@noodleseed/one 0.173.0 → 0.175.0

package/node_modules/@noodle-borg/service/dist/routes/business-information.js

@@ -1,15 +1,13 @@
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
-import { BusinessGrantCreateRequestSchema, formatWireError, ManagedRecordCreateRequestSchema, ManagedRecordMutationRequestSchema, ManagedRecordStatusSchema, SolutionInstallationCreateRequestSchema, SolutionInstallationIntakeRequestSchema, } from '@noodle-borg/wire-contracts';
-import { admitBusinessMutation, admitBusinessTarget, authorizeBusinessApi, } from '../business-api-admission.js';
+import { BusinessGrantCreateRequestSchema, formatWireError, SolutionInstallationCreateRequestSchema, SolutionInstallationIntakeRequestSchema, } from '@noodle-borg/wire-contracts';
+import { admitBusinessTarget } from '../business-api-admission.js';
 import { resolveInstallDefinition } from '../business-information/definition-resolver.js';
-import { BUILT_IN_SOLUTION_PROFILES, businessGrantAllows, MANAGED_SOLUTION_PROFILE_KEYS, PayloadValidationError, validateCollectionEnabled, } from '../business-information/portable.js';
+import { BUILT_IN_SOLUTION_PROFILES, MANAGED_SOLUTION_PROFILE_KEYS, validateCollectionEnabled, } from '../business-information/portable.js';
 import { sendForbidden } from '../http-util.js';
-import { loadExternalRecord, sendExternalRecordPage, sourceBindingKey, unsupportedExternalOperation, } from './business-information-external.js';
+import { requireIdentity, requireInstallationGrant, requireInstallationPermission, resolveBusinessStaffGrant, runBusinessStaffOperation, } from './business-information-access.js';
 import { installationProjection, retryInstallationActivation, stableInstallationId, } from './business-information-installation.js';
-import { createNativeRecord } from './business-information-record-create.js';
-import { cursorRequest, sendNativeRecordActivity } from './business-information-record-reads.js';
-import { expectedRevision, mutationPermission, parseNativeRecordQuery, parseBusinessPaging as parsePaging, requestIdempotencyKey, } from './business-information-request.js';
-import { collectionToWire, externalRecordToWire, grantToWire, profileToWire, recordDetailToWire, recordToWire, } from './business-information-wire.js';
+import { expectedRevision } from './business-information-request.js';
+import { grantToWire, profileToWire } from './business-information-wire.js';
 import { canManageMembers } from './org-admin.js';
 export function handleSolutionCatalog(req, res) {
     if (req.method !== 'GET') {
@@ -70,7 +68,7 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
                 code: 'installation_conflict',
             });
         }
-        const grant = await deps.store.getGrant(result.installation.scope, identity.subject);
+        const grant = await resolveBusinessStaffGrant(deps, result.installation.scope, identity.subject);
         if (grant === undefined || grant.revokedAt !== undefined) {
             return sendForbidden(res, 'business grant required');
         }
@@ -107,7 +105,7 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
         const installations = await deps.store.listInstallations(ref.org);
         const permitted = [];
         for (const installation of installations) {
-            const grant = await deps.store.getGrant(installation.scope, identity.subject);
+            const grant = await resolveBusinessStaffGrant(deps, installation.scope, identity.subject);
             if (grant !== undefined && grant.revokedAt === undefined) {
                 permitted.push({ installation, role: grant.role });
             }
@@ -142,12 +140,12 @@ export async function handleSolutionInstallations(req, res, ref, deps) {
         const parsed = SolutionInstallationIntakeRequestSchema.safeParse(body.value);
         if (!parsed.success)
             return invalid(res, parsed.error);
-        const result = await deps.store.setIntakeState({
+        const result = await runBusinessStaffOperation(deps, authorized.scope, identity.subject, 'installation:administer', () => deps.store.setIntakeState({
             scope: authorized.scope,
             expectedRevision: parsed.data.expectedRevision,
             active: parsed.data.active,
             actorSubject: identity.subject,
-        });
+        }));
         if (!result.ok)
             return mutationFailure(res, result);
         return sendJson(res, 200, {
@@ -213,350 +211,8 @@ export async function handleBusinessGrants(req, res, ref, deps) {
     }
     return methodNotAllowed(res);
 }
-export async function handleManagedRecords(req, res, url, ref, deps) {
-    const identity = await requireIdentity(req, res, deps);
-    if (identity === false)
-        return;
-    if (ref.collection === undefined)
-        return sendJson(res, 404, { error: 'not found' });
-    const collection = ref.collection;
-    if (ref.action === 'activity' && req.method === 'GET' && ref.recordId !== undefined) {
-        const authorized = await requireInstallationPermission(res, ref, identity, 'records:read', deps);
-        if (authorized === undefined)
-            return;
-        const definition = enabledCollection(res, authorized.installation, collection);
