aimeat 1.20.0 → 1.20.2

package/dist/src/middleware/workspace-access.js

@@ -75,23 +75,60 @@ export function workspaceAccessMiddleware(config, storage) {
         // agent sessions below still require a matching grant. This is what lets a logged-in human use
         // their own project workspace from the UI without provisioning an agent-owned consent.
         const isHumanOwnerSession = (req.auth?.roles ?? []).includes('owner') && !(req.auth?.roles ?? []).includes('agent');
-        // Consent needed unless writing your own member namespace, or you're the human owner-principal.
-        const needsConsent = !isOwnMemberNamespace && !isHumanOwnerSession;
-        if (needsConsent) {
-            // Look up all agents for this owner
-            const agents = await storage.getAgentsByOwner(ownerName);
-            if (agents.length === 0) {
-                res.status(403).json(error(config.nodeId, 'CONSENT_REQUIRED', 'No agent found — consent cannot be verified'));
-                return;
+        // An AGENT of the workspace's OWN creator (same owner) is the creator's tool — like the human owner
+        // session, it does not consent to itself. Without this, a same-owner sub-agent (e.g. a CrewAI crew)
+        // could not write to its owner's organism workspace at all. Cross-owner member agents still need a
+        // granted 'workspace-contribution' consent. Scoped to workspace keys (organism.{id}.w.{ws}.*).
+        let isOwnWorkspaceAgent = false;
+        let wsCreator = null;
+        const wsMatch = key.match(/^organism\.[^.]+\.w\.([^.]+)\./);
+        const wsId = wsMatch ? wsMatch[1] : null;
+        if (wsId && !isHumanOwnerSession) {
+            const regKey = `organism.${organismId}.meta.workspaces`;
+            const { items } = await storage.listAllMemory({ prefix: regKey, limit: 1000 });
+            for (const rec of items) {
+                if (rec.key !== regKey)
+                    continue;
+                const list = rec.value?.workspaces ?? [];
+                const entry = list.find(w => w.id === wsId);
+                if (entry) {
+                    wsCreator = entry.createdBy ?? (rec.ownerGaii.includes('#') ? rec.ownerGaii.split('#')[1] : rec.ownerGaii).split('@')[0];
+                    if (wsCreator === ownerName)
+                        isOwnWorkspaceAgent = true;
+                    break;
+                }
             }
-            // Check if ANY of the owner's agents have a matching active consent
-            const accessorPattern = `organism.${organismId}`;
+        }
+        // Consent needed unless writing your own member namespace, you're the human owner-principal, or
+        // you're an agent of the workspace's own creator.
+        const needsConsent = !isOwnMemberNamespace && !isHumanOwnerSession && !isOwnWorkspaceAgent;
+        if (needsConsent) {
             let hasConsent = false;
-            for (const agent of agents) {
-                const matching = await storage.findMatchingConsents(agent.gaii, key, accessorPattern);
-                if (matching.length > 0) {
-                    hasConsent = true;
-                    break;
+            if (wsId) {
+                // Workspace CONTENT (organism.{id}.w.{ws}.*): write requires the creator's 'contributor' ROLE
+                // grant — and only that, so the creator can revoke write by removing the grant. A 'viewer' grant
+                // gives read only (not matched here). The role is granted to the OWNER (recipient ghii:owner@node),
+                // so all the owner's agents inherit it. (Unlike the writer's own request-time consent, a
+                // creator-owned grant is revocable by the creator.)
+                if (wsCreator) {
+                    const creatorGhii = `${wsCreator}@${config.nodeId}`;
+                    const recipient = `ghii:${ownerName}@${config.nodeId}`;
+                    const pattern = `organism.${organismId}.w.${wsId}.**`;
+                    const grants = await storage.listConsents(creatorGhii, { status: 'active' });
+                    hasConsent = grants.some(c => c.purpose === 'workspace-contributor' && c.dataPattern === pattern && c.recipient === recipient);
+                }
+            }
+            else {
+                // Flat organism namespace (organism.{id}.shared.* etc.): the writer's own contribution consent,
+                // owned by the member's OWNER GHII or one of their agents (whichever made the grant).
