refactor(api): rename workspace-api authority to server-api

Absorb the Server HTTP DTO catalog and generators into server-api, remove the obsolete workspace-api package/path, preserve the separate runtime transport authority through explicit boundary DTO conversions, and rename the aggregate frontend projection as a bounded legacy artifact.

crates/workspace-server/Cargo.toml

@@ -12,7 +12,7 @@ path = "src/main.rs"
 
 [features]
 default = ["typescript"]
-typescript = ["dep:ts-rs", "workspace-api/typescript"]
+typescript = ["dep:ts-rs", "server-api/typescript"]
 
 [dependencies]
 async-trait.workspace = true
@@ -42,7 +42,6 @@ tokio = { workspace = true, features = ["fs", "macros", "net", "rt-multi-thread"
 tower.workspace = true
 tokio-tungstenite = { workspace = true, features = ["rustls-tls-webpki-roots"] }
 worker.workspace = true
-workspace-api.workspace = true
 workdir = { workspace = true, features = ["http-client"] }
 worker-runtime.workspace = true
 toml.workspace = true

crates/workspace-server/src/auth.rs

@@ -1,8 +1,8 @@
 use axum::http::{HeaderMap, header};
 use chrono::{DateTime, Duration, Utc};
+pub use server_api::{ActorAuthMethod, AuthPublicConfig, AuthenticatedUser, RequestActor};
 use sha2::{Digest, Sha256};
 use uuid::Uuid;
-pub use workspace_api::{ActorAuthMethod, AuthPublicConfig, AuthenticatedUser, RequestActor};
 
 use crate::{Error, Result, store::ControlPlaneStore};
 

crates/workspace-server/src/companion.rs

@@ -1,9 +1,9 @@
-use workspace_api::{
+use server_api::{
     CompanionLifecycleState, CompanionMessageDisposition, CompanionTransportSummary, Diagnostic,
     DiagnosticSeverity,
 };
 
-pub use workspace_api::{
+pub use server_api::{
     CompanionCancelRequest, CompanionMessageRequest, CompanionMessageResponse,
     CompanionStatusResponse, CompanionTranscriptProjection,
 };

crates/workspace-server/src/hosts.rs

@@ -275,12 +275,12 @@ pub struct WorkerSummary {
     pub diagnostics: Vec<RuntimeDiagnostic>,
 }
 
-impl From<RuntimeDiagnostic> for workspace_api::Diagnostic {
+impl From<RuntimeDiagnostic> for server_api::Diagnostic {
     fn from(diagnostic: RuntimeDiagnostic) -> Self {
         let severity = match diagnostic.severity {
-            DiagnosticSeverity::Info => workspace_api::DiagnosticSeverity::Info,
-            DiagnosticSeverity::Warning => workspace_api::DiagnosticSeverity::Warning,
-            DiagnosticSeverity::Error => workspace_api::DiagnosticSeverity::Error,
+            DiagnosticSeverity::Info => server_api::DiagnosticSeverity::Info,
+            DiagnosticSeverity::Warning => server_api::DiagnosticSeverity::Warning,
+            DiagnosticSeverity::Error => server_api::DiagnosticSeverity::Error,
         };
         Self {
             code: diagnostic.code,
@@ -290,21 +290,21 @@ impl From<RuntimeDiagnostic> for workspace_api::Diagnostic {
     }
 }
 
