Organisation is now SpaceWorks-Labs

.do/app.yaml

@@ -19,7 +19,7 @@ services:
   - name: web
     image:
       registry_type: GHCR
-      registry: spaceworks-hq
+      registry: spaceworks-labs
       repository: spaceworks-workspace-backend
       tag: REPLACE_WITH_IMMUTABLE_RELEASE
     http_port: 3000
@@ -40,7 +40,7 @@ jobs:
     kind: PRE_DEPLOY
     image:
       registry_type: GHCR
-      registry: spaceworks-hq
+      registry: spaceworks-labs
       repository: spaceworks-workspace-backend
       tag: REPLACE_WITH_IMMUTABLE_RELEASE
     instance_size_slug: apps-s-1vcpu-1gb
@@ -50,7 +50,7 @@ workers:
   - name: worker
     image:
       registry_type: GHCR
-      registry: spaceworks-hq
+      registry: spaceworks-labs
       repository: spaceworks-workspace-backend
       tag: REPLACE_WITH_IMMUTABLE_RELEASE
     instance_size_slug: apps-s-1vcpu-1gb
@@ -59,7 +59,7 @@ workers:
   - name: beat
     image:
       registry_type: GHCR
-      registry: spaceworks-hq
+      registry: spaceworks-labs
       repository: spaceworks-workspace-backend
       tag: REPLACE_WITH_IMMUTABLE_RELEASE
     instance_size_slug: apps-s-1vcpu-1gb

.github/workflows/release.yml

@@ -280,7 +280,7 @@ jobs:
           Secrets CLI and Node SDK (\`sww\`), same version:
 
           \`\`\`bash
-          npm install -g @spaceworks-hq/workspace-cli@$BASE
+          npm install -g @spaceworks-labs/workspace-cli@$BASE
           \`\`\`
 
           Built from \`$SHA\`.
@@ -323,9 +323,9 @@ jobs:
           BASE: ${{ needs.prepare.outputs.base }}
         run: |
           set -euo pipefail
-          printf '@spaceworks-hq:registry=https://npm.pkg.github.com\n//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' > "$RUNNER_TEMP/.npmrc"
+          printf '@spaceworks-labs:registry=https://npm.pkg.github.com\n//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' > "$RUNNER_TEMP/.npmrc"
           export NPM_CONFIG_USERCONFIG="$RUNNER_TEMP/.npmrc"
-          if npm view "@spaceworks-hq/workspace-cli@$BASE" version >/dev/null 2>&1; then echo "Already on GitHub Packages."; exit 0; fi
+          if npm view "@spaceworks-labs/workspace-cli@$BASE" version >/dev/null 2>&1; then echo "Already on GitHub Packages."; exit 0; fi
           npm publish --workspace packages/cli --ignore-scripts
       - name: Publish to npmjs.com
         env:
@@ -336,7 +336,7 @@ jobs:
           if [[ -z "$NODE_AUTH_TOKEN" ]]; then echo "No NPM_TOKEN secret; skipping npmjs.com."; exit 0; fi
           printf '//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}\n' > "$RUNNER_TEMP/.npmrc-public"
           export NPM_CONFIG_USERCONFIG="$RUNNER_TEMP/.npmrc-public"
-          if npm view "@spaceworks-hq/workspace-cli@$BASE" version --registry https://registry.npmjs.org >/dev/null 2>&1; then echo "Already on npmjs.com."; exit 0; fi
+          if npm view "@spaceworks-labs/workspace-cli@$BASE" version --registry https://registry.npmjs.org >/dev/null 2>&1; then echo "Already on npmjs.com."; exit 0; fi
           npm publish --workspace packages/cli --ignore-scripts --provenance --access public --registry https://registry.npmjs.org
 
