@jskit-ai/workspaces-core 0.1.14 → 0.1.16

package/src/shared/resources/workspaceSettingsResource.js

@@ -0,0 +1,169 @@
+import { Type } from "typebox";
+import { normalizeText } from "@jskit-ai/kernel/shared/actions/textNormalization";
+import {
+  normalizeObjectInput,
+  createCursorListValidator,
+  normalizeSettingsFieldInput,
+  recordIdSchema
+} from "@jskit-ai/kernel/shared/validators";
+import { normalizeRecordId } from "@jskit-ai/kernel/shared/support/normalize";
+import { workspaceSettingsFields } from "./workspaceSettingsFields.js";
+import { createWorkspaceRoleCatalog } from "../roles.js";
+
+function buildCreateBodySchema() {
+  const properties = {};
+  for (const field of workspaceSettingsFields) {
+    properties[field.key] = field.required === false ? Type.Optional(field.inputSchema) : field.inputSchema;
+  }
+
+  return Type.Object(properties, {
+    additionalProperties: false,
+    messages: {
+      additionalProperties: "Unexpected field.",
+      default: "Invalid value."
+    }
+  });
+}
+
+function buildSettingsOutputSchema() {
+  const properties = {};
+  for (const field of workspaceSettingsFields) {
+    properties[field.key] = field.outputSchema;
+  }
+  properties.invitesAvailable = Type.Boolean();
+  properties.invitesEffective = Type.Boolean();
+
+  return Type.Object(properties, { additionalProperties: false });
+}
+
+function buildResponseRecordSchema() {
+  return Type.Object(
+    {
+      workspace: Type.Object(
+        {
+          id: recordIdSchema,
+          slug: Type.String({ minLength: 1 }),
+          ownerUserId: recordIdSchema
+        },
+        { additionalProperties: false }
+      ),
+      settings: buildSettingsOutputSchema(),
+      roleCatalog: Type.Object(
+        {
+          collaborationEnabled: Type.Boolean(),
+          defaultInviteRole: Type.String(),
+          roles: Type.Array(Type.Object({}, { additionalProperties: true })),
+          assignableRoleIds: Type.Array(Type.String({ minLength: 1 }))
+        },
+        { additionalProperties: true }
+      )
+    },
+    { additionalProperties: false }
+  );
+}
+
+function normalizeInput(payload = {}) {
+  return normalizeSettingsFieldInput(payload, workspaceSettingsFields);
+}
+
+function normalizeOutput(payload = {}) {
+  const source = normalizeObjectInput(payload);
+  const workspace = normalizeObjectInput(source.workspace);
+  const settings = normalizeObjectInput(source.settings);
+  const normalizedSettings = {};
+
+  for (const field of workspaceSettingsFields) {
+    const rawValue = Object.hasOwn(settings, field.key)
+      ? settings[field.key]
+      : field.resolveDefault({
+          workspace,
+          settings
+        });
+    normalizedSettings[field.key] = field.normalizeOutput(rawValue, {
+      workspace,
+      settings
+    });
+  }
+
+  const invitesEnabled = normalizedSettings.invitesEnabled !== false;
+  const invitesAvailable = settings.invitesAvailable !== false;
+  const invitesEffective =
+    typeof settings.invitesEffective === "boolean" ? settings.invitesEffective : invitesEnabled;
+  normalizedSettings.invitesEnabled = invitesEnabled;
+  normalizedSettings.invitesAvailable = invitesAvailable;
+  normalizedSettings.invitesEffective = invitesEffective;
+  const roleCatalog = normalizeObjectInput(source.roleCatalog);
+  const hasRoleCatalog =
+    Array.isArray(roleCatalog.roles) &&
+    roleCatalog.roles.length > 0 &&
+    Array.isArray(roleCatalog.assignableRoleIds);
+
+  return {
+    workspace: {
+      id: normalizeRecordId(workspace.id, { fallback: "" }),
+      slug: normalizeText(workspace.slug),
+      ownerUserId: normalizeRecordId(workspace.ownerUserId, { fallback: "" })
+    },
+    settings: normalizedSettings,
+    roleCatalog: hasRoleCatalog ? roleCatalog : createWorkspaceRoleCatalog()
+  };
+}
+
+const responseRecordValidator = Object.freeze({
+  get schema() {
+    return buildResponseRecordSchema();
+  },
+  normalize: normalizeOutput
+});
+
+const resource = {
+  resource: "workspaceSettings",
+  messages: {
+    validation: "Fix invalid workspace settings values and try again.",
+    saveSuccess: "Workspace settings updated.",
+    saveError: "Unable to update workspace settings.",
+    apiValidation: "Validation failed."