-        if (definition === undefined)
-            return;
-        if (definition.authority.authority === 'external') {
-            return sendJson(res, 200, { ok: true, data: { activities: [] } });
-        }
-        return sendNativeRecordActivity(res, url, authorized.installation.scope, collection, ref.recordId, deps.store);
-    }
-    if (ref.action === 'export' && req.method === 'GET') {
-        const authorized = await requireInstallationPermission(res, ref, identity, 'records:export', deps);
-        if (authorized === undefined)
-            return;
-        const definition = enabledCollection(res, authorized.installation, collection);
-        if (definition === undefined)
-            return;
-        const paging = parsePaging(url, 500);
-        if (!paging.ok)
-            return sendJson(res, 400, { error: paging.error });
-        if (definition.authority.authority === 'external') {
-            return sendExternalRecordPage(res, authorized.installation, definition, { ...paging.value, limit: paging.value.limit ?? 500 }, deps);
-        }
-        const page = await cursorRequest(res, () => deps.store.exportRequests({
-            scope: authorized.installation.scope,
-            collectionKey: collection,
-            ...paging.value,
-            includeDeleted: url.searchParams.get('includeDeleted') === 'true',
-        }));
-        if (page === undefined)
-            return;
-        return sendJson(res, 200, {
-            ok: true,
-            data: {
-                records: page.records.map((record) => ({
-                    ...recordToWire(record),
-                    ...(record.content ? { notes: record.content.notes } : {}),
-                })),
-                ...(page.nextCursor === undefined ? {} : { nextCursor: page.nextCursor }),
-            },
-        });
-    }
-    if (ref.recordId === undefined && req.method === 'GET') {
-        const authorized = await requireInstallationPermission(res, ref, identity, 'records:read', deps);
-        if (authorized === undefined)
-            return;
-        const definition = enabledCollection(res, authorized.installation, collection);
-        if (definition === undefined)
-            return;
-        const paging = parsePaging(url, 100);
-        if (!paging.ok)
-            return sendJson(res, 400, { error: paging.error });
-        const query = parseNativeRecordQuery(url);
-        if (!query.ok)
-            return sendJson(res, 400, { error: query.error, code: 'invalid_query' });
-        if (definition.authority.authority === 'external') {
-            if (Object.keys(query.value).length > 0)
-                return sendJson(res, 400, {
-                    error: 'Field and date queries currently require a native collection.',
-                    code: 'invalid_query',
-                });
-            return sendExternalRecordPage(res, authorized.installation, definition, paging.value, deps);
-        }
-        const statusValue = url.searchParams.get('status');
-        const status = statusValue === null ? undefined : ManagedRecordStatusSchema.safeParse(statusValue);
-        if (status !== undefined && !status.success)
-            return sendJson(res, 400, { error: 'invalid status' });
-        const assigneeSubject = url.searchParams.get('assigneeSubject') ?? undefined;
-        const page = await cursorRequest(res, () => deps.store.listRequests({
-            scope: authorized.installation.scope,
-            collectionKey: collection,
-            ...paging.value,
-            ...query.value,
-            ...(status === undefined ? {} : { status: status.data }),
-            ...(assigneeSubject === undefined ? {} : { assigneeSubject }),
-            includeDeleted: url.searchParams.get('includeDeleted') === 'true',
-        }));
-        if (page === undefined)
-            return;
-        return sendJson(res, 200, {
-            ok: true,
-            data: {
-                records: page.records.map(recordToWire),
-                ...(page.nextCursor === undefined ? {} : { nextCursor: page.nextCursor }),
-            },
-        });
-    }
-    if (ref.recordId === undefined && req.method === 'POST') {
-        const authorized = await requireInstallationPermission(res, ref, identity, 'records:create', deps);
-        if (authorized === undefined)
-            return;
-        const definition = enabledCollection(res, authorized.installation, collection);
-        if (definition === undefined)
-            return;
-        if (definition.authority.authority === 'external') {
-            return unsupportedExternalOperation(res, 'create');
-        }
-        const idempotencyKey = requestIdempotencyKey(req);
-        if (idempotencyKey === undefined) {
-            return sendJson(res, 400, { error: 'Idempotency-Key header is required (1-128 characters)' });
-        }
-        const body = await readJsonBody(req, deps.maxBody);
-        if (!body.ok)
-            return sendJson(res, body.status, { error: body.error });
-        const parsed = ManagedRecordCreateRequestSchema.safeParse(body.value);
-        if (!parsed.success)
-            return invalid(res, parsed.error);