   # Automatic deploys, for this workspace: a self-hosted runner on the VPS (see

.npmrc

@@ -1,3 +1,3 @@
 # Auth.js beta currently declares an outdated optional Nodemailer peer range.
-# Space Works Workspace uses its own SMTP transport with security-patched Nodemailer 10.0.10.
+# Space Works Workspace uses its own SMTP transport with security-patched Nodemailer 10.2.1.
 legacy-peer-deps=true

CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 Space Works Workspace is the private operating tool of the Space Works maker
 community. It is built in the open at
-[github.com/SpaceWorks-HQ/SpaceWorks-Workspace](https://github.com/SpaceWorks-HQ/SpaceWorks-Workspace)
+[github.com/SpaceWorks-Labs/SpaceWorks-Workspace](https://github.com/SpaceWorks-Labs/SpaceWorks-Workspace)
 under the AGPL-3.0-or-later licence.
 
 ## Ways to help

NOTICE

@@ -6,10 +6,10 @@ the terms of the GNU Affero General Public License as published by the Free
 Software Foundation, either version 3 of the License, or (at your option) any
 later version. See the LICENSE file for the full text.
 
-Source code: https://github.com/SpaceWorks-HQ/SpaceWorks-Workspace
+Source code: https://github.com/SpaceWorks-Labs/SpaceWorks-Workspace
 
 The Space Works name, logo and visual identity come from the Space Works
-design system (https://github.com/SpaceWorks-HQ/SpaceWorks-Design).
+design system (https://github.com/SpaceWorks-Labs/SpaceWorks-Design).
 
 Fonts in public/brand/fonts keep their own licences and are not covered by
 the AGPL (see public/brand/fonts/LICENSES):

README.md

@@ -28,9 +28,9 @@ It started with the Space Works maker community at TinkerSpace Kochi. Every
 record, file and secret stays on infrastructure you control, with separate
 workspaces, roles and an audit trail.
 
-Member-facing work lives in the sibling apps: [Space Works](https://github.com/SpaceWorks-HQ/SpaceWorks)
-for the makerspace itself, [Space Works Events](https://github.com/SpaceWorks-HQ/SpaceWorks-Events)
-for events and tickets, and [Space Works Organization](https://github.com/SpaceWorks-HQ/SpaceWorks-Organization)
+Member-facing work lives in the sibling apps: [Space Works](https://github.com/SpaceWorks-Labs/SpaceWorks)
+for the makerspace itself, [Space Works Events](https://github.com/SpaceWorks-Labs/SpaceWorks-Events)
+for events and tickets, and [Space Works Organization](https://github.com/SpaceWorks-Labs/SpaceWorks-Organization)
 for memberships.
 
 ## What you can do
@@ -153,7 +153,7 @@ Install the `sww` command line, link a repository and run your app with its
 secrets injected. Nothing is written to disk.
 
 ```bash
-npm install -g @spaceworks-hq/workspace-cli
+npm install -g @spaceworks-labs/workspace-cli
 sww login --host https://workspace.example.org
 sww init --project PROJECT_ID --env dev
 sww run --env dev -- npm run dev
@@ -174,7 +174,7 @@ Packages. To install from GitHub Packages, point the scope at it with a token
 that can read packages:
 
 ```bash
-npm config set @spaceworks-hq:registry https://npm.pkg.github.com
+npm config set @spaceworks-labs:registry https://npm.pkg.github.com
 npm config set //npm.pkg.github.com/:_authToken "$GITHUB_TOKEN"
 ```
 
@@ -199,10 +199,10 @@ On a 64-bit Linux server (Ubuntu/Debian, Fedora/RHEL/Alma/Rocky, Arch or openSUS
 as root or a user with `sudo`:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/SpaceWorks-HQ/SpaceWorks-Workspace/main/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/SpaceWorks-Labs/SpaceWorks-Workspace/main/install.sh | bash
 ```
 