+  },
+  operations: {
+    view: {
+      method: "GET",
+      outputValidator: responseRecordValidator
+    },
+    list: {
+      method: "GET",
+      outputValidator: createCursorListValidator(responseRecordValidator)
+    },
+    create: {
+      method: "POST",
+      bodyValidator: {
+        get schema() {
+          return buildCreateBodySchema();
+        },
+        normalize: normalizeInput
+      },
+      outputValidator: responseRecordValidator
+    },
+    replace: {
+      method: "PUT",
+      bodyValidator: {
+        get schema() {
+          return buildCreateBodySchema();
+        },
+        normalize: normalizeInput
+      },
+      outputValidator: responseRecordValidator
+    },
+    patch: {
+      method: "PATCH",
+      bodyValidator: {
+        get schema() {
+          return Type.Partial(buildCreateBodySchema(), { additionalProperties: false });
+        },
+        normalize: normalizeInput
+      },
+      outputValidator: responseRecordValidator
+    }
+  }
+};
+
+export { resource as workspaceSettingsResource };

package/src/shared/roles.js

@@ -0,0 +1,161 @@
+import {
+  hasPermission,
+  normalizePermissionList
+} from "@jskit-ai/kernel/shared/support";
+
+const OWNER_ROLE_ID = "owner";
+const ADMIN_ROLE_ID = "admin";
+const MEMBER_ROLE_ID = "member";
+
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return value;
+}
+
+function normalizeRoleId(value) {
+  return String(value || "")
+    .trim()
+    .toLowerCase();
+}
+
+function resolveInheritedRolePermissions(roleSid, configuredRoles = {}, seenRoleIds = new Set()) {
+  if (seenRoleIds.has(roleSid)) {
+    throw new TypeError(`roleCatalog role "${roleSid}" has circular inheritance.`);
+  }
+
+  const source = asRecord(configuredRoles[roleSid]);
+  const inheritedRoleId = normalizeRoleId(source.inherits);
+  const directPermissions = normalizePermissionList(source.permissions);
+  if (!inheritedRoleId) {
+    return directPermissions;
+  }
+
+  if (!Object.hasOwn(configuredRoles, inheritedRoleId)) {
+    throw new TypeError(`roleCatalog role "${roleSid}" inherits unknown role "${inheritedRoleId}".`);
+  }
+
+  const nextSeenRoleIds = new Set(seenRoleIds);
+  nextSeenRoleIds.add(roleSid);
+
+  return normalizePermissionList([
+    ...resolveInheritedRolePermissions(inheritedRoleId, configuredRoles, nextSeenRoleIds),
+    ...directPermissions
+  ]);
+}
+
+function createRoleDescriptor(roleSid, configuredDefinition, configuredRoles = {}) {
+  const source = asRecord(configuredDefinition);
+  const assignable = roleSid === OWNER_ROLE_ID ? false : source.assignable === true;
+  const permissions = resolveInheritedRolePermissions(roleSid, configuredRoles);
+
+  return Object.freeze({
+    id: roleSid,
+    assignable,
+    permissions: Object.freeze([...permissions])
+  });
+}
+
+function listConfiguredRoleIds(appConfig = {}) {
+  const configuredRoles = normalizeConfiguredRoles(appConfig);
+  return Object.freeze(Object.keys(configuredRoles));
+}
+
+function resolveConfiguredDefaultInviteRole(appConfig = {}) {
+  return normalizeRoleId(appConfig?.roleCatalog?.workspace?.defaultInviteRole);