+                const ownerGhii = `${ownerName}@${config.nodeId}`;
+                const agents = await storage.getAgentsByOwner(ownerName);
+                const accessorPattern = `organism.${organismId}`;
+                for (const accessor of [ownerGhii, ...agents.map(a => a.gaii)]) {
+                    if ((await storage.findMatchingConsents(accessor, key, accessorPattern)).length > 0) {
+                        hasConsent = true;
+                        break;
+                    }
                 }
             }
             if (!hasConsent) {

package/dist/src/middleware/workspace-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-access.js","sourceRoot":"","sources":["../../../src/middleware/workspace-access.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAoB,EACpB,OAAgB;IAEhB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,kCAAkC;QAClC,4DAA4D;QAC5D,MAAM,GAAG,GAAI,GAAG,CAAC,MAAiC,CAAC,GAAG,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QAExB,2CAA2C;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAE1B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QAElC,sDAAsD;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,8CAA8C,CAAC,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,uBAAuB,UAAU,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,+DAA+D;YAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,UAAU,UAAU,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,iCAAiC;YACjC,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,UAAU,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3F,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,mDAAmD,CAAC,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAEzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,+BAA+B,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,qFAAqF;QACrF,wFAAwF;QACxF,mFAAmF;QACnF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,uCAAuC,CAAC,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,uDAAuD;QACvD,+BAA+B;QAC/B,4EAA4E;QAC5E,2BAA2B;QAC3B,oDAAoD;QACpD,4DAA4D;QAC5D,MAAM,eAAe,GAAG,YAAY,UAAU,WAAW,SAAS,GAAG,CAAC;QACtE,MAAM,oBAAoB,GAAG,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAE7D,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,mBAAmB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEpH,gGAAgG;QAChG,MAAM,YAAY,GAAG,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,CAAC;QAEnE,IAAI,YAAY,EAAE,CAAC;YACjB,oCAAoC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAEzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,6CAA6C,CAAC,CAAC,CAAC;gBAC9G,OAAO;YACT,CAAC;YAED,oEAAoE;YACpE,MAAM,eAAe,GAAG,YAAY,UAAU,EAAE,CAAC;YACjD,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;gBACtF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAC1D,+DAA+D,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,UAAU,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5F,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC,CAAC;gBACxG,OAAO;YACT,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,IAAI,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,6CAA6C,CAAC,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-access.js","sourceRoot":"","sources":["../../../src/middleware/workspace-access.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAoB,EACpB,OAAgB;IAEhB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,kCAAkC;QAClC,4DAA4D;QAC5D,MAAM,GAAG,GAAI,GAAG,CAAC,MAAiC,CAAC,GAAG,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QAExB,2CAA2C;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAE1B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QAElC,sDAAsD;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,8CAA8C,CAAC,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,uBAAuB,UAAU,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,+DAA+D;YAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,UAAU,UAAU,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,iCAAiC;YACjC,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,UAAU,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3F,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,mDAAmD,CAAC,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAEzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,+BAA+B,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,qFAAqF;QACrF,wFAAwF;QACxF,mFAAmF;QACnF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,uCAAuC,CAAC,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,uDAAuD;QACvD,+BAA+B;QAC/B,4EAA4E;QAC5E,2BAA2B;QAC3B,oDAAoD;QACpD,4DAA4D;QAC5D,MAAM,eAAe,GAAG,YAAY,UAAU,WAAW,SAAS,GAAG,CAAC;QACtE,MAAM,oBAAoB,GAAG,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAE7D,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,mBAAmB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEpH,oGAAoG;QACpG,oGAAoG;QACpG,mGAAmG;QACnG,+FAA+F;QAC/F,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,IAAI,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,YAAY,UAAU,kBAAkB,CAAC;YACxD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM;oBAAE,SAAS;gBACjC,MAAM,IAAI,GAAI,GAAG,CAAC,KAA2E,EAAE,UAAU,IAAI,EAAE,CAAC;gBAChH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;gBAC5C,IAAI,KAAK,EAAE,CAAC;oBACV,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzH,IAAI,SAAS,KAAK,SAAS;wBAAE,mBAAmB,GAAG,IAAI,CAAC;oBACxD,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,gGAAgG;QAChG,kDAAkD;QAClD,MAAM,YAAY,GAAG,CAAC,oBAAoB,IAAI,CAAC,mBAAmB,IAAI,CAAC,mBAAmB,CAAC;QAE3F,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,IAAI,IAAI,EAAE,CAAC;gBACT,8FAA8F;gBAC9F,iGAAiG;gBACjG,oGAAoG;gBACpG,yFAAyF;gBACzF,oDAAoD;gBACpD,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,WAAW,GAAG,GAAG,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBACpD,MAAM,SAAS,GAAG,QAAQ,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBACvD,MAAM,OAAO,GAAG,YAAY,UAAU,MAAM,IAAI,KAAK,CAAC;oBACtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAC7E,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,uBAAuB,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;gBACjI,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,gGAAgG;gBAChG,sFAAsF;gBACtF,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACzD,MAAM,eAAe,GAAG,YAAY,UAAU,EAAE,CAAC;gBACjD,KAAK,MAAM,QAAQ,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAC/D,IAAI,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAAC,UAAU,GAAG,IAAI,CAAC;wBAAC,MAAM;oBAAC,CAAC;gBACpH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAC1D,+DAA+D,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,UAAU,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5F,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC,CAAC;gBACxG,OAAO;YACT,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,IAAI,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,6CAA6C,CAAC,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/routes/organisms.d.ts

@@ -26,6 +26,17 @@
  *     { zip_base64 }). See services/workspace-export.ts + workspace-import.ts.
