug },
+          membership: null,
+          permissions: []
+        };
+      }
+    }
+  });
+
+  const resolved = await resolver({
+    request,
+    actor: { id: 7 },
+    meta: { contextPolicy: "required" }
+  });
+
+  assert.equal(calls[0].options.requireMembership, false);
+  assert.equal(resolved.membership, null);
+});

package/test/workspaceRouteVisibilityResolver.test.js

@@ -81,3 +81,34 @@ test("workspace route visibility resolver still marks workspace_user as actor-sc
     userId: "user_99"
   });
 });
+
+test("workspace route visibility honors membership-optional workspace surfaces", async () => {
+  const calls = [];
+  const request = {
+    routeOptions: { config: { surface: "customer" } }
+  };
+  const resolver = createWorkspaceRouteVisibilityResolver({
+    workspaceMembershipOptionalSurfaceIds: ["customer"],
+    workspaceService: {
+      async resolveWorkspaceContextForUserBySlug(actor, workspaceSlug, options) {
+        calls.push({ actor, workspaceSlug, options });
+        return { workspace: { id: 11 } };
+      }
+    }
+  });
+
+  const contribution = await resolver.resolve({
+    visibility: "workspace_user",
+    context: { actor: { id: "user_99" } },
+    input: { workspaceSlug: "dog-and-groom" },
+    request
+  });
+
+  assert.equal(calls[0].options.requireMembership, false);
+  assert.deepEqual(contribution, {
+    scopeKind: "workspace_user",
+    requiresActorScope: true,
+    scopeOwnerId: "11",
+    userId: "user_99"
+  });
+});

package/test/workspaceService.test.js

@@ -522,6 +522,68 @@ test("workspaceService.resolveWorkspaceContextForUserBySlug grants owner access
   assert.deepEqual(context.permissions, ["*"]);
 });
 
+test("workspaceService.resolveWorkspaceContextForUserBySlug can resolve an existing workspace without membership", async () => {
+  const service = createService({
+    appConfig: {
+      tenancyMode: "personal",
+      roleCatalog: createRoleCatalog()
+    },
+    workspacesRepository: {
+      async findBySlug() {
+        return {
+          id: "42",
+          slug: "dog-and-groom",
+          name: "Dog And Groom",
+          ownerUserId: "99",
+          isPersonal: false,
+          avatarUrl: ""
+        };
+      },
+      async findPersonalByOwnerUserId() {
+        return null;
+      },
+      async listForUserId() {
+        return [];
+      },
+      async insert() {
+        throw new Error("not implemented");
+      }
+    },
+    workspaceMembershipsRepository: {
+      async findByWorkspaceIdAndUserId() {
+        return null;
+      },
+      async ensureOwnerMembership() {
+        throw new Error("must not create membership for a non-owner");
+      }
+    },
+    workspaceSettingsRepository: {
+      async ensureForWorkspaceId() {
+        return { invitesEnabled: true };
+      }
+    }
+  });
+
+  await assert.rejects(
+    () =>
+      service.resolveWorkspaceContextForUserBySlug(
+        { id: "7", email: "customer@example.com" },
+        "dog-and-groom"
+      ),
+    /You do not have access to this workspace/
+  );
+
+  const context = await service.resolveWorkspaceContextForUserBySlug(
+    { id: "7", email: "customer@example.com" },
+    "dog-and-groom",
+    { requireMembership: false }
+  );
+
+  assert.equal(context.workspace.slug, "dog-and-groom");
+  assert.equal(context.membership, null);
+  assert.deepEqual(context.permissions, []);
+});
+
 test("workspaceService.resolveWorkspaceContextForUserBySlug resolves permissions from appConfig.roleCatalog", async () => {
   const { service } = createWorkspaceServiceFixture({
     roleCatalog: {

package/test/workspaceSettingsActions.test.js

@@ -1,26 +1,26 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { workspaceDirectoryActions } from "../src/server/workspaceDirectory/workspaceDirectoryActions.js";
-import { workspacePendingInvitationsActions } from "../src/server/workspacePendingInvitations/workspacePendingInvitationsActions.js";
-import { workspaceMembersActions } from "../src/server/workspaceMembers/workspaceMembersActions.js";
-import { workspaceSettingsActions } from "../src/server/workspaceSettings/workspaceSettingsActions.js";
+import { workspaceDirectoryActionSpecifications } from "../src/server/workspaceDirectory/workspaceDirectoryActions.js";
+import { workspacePendingInvitationsActionSpecifications } from "../src/server/workspacePendingInvitations/workspacePendingInvitationsActions.js";
+import { workspaceMembersActionSpecifications } from "../src/server/workspaceMembers/workspaceMembersActions.js";
+import { workspaceSettingsActionSpecifications } from "../src/server/workspaceSettings/workspaceSettingsActions.js";
 