-It checks the server, picks the latest [release](https://github.com/SpaceWorks-HQ/SpaceWorks-Workspace/releases)
+It checks the server, picks the latest [release](https://github.com/SpaceWorks-Labs/SpaceWorks-Workspace/releases)
 and asks every question first: the layout (by default the website and API
 containers both on this VPS, at `workspace.example.com` and `api.workspace.example.com`;
 or one app container on one hostname; or the website on Netlify), hostnames, the
@@ -299,7 +299,7 @@ flowchart LR
   worker --> mail[SMTP]
 ```
 
-[Deploy to Render](https://render.com/deploy?repo=https://github.com/SpaceWorks-HQ/SpaceWorks-Workspace).
+[Deploy to Render](https://render.com/deploy?repo=https://github.com/SpaceWorks-Labs/SpaceWorks-Workspace).
 The [cloud guide](docs/DEPLOYMENT_CLOUD.md) covers secrets, TLS, SMTP, workers,
 first-run setup and free-plan limits. [Jobs operations](docs/areas/jobs-queue.md)
 covers retries, health and recovery. Docker, AWS, DigitalOcean and Kubernetes

app/styles/tokens.css

@@ -5,7 +5,7 @@
  * shadow, and motion value used by components comes from here; components
  * never hard-code hex values.
  *
- * Source of truth: SpaceWorks-HQ/SpaceWorks-Design (`tokens/tokens.css`,
+ * Source of truth: SpaceWorks-Labs/SpaceWorks-Design (`tokens/tokens.css`,
  * `docs/ui-brand-spec.md`). The `--yy-` prefix matches Space Works Events so
  * utilities stay interchangeable between the two apps; the values are Space Works.
  * Every text/background pair below reaches WCAG AA (4.5:1); disabled text is

charts/spaceworks-workspace/Chart.yaml

@@ -5,6 +5,6 @@ type: application
 version: 0.6.6
 appVersion: "0.6.6"
 kubeVersion: ">=1.25.0-0"
-home: https://github.com/SpaceWorks-HQ/SpaceWorks-Workspace
+home: https://github.com/SpaceWorks-Labs/SpaceWorks-Workspace
 sources:
-  - https://github.com/SpaceWorks-HQ/SpaceWorks-Workspace
+  - https://github.com/SpaceWorks-Labs/SpaceWorks-Workspace

charts/spaceworks-workspace/values.yaml

@@ -6,7 +6,7 @@
 replicaCount: 2
 
 image:
-  repository: ghcr.io/spaceworks-hq/spaceworks-workspace-backend
+  repository: ghcr.io/spaceworks-labs/spaceworks-workspace-backend
   # Use an immutable tag (sha-<commit>) or a digest; defaults to the chart appVersion.
   tag: "0.1"
   pullPolicy: IfNotPresent
@@ -79,7 +79,7 @@ podDisruptionBudget:
 migration:
   enabled: true
   image:
-    repository: ghcr.io/spaceworks-hq/spaceworks-workspace-backend
+    repository: ghcr.io/spaceworks-labs/spaceworks-workspace-backend
     tag: ""
     pullPolicy: IfNotPresent
   backoffLimit: 1

docs/CONFIGURATION.md

@@ -37,7 +37,7 @@ and `ALLOW_INSECURE_PRODUCTION_TESTS=1` belongs only to disposable tests.
 | --- | --- |
 | `SWW_DIR` | Install root, `/opt/spaceworks-workspace` |
 | `SWW_CONFIG_DIR` | External secrets/config directory, `/etc/spaceworks-workspace` |
-| `SWW_REPOSITORY` | GitHub owner/repository; defaults to SpaceWorks-HQ/SpaceWorks-Workspace |
+| `SWW_REPOSITORY` | GitHub owner/repository; defaults to SpaceWorks-Labs/SpaceWorks-Workspace |
 | `SWW_RELEASE_TAG`, `SWW_REF` | Published release or source reference; choose only one |
 | `SWW_LAYOUT` | `split`, `single` or `netlify`, recorded in `compose.env` |
 | `SWW_VERSION` | Immutable release version |

docs/CONTAINER_IMAGES.md

@@ -14,8 +14,8 @@ with these roles:
 
 | Image | Dockerfile target | Roles (the container command) |
 | --- | --- | --- |