+}
+
+function normalizeConfiguredRoles(appConfig = {}) {
+  const roleCatalog = asRecord(appConfig?.roleCatalog);
+  const configuredRoles = asRecord(roleCatalog.roles);
+  const normalizedRoles = {};
+
+  for (const [roleSid, roleDefinition] of Object.entries(configuredRoles)) {
+    const normalizedRoleId = normalizeRoleId(roleSid);
+    if (!normalizedRoleId) {
+      continue;
+    }
+    normalizedRoles[normalizedRoleId] = roleDefinition;
+  }
+
+  return normalizedRoles;
+}
+
+function createWorkspaceRoleCatalog(appConfig = {}) {
+  const configuredRoles = normalizeConfiguredRoles(appConfig);
+  const roleIds = listConfiguredRoleIds(appConfig);
+  const roles = roleIds.map((roleSid) => createRoleDescriptor(roleSid, configuredRoles[roleSid], configuredRoles));
+  const assignableRoleIds = roles.filter((role) => role.assignable).map((role) => role.id);
+  const configuredDefaultInviteRole = resolveConfiguredDefaultInviteRole(appConfig);
+  const defaultInviteRole = assignableRoleIds.includes(configuredDefaultInviteRole)
+    ? configuredDefaultInviteRole
+    : assignableRoleIds[0] || "";
+
+  return Object.freeze({
+    collaborationEnabled: assignableRoleIds.length > 0 && Boolean(defaultInviteRole),
+    defaultInviteRole,
+    roles: Object.freeze(
+      roles.map((role) =>
+        Object.freeze({
+          id: role.id,
+          assignable: role.assignable,
+          permissions: Object.freeze([...role.permissions])
+        })
+      )
+    ),
+    assignableRoleIds: Object.freeze([...assignableRoleIds])
+  });
+}
+
+function cloneWorkspaceRoleCatalog(roleCatalog = null) {
+  const source = asRecord(roleCatalog);
+
+  return {
+    collaborationEnabled: source.collaborationEnabled === true,
+    defaultInviteRole: String(source.defaultInviteRole || ""),
+    roles: Array.isArray(source.roles)
+      ? source.roles.map((role) => ({
+          id: normalizeRoleId(role?.id),
+          assignable: role?.assignable === true,
+          permissions: Array.isArray(role?.permissions) ? [...role.permissions] : []
+        }))
+      : [],
+    assignableRoleIds: Array.isArray(source.assignableRoleIds) ? [...source.assignableRoleIds] : []
+  };
+}
+
+function listRoleDescriptors(appConfig = {}) {
+  const roleCatalog = createWorkspaceRoleCatalog(appConfig);
+  return roleCatalog.roles.map((role) => ({
+    id: role.id,
+    assignable: role.assignable,
+    permissions: [...role.permissions]
+  }));
+}
+
+function resolveRolePermissions(roleSid, appConfig = {}) {
+  const normalizedRoleId = normalizeRoleId(roleSid);
+  if (!normalizedRoleId) {
+    return [];
+  }
+
+  const roleCatalog = createWorkspaceRoleCatalog(appConfig);
+  const role = roleCatalog.roles.find((entry) => entry.id === normalizedRoleId);
+  if (!role) {
+    return [];
+  }
+
+  return [...role.permissions];
+}
+
+export {
+  OWNER_ROLE_ID,
+  ADMIN_ROLE_ID,
+  MEMBER_ROLE_ID,
+  resolveRolePermissions,
+  listRoleDescriptors,
+  createWorkspaceRoleCatalog,
+  cloneWorkspaceRoleCatalog,
+  hasPermission
+};

package/src/shared/settings.js