-impl From<RuntimeSourceSummary> for workspace_api::RuntimeSourceSummary {
+impl From<RuntimeSourceSummary> for server_api::RuntimeSourceSummary {
     fn from(source: RuntimeSourceSummary) -> Self {
         let kind = match source.kind {
             RuntimeSourceKind::EmbeddedWorkerRuntime => {
-                workspace_api::RuntimeSourceKind::EmbeddedWorkerRuntime
+                server_api::RuntimeSourceKind::EmbeddedWorkerRuntime
             }
-            RuntimeSourceKind::RemoteHttp => workspace_api::RuntimeSourceKind::RemoteHttp,
+            RuntimeSourceKind::RemoteHttp => server_api::RuntimeSourceKind::RemoteHttp,
         };
         let status = match source.status {
-            RuntimeSourceStatus::Active => workspace_api::RuntimeSourceStatus::Active,
-            RuntimeSourceStatus::Reserved => workspace_api::RuntimeSourceStatus::Reserved,
+            RuntimeSourceStatus::Active => server_api::RuntimeSourceStatus::Active,
+            RuntimeSourceStatus::Reserved => server_api::RuntimeSourceStatus::Reserved,
         };
         let identity_authority = match source.identity_authority {
             RuntimeIdentityAuthority::RuntimeRegistryProjection => {
-                workspace_api::RuntimeIdentityAuthority::RuntimeRegistryProjection
+                server_api::RuntimeIdentityAuthority::RuntimeRegistryProjection
             }
         };
         Self {
@@ -316,7 +316,7 @@ impl From<RuntimeSourceSummary> for workspace_api::RuntimeSourceSummary {
     }
 }
 
-impl From<RuntimeSummary> for workspace_api::RuntimeSummary {
+impl From<RuntimeSummary> for server_api::RuntimeSummary {
     fn from(runtime: RuntimeSummary) -> Self {
         Self {
             runtime_id: runtime.runtime_id,
@@ -336,9 +336,9 @@ impl From<RuntimeSummary> for workspace_api::RuntimeSummary {
 pub(crate) fn workspace_worker_summary(
     summary: WorkerSummary,
     resource_key: String,
-    working_directory: Option<workspace_api::WorkingDirectorySummary>,
-) -> workspace_api::WorkerSummary {
-    workspace_api::WorkerSummary {
+    working_directory: Option<server_api::WorkingDirectorySummary>,
+) -> server_api::WorkerSummary {
+    server_api::WorkerSummary {
         runtime_id: summary.worker.runtime_id,
         worker_id: summary.worker.worker_id,
         resource_key,
@@ -348,7 +348,7 @@ pub(crate) fn workspace_worker_summary(
         profile: summary.profile,
         singleton_key: summary.singleton_key,
         tags: summary.tags,
-        workspace: workspace_api::WorkerWorkspaceSummary {
+        workspace: server_api::WorkerWorkspaceSummary {
             visibility: summary.workspace.visibility,
             identity: summary.workspace.identity,
             workspace_id: summary.workspace.workspace_id,
@@ -358,11 +358,11 @@ pub(crate) fn workspace_worker_summary(
         last_seen_at: summary.last_seen_at,
         pinned: summary.pinned,
         retention_state: summary.retention_state,
-        implementation: workspace_api::WorkerImplementationSummary {
+        implementation: server_api::WorkerImplementationSummary {
             kind: summary.implementation.kind,
             display_hint: summary.implementation.display_hint,
         },
-        capabilities: workspace_api::WorkerCapabilitySummary {
+        capabilities: server_api::WorkerCapabilitySummary {
             can_stop: summary.capabilities.can_stop,
             can_spawn_followup: summary.capabilities.can_spawn_followup,
         },
@@ -374,7 +374,7 @@ pub(crate) fn workspace_worker_summary(
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(deny_unknown_fields)]
 pub struct WorkerRestoreResult {
-    pub state: workspace_api::WorkerRestoreState,
+    pub state: server_api::WorkerRestoreState,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub worker: Option<WorkerSummary>,
     pub diagnostics: Vec<RuntimeDiagnostic>,
@@ -613,7 +613,7 @@ pub enum WorkerOperationState {
     Rejected,
 }
 