-test("workspace settings actions live in their own action array", () => {
+test("workspace settings action specifications stay explicit", () => {
   assert.deepEqual(
-    workspaceSettingsActions.map((action) => action.id),
+    workspaceSettingsActionSpecifications.map((action) => action.id),
     ["workspace.settings.read", "workspace.settings.update"]
   );
-  assert.equal(workspaceSettingsActions[0].surfacesFrom, "workspace");
-  assert.equal(workspaceSettingsActions[1].surfacesFrom, "workspace");
-  assert.deepEqual(workspaceSettingsActions[1].channels, ["api", "assistant_tool", "automation", "internal"]);
-  assert.equal(workspaceSettingsActions[1].extensions?.assistant?.description, "Update workspace settings.");
+  assert.deepEqual(workspaceSettingsActionSpecifications[0].surfaces, ["*"]);
+  assert.deepEqual(workspaceSettingsActionSpecifications[1].surfaces, ["*"]);
+  assert.deepEqual(workspaceSettingsActionSpecifications[1].channels, ["api", "assistant_tool", "automation", "internal"]);
+  assert.equal(workspaceSettingsActionSpecifications[1].extensions?.assistant?.description, "Update workspace settings.");
 });
 
 test("workspace actions array excludes workspace settings actions", () => {
   const otherWorkspaceActionIds = [
-    ...workspaceDirectoryActions,
-    ...workspacePendingInvitationsActions,
-    ...workspaceMembersActions
+    ...workspaceDirectoryActionSpecifications,
+    ...workspacePendingInvitationsActionSpecifications,
+    ...workspaceMembersActionSpecifications
   ].map((action) => action.id);
 
   assert.equal(
@@ -34,17 +34,103 @@ test("workspace actions array excludes workspace settings actions", () => {
 });
 
 test("workspace directory actions stay thin and defer output validation to routes", () => {
-  const listAction = workspaceDirectoryActions.find((action) => action.id === "workspace.workspaces.list");
+  const listAction = workspaceDirectoryActionSpecifications.find((action) => action.id === "workspace.workspaces.list");
   assert.ok(listAction);
   assert.equal(listAction.output, null);
 });
 
 test("workspace directory read/update actions stay thin and defer output validation to routes", () => {
-  const readAction = workspaceDirectoryActions.find((action) => action.id === "workspace.workspaces.read");
-  const updateAction = workspaceDirectoryActions.find((action) => action.id === "workspace.workspaces.update");
+  const readAction = workspaceDirectoryActionSpecifications.find((action) => action.id === "workspace.workspaces.read");
+  const updateAction = workspaceDirectoryActionSpecifications.find((action) => action.id === "workspace.workspaces.update");
 
