@noodleseed/one 0.173.0 → 0.175.0

package/node_modules/@noodle-borg/service/dist/business-information/memory-native-retention.js

@@ -0,0 +1,29 @@
+import { cloneRecord, deletedRecord } from './model.js';
+export function expireNativeMemoryRecord(store, key, now) {
+    const current = store.records.get(key);
+    if (current === undefined ||
+        current.deletedAt !== undefined ||
+        current.retentionExpiresAt === null ||
+        current.retentionExpiresAt > now.toISOString())
+        return current;
+    const erased = deletedRecord(current, 'system:retention', now, 'retention_expired');
+    store.commit(key, erased, 'retention_expired');
+    return erased;
+}
+/** Recheck after acquiring the record lock: a reviewed migration may have won since sweep selection. */
+export function eraseNativeMemoryRecord(store, key, expectedRevision, actorSubject, reason, now) {
+    const current = reason === 'retention_expired'
+        ? store.records.get(key)
+        : expireNativeMemoryRecord(store, key, now);
+    if (current === undefined || current.deletedAt !== undefined)
+        return { ok: false, reason: 'not_found', currentRevision: current?.revision ?? 0 };
+    if (current.revision !== expectedRevision)
+        return { ok: false, reason: 'conflict', currentRevision: current.revision };
+    if (reason === 'retention_expired' &&
+        (current.retentionExpiresAt === null || current.retentionExpiresAt > now.toISOString()))
+        return { ok: false, reason: 'invalid_transition', currentRevision: current.revision };
+    const erased = deletedRecord(current, actorSubject, now, reason);
+    store.commit(key, erased, reason === 'customer_request' ? 'deleted' : 'retention_expired');
+    return { ok: true, record: cloneRecord(erased) };
+}
+//# sourceMappingURL=memory-native-retention.js.map

package/node_modules/@noodle-borg/service/dist/business-information/model.js

@@ -4,6 +4,7 @@ import { collectionControlEnabled, creationPayload, patchedPayload, } from './co
 import { collectionForStoredRecord, resolveManagedInstallation, } from './managed-releases.js';
 import { builtInDefinition } from './profiles.js';
 import { PayloadValidationError, validateEmail, validateManagedPayload, validateRetentionDays, validateRevision, validateScalar, validateScope, } from './validation.js';
+import { workspacePermissionForBusinessOperation } from './workspace-permissions.js';
 const ROLE_PERMISSIONS = {
     administrator: [
         'installation:administer',
@@ -43,6 +44,10 @@ export function permissionsForBusinessRole(role) {
     return permissions;
 }
 export function businessGrantAllows(grant, permission) {
+    if (grant?.authorityVersion === 1) {
+        const mapped = workspacePermissionForBusinessOperation(permission);
+        return mapped !== undefined && grant.permissions.includes(mapped);
+    }
     return (grant !== undefined &&
         grant.revokedAt === undefined &&
         permissionsForBusinessRole(grant.role).includes(permission));
@@ -142,7 +147,9 @@ export function initialRecord(input) {
         ...(collection.behavior?.kind === 'request' ? { status: 'new' } : {}),
         origin: normalizeOrigin(input.origin),
         revision: 1,
-        retentionExpiresAt: new Date(input.now.getTime() + input.installation.retentionDays * 24 * 60 * 60 * 1000).toISOString(),
+        retentionExpiresAt: input.installation.nativeRecordLifecycle === 'explicit_erasure'
+            ? null
+            : new Date(input.now.getTime() + input.installation.retentionDays * 24 * 60 * 60 * 1000).toISOString(),
         createdAt,
         createdBySubject: actor,
         updatedAt: createdAt,
@@ -315,7 +322,7 @@ export function validateExpectedRevision(value) {
     return validateRevision(value);
 }
 function normalizeOrigin(origin) {
-    const kinds = ['embedded', 'mcp', 'portal', 'api', 'import'];
+    const kinds = ['embedded', 'mcp', 'portal', 'api', 'import', 'messaging'];
     if (!kinds.includes(origin.kind))
         throw new Error('unsupported managed request origin');
     return {

package/node_modules/@noodle-borg/service/dist/business-information/native-query.js