-impl From<WorkerOperationState> for workspace_api::WorkerOperationState {
+impl From<WorkerOperationState> for server_api::WorkerOperationState {
     fn from(state: WorkerOperationState) -> Self {
         match state {
             WorkerOperationState::Accepted => Self::Accepted,
@@ -877,7 +877,7 @@ pub trait WorkspaceWorkerRuntime: Send + Sync {
 
     fn restore_worker(&self, worker_id: &str) -> WorkerRestoreResult {
         WorkerRestoreResult {
-            state: workspace_api::WorkerRestoreState::Rejected,
+            state: server_api::WorkerRestoreState::Rejected,
             worker: None,
             diagnostics: vec![diagnostic(
                 "worker_restore_unsupported",
@@ -2365,7 +2365,7 @@ impl WorkspaceWorkerRuntime for EmbeddedWorkerRuntime {
     fn restore_worker(&self, worker_id: &str) -> WorkerRestoreResult {
         let Some(worker_ref) = self.worker_ref(worker_id) else {
             return WorkerRestoreResult {
-                state: workspace_api::WorkerRestoreState::Rejected,
+                state: server_api::WorkerRestoreState::Rejected,
                 worker: None,
                 diagnostics: vec![diagnostic(
                     "embedded_worker_id_invalid",
@@ -2389,7 +2389,7 @@ impl WorkspaceWorkerRuntime for EmbeddedWorkerRuntime {
                 }
             }
             Err(err) => WorkerRestoreResult {
-                state: workspace_api::WorkerRestoreState::ReconciliationRequired,
+                state: server_api::WorkerRestoreState::ReconciliationRequired,
                 worker: None,
                 diagnostics: vec![embedded_runtime_diagnostic(&err)],
             },
@@ -4318,7 +4318,20 @@ impl WorkspaceWorkerRuntime for RemoteWorkerRuntime {
                     _ => Vec::new(),
                 };
                 WorkerRestoreResult {
-                    state,
+                    state: match state {
+                        runtime_api::WorkerRestoreState::Accepted => {
+                            server_api::WorkerRestoreState::Accepted
+                        }
+                        runtime_api::WorkerRestoreState::Rejected => {
+                            server_api::WorkerRestoreState::Rejected
+                        }
+                        runtime_api::WorkerRestoreState::RolledBack => {
+                            server_api::WorkerRestoreState::RolledBack
+                        }
+                        runtime_api::WorkerRestoreState::ReconciliationRequired => {
+                            server_api::WorkerRestoreState::ReconciliationRequired
+                        }
+                    },
                     worker: worker.map(|worker| self.map_worker_detail(worker)),
                     diagnostics,
                 }
@@ -4326,7 +4339,7 @@ impl WorkspaceWorkerRuntime for RemoteWorkerRuntime {
             Err(diagnostic) => WorkerRestoreResult {
                 // A transport/protocol failure cannot prove that the Runtime
                 // rejected before side effects. Preserve uncertainty.
-                state: workspace_api::WorkerRestoreState::ReconciliationRequired,
+                state: server_api::WorkerRestoreState::ReconciliationRequired,
                 worker: None,
                 diagnostics: vec![diagnostic],
             },
@@ -5769,7 +5782,7 @@ mod tests {
 
         assert_eq!(
             result.state,
-            workspace_api::WorkerRestoreState::ReconciliationRequired
+            server_api::WorkerRestoreState::ReconciliationRequired
         );
         assert!(result.worker.is_none());
         assert_eq!(result.diagnostics.len(), 1);
@@ -6206,8 +6219,8 @@ mod tests {
             repository: worker_runtime::catalog::WorkingDirectoryRepository {
                 id: "repository-1".to_string(),
                 provider: "git".to_string(),
-                source: workspace_api::RepositorySource {
-                    kind: workspace_api::RepositorySourceKind::LocalPath,
+                source: server_api::RepositorySource {
+                    kind: server_api::RepositorySourceKind::LocalPath,
                     uri: "/provider/repository.git".to_string(),
                 },
                 source_revision: 7,

crates/workspace-server/src/lib.rs

@@ -48,11 +48,11 @@ pub use server::{
     AuthConfig, ServerConfig, WorkspaceApi, WorkspaceServerApi, build_router,
     build_workspace_server_router, serve, serve_workspace_catalog,
 };
-pub use store::{ControlPlaneStore, SqliteWorkspaceStore, WorkspaceRecord};
-pub use workspace_api::{
+pub use server_api::{
     GitCommitSummary, GitRemoteSummary, GitRepositorySummary, RepositorySummary,
     WorkspaceCreateResponse,
 };
+pub use store::{ControlPlaneStore, SqliteWorkspaceStore, WorkspaceRecord};
 pub use workspace_catalog::{
     InitialRepositoryIntent, WorkspaceCatalogService, WorkspaceCreateRequest, WorkspaceCreateResult,
 };