-        const result = await createNativeRecord(res, deps, {
-            installation: authorized.installation,
-            collection,
-            idempotencyKey,
-            payload: parsed.data.payload,
-            origin: { kind: 'portal' },
-            actorSubject: identity.subject,
-            admit: () => admitBusinessMutation(res, authorized.scope),
-        });
-        if (result === undefined)
-            return;
-        if (result.disposition === 'conflict')
-            return idempotencyConflict(res);
-        if (result.disposition === 'paused') {
-            return sendJson(res, 503, {
-                error: 'Record creation requires an active application.',
-                code: 'application_unavailable',
-            });
-        }
-        return sendJson(res, result.disposition === 'created' ? 201 : 200, {
-            ok: true,
-            data: { record: recordToWire(result.record) },
-        });
-    }
-    if (ref.recordId !== undefined && req.method === 'GET') {
-        const authorized = await requireInstallationPermission(res, ref, identity, 'records:read', deps);
-        if (authorized === undefined)
-            return;
-        const definition = enabledCollection(res, authorized.installation, collection);
-        if (definition === undefined)
-            return;
-        if (definition.authority.authority === 'external') {
-            const loaded = await loadExternalRecord(authorized.installation, definition, ref.recordId, deps);
-            if (loaded === undefined)
-                return sendJson(res, 503, { error: 'collection source unavailable' });
-            if (loaded.record === undefined)
-                return sendJson(res, 404, { error: 'record not found' });
-            return sendJson(res, 200, {
-                ok: true,
-                data: {
-                    record: externalRecordToWire(loaded.record, loaded.binding),
-                    collection: collectionToWire(definition),
-                },
-            });
-        }
-        const record = await deps.store.getRequest(authorized.installation.scope, collection, ref.recordId);
-        if (record === undefined)
-            return sendJson(res, 404, { error: 'record not found' });
-        return sendJson(res, 200, {
-            ok: true,
-            data: recordDetailToWire(authorized.installation, record),
-        });
-    }
-    if (ref.recordId !== undefined && req.method === 'PATCH') {
-        const body = await readJsonBody(req, deps.maxBody);
-        if (!body.ok)
-            return sendJson(res, body.status, { error: body.error });
-        const parsed = ManagedRecordMutationRequestSchema.safeParse(body.value);
-        if (!parsed.success)
-            return invalid(res, parsed.error);
-        const permission = mutationPermission(parsed.data.operation);
-        const authorized = await requireInstallationPermission(res, ref, identity, permission, deps);
-        if (authorized === undefined)
-            return;
-        const definition = enabledCollection(res, authorized.installation, collection);
-        if (definition === undefined)
-            return;
-        if (definition.authority.authority === 'external') {
-            return unsupportedExternalOperation(res, parsed.data.operation);
-        }
-        if (parsed.data.operation === 'migrate-schema') {
-            const result = await deps.store.migrateLegacyRequest({
-                scope: authorized.installation.scope,
-                collectionKey: collection,
-                id: ref.recordId,
-                expectedRevision: parsed.data.expectedRevision,
-                actorSubject: identity.subject,
-            });
-            if (!result.ok)
-                return mutationFailure(res, result);
-            return sendJson(res, 200, { ok: true, data: { record: recordToWire(result.record) } });
-        }
-        let operation;
-        if (parsed.data.operation === 'update') {
-            operation = {
-                kind: 'update',
-                payload: parsed.data.patch,
-                ...(parsed.data.unset ? { unset: parsed.data.unset } : {}),
-            };
-        }
-        else if (parsed.data.operation === 'assign') {
-            if (parsed.data.assigneeSubject !== null) {
-                const assigneeGrant = await deps.store.getGrant(authorized.installation.scope, parsed.data.assigneeSubject);
-                if (assigneeGrant === undefined ||
-                    assigneeGrant.revokedAt !== undefined ||
-                    assigneeGrant.role === 'viewer') {
-                    return sendJson(res, 422, {
-                        error: 'assignee must have an active operator grant',
-                        code: 'invalid_assignee',
-                    });
-                }
-            }
-            operation = {
-                kind: 'assign',
-                assigneeSubject: parsed.data.assigneeSubject ?? undefined,
-            };
-        }
-        else if (parsed.data.operation === 'set-status') {
-            operation = { kind: 'set_status', status: parsed.data.status };
-        }
-        else {
-            operation = { kind: 'add_note', note: parsed.data.note };
-        }