@@ -0,0 +1,119 @@
+const WORKSPACE_THEME_MODE_LIGHT = "light";
+const WORKSPACE_THEME_MODE_DARK = "dark";
+const HEX_COLOR_PATTERN = /^#[0-9A-Fa-f]{6}$/;
+
+const DEFAULT_WORKSPACE_LIGHT_PALETTE = Object.freeze({
+  color: "#1867C0",
+  secondaryColor: "#48A9A6",
+  surfaceColor: "#FFFFFF",
+  surfaceVariantColor: "#424242"
+});
+
+const DEFAULT_WORKSPACE_DARK_PALETTE = Object.freeze({
+  color: "#2196F3",
+  secondaryColor: "#54B6B2",
+  surfaceColor: "#212121",
+  surfaceVariantColor: "#C8C8C8"
+});
+
+const DEFAULT_WORKSPACE_COLOR = DEFAULT_WORKSPACE_LIGHT_PALETTE.color;
+
+function normalizeWorkspaceHexColor(value) {
+  const normalized = String(value || "").trim();
+  if (!HEX_COLOR_PATTERN.test(normalized)) {
+    return "";
+  }
+  return normalized.toUpperCase();
+}
+
+function coerceWorkspaceColor(value) {
+  return normalizeWorkspaceHexColor(value) || DEFAULT_WORKSPACE_COLOR;
+}
+
+function normalizeWorkspaceThemeMode(value = "") {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (normalized === WORKSPACE_THEME_MODE_DARK) {
+    return WORKSPACE_THEME_MODE_DARK;
+  }
+  return WORKSPACE_THEME_MODE_LIGHT;
+}
+
+function resolveWorkspaceThemeDefaultPalette(mode = WORKSPACE_THEME_MODE_LIGHT) {
+  const normalizedMode = normalizeWorkspaceThemeMode(mode);
+  return normalizedMode === WORKSPACE_THEME_MODE_DARK
+    ? DEFAULT_WORKSPACE_DARK_PALETTE
+    : DEFAULT_WORKSPACE_LIGHT_PALETTE;
+}
+
+function coerceWorkspaceThemeColor(value, fallbackColor = DEFAULT_WORKSPACE_COLOR) {
+  return normalizeWorkspaceHexColor(value) || normalizeWorkspaceHexColor(fallbackColor) || DEFAULT_WORKSPACE_COLOR;
+}
+
+function coerceWorkspaceSecondaryColor(value, { mode = WORKSPACE_THEME_MODE_LIGHT } = {}) {
+  return coerceWorkspaceThemeColor(value, resolveWorkspaceThemeDefaultPalette(mode).secondaryColor);
+}
+
+function coerceWorkspaceSurfaceColor(value, { mode = WORKSPACE_THEME_MODE_LIGHT } = {}) {
+  return coerceWorkspaceThemeColor(value, resolveWorkspaceThemeDefaultPalette(mode).surfaceColor);
+}
+
+function coerceWorkspaceSurfaceVariantColor(value, { mode = WORKSPACE_THEME_MODE_LIGHT } = {}) {
+  return coerceWorkspaceThemeColor(value, resolveWorkspaceThemeDefaultPalette(mode).surfaceVariantColor);
+}
+
+function resolveWorkspaceThemePalette(input = {}, { mode = WORKSPACE_THEME_MODE_LIGHT } = {}) {
+  const source = input && typeof input === "object" ? input : {};
+  const normalizedMode = normalizeWorkspaceThemeMode(mode);
+  const paletteDefaults = resolveWorkspaceThemeDefaultPalette(normalizedMode);
+
+  if (normalizedMode === WORKSPACE_THEME_MODE_DARK) {
+    return Object.freeze({
+      color: coerceWorkspaceThemeColor(source.darkPrimaryColor, paletteDefaults.color),
+      secondaryColor: coerceWorkspaceThemeColor(source.darkSecondaryColor, paletteDefaults.secondaryColor),
+      surfaceColor: coerceWorkspaceThemeColor(source.darkSurfaceColor, paletteDefaults.surfaceColor),
+      surfaceVariantColor: coerceWorkspaceThemeColor(
+        source.darkSurfaceVariantColor,
+        paletteDefaults.surfaceVariantColor
+      )
+    });