  *   v1.7.0 -- 2026-06-09 -- Organism-level bundle: GET /:id/export (whole organism + all workspaces)
  *     + POST /organisms/import (restore as a NEW organism). See services/organism-export+import.ts.
+ *   v1.8.0 -- 2026-06-09 -- Document-space public sharing: meta.share record + GET/PUT
+ *     /:id/workspace/share (member reads, creator/admin writes) and NO-AUTH GET
+ *     /:id/workspace/public/documents + /public/document (?format=md), serving only PUBLISHED docs
+ *     the share meta marks public. Backs the public HTML markdown viewer.
+ *   v1.9.0 -- 2026-06-09 -- Creator-managed workspace member roles: viewer (read) | contributor
+ *     (read+write), as creator-owned consents. POST /:id/workspace-access/grant + /revoke; decide now
+ *     assigns a role; GET /:id/workspace-access returns members + roles. Write requires the contributor
+ *     role (revocable), so a creator can manage who writes.
+ *   v1.10.0 -- 2026-06-09 -- Workspace-level read: GET /:id/workspace authorizes once on the manifest
+ *     (creator / same-owner / a viewer|contributor grant) and then returns ALL content, not per record —
+ *     so a contributor's writes are visible to the creator + every member of a shared workspace.
  */
 import { Router } from 'express';
 import type { AimeatConfig } from '../config.js';

package/dist/src/routes/organisms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organisms.d.ts","sourceRoot":"","sources":["../../../src/routes/organisms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,MAAM,EAAO,MAAM,SAAS,CAAC;AAEtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAuC,MAAM,yBAAyB,CAAC;AA0B5F,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CA80C9E"}
+{"version":3,"file":"organisms.d.ts","sourceRoot":"","sources":["../../../src/routes/organisms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,MAAM,EAAoC,MAAM,SAAS,CAAC;AAEnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAuC,MAAM,yBAAyB,CAAC;AA0B5F,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAqlD9E"}

package/dist/src/routes/organisms.js

@@ -26,6 +26,17 @@
  *     { zip_base64 }). See services/workspace-export.ts + workspace-import.ts.
  *   v1.7.0 -- 2026-06-09 -- Organism-level bundle: GET /:id/export (whole organism + all workspaces)
  *     + POST /organisms/import (restore as a NEW organism). See services/organism-export+import.ts.
+ *   v1.8.0 -- 2026-06-09 -- Document-space public sharing: meta.share record + GET/PUT
+ *     /:id/workspace/share (member reads, creator/admin writes) and NO-AUTH GET
+ *     /:id/workspace/public/documents + /public/document (?format=md), serving only PUBLISHED docs
+ *     the share meta marks public. Backs the public HTML markdown viewer.
+ *   v1.9.0 -- 2026-06-09 -- Creator-managed workspace member roles: viewer (read) | contributor
+ *     (read+write), as creator-owned consents. POST /:id/workspace-access/grant + /revoke; decide now
+ *     assigns a role; GET /:id/workspace-access returns members + roles. Write requires the contributor
+ *     role (revocable), so a creator can manage who writes.
+ *   v1.10.0 -- 2026-06-09 -- Workspace-level read: GET /:id/workspace authorizes once on the manifest
+ *     (creator / same-owner / a viewer|contributor grant) and then returns ALL content, not per record —
+ *     so a contributor's writes are visible to the creator + every member of a shared workspace.
  */
 import { Router, raw } from 'express';
 import { v4 as uuidv4 } from 'uuid';
@@ -498,26 +509,25 @@ export function organismsRouter(config, storage) {
         // (No ws → legacy organism-level root, kept only so an un-scoped call still reads something.)
         const ws = typeof req.query.ws === 'string' ? req.query.ws : undefined;
         const nsRoot = ws ? `organism.${id}.w.${ws}.` : `organism.${id}.`;
-        // Enumerate the whole workspace by key prefix across all member identities, then
-        // access-filter: own records pass directly; others go through the shared read guard.