crates/workspace-server/src/memory_staging.rs

@@ -1,6 +1,6 @@
 use memory::extract::{CandidateKind, StagingRecord};
 use memory::schema::{EvidenceOrigin, EvidenceOriginKind, SourceEvidenceRef, SourceRef};
-use workspace_api::{
+use server_api::{
     Diagnostic, DiagnosticSeverity, MemoryCandidateKind, MemoryEvidenceOrigin,
     MemoryEvidenceOriginKind, MemorySourceEvidenceRef, MemorySourceRef, MemoryStagingEntry,
     MemoryStagingEvidence, MemoryStagingListResponse, MemoryStagingRecord,

crates/workspace-server/src/profile_settings.rs

@@ -4,16 +4,16 @@ use std::path::{Component, Path, PathBuf};
 use config_source::{ConfigContentType, ConfigSchemaContribution, VirtualPath};
 use manifest::{ProfileSource, builtin_profile_catalog_snapshot, resolve_profile_artifact_value};
 use serde::Deserialize;
+use server_api::{
+    ProfileSettingsResponse, WorkspaceMetadataSettingsResponse, WorkspaceProfileSourceProvenance,
+    WorkspaceProfileSourceSummary, WorkspaceProfileSummary,
+};
 use sha2::{Digest, Sha256};
 use worker::EffectivePromptCatalog;
 use worker_runtime::config_bundle::{
     ConfigBundle, ConfigBundleMetadata, ConfigBundleProvenance, ConfigProfileDescriptor,
 };
 use worker_runtime::profile_archive::{ProfileSourceArchive, ProfileSourceArchiveInput};
-use workspace_api::{
-    ProfileSettingsResponse, WorkspaceMetadataSettingsResponse, WorkspaceProfileSourceProvenance,
-    WorkspaceProfileSourceSummary, WorkspaceProfileSummary,
-};
 
 use crate::config_source::{
     WorkspaceConfigSchemaProvider, WorkspaceConfigState, evaluate_workspace_config_state,

crates/workspace-server/src/records.rs

@@ -1,5 +1,5 @@
 use serde::{Deserialize, Serialize};
-pub use workspace_api::{
+pub use server_api::{
     ObjectiveDetail, ObjectiveEventDetail, ObjectiveLinkedTicketSummary, ObjectiveResourceSummary,
     ObjectiveSummary, QueryPage,
 };

crates/workspace-server/src/repositories.rs

@@ -4,7 +4,7 @@ use std::{
     process::Command,
 };
 
-use workspace_api::{
+use server_api::{
     Diagnostic, DiagnosticSeverity, GitCommitSummary, GitRemoteSummary, GitRepositorySummary,
     RepositoryDiagnostic, RepositoryObservedStatus, RepositorySource, RepositorySummary,
 };
@@ -629,7 +629,7 @@ mod tests {
         let projection = reader.list();
         assert_eq!(
             projection.items[0].source.kind,
-            workspace_api::RepositorySourceKind::Invalid
+            server_api::RepositorySourceKind::Invalid
         );
         let diagnostics = projection.items[0].diagnostics.as_ref().unwrap();
         assert!(diagnostics.iter().any(|diagnostic| {
@@ -642,7 +642,7 @@ mod tests {
     #[test]
     fn remote_source_is_visible_but_local_provider_operations_fail_closed() {
         let source = RepositorySource {
-            kind: workspace_api::RepositorySourceKind::Ssh,
+            kind: server_api::RepositorySourceKind::Ssh,
             uri: "git@example.test:org/repository.git".to_string(),
         };
         let reader = RepositoryRegistryReader::new(vec![ConfiguredRepository {
@@ -660,10 +660,7 @@ mod tests {
 