-| `ghcr.io/spaceworks-hq/spaceworks-workspace-backend` | `runner` | `node server.js` (default): the application and API. `migrate`: apply pending database migrations once and exit. `node dist/worker.js`: BullMQ consumers. `node dist/beat.js`: registry schedule reconciliation. `node docker/vps/<tool>.mjs`: the VPS operator tools (setup, SMTP and external-storage configuration, certificate renewal, super-admin recovery, preflight, checks, SMTP check, smoke test), run as root. |
-| `ghcr.io/spaceworks-hq/spaceworks-workspace-frontend` | `frontend` | `node frontend/server.js`: the website alone (the `frontend/` workspace). It holds no database, Redis, storage or mail credentials and calls the backend through the authenticated gateway. |
+| `ghcr.io/spaceworks-labs/spaceworks-workspace-backend` | `runner` | `node server.js` (default): the application and API. `migrate`: apply pending database migrations once and exit. `node dist/worker.js`: BullMQ consumers. `node dist/beat.js`: registry schedule reconciliation. `node docker/vps/<tool>.mjs`: the VPS operator tools (setup, SMTP and external-storage configuration, certificate renewal, super-admin recovery, preflight, checks, SMTP check, smoke test), run as root. |
+| `ghcr.io/spaceworks-labs/spaceworks-workspace-frontend` | `frontend` | `node frontend/server.js`: the website alone (the `frontend/` workspace). It holds no database, Redis, storage or mail credentials and calls the backend through the authenticated gateway. |
 
 Pull requests and forks' pull requests never publish.
 

docs/DEPLOYMENT_AWS.md

@@ -6,7 +6,7 @@ Launch an x86_64 or arm64 Linux instance with at least 30 GiB disk. Allow inboun
 
 ## ECS / Fargate
 
-Use `ghcr.io/spaceworks-hq/spaceworks-workspace-backend:<immutable-version>` for the web task on port 3000. An ALB terminates HTTPS and routes the website and all API routes to it. A separate rendering frontend uses its own deployment and the gateway settings in [Split hosting](DEPLOYMENT_SPLIT.md). Enable ALB idle timeouts long enough for SSE and avoid a proxy/CDN that buffers streams. Do not cache authenticated pages, Server Actions or private downloads.
+Use `ghcr.io/spaceworks-labs/spaceworks-workspace-backend:<immutable-version>` for the web task on port 3000. An ALB terminates HTTPS and routes the website and all API routes to it. A separate rendering frontend uses its own deployment and the gateway settings in [Split hosting](DEPLOYMENT_SPLIT.md). Enable ALB idle timeouts long enough for SSE and avoid a proxy/CDN that buffers streams. Do not cache authenticated pages, Server Actions or private downloads.
 
 Run a one-off task from the same backend image with command `["migrate"]` and the maintenance DIRECT_URL before rolling the web service. A failed task blocks rollout. Runtime web tasks use a restricted DB identity. Run separate private worker and beat ECS services from the same backend image
 with commands `["node", "dist/worker.js"]` and `["node", "dist/beat.js"]`.

docs/DEPLOYMENT_DOCKER.md

@@ -8,14 +8,14 @@ Terminate HTTPS at a trusted proxy; publish only a private container port.
 
 ## Images and runtime
 
-Pull an immutable `ghcr.io/spaceworks-hq/spaceworks-workspace-backend:<release>`.
+Pull an immutable `ghcr.io/spaceworks-labs/spaceworks-workspace-backend:<release>`.
 It serves the whole application by default. Run `migrate` once before the web
 rollout using an administration connection. Runtime connections should have
 only data privileges. Use TLS for PostgreSQL, Redis and custom S3 endpoints.
 