@@ -103,7 +103,9 @@ export function matchesNativeQueryMetadata(record, plan, now) {
     return (scopeKey(record.scope) === scopeKey(input.scope) &&
         record.collectionKey === input.collectionKey &&
         (input.includeDeleted === true || record.deletedAt === undefined) &&
-        (record.deletedAt !== undefined || record.retentionExpiresAt > now.toISOString()) &&
+        (record.deletedAt !== undefined ||
+            record.retentionExpiresAt === null ||
+            record.retentionExpiresAt > now.toISOString()) &&
         (input.status === undefined || record.status === input.status) &&
         (input.assigneeSubject === undefined || record.assigneeSubject === input.assigneeSubject) &&
         record.createdAt <= plan.snapshotAt &&

package/node_modules/@noodle-borg/service/dist/business-information/native-record-lifecycle.d.ts

@@ -0,0 +1,27 @@
+import { type NativeRecordLifecyclePreview, type NativeRecordLifecycleResult } from '@noodle-borg/wire-contracts';
+import type { InstallationScope, ManagedRequestRecord, SolutionInstallation } from './contracts.js';
+export declare class NativeLifecycleError extends Error {
+    readonly code: 'lifecycle_denied' | 'lifecycle_conflict' | 'lifecycle_unavailable';
+    constructor(code: 'lifecycle_denied' | 'lifecycle_conflict' | 'lifecycle_unavailable');
+}
+export interface NativeRecordLifecycleStore {
+    preview(scope: InstallationScope, actor: string): Promise<NativeRecordLifecyclePreview>;
+    migrate(input: {
+        readonly scope: InstallationScope;
+        readonly actor: string;
+        readonly preview: NativeRecordLifecyclePreview;
+    }): Promise<NativeRecordLifecycleResult>;
+}
+export type LifecycleInventory = Pick<ManagedRequestRecord, 'collectionKey' | 'id' | 'revision' | 'retentionExpiresAt' | 'deletedAt'>;
+export interface LifecycleReceipt {
+    readonly preview: NativeRecordLifecyclePreview;
+    readonly actor: string;
+    readonly result: NativeRecordLifecycleResult;
+}
+export declare const LIFECYCLE_REVIEW_MS: number;
+export declare const LIFECYCLE_INVENTORY_LIMIT = 65536;
+export declare function sameLifecycleReview(expected: NativeRecordLifecyclePreview, input: NativeRecordLifecyclePreview): boolean;
+/** Digest is an optimistic review precondition, never a bearer authorization token. No payload reads. */
+export declare function lifecyclePreview(installation: SolutionInstallation, records: readonly LifecycleInventory[], observedAt: string, now?: string): NativeRecordLifecyclePreview;
+export declare function checkLifecycleReview(installation: SolutionInstallation, records: readonly LifecycleInventory[], input: NativeRecordLifecyclePreview, now: string): void;
+//# sourceMappingURL=native-record-lifecycle.d.ts.map

package/node_modules/@noodle-borg/service/dist/business-information/native-record-lifecycle.js