-        let result;
-        try {
-            result = await deps.store.mutateRequest({
-                scope: authorized.installation.scope,
-                collectionKey: collection,
-                id: ref.recordId,
-                expectedRevision: parsed.data.expectedRevision,
-                actorSubject: identity.subject,
-                operation,
-            });
-        }
-        catch (error) {
-            if (error instanceof PayloadValidationError) {
-                return sendJson(res, 400, { error: error.message, code: error.code });
-            }
-            throw error;
-        }
-        if (!result.ok)
-            return mutationFailure(res, result);
-        return sendJson(res, 200, { ok: true, data: { record: recordToWire(result.record) } });
-    }
-    if (ref.recordId !== undefined && req.method === 'DELETE') {
-        const authorized = await requireInstallationPermission(res, ref, identity, 'records:delete', deps);
-        if (authorized === undefined)
-            return;
-        const definition = enabledCollection(res, authorized.installation, collection);
-        if (definition === undefined)
-            return;
-        const body = await readJsonBody(req, deps.maxBody);
-        if (!body.ok)
-            return sendJson(res, body.status, { error: body.error });
-        const revision = expectedRevision(body.value);
-        if (revision === undefined) {
-            return sendJson(res, 400, { error: 'expectedRevision must be a positive integer' });
-        }
-        if (definition.authority.authority === 'external') {
-            const loaded = await loadExternalRecord(authorized.installation, definition, ref.recordId, deps);
-            if (loaded === undefined)
-                return sendJson(res, 503, { error: 'collection source unavailable' });
-            if (loaded.record === undefined)
-                return sendJson(res, 404, { error: 'record not found' });
-            const { record } = loaded;
-            if (record.revision !== revision) {
-                return sendJson(res, 409, {
-                    error: 'record revision conflict',
-                    code: 'revision_conflict',
-                    currentRevision: record.revision,
-                });
-            }
-            await deps.sourceStore?.suppressExternalRecord({
-                ...sourceBindingKey(authorized.installation, definition),
-                sourceId: record.source.id,
-                reason: 'customer_request',
-                now: now(deps),
-            });
-            const deletedAt = now(deps).toISOString();
-            return sendJson(res, 200, {
-                ok: true,
-                data: {
-                    recordId: record.id,
-                    authority: 'external',
-                    disposition: 'suppressed',
-                    deletedAt,
-                },
-            });
-        }
-        const result = await deps.store.deleteRequest({
-            scope: authorized.installation.scope,
-            collectionKey: collection,
-            id: ref.recordId,
-            expectedRevision: revision,
-            actorSubject: identity.subject,
-            reason: 'customer_request',
-        });
-        if (!result.ok)
-            return mutationFailure(res, result);
-        return sendJson(res, 200, {
-            ok: true,
-            data: {
-                recordId: result.record.id,
-                authority: 'native',
-                disposition: 'deleted',
-                deletedAt: result.record.deletedAt,
-            },
-        });
-    }
-    return methodNotAllowed(res);
-}
-export async function requireIdentity(req, res, deps) {
-    return authorizeBusinessApi(req, res, deps);
-}
-export async function requireInstallationGrant(res, ref, identity, deps, permission) {
-    if (ref.installationId === undefined)
-        return undefined;
-    const installation = await deps.store.getInstallationById(ref.org, ref.installationId);
-    if (installation === undefined) {
-        sendJson(res, 404, { error: 'installation not found' });
-        return undefined;
-    }
-    const grant = await deps.store.getGrant(installation.scope, identity.subject);
-    if (grant?.revokedAt !== undefined || grant === undefined) {
-        sendForbidden(res, 'business grant required');
-        return undefined;
-    }
-    if (permission && !businessGrantAllows(grant, permission)) {
-        sendForbidden(res, `business permission required: ${permission}`);
-        return undefined;
-    }
-    if (!(await admitBusinessTarget(res, installation.scope)))
-        return undefined;
-    return { installation, scope: installation.scope, grant };
-}
-export async function requireInstallationPermission(res, ref, identity, permission, deps) {
-    return requireInstallationGrant(res, ref, identity, deps, permission);
-}
+export { requireIdentity, requireInstallationGrant, requireInstallationPermission, } from './business-information-access.js';
+export { handleManagedRecords } from './business-information-records.js';
 export function mutationFailure(res, result) {
     const status = result.reason === 'not_found'
         ? 404