+  }
+
+  return Object.freeze({
+    color: coerceWorkspaceThemeColor(source.lightPrimaryColor, paletteDefaults.color),
+    secondaryColor: coerceWorkspaceThemeColor(source.lightSecondaryColor, paletteDefaults.secondaryColor),
+    surfaceColor: coerceWorkspaceThemeColor(source.lightSurfaceColor, paletteDefaults.surfaceColor),
+    surfaceVariantColor: coerceWorkspaceThemeColor(
+      source.lightSurfaceVariantColor,
+      paletteDefaults.surfaceVariantColor
+    )
+  });
+}
+
+function resolveWorkspaceThemePalettes(input = {}) {
+  return Object.freeze({
+    light: resolveWorkspaceThemePalette(input, {
+      mode: WORKSPACE_THEME_MODE_LIGHT
+    }),
+    dark: resolveWorkspaceThemePalette(input, {
+      mode: WORKSPACE_THEME_MODE_DARK
+    })
+  });
+}
+
+export {
+  DEFAULT_WORKSPACE_DARK_PALETTE,
+  DEFAULT_WORKSPACE_LIGHT_PALETTE,
+  DEFAULT_WORKSPACE_COLOR,
+  coerceWorkspaceColor,
+  coerceWorkspaceThemeColor,
+  coerceWorkspaceSecondaryColor,
+  coerceWorkspaceSurfaceColor,
+  coerceWorkspaceSurfaceVariantColor,
+  normalizeWorkspaceHexColor,
+  normalizeWorkspaceThemeMode,
+  resolveWorkspaceThemeDefaultPalette,
+  resolveWorkspaceThemePalettes,
+  WORKSPACE_THEME_MODE_DARK,
+  WORKSPACE_THEME_MODE_LIGHT,
+  resolveWorkspaceThemePalette
+};

package/src/shared/support/workspacePathModel.js

@@ -0,0 +1,145 @@
+import {
+  deriveSurfaceRouteBaseFromPagesRoot,
+  normalizeSurfaceId
+} from "@jskit-ai/kernel/shared/surface/registry";
+import { normalizePathname } from "@jskit-ai/kernel/shared/surface/paths";
+
+function normalizeWorkspaceBasePath(workspaceBasePath = "/w") {
+  return normalizePathname(workspaceBasePath || "/w");
+}
+
+function normalizeSurfaceSegment(segmentLike = "") {
+  const normalizedPath = normalizePathname(segmentLike || "/");
+  if (normalizedPath === "/") {
+    return "";
+  }
+  return normalizedPath.replace(/^\/+/, "");
+}
+
+function normalizeSurfaceRouteBase(routeBaseLike = "") {
+  const rawRouteBase = String(routeBaseLike || "").trim();
+  if (!rawRouteBase || rawRouteBase === "/") {
+    return "/";
+  }
+  const withoutLeadingSlash = rawRouteBase.startsWith("/") ? rawRouteBase.slice(1) : rawRouteBase;
+  return deriveSurfaceRouteBaseFromPagesRoot(withoutLeadingSlash || "");
+}
+
+function normalizeSurfaceSegmentFromRouteBase(routeBase, { workspaceBasePath = "/w" } = {}) {
+  const normalizedRouteBase = normalizeSurfaceRouteBase(routeBase);
+  if (normalizedRouteBase === "/") {
+    return "";
+  }
+
+  const normalizedWorkspaceBasePath = normalizeWorkspaceBasePath(workspaceBasePath);
+  const workspacePlaceholderRoot = `${normalizedWorkspaceBasePath}/:workspaceSlug`;
+  if (normalizedRouteBase === workspacePlaceholderRoot) {
+    return "";
+  }
+  if (normalizedRouteBase.startsWith(`${workspacePlaceholderRoot}/`)) {
+    const remainder = normalizedRouteBase.slice(`${workspacePlaceholderRoot}/`.length);
+    const firstSegment = remainder.split("/").filter(Boolean)[0] || "";
+    return firstSegment.startsWith(":") ? "" : firstSegment;
+  }
+
+  const firstSegment = normalizedRouteBase.replace(/^\/+/, "").split("/").filter(Boolean)[0] || "";