@@ -0,0 +1,63 @@
+import { createHash } from 'node:crypto';
+import { NativeRecordLifecyclePreviewSchema, } from '@noodle-borg/wire-contracts';
+import { scopeKey } from './pagination.js';
+export class NativeLifecycleError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+export const LIFECYCLE_REVIEW_MS = 5 * 60_000;
+// A live record prepays a 16 KiB terminal reserve inside the 1 GiB custody ceiling.
+export const LIFECYCLE_INVENTORY_LIMIT = 65_536;
+export function sameLifecycleReview(expected, input) {
+    const parsed = NativeRecordLifecyclePreviewSchema.safeParse(input);
+    return (parsed.success &&
+        JSON.stringify(NativeRecordLifecyclePreviewSchema.parse(expected)) ===
+            JSON.stringify(parsed.data));
+}
+/** Digest is an optimistic review precondition, never a bearer authorization token. No payload reads. */
+export function lifecyclePreview(installation, records, observedAt, now = observedAt) {
+    if (records.length > LIFECYCLE_INVENTORY_LIMIT)
+        throw new NativeLifecycleError('lifecycle_unavailable');
+    const sorted = [...records].sort((a, b) => {
+        const left = `${a.collectionKey}\0${a.id}`, right = `${b.collectionKey}\0${b.id}`;
+        return left < right ? -1 : left > right ? 1 : 0;
+    });
+    const rows = sorted.map((r) => [
+        r.collectionKey,
+        r.id,
+        r.revision,
+        r.retentionExpiresAt,
+        r.deletedAt ?? null,
+        r.retentionExpiresAt !== null && r.retentionExpiresAt <= now,
+    ]);
+    const values = {
+        policy: installation.nativeRecordLifecycle ?? 'legacy_expiry',
+        installationRevision: installation.revision,
+        observedAt,
+        recordsToPreserve: records.filter((r) => !r.deletedAt && r.retentionExpiresAt !== null && r.retentionExpiresAt > now).length,
+        expiredRecords: records.filter((r) => !r.deletedAt && r.retentionExpiresAt !== null && r.retentionExpiresAt <= now).length,
+    };
+    return NativeRecordLifecyclePreviewSchema.parse({
+        ...values,
+        digest: createHash('sha256')
+            .update(JSON.stringify([scopeKey(installation.scope), values, rows]))
+            .digest('hex'),
+    });
+}
+export function checkLifecycleReview(installation, records, input, now) {
+    const parsed = NativeRecordLifecyclePreviewSchema.safeParse(input);
+    if (!parsed.success)
+        throw new NativeLifecycleError('lifecycle_conflict');
+    const age = Date.parse(now) - Date.parse(input.observedAt);
+    if (!Number.isFinite(age) ||
+        age < 0 ||
+        age > LIFECYCLE_REVIEW_MS ||
+        JSON.stringify(lifecyclePreview(installation, records, input.observedAt, now)) !==
+            JSON.stringify(parsed.data) ||
+        input.policy !== 'legacy_expiry')
+        throw new NativeLifecycleError('lifecycle_conflict');
+}
+//# sourceMappingURL=native-record-lifecycle.js.map

package/node_modules/@noodle-borg/service/dist/business-information/principal-authority.d.ts

@@ -5,7 +5,9 @@ export type BusinessPrincipalProvider = Pick<PlatformHumanIdentityContribution,
 export declare class BusinessPrincipalAuthority {
     #private;
     configure(provider: BusinessPrincipalProvider | undefined): void;
-    allows(subject: string, transaction?: ModuleSqlTransaction): Promise<boolean>;
+    allows(subject: string, transaction?: ModuleSqlTransaction, options?: {
+        readonly requireKnown?: true;
+    }): Promise<boolean>;
     eligible(grants: readonly BusinessGrant[]): Promise<readonly BusinessGrant[]>;
 }
 //# sourceMappingURL=principal-authority.d.ts.map

package/node_modules/@noodle-borg/service/dist/business-information/principal-authority.js

@@ -5,18 +5,23 @@ export class BusinessPrincipalAuthority {
     configure(provider) {
         this.#provider = provider;
     }
-    async allows(subject, transaction) {
+    async allows(subject, transaction, options = {}) {
         const provider = this.#provider;
         if (provider === undefined)
-            return true;
+            return options.requireKnown !== true;
         try {
-            if (transaction === undefined)
+            if (transaction === undefined) {
+                if (options.requireKnown)
+                    return (await provider.principalResolver.resolveExisting(subject))?.subject === subject;
                 await provider.principalResolver.assertActive(subject);
+            }
             else {
                 if (provider.assertActivePrincipal === undefined) {
                     throw new Error('Business assignment requires transactional principal authority');
                 }
-                await provider.assertActivePrincipal(transaction, subject);
+                const checked = await provider.assertActivePrincipal(transaction, subject);
+                if (options.requireKnown)
+                    return checked?.known === true;
             }
             return true;
         }

package/node_modules/@noodle-borg/service/dist/business-information/staff-authority.d.ts