+        // A workspace is SHARED: authorization is at the workspace level, not per record. If the caller can
+        // read the manifest (they created it, are a same-owner agent, or hold a viewer/contributor grant —
+        // see authorizeRead/the workspace-role consents), they see ALL of the workspace's content, whoever
+        // wrote it — so a contributor's writes are visible to the creator + other members. If not, they see
+        // nothing (org membership alone is discovery-only). The manifest is the single gate record.
         const { items } = await storage.listAllMemory({ prefix: nsRoot, limit: 5000 });
-        const readable = [];
-        for (const rec of items) {
-            if (rec.ownerGaii === callerGaii) {
-                readable.push(rec);
-                continue;
+        const manRec = items.find(r => r.key === `${nsRoot}meta.manifest`);
+        let canReadWorkspace = false;
+        if (manRec) {
+            canReadWorkspace = manRec.ownerGaii === callerGaii || isSameOwner(manRec.ownerGaii, callerGaii);
+            if (!canReadWorkspace) {
+                const decision = await authorizeRead(storage, config, {
+                    ownerGaii: manRec.ownerGaii, accessorGaii: callerGaii, resourceKey: manRec.key,
+                    visibility: manRec.visibility, groupId: manRec.groupId, action: 'read',
+                });
+                canReadWorkspace = decision.allowed;
             }
-            const decision = await authorizeRead(storage, config, {
-                ownerGaii: rec.ownerGaii,
-                accessorGaii: callerGaii,
-                resourceKey: rec.key,
-                visibility: rec.visibility,
-                groupId: rec.groupId,
-                action: 'read',
-            });
-            if (decision.allowed)
-                readable.push(rec);
         }
+        const readable = canReadWorkspace ? items : [];
         const byKey = new Map(readable.map(r => [r.key, r]));
         const manifestRec = byKey.get(`${nsRoot}meta.manifest`);
         const manifest = manifestRec?.value ?? null;
@@ -712,7 +722,7 @@ export function organismsRouter(config, storage) {
         const man = items.find(r => r.key === mkey);
         if (!man)
             return false;
-        if (man.ownerGaii === callerGaii)
+        if (man.ownerGaii === callerGaii || isSameOwner(man.ownerGaii, callerGaii))
             return true;
         const d = await authorizeRead(storage, config, { ownerGaii: man.ownerGaii, accessorGaii: callerGaii, resourceKey: man.key, visibility: man.visibility, groupId: man.groupId, action: 'read' });
         return d.allowed;
@@ -725,6 +735,123 @@ export function organismsRouter(config, storage) {
         const now = new Date().toISOString();
         await storage.createConsent({ id: uuidv4(), ownerGaii, dataPattern, recipient, purpose, scope: 'private', expires: null, status: 'active', grantedAt: now, revokedAt: null });
     };
+    /* ══ Workspace member roles (creator-managed) ══
+     * A workspace creator grants approved members one of two roles, as a consent the creator OWNS on
+     * organism.{id}.w.{ws}.** (so reads resolve via the creator + revoking is clean):
+     *   - viewer       → read only          (purpose 'workspace-viewer')
+     *   - contributor  → read + write       (purpose 'workspace-contributor')
+     * Reads honor ANY grant (viewer/contributor + the legacy 'workspace-access'); writes honor contributor
+     * (the write gate also accepts the legacy requester-owned 'workspace-contribution'). Members are an
+     * OWNER (+ their agents): the recipient is `ghii:owner@node`, so all the owner's agents inherit. */
+    const WS_ROLE_PURPOSES = ['workspace-viewer', 'workspace-contributor', 'workspace-access'];
+    const wsPattern = (id, ws) => `organism.${id}.w.${ws}.**`;
+    const recipientOf = (grantee) => `ghii:${parseGaiiLoose(grantee).owner || grantee}@${config.nodeId}`;
+    /** Set a member's role: revoke any prior workspace-role consent for them, then grant the new one. */
+    const setWorkspaceRole = async (creatorGhii, id, ws, grantee, role) => {
+        const recipient = recipientOf(grantee);
+        const pattern = wsPattern(id, ws);
+        const now = new Date().toISOString();
+        const prior = (await storage.listConsents(creatorGhii, { status: 'active' })).filter(c => c.dataPattern === pattern && c.recipient === recipient && WS_ROLE_PURPOSES.includes(c.purpose));
+        for (const g of prior)
+            await storage.updateConsent(g.id, { status: 'revoked', revokedAt: now });
+        await storage.createConsent({ id: uuidv4(), ownerGaii: creatorGhii, dataPattern: pattern, recipient, purpose: role === 'contributor' ? 'workspace-contributor' : 'workspace-viewer', scope: 'private', expires: null, status: 'active', grantedAt: now, revokedAt: null });
+        return recipient;
+    };
+    const revokeWorkspaceRole = async (creatorGhii, id, ws, grantee) => {
+        const recipient = recipientOf(grantee);
+        const pattern = wsPattern(id, ws);
+        const now = new Date().toISOString();
+        const grants = (await storage.listConsents(creatorGhii, { status: 'active' })).filter(c => c.dataPattern === pattern && c.recipient === recipient && WS_ROLE_PURPOSES.includes(c.purpose));
+        for (const g of grants)