+  if (!firstSegment || firstSegment.startsWith(":")) {
+    return "";
+  }
+  return firstSegment;
+}
+
+function parseWorkspacePathname(pathname = "", { workspaceBasePath = "/w" } = {}) {
+  const normalizedPathname = normalizePathname(pathname);
+  const normalizedWorkspaceBasePath = normalizeWorkspaceBasePath(workspaceBasePath);
+  if (!normalizedPathname.startsWith(`${normalizedWorkspaceBasePath}/`)) {
+    return null;
+  }
+
+  const trailingPath = normalizedPathname.slice(`${normalizedWorkspaceBasePath}/`.length);
+  const segments = trailingPath.split("/").filter(Boolean);
+  if (segments.length < 1) {
+    return null;
+  }
+
+  const [workspaceSlug, ...suffixSegments] = segments;
+  return {
+    workspaceSlug: String(workspaceSlug || "").trim(),
+    suffixSegments
+  };
+}
+
+function resolveDefaultWorkspaceSurfaceId({
+  defaultSurfaceId = "",
+  workspaceSurfaceIds = [],
+  surfaceRequiresWorkspace = null
+} = {}) {
+  const normalizedDefaultSurfaceId = normalizeSurfaceId(defaultSurfaceId);
+  if (
+    normalizedDefaultSurfaceId &&
+    typeof surfaceRequiresWorkspace === "function" &&
+    surfaceRequiresWorkspace(normalizedDefaultSurfaceId)
+  ) {
+    return normalizedDefaultSurfaceId;
+  }
+
+  for (const workspaceSurfaceId of Array.isArray(workspaceSurfaceIds) ? workspaceSurfaceIds : []) {
+    const normalizedWorkspaceSurfaceId = normalizeSurfaceId(workspaceSurfaceId);
+    if (normalizedWorkspaceSurfaceId) {
+      return normalizedWorkspaceSurfaceId;
+    }
+  }
+
+  return normalizedDefaultSurfaceId;
+}
+
+function resolveWorkspaceSurfaceIdFromSuffixSegments({
+  suffixSegments = [],
+  defaultWorkspaceSurfaceId = "",
+  workspaceSurfaces = []
+} = {}) {
+  const normalizedDefaultWorkspaceSurfaceId = normalizeSurfaceId(defaultWorkspaceSurfaceId);
+  if (!Array.isArray(suffixSegments) || suffixSegments.length < 1) {
+    return normalizedDefaultWorkspaceSurfaceId;
+  }
+
+  const suffixPath = suffixSegments.join("/");
+  const candidates = (Array.isArray(workspaceSurfaces) ? workspaceSurfaces : [])
+    .map((entry) => {
+      const surfaceId = normalizeSurfaceId(entry?.surfaceId || entry?.id);
+      if (!surfaceId || surfaceId === normalizedDefaultWorkspaceSurfaceId) {
+        return null;
+      }
+
+      const segment =
+        normalizeSurfaceSegment(entry?.segment) ||
+        normalizeSurfaceSegmentFromRouteBase(entry?.routeBase || entry?.pagesRoot) ||
+        surfaceId;
+      if (!segment) {
+        return null;
+      }
+
+      return {
+        surfaceId,
+        segment
+      };
+    })
+    .filter(Boolean)
+    .sort((left, right) => right.segment.length - left.segment.length);
+
+  for (const candidate of candidates) {
+    if (suffixPath === candidate.segment || suffixPath.startsWith(`${candidate.segment}/`)) {
+      return candidate.surfaceId;
+    }
+  }
+
+  return normalizedDefaultWorkspaceSurfaceId;
+}
+
+export {
+  normalizePathname,
+  normalizeSurfaceSegmentFromRouteBase,
+  parseWorkspacePathname,
+  resolveDefaultWorkspaceSurfaceId,