@@ -0,0 +1,16 @@
+import type { EligibleBusinessAssignee } from '@noodle-borg/wire-contracts';
+import type { BusinessWorkspaceStore } from '../business-workspaces/store.js';
+import type { BusinessGrant, BusinessPermission, BusinessStaffGrant, InstallationScope } from './contracts.js';
+/** One version selector shared by HTTP reads and transaction-bound native store effects. */
+export declare class BusinessStaffAuthority {
+    #private;
+    private readonly getLegacyGrant;
+    constructor(getLegacyGrant: (scope: InstallationScope, subject: string) => Promise<BusinessGrant | undefined>);
+    configure(workspaces: BusinessWorkspaceStore | undefined): void;
+    resolve(scope: InstallationScope, subject: string): Promise<BusinessStaffGrant | undefined>;
+    allows(scope: InstallationScope, subject: string, permission: BusinessPermission): Promise<boolean>;
+    eligibleAssignees(scope: InstallationScope, actor: string, legacy: () => Promise<readonly BusinessGrant[]>): Promise<readonly EligibleBusinessAssignee[]>;
+    /** Local effects only. The caller emits responses after this transaction has committed. */
+    run<T>(scope: InstallationScope, actor: string, permission: BusinessPermission, operation: () => Promise<T>, forbidden?: () => Error): Promise<T>;
+}
+//# sourceMappingURL=staff-authority.d.ts.map

package/node_modules/@noodle-borg/service/dist/business-information/staff-authority.js

@@ -0,0 +1,60 @@
+import { BusinessWorkspaceError } from '../business-workspaces/contracts.js';
+import { businessGrantAllows } from './model.js';
+import { workspacePermissionForBusinessOperation } from './workspace-permissions.js';
+/** One version selector shared by HTTP reads and transaction-bound native store effects. */
+export class BusinessStaffAuthority {
+    getLegacyGrant;
+    #workspaces;
+    constructor(getLegacyGrant) {
+        this.getLegacyGrant = getLegacyGrant;
+    }
+    configure(workspaces) {
+        this.#workspaces = workspaces;
+    }
+    async resolve(scope, subject) {
+        try {
+            const access = await this.#workspaces?.resolveAccess(scope.org, subject);
+            if (access)
+                return { ...access, scope };
+            return this.getLegacyGrant(scope, subject);
+        }
+        catch (error) {
+            if (error instanceof BusinessWorkspaceError && error.code === 'forbidden')
+                return undefined;
+            throw error;
+        }
+    }
+    async allows(scope, subject, permission) {
+        return businessGrantAllows(await this.resolve(scope, subject), permission);
+    }
+    async eligibleAssignees(scope, actor, legacy) {
+        const current = await this.#workspaces?.listEligibleAssignees(scope.org, actor);
+        if (current)
+            return current;
+        const result = [];
+        for (const grant of await legacy()) {
+            if (grant.email && !grant.revokedAt && grant.role !== 'viewer')
+                result.push({ subject: grant.subject, role: grant.role, email: grant.email });
+        }
+        return result;
+    }
+    /** Local effects only. The caller emits responses after this transaction has committed. */
+    async run(scope, actor, permission, operation, forbidden) {
+        const legacy = async () => {
+            if (!businessGrantAllows(await this.getLegacyGrant(scope, actor), permission))
+                throw new BusinessWorkspaceError('forbidden');
+            return operation();
+        };
+        try {
+            if (!this.#workspaces)
+                return await legacy();
+            return await this.#workspaces.runAuthorized(scope.org, actor, workspacePermissionForBusinessOperation(permission) ?? null, operation, legacy);
+        }
+        catch (error) {
+            if (forbidden && error instanceof BusinessWorkspaceError && error.code === 'forbidden')
+                throw forbidden();
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=staff-authority.js.map

package/node_modules/@noodle-borg/service/dist/business-information/workspace-permissions.js