+            await storage.updateConsent(g.id, { status: 'revoked', revokedAt: now });
+        return grants.length;
+    };
+    /** Map the creator's active grants → each member's current role for a workspace. */
+    const memberRolesForWs = async (creatorGhii, id, ws) => {
+        const pattern = wsPattern(id, ws);
+        const byOwner = new Map();
+        for (const c of await storage.listConsents(creatorGhii, { status: 'active' })) {
+            if (c.dataPattern !== pattern || !WS_ROLE_PURPOSES.includes(c.purpose))
+                continue;
+            const owner = c.recipient.replace(/^ghii:/, '').split('@')[0];
+            if (c.purpose === 'workspace-contributor')
+                byOwner.set(owner, 'contributor');
+            else if (!byOwner.has(owner))
+                byOwner.set(owner, 'viewer');
+        }
+        return byOwner;
+    };
+    const readShareMeta = async (id, ws) => {
+        const key = `organism.${id}.w.${ws}.meta.share`;
+        const { items } = await storage.listAllMemory({ prefix: key, limit: 10 });
+        const v = items.find(r => r.key === key)?.value ?? {};
+        return { public: !!v.public, spaces: v.spaces ?? {}, docs: v.docs ?? {} };
+    };
+    const isDocPublic = (share, typeName, docId) => {
+        const docKey = `${typeName}/${docId}`;
+        if (docKey in share.docs)
+            return !!share.docs[docKey];
+        if (typeName in share.spaces)
+            return !!share.spaces[typeName];
+        return !!share.public;
+    };
+    /** Read a workspace's manifest value regardless of which member owns it (public path — no auth). */
+    const readWsManifestValue = async (id, ws) => {
+        const key = `organism.${id}.w.${ws}.meta.manifest`;
+        const { items } = await storage.listAllMemory({ prefix: key, limit: 10 });
+        return items.find(r => r.key === key)?.value ?? null;
+    };
+    /** Collect the PUBLISHED (.latest) document-space pages that the share meta marks public. An optional
+     *  filter narrows to one {type,id}. Drafts/versions are never included. */
+    const collectPublicDocs = async (id, ws, share, filter) => {
+        const manifest = await readWsManifestValue(id, ws);
+        if (!manifest)
+            return [];
+        const objectTypes = manifest.objectTypes ?? [];
+        const root = `organism.${id}.w.${ws}`;
+        const out = [];
+        for (const ot of objectTypes) {
+            const name = typeof ot.name === 'string' ? ot.name : undefined;
+            const namespace = typeof ot.namespace === 'string' ? ot.namespace : undefined;
+            if (!name || !namespace || ot.mode !== 'document')
+                continue;
+            if (filter && filter.type !== name)
+                continue;
+            const nsPrefix = `${root}.${namespace}.`;
+            const { items } = await storage.listAllMemory({ prefix: nsPrefix, limit: 5000 });
+            for (const r of items) {
+                if (!r.key.startsWith(nsPrefix))
+                    continue;
+                const parts = r.key.slice(nsPrefix.length).split('.');
+                const docId = parts[0];
+                if (parts.slice(1).join('.') !== 'latest')
+                    continue; // only published
+                if (filter && filter.id !== docId)
+                    continue;
+                if (!isDocPublic(share, name, docId))
+                    continue;
+                const v = r.value;
+                out.push({
+                    type: name, id: docId,
+                    title: (v && typeof v.title === 'string') ? v.title : docId,
+                    markdown: (v && typeof v.markdown === 'string') ? v.markdown : '',
+                });
+            }
+        }
+        return out;
+    };
+    /** Render a list of public docs as a single markdown document (for ?format=md). */
+    const docsToMarkdown = (wsName, docs) => {
+        const parts = [];
+        if (wsName)
+            parts.push(`# ${wsName}\n`);
+        for (const d of docs) {
+            parts.push(`## ${d.title}\n`);
+            parts.push(d.markdown.trim());
+            parts.push('\n---\n');
+        }
+        return parts.join('\n');
+    };
     /* ── GET /v1/organisms/:id/workspaces — discover every workspace in the org (membership-gated,
      * names + creator + your access status). Discovery is open to members; content stays gated. ── */
     router.get('/v1/organisms/:id/workspaces', requireAuth(), async (req, res) => {
@@ -840,15 +967,15 @@ export function organismsRouter(config, storage) {
             return;
         }
         const creatorGhii = `${createdBy}@${config.nodeId}`;
-        const grants = (await storage.listConsents(creatorGhii, { status: 'active' })).filter(c => c.dataPattern === `organism.${id}.w.${ws}.**` && c.purpose === 'workspace-access');
-        const approved = new Set(grants.map(c => c.recipient));
+        const roles = await memberRolesForWs(creatorGhii, id, ws); // owner → 'viewer' | 'contributor'
         const { items } = await storage.listAllMemory({ prefix: `organism.${id}.w.${ws}.access.request.`, limit: 1000 });
         const requests = items.map(r => {
             const v = r.value;
             const requester = v.requester ?? bareOwner(r.ownerGaii);
-            return { requester, message: v.message ?? '', created_at: v.createdAt, status: approved.has(`ghii:${requester}@${config.nodeId}`) ? 'approved' : 'pending' };