package/node_modules/@noodle-borg/service/dist/routes/business-native-lifecycle.js

@@ -0,0 +1,46 @@
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { NativeRecordLifecycleMigrateRequestSchema, NativeRecordLifecyclePreviewResponseSchema, NativeRecordLifecycleResponseSchema, } from '@noodle-borg/wire-contracts';
+import { NativeLifecycleError } from '../business-information/native-record-lifecycle.js';
+import { invalid, methodNotAllowed, requireIdentity, requireInstallationPermission, } from './business-information.js';
+export async function handleNativeRecordLifecycle(req, res, ref, deps) {
+    res.setHeader('cache-control', 'private, no-store');
+    if (req.method !== 'GET' && req.method !== 'POST')
+        return methodNotAllowed(res);
+    const identity = await requireIdentity(req, res, deps);
+    if (identity === false)
+        return;
+    const authorized = await requireInstallationPermission(res, ref, identity, 'installation:administer', deps);
+    if (!authorized)
+        return;
+    try {
+        if (req.method === 'GET') {
+            const data = await deps.store.nativeLifecycle.preview(authorized.scope, identity.subject);
+            return sendJson(res, 200, NativeRecordLifecyclePreviewResponseSchema.parse({ ok: true, data }));
+        }
+        const body = await readJsonBody(req, deps.maxBody);
+        if (!body.ok)
+            return sendJson(res, body.status, { error: body.error });
+        const parsed = NativeRecordLifecycleMigrateRequestSchema.safeParse(body.value);
+        if (!parsed.success)
+            return invalid(res, parsed.error);
+        const data = await deps.store.nativeLifecycle.migrate({
+            scope: authorized.scope,
+            actor: identity.subject,
+            preview: parsed.data.preview,
+        });
+        return sendJson(res, 200, NativeRecordLifecycleResponseSchema.parse({ ok: true, data }));
+    }
+    catch (error) {
+        if (!(error instanceof NativeLifecycleError))
+            throw error;
+        return sendJson(res, error.code === 'lifecycle_denied' ? 403 : error.code === 'lifecycle_conflict' ? 409 : 503, {
+            code: error.code,
+            error: error.code === 'lifecycle_conflict'
+                ? 'The reviewed inventory changed or expired. Review again before applying the migration.'
+                : error.code === 'lifecycle_denied'
+                    ? 'Current Owner or Admin permission is required.'
+                    : 'Native record lifecycle is unavailable.',
+        });
+    }
+}
+//# sourceMappingURL=business-native-lifecycle.js.map