@@ -0,0 +1,18 @@
+/** Legacy operation vocabulary mapped to the one workspace matrix, not a second role matrix. */
+const operations = {
+    'installation:administer': 'settings:manage',
+    // Workspace team APIs own versioned membership; old installation grants cannot mutate it.
+    'grants:manage': undefined,
+    'records:create': 'records:write',
+    'records:read': 'records:read',
+    'records:update': 'records:write',
+    'records:assign': 'records:write',
+    'records:status': 'records:write',
+    'records:note': 'records:write',
+    'records:delete': 'records:erase',
+    'records:export': 'records:export',
+};
+export function workspacePermissionForBusinessOperation(permission) {
+    return operations[permission];
+}
+//# sourceMappingURL=workspace-permissions.js.map

package/node_modules/@noodle-borg/service/dist/business-information-runtime.js

@@ -9,6 +9,7 @@ export function createBusinessInformationRuntime(registry, options, publicCounte
         (options.businessInformationEnabled === false
             ? undefined
             : new InMemoryBusinessInformationStore());
+    businessInformationStore?.staff.configure(options.businessAuthoring?.workspaces);
     if (businessInformationStore)
         registry.setApplicationLifecycleObserver((org, app, at, retired) => businessInformationStore.pauseApplication(org, app, at, retired));
     if (businessInformationStore instanceof InMemoryBusinessInformationStore) {

package/node_modules/@noodle-borg/service/dist/business-onboarding.js

@@ -18,14 +18,22 @@ export function parseBusinessOnboarding(serialized) {
 export class BusinessOnboarding {
     organizations;
     installations;
+    workspaces;
     #documents;
-    constructor(options, organizations, installations) {
+    constructor(options, organizations, installations, workspaces) {
         this.organizations = organizations;
         this.installations = installations;
+        this.workspaces = workspaces;
         this.#documents = options.documents ? validateAgreementDocuments(options.documents) : undefined;
     }
     async status(org, subject) {
-        const canAccept = (await this.organizations.getOrgMember({ org, subject }))?.role === 'owner';
+        const legacy = async () => this.readStatus(org, (await this.organizations.getOrgMember({ org, subject }))?.role === 'owner');
+        const workspaces = this.workspaces;
+        if (!workspaces)
+            return legacy();
+        return workspaces.runAuthorized(org, subject, 'settings:manage', async () => this.readStatus(org, (await workspaces.authorize(org, subject, 'owners:manage')) === 'allowed'), legacy);
+    }
+    async readStatus(org, canAccept) {
         const documents = this.#documents;
         if (!documents)
             return { canAccept, accepted: false, required: null };
@@ -58,7 +66,12 @@ export class BusinessOnboarding {
         const documents = this.#documents;
         if (!documents)
             throw new BusinessSetupError();
-        await this.organizations.acceptOrganizationAgreement({ org, actorSubject: subject, documents });
+        const workspaces = this.workspaces;
+        await this.organizations.acceptOrganizationAgreement({ org, actorSubject: subject, documents }, workspaces
+            ? {
+                run: (selectedOrg, actor, commit, legacy) => workspaces.runAuthorized(selectedOrg, actor, 'owners:manage', commit, legacy),
+            }
+            : undefined);
         return this.status(org, subject);
     }
     async ready(installation) {

package/node_modules/@noodle-borg/service/dist/business-workspaces/contracts.d.ts