+            return { requester, message: v.message ?? '', created_at: v.createdAt, status: roles.has(requester) ? 'approved' : 'pending', role: roles.get(requester) ?? null };
         });
-        res.json(success(config.nodeId, { ws, requests }));
+        const members = [...roles.entries()].map(([owner, role]) => ({ owner, role }));
+        res.json(success(config.nodeId, { ws, requests, members }));
     });
     /* ── POST /v1/organisms/:id/workspace-access/decision — the workspace creator approves or denies a
      * request. Approve → grant the requester read access to the workspace's content. Body:
@@ -881,23 +1008,23 @@ export function organismsRouter(config, storage) {
             res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the workspace creator or an org admin can decide access'));
             return;
         }
-        const creatorGhii = resolveIdentity(req.auth, config.nodeId);
-        const recipient = `ghii:${requester}@${config.nodeId}`;
-        const pattern = `organism.${id}.w.${ws}.**`;
+        // Grants are owned by the WORKSPACE CREATOR (not the deciding admin), so reads resolve via the
+        // creator who owns the content. Approve assigns a role (default contributor; the body may ask for
+        // 'viewer'); deny revokes every workspace-role grant for the requester.
+        const wsCreatorGhii = `${createdBy}@${config.nodeId}`;
         if (decision === 'approve') {
-            await ensureConsent(creatorGhii, pattern, recipient, 'workspace-access');
+            const role = (req.body?.role === 'viewer' ? 'viewer' : 'contributor');
+            await setWorkspaceRole(wsCreatorGhii, id, ws, requester, role);
             await notify(storage, `${requester}@${config.nodeId}`, {
                 type: 'workspace_access_approved',
-                title: `Your access to "${entry.name ?? ws}" was approved`,
+                title: `Your access to "${entry.name ?? ws}" was approved (${role})`,
                 link: '/v1/profile#organisms',
             });
             emitChange('notifications');
-            res.json(success(config.nodeId, { status: 'approved', ws, requester }));
+            res.json(success(config.nodeId, { status: 'approved', ws, requester, role }));
         }
         else {
-            const grants = (await storage.listConsents(creatorGhii, { status: 'active' })).filter(c => c.dataPattern === pattern && c.recipient === recipient && c.purpose === 'workspace-access');
-            for (const g of grants)
-                await storage.updateConsent(g.id, { status: 'revoked', revokedAt: new Date().toISOString() });
+            await revokeWorkspaceRole(wsCreatorGhii, id, ws, requester);
             await notify(storage, `${requester}@${config.nodeId}`, {
                 type: 'workspace_access_denied',
                 title: `Your access request to "${entry.name ?? ws}" was declined`,
@@ -907,6 +1034,75 @@ export function organismsRouter(config, storage) {
             res.json(success(config.nodeId, { status: 'denied', ws, requester }));
         }
     });
+    /** Shared gate for the grant/revoke routes — returns the workspace creator's name, or sends the
+     *  error response and returns null. Only the workspace creator or an org admin may manage access. */
+    const requireWsManager = async (req, res, id, ws) => {
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return null;
+        }
+        const callerRole = await memberRole(req, organism, id);
+        if (!callerRole) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Not an active member of this organism'));
+            return null;
+        }
+        if (!ws || typeof ws !== 'string') {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'ws is required'));
+            return null;
+        }
+        const entry = await findWsEntry(id, ws);
+        if (!entry) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Workspace not found'));
+            return null;
+        }
+        const createdBy = entry.createdBy ?? bareOwner(entry.ownerGaii);
+        if (createdBy !== req.auth.owner && callerRole !== 'creator' && callerRole !== 'admin') {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the workspace creator or an org admin can manage access'));
+            return null;
+        }
+        return createdBy;
+    };
+    /* ── POST /v1/organisms/:id/workspace-access/grant — creator/admin DIRECTLY adds a member with a role
+     * (no prior request). Body: { ws, grantee, role: 'viewer' | 'contributor' }. grantee may be an owner
+     * name, GHII, or GAII — the grant applies to that OWNER (so all their agents inherit it). ── */
+    router.post('/v1/organisms/:id/workspace-access/grant', requireAuth(), async (req, res) => {
+        const id = req.params.id;
+        const { ws, grantee, role } = req.body ?? {};
+        if (!grantee || typeof grantee !== 'string' || (role !== 'viewer' && role !== 'contributor')) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', "grantee and role ('viewer' | 'contributor') are required"));
+            return;
+        }
+        const createdBy = await requireWsManager(req, res, id, ws);
+        if (!createdBy)
+            return;
+        const granteeOwner = parseGaiiLoose(grantee).owner || grantee;