 ```bash
 export SWW_VERSION=0.1.0-main.42.a1b2c3d4e5f6
-image="ghcr.io/spaceworks-hq/spaceworks-workspace-backend:$SWW_VERSION"
+image="ghcr.io/spaceworks-labs/spaceworks-workspace-backend:$SWW_VERSION"
 docker pull "$image"
 docker run --rm --env-file /secure/workspace-migration.env "$image" migrate
 docker run -d --name spaceworks-workspace --restart unless-stopped \

docs/DEPLOYMENT_VPS.md

@@ -40,7 +40,7 @@ Use `compose.production.yml` through `scripts/vps-compose.sh`. Development and s
 As root or a user with `sudo`:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/SpaceWorks-HQ/SpaceWorks-Workspace/main/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/SpaceWorks-Labs/SpaceWorks-Workspace/main/install.sh | bash
 ```
 
 The bootstrap checks for Linux, the architecture, root or sudo and `curl`/`tar`,
@@ -209,7 +209,7 @@ public hostname. Build images locally below, or use a trusted build host and
 transfer the same versioned images to the VPS.
 
 ```bash
-git clone https://github.com/SpaceWorks-HQ/SpaceWorks-Workspace.git
+git clone https://github.com/SpaceWorks-Labs/SpaceWorks-Workspace.git
 cd SpaceWorks-Workspace
 git checkout <reviewed-commit-or-tag>
 SWW_VERSION="vps-$(git rev-parse --short HEAD)"
@@ -428,10 +428,10 @@ backup=/root/<time>
 version=$(cat "$backup/version")   # a release such as 0.1.0-main.42.<commit>, or vps-<commit>
 case "$version" in vps-*) ref=${version#vps-} ;; *) ref=v$version ;; esac
 commit=$(curl -fsSL -H 'Accept: application/vnd.github.sha' \
-  "https://api.github.com/repos/SpaceWorks-HQ/SpaceWorks-Workspace/commits/$ref")
+  "https://api.github.com/repos/SpaceWorks-Labs/SpaceWorks-Workspace/commits/$ref")
 release=/opt/spaceworks-workspace/releases/$commit
 mkdir -p "$release"
-curl -fsSL "https://codeload.github.com/SpaceWorks-HQ/SpaceWorks-Workspace/tar.gz/$commit" | tar -xz -C "$release" --strip-components=1
+curl -fsSL "https://codeload.github.com/SpaceWorks-Labs/SpaceWorks-Workspace/tar.gz/$commit" | tar -xz -C "$release" --strip-components=1
 echo "$commit" > "$release/.release"
 case "$version" in vps-*) ;; *) echo "$version" > "$release/.release-version" ;; esac
 install -d -m 0700 /etc/spaceworks-workspace
@@ -544,7 +544,7 @@ with an authenticated request, then run it with the same environment:
 ```bash
 # The header is read from stdin, keeping the token out of curl's argv.
 printf 'header = "Authorization: Bearer %s"\n' "$SWW_GITHUB_TOKEN" | \
-  curl --config - -fsSL https://raw.githubusercontent.com/SpaceWorks-HQ/SpaceWorks-Workspace/main/install.sh -o /tmp/sww-install.sh
+  curl --config - -fsSL https://raw.githubusercontent.com/SpaceWorks-Labs/SpaceWorks-Workspace/main/install.sh -o /tmp/sww-install.sh
 bash /tmp/sww-install.sh
 rm -f /tmp/sww-install.sh
 ```

docs/DESIGN.md

@@ -3,7 +3,7 @@
 > Read this before building or changing any Space Works Workspace UI. It describes how the brand is
 > implemented in this app.
 >
-> **Source of truth for the brand:** [SpaceWorks-HQ/SpaceWorks-Design](https://github.com/SpaceWorks-HQ/SpaceWorks-Design):
+> **Source of truth for the brand:** [SpaceWorks-Labs/SpaceWorks-Design](https://github.com/SpaceWorks-Labs/SpaceWorks-Design):
 > `tokens/tokens.css` (colour values), `docs/ui-brand-spec.md` (tokens, states, type, shape, logo, icons),
 > `logo/` (master artwork), `fonts/` (Gilroy, Unbounded and their licences). When this file and the
 > design repo disagree, the design repo wins. Update this file to match.
@@ -451,7 +451,7 @@ emoji in chrome; the orange button in the app; colour-only status.
 