@@ -0,0 +1,110 @@
+import type { ModuleSqlTransaction } from '@noodle-borg/module';
+import { BusinessWorkspaceRoleSchema } from '@noodle-borg/wire-contracts';
+import { z } from 'zod';
+import type { WorkspacePermission } from './permissions.js';
+export interface BusinessWorkspaceAccess {
+    readonly authorityVersion: 1;
+    readonly revision: number;
+    readonly subject: string;
+    readonly role: z.infer<typeof BusinessWorkspaceRoleSchema>;
+    readonly permissions: readonly WorkspacePermission[];
+}
+export declare const WorkspaceSubjectSchema: z.ZodString;
+export declare const WorkspaceOrgSchema: z.ZodString;
+export declare const WorkspaceRevisionSchema: z.ZodNumber;
+export declare const WorkspaceMemberSchema: z.ZodObject<{
+    subject: z.ZodString;
+    role: z.ZodEnum<{
+        operator: "operator";
+        owner: "owner";
+        viewer: "viewer";
+        administrator: "administrator";
+        builder: "builder";
+    }>;
+    joinedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+declare const invitation: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodEmail;
+    role: z.ZodEnum<{
+        operator: "operator";
+        owner: "owner";
+        viewer: "viewer";
+        administrator: "administrator";
+        builder: "builder";
+    }>;
+    tokenDigest: z.ZodString;
+    createdBy: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    expiresAt: z.ZodISODateTime;
+}, z.core.$strict>;
+/** Internal encrypted state. Never serialize pending invitation material into a staff response. */
+export declare const WorkspaceStateSchema: z.ZodObject<{
+    org: z.ZodString;
+    authorityVersion: z.ZodLiteral<1>;
+    revision: z.ZodNumber;
+    initializedBy: z.ZodString;
+    activatedAt: z.ZodISODateTime;
+    members: z.ZodArray<z.ZodObject<{
+        subject: z.ZodString;
+        role: z.ZodEnum<{
+            operator: "operator";
+            owner: "owner";
+            viewer: "viewer";
+            administrator: "administrator";
+            builder: "builder";
+        }>;
+        joinedAt: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    invitations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodEmail;
+        role: z.ZodEnum<{
+            operator: "operator";
+            owner: "owner";
+            viewer: "viewer";
+            administrator: "administrator";
+            builder: "builder";
+        }>;
+        tokenDigest: z.ZodString;
+        createdBy: z.ZodString;
+        createdAt: z.ZodISODateTime;
+        expiresAt: z.ZodISODateTime;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type WorkspaceState = z.infer<typeof WorkspaceStateSchema>;
+export type WorkspaceInvitation = z.infer<typeof invitation>;
+export interface WorkspaceAuditEvent {
+    readonly revision: number;
+    readonly actor: string;
+    readonly action: 'initialized' | 'invited' | 'accepted' | 'role_changed' | 'removed' | 'invitation_revoked';
+    readonly target: string;
+    readonly at: string;
+}
+export interface BusinessWorkspaceTransaction {
+    readonly now: string;
+    /** Borrowed authority transaction for canonical principal checks; never acquire a second connection. */
+    readonly principalTransaction?: ModuleSqlTransaction;
+    get(): Promise<WorkspaceState | undefined>;
+    save(state: WorkspaceState, event: WorkspaceAuditEvent): Promise<void>;
+}
+export interface BusinessWorkspaceBackend {
+    /** Existing caller transaction only; reads must not acquire a second identity connection. */
+    principalTransaction?(): ModuleSqlTransaction | undefined;
+    /** Candidate lookup only; the encrypted workspace state remains permission authority. */
+    findMemberships(subject: string, input: {
+        readonly after?: string;
+        readonly limit: number;
+    }): Promise<readonly string[]>;
+    /** Snapshot read; inherits a caller's authority transaction when one is already active. */
+    read(org: string): Promise<WorkspaceState | undefined>;
+    /** Uses the same organization authority lock as draft writes and publication. */
+    run<T>(org: string, work: (tx: BusinessWorkspaceTransaction) => Promise<T>): Promise<T>;
+}
+export declare class BusinessWorkspaceError extends Error {
+    readonly code: 'invalid_request' | 'forbidden' | 'legacy_authority' | 'already_activated' | 'revision_conflict' | 'not_found' | 'last_owner' | 'invalid_invitation' | 'member_exists' | 'workspace_limit';
+    readonly currentRevision?: number | undefined;
+    constructor(code: 'invalid_request' | 'forbidden' | 'legacy_authority' | 'already_activated' | 'revision_conflict' | 'not_found' | 'last_owner' | 'invalid_invitation' | 'member_exists' | 'workspace_limit', currentRevision?: number | undefined);
+}
+export {};
+//# sourceMappingURL=contracts.d.ts.map