   assert.ok(readAction);
   assert.ok(updateAction);
   assert.equal(readAction.output, null);
   assert.equal(updateAction.output, null);
 });
+
+test("workspace mutation actions declare their domain and bootstrap changes explicitly", async () => {
+  const context = {
+    actor: { id: 7 },
+    visibilityContext: { visibility: "workspace", scopeKind: "workspace", scopeOwnerId: 11 },
+    requestMeta: {
+      resolvedWorkspaceContext: {
+        workspace: { id: 11, slug: "acme" }
+      }
+    }
+  };
+  const settingsAction = workspaceSettingsActionSpecifications.find(
+    (action) => action.id === "workspace.settings.update"
+  );
+  const events = await Promise.all(settingsAction.events.map((builder) => builder({
+    input: { workspaceSlug: "acme", invitesEnabled: true },
+    result: { value: { invitesEnabled: true } },
+    context
+  })));
+
+  assert.deepEqual(events.map((event) => event.realtime.event), [
+    "workspace.settings.changed",
+    "users.bootstrap.changed"
+  ]);
+  assert.deepEqual(events[0].scope, { kind: "workspace", id: "11" });
+  assert.equal(events[0].entityId, "11");
+  assert.deepEqual(events[0].realtime.payload, { workspaceSlug: "acme" });
+});
+
+test("workspace invite actions carry recipient lookup as delivery policy, not service metadata", async () => {
+  const action = workspaceMembersActionSpecifications.find((entry) => entry.id === "workspace.invite.create");
+  const context = {
+    actor: { id: 7 },
+    visibilityContext: { visibility: "workspace", scopeKind: "workspace", scopeOwnerId: 11 },
+    requestMeta: { resolvedWorkspaceContext: { workspace: { id: 11, slug: "acme" } } }
+  };
+  const events = await Promise.all(action.events.map((builder) => builder({
+    input: { workspaceSlug: "acme", email: "reader@example.test", roleSid: "member" },
+    result: { value: { createdInviteId: 91 } },
+    context
+  })));
+  assert.equal(events[0].operation, "created");
+  assert.equal(events[1].entityId, "91");
+  assert.equal(typeof events[1].realtime.audience.userQuery, "function");
+  const rows = await events[1].realtime.audience.userQuery({
+    event: events[1],
+    knex() {
+      return {
+        join() { return this; },
+        where(field, value) {
+          assert.equal(field, "wi.id");
+          assert.equal(value, "91");
+          return this;
+        },
+        async first() { return { user_id: 55 }; }
+      };
+    }
+  });
+  assert.deepEqual(rows, [{ userId: "55" }]);
+});
+
+test("accepting an invitation declares directory/member refresh while refusal does not", async () => {
+  const action = workspacePendingInvitationsActionSpecifications.find(
+    (entry) => entry.id === "workspace.invite.redeem"
+  );
+  async function emittedNames(decision) {
+    const built = await Promise.all(action.events.map((builder) => builder({
+      input: { decision, token: "opaque" },
+      result: { value: { workspaceId: 11 } },
+      context: { actor: { id: 7 } }
+    })));
+    return built.filter(Boolean).map((event) => event.realtime.event);
+  }
+  assert.deepEqual(await emittedNames("accept"), [
+    "workspace.invitations.pending.changed",
+    "users.bootstrap.changed",
+    "workspaces.changed",
+    "workspace.members.changed",
+    "workspace.invites.changed"
+  ]);
+  assert.deepEqual(await emittedNames("refuse"), [
+    "workspace.invitations.pending.changed",
+    "users.bootstrap.changed",
+    "workspace.invites.changed"
+  ]);
+});

package/test/workspacesRouteRequestInputValidator.test.js

@@ -1,9 +1,10 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { UsersCoreServiceProvider } from "../../users-core/src/server/UsersCoreServiceProvider.js";
-import { INTERNAL_JSON_REST_API } from "../../json-rest-api-core/src/server/jsonRestApiHost.js";
 import { resolveTenancyProfile } from "../src/shared/tenancyProfile.js";
-import { WorkspacesCoreServiceProvider } from "../src/server/WorkspacesCoreServiceProvider.js";
+import { registerWorkspaceDirectoryRoutes } from "../src/server/workspaceDirectory/bootWorkspaceDirectoryRoutes.js";
+import { registerWorkspaceMembersRoutes } from "../src/server/workspaceMembers/bootWorkspaceMembers.js";
+import { registerWorkspacePendingInvitationsRoutes } from "../src/server/workspacePendingInvitations/bootWorkspacePendingInvitations.js";
+import { registerWorkspaceSettingsRoutes } from "../src/server/workspaceSettings/bootWorkspaceSettings.js";
 
 function createReplyDouble() {
   return {
@@ -30,20 +31,11 @@ function findRoute(routes, { method, path }) {
 }
 