+        if (granteeOwner === createdBy) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'The creator already has full access to their workspace'));
+            return;
+        }
+        await setWorkspaceRole(`${createdBy}@${config.nodeId}`, id, ws, grantee, role);
+        await notify(storage, `${granteeOwner}@${config.nodeId}`, {
+            type: 'workspace_access_granted', title: `You were added to "${ws}" as ${role}`, link: '/v1/profile#organisms',
+        });
+        emitChange('notifications');
+        res.json(success(config.nodeId, { ws, grantee: granteeOwner, role }));
+    });
+    /* ── POST /v1/organisms/:id/workspace-access/revoke — creator/admin removes a member's access.
+     * Body: { ws, grantee }. ── */
+    router.post('/v1/organisms/:id/workspace-access/revoke', requireAuth(), async (req, res) => {
+        const id = req.params.id;
+        const { ws, grantee } = req.body ?? {};
+        if (!grantee || typeof grantee !== 'string') {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'grantee is required'));
+            return;
+        }
+        const createdBy = await requireWsManager(req, res, id, ws);
+        if (!createdBy)
+            return;
+        const revoked = await revokeWorkspaceRole(`${createdBy}@${config.nodeId}`, id, ws, grantee);
+        res.json(success(config.nodeId, { ws, grantee: parseGaiiLoose(grantee).owner || grantee, revoked }));
+    });
     /* ── GET /v1/organisms/:id/workspace/activity?ws= — deterministic activity feed for a workspace,
      * derived from the version history: who did what, in which space, draft-edit vs publish, when.
      * Each .version.N = a publish event; each .draft = an edit event. Member-gated; access-filtered. ── */
@@ -1075,6 +1271,7 @@ export function organismsRouter(config, storage) {
                 orgId: id, ws, callerOwner: req.auth.owner,
                 isAdmin: role === 'admin' || role === 'creator',
                 name: req.body?.name, readme: req.body?.readme,
+                addObjectTypes: Array.isArray(req.body?.add_object_types) ? req.body.add_object_types : (Array.isArray(req.body?.add_spaces) ? req.body.add_spaces : undefined),
                 manifest: req.body?.manifest, schemas: req.body?.schemas,
             });
             emitChange('organisms');
@@ -1089,6 +1286,135 @@ export function organismsRouter(config, storage) {
             res.status(500).json(error(config.nodeId, 'UPDATE_FAILED', e.message || 'Could not update the workspace'));
         }
     });
+    /* ── GET /v1/organisms/:id/workspace/public/documents?ws=&space=&format= — NO AUTH. The published
+     * document-space pages a workspace has marked public (via meta.share). ?space= limits to one space;
+     * ?format=md returns a single concatenated markdown document. 404 (no disclosure) if nothing public. ── */
+    router.get('/v1/organisms/:id/workspace/public/documents', async (req, res) => {
+        const id = req.params.id;
+        const ws = typeof req.query.ws === 'string' ? req.query.ws : '';
+        const space = typeof req.query.space === 'string' ? req.query.space : undefined;
+        const organism = await storage.getOrganism(id);
+        if (!organism || !ws) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Not found'));
+            return;
+        }
+        const share = await readShareMeta(id, ws);
+        let docs = await collectPublicDocs(id, ws, share);
+        if (space)
+            docs = docs.filter(d => d.type === space);
+        if (docs.length === 0) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'No public documents'));
+            return;
+        }
+        if (req.query.format === 'md') {
+            const entry = await findWsEntry(id, ws);
+            res.type('text/markdown; charset=utf-8').send(docsToMarkdown(entry?.name, docs));
+            return;
+        }
+        res.json(success(config.nodeId, { organism_id: id, ws, documents: docs }));
+    });
+    /* ── GET /v1/organisms/:id/workspace/public/document?ws=&type=&id=&format= — NO AUTH. A single
+     * published+public document-space page. ?format=md returns its raw markdown. 404 otherwise. ── */
+    router.get('/v1/organisms/:id/workspace/public/document', async (req, res) => {
+        const id = req.params.id;
+        const ws = typeof req.query.ws === 'string' ? req.query.ws : '';
+        const type = typeof req.query.type === 'string' ? req.query.type : '';
+        const docId = typeof req.query.id === 'string' ? req.query.id : '';
+        const organism = await storage.getOrganism(id);
+        if (!organism || !ws || !type || !docId) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Not found'));
+            return;
+        }
+        const share = await readShareMeta(id, ws);
+        const docs = await collectPublicDocs(id, ws, share, { type, id: docId });
+        if (docs.length === 0) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Document not found or not public'));
+            return;
+        }
+        const doc = docs[0];
+        if (req.query.format === 'md') {
+            res.type('text/markdown; charset=utf-8').send(`# ${doc.title}\n\n${doc.markdown.trim()}\n`);
+            return;
+        }
+        res.json(success(config.nodeId, { organism_id: id, ws, document: doc }));
+    });
+    /* ── GET /v1/organisms/:id/workspace/share?ws= — the current share state (for the UI toggles).