package/node_modules/@noodle-borg/service/dist/business-workspaces/contracts.js

@@ -0,0 +1,52 @@
+import { SLUG_PATTERN, validateSlug } from '@noodle-borg/control-plane/portable';
+import { BusinessWorkspaceRoleSchema } from '@noodle-borg/wire-contracts';
+import { z } from 'zod';
+export const WorkspaceSubjectSchema = z.string().min(1).max(500);
+export const WorkspaceOrgSchema = z
+    .string()
+    .regex(SLUG_PATTERN)
+    .refine((value) => {
+    try {
+        validateSlug('org', value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+});
+export const WorkspaceRevisionSchema = z.number().int().positive().max(2147483647);
+export const WorkspaceMemberSchema = z.strictObject({
+    subject: WorkspaceSubjectSchema,
+    role: BusinessWorkspaceRoleSchema,
+    joinedAt: z.iso.datetime(),
+});
+const invitation = z.strictObject({
+    id: z.string().uuid(),
+    email: z.email().max(254),
+    role: BusinessWorkspaceRoleSchema,
+    tokenDigest: z.string().regex(/^[a-f0-9]{64}$/),
+    createdBy: WorkspaceSubjectSchema,
+    createdAt: z.iso.datetime(),
+    expiresAt: z.iso.datetime(),
+});
+/** Internal encrypted state. Never serialize pending invitation material into a staff response. */
+export const WorkspaceStateSchema = z.strictObject({
+    org: WorkspaceOrgSchema,
+    authorityVersion: z.literal(1),
+    revision: WorkspaceRevisionSchema,
+    initializedBy: WorkspaceSubjectSchema,
+    activatedAt: z.iso.datetime(),
+    members: z.array(WorkspaceMemberSchema).min(1).max(1000),
+    invitations: z.array(invitation).max(100),
+});
+export class BusinessWorkspaceError extends Error {
+    code;
+    currentRevision;
+    constructor(code, currentRevision) {
+        super(code);
+        this.code = code;
+        this.currentRevision = currentRevision;
+        this.name = 'BusinessWorkspaceError';
+    }
+}
+//# sourceMappingURL=contracts.js.map

package/node_modules/@noodle-borg/service/dist/business-workspaces/paths.js

@@ -0,0 +1,17 @@
+const root = /^\/v1\/orgs\/([a-z0-9][a-z0-9-]{0,62})\/business-workspace(?:\/(members|accept|invitations)(?:\/([a-f0-9-]{36}))?)?$/;
+export function parseBusinessWorkspacePath(path) {
+    const match = root.exec(path);
+    if (!match?.[1] || (match[3] && match[2] !== 'invitations'))
+        return undefined;
+    return { org: match[1], action: match[2], id: match[3] };
+}
+export function businessWorkspaceMethod(ref) {
+    if (!ref.action)
+        return 'GET';
+    if (ref.action === 'members')
+        return 'PATCH';
+    if (ref.action === 'invitations' && ref.id)
+        return 'DELETE';
+    return 'POST';
+}
+//# sourceMappingURL=paths.js.map

package/node_modules/@noodle-borg/service/dist/business-workspaces/permissions.d.ts

@@ -0,0 +1,7 @@
+import type { BusinessWorkspacePermissionSchema, BusinessWorkspaceRole } from '@noodle-borg/wire-contracts';
+import type { z } from 'zod';
+export type WorkspacePermission = z.infer<typeof BusinessWorkspacePermissionSchema>;
+/** One fixed matrix, projected by clients; client-side visibility never supplies authorization. */
+export declare const WORKSPACE_ROLE_PERMISSIONS: Readonly<Record<BusinessWorkspaceRole, readonly WorkspacePermission[]>>;
+export declare function mayDelegate(actor: BusinessWorkspaceRole | undefined, target: BusinessWorkspaceRole): boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/node_modules/@noodle-borg/service/dist/business-workspaces/store.d.ts