 ---
 
-*Version 1.0 · 19 Oct 2026 · Space Works Workspace. Brand values from SpaceWorks-HQ/SpaceWorks-Design.*
+*Version 1.0 · 19 Oct 2026 · Space Works Workspace. Brand values from SpaceWorks-Labs/SpaceWorks-Design.*
 
 
 ## 10. Fidelity checks and source priority

docs/areas/secrets.md

@@ -28,7 +28,7 @@ Service tokens are exact project/environment/path capabilities, read-only by def
 
 `GET /api/v1/secrets?project=ID&environment=dev&path=/&format=env|json|yaml` exports; `list=true` returns keys only and `key=NAME` reveals one key. POST accepts `{ project, environment, changes: [{ key, path, value }] }`; `{ delete:true }` removes a key. Device login endpoints live under `/api/cli/device/{code,token}`; refresh, own-session list/revoke, whoami and session MFA endpoints live under `/api/cli`. HTTPS is required outside localhost. Device codes expire in ten minutes, poll every five seconds, are hashed, row-locked and consumed once. Approval requires a signed-in enabled user and MFA when enrolled. Access tokens last 15 minutes; refresh credentials rotate and expire after 30 days. All comparisons use constant-time hash checks. Account → CLI devices revokes sessions immediately.
 
-The Node 20+ workspace package `@spaceworks-hq/workspace-cli` (single runtime dependency: `cross-spawn`, for Windows command shims in `sww run`) supplies `sww login/init/secrets/run/export/whoami/logout/tokens` and the `getSecrets` SDK. See [package quickstart](../../packages/cli/README.md). `.sww.json` holds no secrets. Credentials use the OS keychain where available or a 0600 file in a 0700 directory. `run` injects values without writing files and forwards child signals/exit codes. The SDK's optional bounded cache defaults off; only calls with a positive `cacheTtlMs` read or populate it.
+The Node 20+ workspace package `@spaceworks-labs/workspace-cli` (single runtime dependency: `cross-spawn`, for Windows command shims in `sww run`) supplies `sww login/init/secrets/run/export/whoami/logout/tokens` and the `getSecrets` SDK. See [package quickstart](../../packages/cli/README.md). `.sww.json` holds no secrets. Credentials use the OS keychain where available or a 0600 file in a 0700 directory. `run` injects values without writing files and forwards child signals/exit codes. The SDK's optional bounded cache defaults off; only calls with a positive `cacheTtlMs` read or populate it.
 
 Sharing encrypts text in the browser with AES-256-GCM. The server stores ciphertext plus a hashed capability; the 256-bit decryption key remains solely in the URL fragment. `/share` removes the fragment from browser history, transmits only the capability on an explicit view, and decrypts locally. Consumption is row-locked; one-time links disappear on the first view and limited links on the last. Expired rows are deleted by the scheduled job, including in archived workspaces. There is no GET consumption or prefetch. Text hides after 30 seconds or tab hiding. Hiding the tab during fetch/decryption discards the pending reveal even if the tab becomes visible again; the consumed share stays hidden. This is bearer sharing; send the whole link only to the intended recipient.
 

frontend/package.json

@@ -9,7 +9,7 @@
     "typecheck": "next typegen && tsc --noEmit"
   },
   "dependencies": {
-    "next": "^16.3.5",
+    "next": "^16.4.3",
     "react": "19.2.4",
     "react-dom": "19.2.4"
   }