         let projection = reader.list();
         let summary = &projection.items[0];
-        assert_eq!(
-            summary.source.kind,
-            workspace_api::RepositorySourceKind::Ssh
-        );
+        assert_eq!(summary.source.kind, server_api::RepositorySourceKind::Ssh);
         assert_eq!(
             summary.observed_status,
             RepositoryObservedStatus::Unverified
@@ -766,7 +763,7 @@ mod tests {
         );
 
         let source_descriptor = RepositorySource {
-            kind: workspace_api::RepositorySourceKind::LocalPath,
+            kind: server_api::RepositorySourceKind::LocalPath,
             uri: path.display().to_string(),
         };
         let reader = RepositoryRegistryReader::new(vec![ConfiguredRepository {

crates/workspace-server/src/repository_access.rs

@@ -11,16 +11,16 @@ use ring::hmac;
 use ring::rand::{SecureRandom, SystemRandom};
 use rusqlite::{OptionalExtension, TransactionBehavior, params};
 use serde::Deserialize;
-use sha2::{Digest, Sha256};
-use ssh_key::private::Ed25519Keypair;
-use ssh_key::{Algorithm, HashAlg, LineEnding, PrivateKey, PublicKey};
-use workspace_api::{
+use server_api::{
     CreateRepositorySshCredentialRequest, DeleteRepositorySshCredentialRequest,
     DeleteRepositorySshHostTrustRequest, GenerateRepositorySshCredentialRequest,
     PutRepositorySshHostTrustRequest, RepositoryAccessMode, RepositoryAccessProjection,
     RepositorySshAccessBinding, RepositorySshCredential, RepositorySshHostTrust,
     RepositorySshPublicKey, RotateRepositorySshCredentialRequest,
 };
+use sha2::{Digest, Sha256};
+use ssh_key::private::Ed25519Keypair;
+use ssh_key::{Algorithm, HashAlg, LineEnding, PrivateKey, PublicKey};
 
 use crate::config_source::{
     EvaluatedConfigCandidate, WorkspaceConfigSchemaProvider, WorkspaceConfigState,
@@ -138,7 +138,7 @@ pub fn project_repository_access_state(
 
 fn validate_repository_access_source(
     repository_key: &str,
-    source: &workspace_api::RepositorySource,
+    source: &server_api::RepositorySource,
 ) -> Result<()> {
     if crate::repository_source::is_plain_http_repository_source(source) {
         return Err(Error::InvalidInput(format!(
@@ -205,7 +205,7 @@ fn project_repository_access_evaluation(
     }
     let mut bindings = Vec::with_capacity(config.repository_access.len());
     for (repository_key, access) in config.repository_access {
-        workspace_api::validate_repository_key(&repository_key)
+        server_api::validate_repository_key(&repository_key)
             .map_err(|error| Error::InvalidInput(format!("invalid Repository key: {error}")))?;
         validate_identifier("credential_id", &access.ssh.credential)?;
         validate_identifier("host_trust_id", &access.ssh.host_trust)?;
@@ -213,7 +213,7 @@ fn project_repository_access_evaluation(
             .get_repository_by_key(workspace_id, &repository_key)?
             .ok_or_else(|| Error::InvalidInput(format!("unknown Repository `{repository_key}`")))?;
         validate_repository_access_source(&repository_key, &repository.source)?;
-        if repository.source.kind != workspace_api::RepositorySourceKind::Ssh {
+        if repository.source.kind != server_api::RepositorySourceKind::Ssh {
             return Err(Error::InvalidInput(format!(
                 "Repository `{repository_key}` is not an ssh:// Repository"
             )));
@@ -1940,8 +1940,8 @@ mod tests {
         DEFAULT_SCHEMA_VERSION, SnapshotEnvironment, ToolchainContract, VirtualPath,
         WorkspaceConfigSchemaBundle,
     };
+    use server_api::{RepositoryObservedStatus, RepositorySource, RepositorySourceKind};
     use ssh_key::private::Ed25519Keypair;
-    use workspace_api::{RepositoryObservedStatus, RepositorySource, RepositorySourceKind};
 
     fn test_private_key(seed: u8) -> (String, String) {
         let key = PrivateKey::from(Ed25519Keypair::from_seed(&[seed; 32]));
@@ -1995,8 +1995,8 @@ mod tests {
         assert!(error.to_string().contains("unsupported plain HTTP"));
         assert!(error.to_string().contains("HTTPS or SSH"));
 