@@ -0,0 +1,102 @@
+import type { ModuleSqlTransaction } from '@noodle-borg/module';
+import { BusinessWorkspaceRoleSchema, type EligibleBusinessAssignee } from '@noodle-borg/wire-contracts';
+import { z } from 'zod';
+import { type BusinessWorkspaceAccess, type BusinessWorkspaceBackend, type WorkspaceState } from './contracts.js';
+import { type WorkspacePermission } from './permissions.js';
+export interface BusinessWorkspaceStoreOptions {
+    /** Canonical identity authority, never an email claim or a caller-supplied boolean. */
+    readonly isIdentityActive: (subject: string, transaction?: ModuleSqlTransaction) => Promise<boolean>;
+}
+interface Mutation {
+    readonly org: string;
+    readonly actor: string;
+    readonly expectedRevision: number;
+}
+export declare class BusinessWorkspaceStore {
+    private readonly backend;
+    private readonly options;
+    constructor(backend: BusinessWorkspaceBackend, options: BusinessWorkspaceStoreOptions);
+    listForSubject(subject: string, query: unknown): Promise<{
+        nextCursor?: string;
+        workspaces: {
+            org: string;
+            authorityVersion: 1;
+            revision: number;
+            role: "operator" | "owner" | "viewer" | "administrator" | "builder";
+            permissions: readonly ("records:read" | "records:write" | "records:export" | "records:erase" | "drafts:read" | "drafts:edit" | "drafts:preview" | "applications:publish" | "settings:manage" | "team:manage" | "owners:manage" | "billing:manage" | "workspace:delete")[];
+        }[];
+    }>;
+    /** Internal new-organization composition only; legacy activation uses reviewed migration, never this method. */
+    initializeNewWorkspace(input: {
+        readonly org: string;
+        readonly ownerSubject: string;
+    }): Promise<WorkspaceState>;
+    /** A dispatch that mutates data must call this again inside its workspace authority transaction. */
+    authorize(org: string, subject: string, permission: WorkspacePermission): Promise<'legacy' | 'allowed' | 'denied'>;
+    /** Undefined means retained legacy authority, never a versioned workspace with a missing member. */
+    resolveAccess(org: string, subject: string): Promise<BusinessWorkspaceAccess | undefined>;
+    /** Minimal assignment choices; not a team directory or a second identity profile store. */
+    listEligibleAssignees(org: string, actor: string): Promise<readonly EligibleBusinessAssignee[] | undefined>;
+    /** Commit a local authoritative effect under the same lock/transaction as membership changes.
+     * The callback must use this backend's transaction-aware stores, never send an HTTP response or
+     * perform a remote side effect. External operations use their own dispatch/confirmation boundary.
+     */
+    runAuthorized<T>(org: string, actor: string, permission: WorkspacePermission | null, operation: () => Promise<T>, legacy?: () => Promise<T>): Promise<T>;
+    inspect(org: string, actor: string): Promise<{
+        org: string;
+        authorityVersion: 1;
+        revision: number;
+        activatedAt: string;
+        role: "operator" | "owner" | "viewer" | "administrator" | "builder";
+        permissions: readonly ("records:read" | "records:write" | "records:export" | "records:erase" | "drafts:read" | "drafts:edit" | "drafts:preview" | "applications:publish" | "settings:manage" | "team:manage" | "owners:manage" | "billing:manage" | "workspace:delete")[];
+        members: {
+            subject: string;
+            role: "operator" | "owner" | "viewer" | "administrator" | "builder";
+            joinedAt: string;
+        }[];
+        invitations: {
+            id: string;
+            email: string;
+            role: "operator" | "owner" | "viewer" | "administrator" | "builder";
+            createdBy: string;
+            createdAt: string;
+            expiresAt: string;
+        }[];
+    }>;
+    changeRole(input: Mutation & {
+        readonly subject: string;
+        readonly role: z.infer<typeof BusinessWorkspaceRoleSchema> | null;
+    }): Promise<{
+        revision: number;
+    }>;
+    invite(input: Mutation & {
+        readonly email: string;
+        readonly role?: z.infer<typeof BusinessWorkspaceRoleSchema>;
+    }): Promise<{
+        id: `${string}-${string}-${string}-${string}-${string}`;
+        role: "operator" | "owner" | "viewer" | "administrator" | "builder";
+        token: string;
+        expiresAt: string;
+        revision: number;
+    }>;
+    /** Caller supplies the authenticated canonical identity's verified email, never form input. */
+    accept(input: {
+        readonly org: string;
+        readonly subject: string;
+        readonly verifiedEmail: string;
+        readonly token: string;
+    }): Promise<{
+        revision: number;
+    }>;
+    revokeInvitation(input: Mutation & {
+        readonly invitationId: string;
+    }): Promise<{
+        revision: number;
+    }>;
+    private mutate;
+    private commit;
+    private requireState;
+    private requireActive;
+}
+export {};
+//# sourceMappingURL=store.d.ts.map