+     * Any active member may read it. ── */
+    router.get('/v1/organisms/:id/workspace/share', requireAuth(), async (req, res) => {
+        const id = req.params.id;
+        const ws = typeof req.query.ws === 'string' ? req.query.ws : '';
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        if (!ws) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'ws is required'));
+            return;
+        }
+        const role = await memberRole(req, organism, id);
+        if (!role) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Not an active member of this organism'));
+            return;
+        }
+        res.json(success(config.nodeId, { organism_id: id, ws, share: await readShareMeta(id, ws) }));
+    });
+    /* ── PUT /v1/organisms/:id/workspace/share?ws= — set the share state. Body { public?, spaces?, docs? }
+     * is MERGED into the existing meta.share. The workspace creator or an org admin only. The record is
+     * stored under the workspace creator's GHII so there is exactly one canonical share record. ── */
+    router.put('/v1/organisms/:id/workspace/share', requireAuth(), async (req, res) => {
+        const id = req.params.id;
+        const ws = typeof req.query.ws === 'string' ? req.query.ws : '';
+        const organism = await storage.getOrganism(id);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Organism not found'));
+            return;
+        }
+        if (!ws) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'ws is required'));
+            return;
+        }
+        const role = await memberRole(req, organism, id);
+        if (!role) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Not an active member of this organism'));
+            return;
+        }
+        const entry = await findWsEntry(id, ws);
+        if (!entry) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Workspace not found'));
+            return;
+        }
+        const createdBy = entry.createdBy ?? bareOwner(entry.ownerGaii);
+        if (createdBy !== req.auth.owner && role !== 'creator' && role !== 'admin') {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Only the workspace creator or an org admin can change sharing'));
+            return;
+        }
+        const body = (req.body ?? {});
+        const isBoolMap = (m) => !!m && typeof m === 'object' && !Array.isArray(m) && Object.values(m).every(v => typeof v === 'boolean');
+        if (body.spaces !== undefined && !isBoolMap(body.spaces)) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'spaces must be a map of name → boolean'));
+            return;
+        }
+        if (body.docs !== undefined && !isBoolMap(body.docs)) {
+            res.status(400).json(error(config.nodeId, 'INVALID_INPUT', 'docs must be a map of key → boolean'));
+            return;
+        }
+        const prev = await readShareMeta(id, ws);
+        const next = {
+            public: typeof body.public === 'boolean' ? body.public : prev.public,
+            spaces: { ...prev.spaces, ...(body.spaces ?? {}) },
+            docs: { ...prev.docs, ...(body.docs ?? {}) },
+        };
+        const key = `organism.${id}.w.${ws}.meta.share`;
+        const existing = (await storage.listAllMemory({ prefix: key, limit: 10 })).items.find(r => r.key === key);
+        const now = new Date().toISOString();
+        await storage.setMemory({
+            key, ownerGaii: entry.ownerGaii, value: next, visibility: 'private', tags: ['share'], ttlHours: null,
+            version: existing ? existing.version + 1 : 1, createdAt: existing?.createdAt ?? now, updatedAt: now,
+        });
+        emitChange('organisms');
+        res.json(success(config.nodeId, { organism_id: id, ws, share: next }));
+    });
     /* ── GET /v1/organisms/:id/workspace/export?ws= — download a full-fidelity ZIP backup of a
      * workspace (workspace.json + images/). The workspace creator (or an org admin) only. ── */
     router.get('/v1/organisms/:id/workspace/export', requireAuth(), async (req, res) => {