+  resolveWorkspaceSurfaceIdFromSuffixSegments
+};

package/src/shared/tenancyMode.js

@@ -0,0 +1,35 @@
+const TENANCY_MODE_NONE = "none";
+const TENANCY_MODE_PERSONAL = "personal";
+const TENANCY_MODE_WORKSPACES = "workspaces";
+
+const TENANCY_MODES = Object.freeze([
+  TENANCY_MODE_NONE,
+  TENANCY_MODE_PERSONAL,
+  TENANCY_MODE_WORKSPACES
+]);
+
+function normalizeTenancyMode(value = "") {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (!TENANCY_MODES.includes(normalized)) {
+    return TENANCY_MODE_NONE;
+  }
+  return normalized;
+}
+
+function isTenancyMode(value = "") {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  return TENANCY_MODES.includes(normalized);
+}
+
+export {
+  TENANCY_MODE_NONE,
+  TENANCY_MODE_PERSONAL,
+  TENANCY_MODE_WORKSPACES,
+  TENANCY_MODES,
+  normalizeTenancyMode,
+  isTenancyMode
+};

package/src/shared/tenancyProfile.js

@@ -0,0 +1,73 @@
+import {
+  TENANCY_MODE_NONE,
+  TENANCY_MODE_PERSONAL,
+  TENANCY_MODE_WORKSPACES,
+  normalizeTenancyMode
+} from "./tenancyMode.js";
+import { isRecord } from "@jskit-ai/kernel/shared/support/normalize";
+
+const WORKSPACE_SLUG_POLICY_NONE = "none";
+const WORKSPACE_SLUG_POLICY_IMMUTABLE_USERNAME = "immutable_username";
+const WORKSPACE_SLUG_POLICY_USER_SELECTED = "user_selected";
+
+function resolveWorkspacePolicyOverrides(appConfig = {}) {
+  const tenancyPolicy = isRecord(appConfig?.tenancyPolicy) ? appConfig.tenancyPolicy : {};
+  const workspacePolicy = isRecord(tenancyPolicy.workspace) ? tenancyPolicy.workspace : {};
+
+  return Object.freeze({
+    allowSelfCreate: typeof workspacePolicy.allowSelfCreate === "boolean" ? workspacePolicy.allowSelfCreate : null
+  });
+}
+
+function resolveWorkspacePolicy(mode, overrides = {}) {
+  if (mode === TENANCY_MODE_NONE) {
+    return Object.freeze({
+      enabled: false,
+      autoProvision: false,
+      allowSelfCreate: false,
+      slugPolicy: WORKSPACE_SLUG_POLICY_NONE
+    });
+  }
+
+  if (mode === TENANCY_MODE_PERSONAL) {
+    return Object.freeze({
+      enabled: true,
+      autoProvision: true,
+      allowSelfCreate: false,
+      slugPolicy: WORKSPACE_SLUG_POLICY_IMMUTABLE_USERNAME
+    });
+  }
+
+  return Object.freeze({
+    enabled: true,
+    autoProvision: false,
+    allowSelfCreate: overrides.allowSelfCreate === true,
+    slugPolicy: WORKSPACE_SLUG_POLICY_USER_SELECTED
+  });
+}
+
+function resolveTenancyProfile(appConfig = {}) {
+  const mode = normalizeTenancyMode(appConfig?.tenancyMode);
+  const workspacePolicyOverrides = resolveWorkspacePolicyOverrides(appConfig);
+
+  return Object.freeze({
+    mode,
+    workspace: resolveWorkspacePolicy(mode, workspacePolicyOverrides)
+  });
+}
+
+function isWorkspacesTenancyMode(value = "") {
+  return normalizeTenancyMode(value) === TENANCY_MODE_WORKSPACES;
+}
+
+export {
+  TENANCY_MODE_NONE,
+  TENANCY_MODE_PERSONAL,
+  TENANCY_MODE_WORKSPACES,
+  normalizeTenancyMode,
+  WORKSPACE_SLUG_POLICY_NONE,
+  WORKSPACE_SLUG_POLICY_IMMUTABLE_USERNAME,
+  WORKSPACE_SLUG_POLICY_USER_SELECTED,
+  resolveTenancyProfile,
+  isWorkspacesTenancyMode
+};