-        let mismatched = workspace_api::RepositorySource {
-            kind: workspace_api::RepositorySourceKind::Https,
+        let mismatched = server_api::RepositorySource {
+            kind: server_api::RepositorySourceKind::Https,
             uri: "http://git.example.test/team/project.git".to_string(),
         };
         let error = validate_repository_access_source("remote", &mismatched).unwrap_err();

crates/workspace-server/src/repository_source.rs

@@ -1,8 +1,8 @@
 use std::path::Path;
 
+use server_api::{RepositorySource, RepositorySourceKind};
 use sha2::{Digest, Sha256};
 use url::Url;
-use workspace_api::{RepositorySource, RepositorySourceKind};
 
 use crate::{Error, Result};
 

crates/workspace-server/src/skills.rs

@@ -4,12 +4,12 @@ use config_source::{
     ConfigSchemaContribution, MarkdownDocumentProjection, VirtualPath, project_markdown_document,
 };
 use serde::Deserialize;
-use worker::skill::SkillActivationResponse;
-use workspace_api::{
+use server_api::{
     SKILL_CATALOG_AUTHORITY, SkillActivationStatus, SkillCatalogEntry, SkillCatalogResponse,
     SkillDetailResponse, SkillDiagnostic, SkillDiagnosticSeverity, SkillProjectionIdentity,
     SkillProjectionStatus, SkillProvenance, SkillResourceRef, SkillSourceKind,
 };
+use worker::skill::SkillActivationResponse;
 
 use crate::config_source::{
     WorkspaceConfigSchemaProvider, WorkspaceConfigState, evaluate_workspace_config_state,

crates/workspace-server/src/store.rs

@@ -11,8 +11,8 @@ use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use uuid::Uuid;
 
+use server_api::{RepositoryObservedStatus, RepositorySource};
 use worker_runtime::identity::{RuntimeWorkerRef, WorkerId};
-use workspace_api::{RepositoryObservedStatus, RepositorySource};
 
 use crate::workspace_deletion::WorkspaceDeletionStore;
 use crate::{Error, Result};
@@ -7496,15 +7496,15 @@ fn repository_registration_intent_matches(
 }
 
 fn validate_repository_record_identity(record: &RepositoryRecord) -> Result<()> {
-    workspace_api::validate_repository_key(&record.repository_key)
+    server_api::validate_repository_key(&record.repository_key)
         .map_err(|error| Error::InvalidInput(format!("invalid Repository key: {error}")))?;
     Ok(())
 }
 