package/node_modules/@noodle-borg/service/dist/routes/business-workspaces.js

@@ -0,0 +1,119 @@
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import { BusinessWorkspaceAcceptRequestSchema, BusinessWorkspaceInvitationRequestSchema, BusinessWorkspaceIssuedInvitationResponseSchema, BusinessWorkspaceListResponseSchema, BusinessWorkspaceMutationResponseSchema, BusinessWorkspaceResponseSchema, BusinessWorkspaceRevisionRequestSchema, BusinessWorkspaceRoleChangeRequestSchema, } from '@noodle-borg/wire-contracts';
+import { admitBusinessTarget, authorizeBusinessApi } from '../business-api-admission.js';
+import { BusinessWorkspaceError } from '../business-workspaces/contracts.js';
+import { businessWorkspaceMethod, parseBusinessWorkspacePath, } from '../business-workspaces/paths.js';
+export async function handleBusinessWorkspaceRoute(req, res, url, deps) {
+    res.setHeader('cache-control', 'private, no-store');
+    try {
+        await handle(req, res, url, deps);
+    }
+    catch (error) {
+        if (error instanceof BusinessWorkspaceError) {
+            const status = error.code === 'forbidden'
+                ? 403
+                : error.code === 'invalid_request'
+                    ? 400
+                    : error.code === 'not_found'
+                        ? 404
+                        : 409;
+            return sendJson(res, status, {
+                error: error.code.replaceAll('_', ' '),
+                code: error.code,
+                ...(error.currentRevision === undefined ? {} : { currentRevision: error.currentRevision }),
+            });
+        }
+        sendJson(res, 503, {
+            error: 'Workspace access is temporarily unavailable.',
+            code: 'workspace_unavailable',
+        });
+    }
+}
+async function handle(req, res, url, deps) {
+    if (url.pathname === '/v1/me/business-workspaces') {
+        const identity = await authorizeBusinessApi(req, res, deps);
+        if (!identity)
+            return;
+        if (req.method !== 'GET') {
+            res.setHeader('allow', 'GET');
+            return sendJson(res, 405, { error: 'method not allowed' });
+        }
+        if (new Set(url.searchParams.keys()).size !== [...url.searchParams].length)
+            return invalid(res);
+        const data = await deps.workspaces.listForSubject(identity.subject, Object.fromEntries(url.searchParams));
+        return sendJson(res, 200, BusinessWorkspaceListResponseSchema.parse({ ok: true, data }));
+    }
+    const ref = parseBusinessWorkspacePath(url.pathname);
+    if (!ref)
+        return sendJson(res, 404, { error: 'not found' });
+    const identity = await authorizeBusinessApi(req, res, deps);
+    if (!identity)
+        return;
+    const method = businessWorkspaceMethod(ref);
+    if (req.method !== method) {
+        res.setHeader('allow', method);
+        return sendJson(res, 405, { error: 'method not allowed' });
+    }
+    if ([...url.searchParams].length)
+        return invalid(res);
+    const { org } = ref;
+    if (ref.action !== 'accept') {
+        const state = await deps.workspaces.inspect(org, identity.subject);
+        if (ref.action && !state.permissions.includes('team:manage'))
+            throw new BusinessWorkspaceError('forbidden');
+        if (!(await admitBusinessTarget(res, { org })))
+            return;
+        if (!ref.action)
+            return sendJson(res, 200, BusinessWorkspaceResponseSchema.parse({ ok: true, data: state }));
+    }
+    const body = await readJsonBody(req, Math.min(deps.maxBody, 16 * 1024));
+    if (!body.ok)
+        return sendJson(res, body.status, { error: body.error });
+    if (ref.action === 'accept') {
+        const input = BusinessWorkspaceAcceptRequestSchema.safeParse(body.value);
+        if (!input.success)
+            return invalid(res);
+        const email = await deps.verifiedEmail?.(identity.subject, identity.email);
+        if (!email)
+            return sendJson(res, 403, {
+                error: 'Sign in with a verified invited email address.',
+                code: 'verified_email_required',
+            });
+        // Subject admission already ran. The opaque one-use invitation supplies authority, not the org in the URL.
+        const result = await deps.workspaces.accept({
+            org,
+            subject: identity.subject,
+            verifiedEmail: email,
+            token: input.data.token,
+        });
+        return sendJson(res, 200, BusinessWorkspaceMutationResponseSchema.parse({ ok: true, data: result }));
+    }
+    if (ref.action === 'invitations' && !ref.id) {
+        const input = BusinessWorkspaceInvitationRequestSchema.safeParse(body.value);
+        if (!input.success)
+            return invalid(res);
+        const result = await deps.workspaces.invite({ ...input.data, org, actor: identity.subject });
+        return sendJson(res, 201, BusinessWorkspaceIssuedInvitationResponseSchema.parse({ ok: true, data: result }));
+    }
+    if (ref.action === 'invitations' && ref.id) {
+        const input = BusinessWorkspaceRevisionRequestSchema.safeParse(body.value);
+        if (!input.success)
+            return invalid(res);
+        const result = await deps.workspaces.revokeInvitation({
+            ...input.data,
+            org,
+            actor: identity.subject,
+            invitationId: ref.id,
+        });
+        return sendJson(res, 200, BusinessWorkspaceMutationResponseSchema.parse({ ok: true, data: result }));
+    }
+    const input = BusinessWorkspaceRoleChangeRequestSchema.safeParse(body.value);
+    if (!input.success)
+        return invalid(res);
+    const result = await deps.workspaces.changeRole({ ...input.data, org, actor: identity.subject });
+    return sendJson(res, 200, BusinessWorkspaceMutationResponseSchema.parse({ ok: true, data: result }));
+}
+function invalid(res) {
+    return sendJson(res, 400, { error: 'Invalid workspace request.', code: 'invalid_request' });
+}
+//# sourceMappingURL=business-workspaces.js.map