 async function registerRoutes({
-  authService = {},
-  consoleService = null,
   workspaceEnabled = true,
-  workspaceTenancyEnabled = true,
   workspaceInvitationsEnabled = true,
-  workspaceSelfCreateEnabled = true
+  workspaceSelfCreateEnabled = true,
+  config = {}
 } = {}) {
-  const internalApi = {
-    resources: {},
-    async addResource(scopeName) {
-      this.resources[scopeName] = {};
-      return this.resources[scopeName];
-    }
-  };
   const registeredRoutes = [];
   const router = {
     register(method, path, route, handler) {
@@ -55,53 +47,14 @@ async function registerRoutes({
       });
     }
   };
-
-  const bindings = new Map([
-    ["jskit.http.router", router],
-    ["authService", authService],
-    [INTERNAL_JSON_REST_API, internalApi],
-    [
-      "users.accountProfile.service",
-      {
-        async readAvatar() {
-          return {
-            mimeType: "image/png",
-            buffer: Buffer.from([])
-          };
-        }
-      }
-    ],
-    ["actionExecutor", {}],
-    ["workspaces.enabled", workspaceEnabled],
-    ["workspaces.tenancy.enabled", workspaceTenancyEnabled],
-    ["workspaces.invitations.enabled", workspaceInvitationsEnabled],
-    ["workspaces.self-create.enabled", workspaceSelfCreateEnabled]
-  ]);
-
-  if (consoleService) {
-    bindings.set("consoleService", consoleService);
-  }
-
-  const app = {
-    has(token) {
-      return bindings.has(token);
-    },
-    instance(token, value) {
-      bindings.set(token, value);
-      return this;
-    },
-    make(token) {
-      if (!bindings.has(token)) {
-        throw new Error(`Missing test binding for token: ${String(token)}`);
-      }
-      return bindings.get(token);
+  if (workspaceEnabled) {
+    registerWorkspaceDirectoryRoutes(router, { config, workspaceSelfCreateEnabled });
+    registerWorkspaceSettingsRoutes(router, { config });
+    registerWorkspaceMembersRoutes(router, { config, workspaceInvitationsEnabled });
+    if (workspaceInvitationsEnabled) {
+      registerWorkspacePendingInvitationsRoutes(router);
     }
-  };
-
-  const usersCoreProvider = new UsersCoreServiceProvider();
-  const workspacesCoreProvider = new WorkspacesCoreServiceProvider();
-  await usersCoreProvider.boot(app);
-  await workspacesCoreProvider.boot(app);
+  }
 
   return registeredRoutes;
 }
@@ -115,8 +68,8 @@ async function registerRoutesForMode({
     tenancyPolicy
   });
   return registerRoutes({
+    config: { tenancyMode, tenancyPolicy },
     workspaceEnabled: tenancyProfile.workspace.enabled === true,
-    workspaceTenancyEnabled: tenancyProfile.mode === "workspaces",
     workspaceInvitationsEnabled:
       tenancyProfile.workspace.enabled === true && tenancyProfile.mode !== "none",
     workspaceSelfCreateEnabled: tenancyProfile.workspace.allowSelfCreate === true
@@ -220,7 +173,6 @@ test("workspace core/settings routes mount one canonical workspace endpoint", as
 test("workspaces-core boot skips workspace routes when workspace policy is disabled", async () => {
   const routes = await registerRoutes({
     workspaceEnabled: false,
-    workspaceTenancyEnabled: false,
     workspaceInvitationsEnabled: false,
     workspaceSelfCreateEnabled: false
   });
@@ -230,13 +182,11 @@ test("workspaces-core boot skips workspace routes when workspace policy is disab
   assert.equal(findRoute(routes, { method: "GET", path: "/api/w/:workspaceSlug" }), null);
   assert.equal(findRoute(routes, { method: "PATCH", path: "/api/w/:workspaceSlug" }), null);
   assert.equal(findRoute(routes, { method: "GET", path: "/api/w/:workspaceSlug/settings" }), null);
-  assert.equal(findRoute(routes, { method: "GET", path: "/api/settings" })?.path, "/api/settings");
 });
 
 test("workspaces-core boot skips workspace create route when self-create policy is disabled", async () => {
   const routes = await registerRoutes({
     workspaceEnabled: true,
-    workspaceTenancyEnabled: true,
     workspaceInvitationsEnabled: true,
     workspaceSelfCreateEnabled: false
   });
@@ -327,7 +277,6 @@ test("workspaces-core route registration follows tenancy mode matrix", async ()
 test("workspaces-core boot skips invitation redeem/list routes when workspace invitations are disabled", async () => {
   const routes = await registerRoutes({
     workspaceEnabled: true,
-    workspaceTenancyEnabled: true,
     workspaceInvitationsEnabled: false,
     workspaceSelfCreateEnabled: false
   });