 fn read_repository_record(row: &rusqlite::Row<'_>) -> rusqlite::Result<RepositoryRecord> {
     let source_kind_value = row.get::<_, String>(5)?;
-    let source_kind = workspace_api::RepositorySourceKind::parse(&source_kind_value)
-        .unwrap_or(workspace_api::RepositorySourceKind::Invalid);
+    let source_kind = server_api::RepositorySourceKind::parse(&source_kind_value)
+        .unwrap_or(server_api::RepositorySourceKind::Invalid);
     let source_revision = row.get::<_, u64>(8)?;
     let source_fingerprint = row.get::<_, String>(9)?;
     let mut source = RepositorySource {
@@ -7517,7 +7517,7 @@ fn read_repository_record(row: &rusqlite::Row<'_>) -> rusqlite::Result<Repositor
     if source_revision == 0
         || crate::repository_source::repository_source_fingerprint(&source) != source_fingerprint
     {
-        source.kind = workspace_api::RepositorySourceKind::Invalid;
+        source.kind = server_api::RepositorySourceKind::Invalid;
         observed_status = RepositoryObservedStatus::Invalid;
     }
     Ok(RepositoryRecord {
@@ -12411,7 +12411,7 @@ mod tests {
                 kind: "git".to_string(),
                 provider: Some("git".to_string()),
                 source: RepositorySource {
-                    kind: workspace_api::RepositorySourceKind::LocalPath,
+                    kind: server_api::RepositorySourceKind::LocalPath,
                     uri: "/repo-a".to_string(),
                 },
                 default_ref: Some("HEAD".to_string()),
@@ -13255,7 +13255,7 @@ INSERT INTO worker_registry (
                 kind: "git".to_string(),
                 provider: Some("git".to_string()),
                 source: RepositorySource {
-                    kind: workspace_api::RepositorySourceKind::File,
+                    kind: server_api::RepositorySourceKind::File,
                     uri: "file:///tmp/main".to_string(),
                 },
                 default_ref: Some("develop".to_string()),
@@ -13672,8 +13672,8 @@ INSERT INTO worker_registry (
             repository_key: "Invalid_Key".to_string(),
             kind: "git".to_string(),
             provider: Some("git".to_string()),
-            source: workspace_api::RepositorySource {
-                kind: workspace_api::RepositorySourceKind::LocalPath,
+            source: server_api::RepositorySource {
+                kind: server_api::RepositorySourceKind::LocalPath,
                 uri: "/repo".to_string(),
             },
             default_ref: Some("develop".to_string()),
@@ -13723,8 +13723,8 @@ INSERT INTO worker_registry (
             repository_key: "main".to_string(),
             kind: "git".to_string(),
             provider: Some("git".to_string()),
-            source: workspace_api::RepositorySource {
-                kind: workspace_api::RepositorySourceKind::LocalPath,
+            source: server_api::RepositorySource {
+                kind: server_api::RepositorySourceKind::LocalPath,
                 uri: "/repo".to_string(),
             },
             default_ref: Some("develop".to_string()),
@@ -13798,14 +13798,14 @@ INSERT INTO worker_registry (
             kind: "git".to_string(),
             provider: Some("git".to_string()),
             source: RepositorySource {
-                kind: workspace_api::RepositorySourceKind::LocalPath,
+                kind: server_api::RepositorySourceKind::LocalPath,
                 uri: "/repo".to_string(),
             },
             default_ref: Some("HEAD".to_string()),
             source_revision: 1,
             source_fingerprint: crate::repository_source::repository_source_fingerprint(
                 &RepositorySource {
-                    kind: workspace_api::RepositorySourceKind::LocalPath,
+                    kind: server_api::RepositorySourceKind::LocalPath,
                     uri: "/repo".to_string(),
                 },
             ),
@@ -13955,7 +13955,7 @@ INSERT INTO worker_registry (
                 kind: "git".to_string(),
                 provider: Some("git".to_string()),
                 source: RepositorySource {
-                    kind: workspace_api::RepositorySourceKind::LocalPath,
+                    kind: server_api::RepositorySourceKind::LocalPath,
                     uri: "/repo".to_string(),
                 },
                 default_ref: Some("HEAD".to_string()),

crates/workspace-server/src/workdir_create_operations.rs

@@ -549,14 +549,14 @@ mod tests {
                 repository_key: "main".to_string(),
                 kind: "git".to_string(),
                 provider: Some("git".to_string()),
-                source: workspace_api::RepositorySource {
-                    kind: workspace_api::RepositorySourceKind::LocalPath,
+                source: server_api::RepositorySource {
+                    kind: server_api::RepositorySourceKind::LocalPath,
                     uri: "/tmp/main".to_string(),
                 },
                 default_ref: Some("develop".to_string()),
                 source_revision: 1,
                 source_fingerprint: "sha256:test".to_string(),
-                observed_status: workspace_api::RepositoryObservedStatus::Unverified,
+                observed_status: server_api::RepositoryObservedStatus::Unverified,
                 observed_at: None,
                 created_at: "2026-08-24T00:00:00Z".to_string(),
                 updated_at: "2026-08-24T00:00:00Z".to_string(),