package/node_modules/@noodle-borg/service/dist/routes/service-probes.js

@@ -16,7 +16,8 @@ function handleServiceProbe(req, res, url, { tls, moduleHost, buildInfo, options
         applySecurityHeaders(res, tls);
         if (url.pathname === '/healthz')
             return sendJson(res, 200, { status: 'ok' });
-        void Promise.resolve(moduleHost.ready())
+        void Promise.resolve()
+            .then(() => moduleHost.ready())
             .then((ready) => sendJson(res, ready ? 200 : 503, { status: ready ? 'ready' : 'unready' }))
             .catch(() => sendJson(res, 503, { status: 'unready' }));
         return;

package/node_modules/@noodle-borg/service/dist/service.js

@@ -36,6 +36,7 @@ import { handleAppArchive, handleAppRestore } from './routes/archive.js';
 import { handleAssetPreflight } from './routes/asset-control-plane.js';
 import { dispatchAssistantRoutes } from './routes/assistant-dispatch.js';
 import { dispatchAuthDiscoveryRoute } from './routes/auth-discovery.js';
+import { dispatchBusinessAuthoringRoutes } from './routes/business-authoring-dispatch.js';
 import { dispatchBusinessInformationRoutes } from './routes/business-information-dispatch.js';
 import { dispatchConfigValueRequest } from './routes/config-values-dispatch.js';
 import { authorizeTenantControl, handleDeploymentStatus, handleWhoami, } from './routes/control-plane.js';
@@ -294,15 +295,21 @@ export function createServiceHandler(registry, options = {}) {
         }
         if (servicePrincipalDispatcher?.(req, res, url))
             return;
+        if (dispatchBusinessAuthoringRoutes(req, res, url, options.businessAuthoring, {
+            gate,
+            publicCounters,
+            maxBody: maxDeployBody,
+            tls,
+        }))
+            return;
         if (businessInformationStore !== undefined &&
             options.businessInformationEnabled !== false &&
             dispatchBusinessInformationRoutes(req, res, url, {
-                authoring: options.businessAuthoring,
                 pageOrigin: options.businessPageOrigin,
                 pageServiceUrl: options.publicBaseUrl,
-                maxDraftBody: maxDeployBody,
                 ...(whatsapp ? { readWhatsApp: whatsapp.projection.bind(whatsapp) } : {}),
                 store: businessInformationStore,
+                ...(options.businessAuthoring ? { workspaces: options.businessAuthoring.workspaces } : {}),
                 ...(businessOnboarding ? { businessOnboarding } : {}),
                 activateInstallation,
                 readInstallationActivation,

package/node_modules/@noodle-borg/service/dist/web-capabilities.js

@@ -30,7 +30,9 @@ export function deploymentWebConnector(artifact, tenant, deploymentId, service)
                 }, call.caller).allow,
             anonymous: call.caller === undefined || call.caller.identityKind === 'anonymous',
             ...(call.caller === undefined ? {} : { subject: call.caller.subject }),
-            ...(call.publicAdmission === undefined ? {} : { network: call.publicAdmission.network }),
+            ...(call.publicAdmission?.network === undefined
+                ? {}
+                : { network: call.publicAdmission.network }),
             budget: call.capabilityBudget,
             ...(call.signal === undefined ? {} : { signal: call.signal }),
         });

package/node_modules/@noodle-borg/service/package.json

@@ -37,10 +37,11 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
+    "@noodle-borg/authoring": "0.0.0",
     "@noodle-borg/managed-capabilities": "0.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.106.0",
+    "@noodle-borg/agent-kit": "0.107.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",