crates/workspace-server/src/workdir_removal.rs

@@ -879,7 +879,7 @@ fn hex_sha256(bytes: &[u8]) -> String {
 mod tests {
     use super::*;
     use crate::store::{AccountRecord, ControlPlaneStore, RepositoryRecord, WorkspaceRecord};
-    use workspace_api::{RepositoryObservedStatus, RepositorySource, RepositorySourceKind};
+    use server_api::{RepositoryObservedStatus, RepositorySource, RepositorySourceKind};
 
     fn attempt_owner() -> WorkdirRemovalAttemptOwner {
         WorkdirRemovalAttemptOwner {

crates/workspace-server/src/workspace_catalog.rs

@@ -4,8 +4,8 @@ use chrono::{SecondsFormat, Utc};
 use sha2::{Digest, Sha256};
 use uuid::Uuid;
 
-pub use workspace_api::{InitialRepositoryIntent, WorkspaceCreateRequest};
-use workspace_api::{RepositoryObservedStatus, RepositorySource};
+pub use server_api::{InitialRepositoryIntent, WorkspaceCreateRequest};
+use server_api::{RepositoryObservedStatus, RepositorySource};
 
 use crate::repository_source::{parse_repository_source, repository_source_fingerprint};
 use crate::store::{
@@ -96,7 +96,7 @@ impl WorkspaceCatalogService {
             normalize_required("display_name", request.display_name, MAX_DISPLAY_NAME_BYTES)?;
         let repository_source = validate_repository_source(&request.repository.uri)?;
         let repository_uri = repository_source.uri.clone();
-        workspace_api::validate_repository_key(&request.repository.repository_key)
+        server_api::validate_repository_key(&request.repository.repository_key)
             .map_err(|error| Error::InvalidInput(format!("invalid Repository key: {error}")))?;
         let repository_key = request.repository.repository_key.clone();
         let default_ref = request
@@ -228,7 +228,7 @@ mod tests {
         InMemoryWorkspaceSigningMaterialStore, WorkspaceSigningMaterialStore,
         WorkspaceSigningPrivateMaterial, identity_error,
     };
-    use workspace_api::RepositorySourceKind;
+    use server_api::RepositorySourceKind;
 
     struct FailFirstMaterialWrite {
         inner: Arc<InMemoryWorkspaceSigningMaterialStore>,

crates/workspace-server/src/workspace_deletion.rs

@@ -1,7 +1,6 @@
 use chrono::Utc;
 use rusqlite::{OptionalExtension, params};
-use sha2::{Digest, Sha256};
-use workspace_api::{
+use server_api::{
     WORKSPACE_DELETION_MAX_BLOCKER_MESSAGE_BYTES, WORKSPACE_DELETION_MAX_BLOCKERS,
     WORKSPACE_DELETION_MAX_CHILD_OPERATION_IDS, WORKSPACE_DELETION_MAX_OPERATION_ID_BYTES,
     WORKSPACE_DELETION_MAX_RESOURCE_VALUE_BYTES, WORKSPACE_DELETION_MAX_REVISION_BYTES,
@@ -9,6 +8,7 @@ use workspace_api::{
     WorkspaceDeletionPreflightResponse, WorkspaceDeletionRequest, WorkspaceDeletionResourceCounts,
     WorkspaceDeletionState,
 };
+use sha2::{Digest, Sha256};
 
 use crate::store::{SqliteWorkspaceStore, WorkspaceRecord};
 use crate::{Error, Result};
@@ -200,7 +200,7 @@ impl WorkspaceDeletionStore for SqliteWorkspaceStore {
     ) -> Result<WorkspaceDeletionReservation> {
         validate_operation_id(&request.operation_id)?;
         if request.expected_revision.len() > WORKSPACE_DELETION_MAX_REVISION_BYTES
-            || request.confirmation.len() > workspace_api::WORKSPACE_DELETION_MAX_CONFIRMATION_BYTES
+            || request.confirmation.len() > server_api::WORKSPACE_DELETION_MAX_CONFIRMATION_BYTES
         {
             return Err(Error::InvalidInput(
                 "Workspace deletion request exceeds bounded field limits".to_string(),