@canopy-io/node 0.10.0 → 0.12.0

package/dist/index.d.cts

@@ -748,7 +748,7 @@ interface paths {
         };
         /**
          * Get identity's effective permissions
-         * @description Returns the identity's effective Application-wide permission keys for the current Environment as a flat `items` array of strings, resolved across all of its role assignments. Use this to answer "what can this identity do" without replaying individual assignments. Returns `404` when the identity has no membership in this Environment.
+         * @description Returns the identity's effective permission keys for the current Environment as a flat `items` array of strings. Without `node_id`, the Application-wide answer: every permission its role assignments grant anywhere. With `node_id`, the answer at that node: the permissions granted by assignments on the node's lineage, the list a screen renders its controls from. Returns `404` when the identity has no membership in this Environment, or when `node_id` names no node in it.
          */
         get: operations["ApiIdentitiesController_getIdentityPermissions"];
         put?: never;
@@ -759,6 +759,26 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/identities/{id}/accessible-nodes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get where an identity may act with one permission
+         * @description Returns where the identity may act with `permission`, for a list query: `roots`, the nodes it holds the permission at that no other such node already covers, and `nodes`, every node beneath those roots, the roots included, when there are at most `max_nodes` of them (default 10,000; at most 50,000). Past the cap `nodes` is null and `complete` false, and the caller filters by `roots` against its own closure table or materialised path. `env_wide` is true when a root is the Environment's own root, so every node qualifies and no filter is needed; `nodes` is null then too. The same rules as `evaluate` decide the roots, so a list filtered by this answer agrees with the check a write makes. Returns `404` when the identity has no membership in this Environment.
+         */
+        get: operations["ApiIdentitiesController_getIdentityAccessibleNodes"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/identities/{id}/grants": {
         parameters: {
             query?: never;
@@ -768,7 +788,7 @@ interface paths {
         };
         /**
          * Get where an identity holds each permission
-         * @description Returns, for the current Environment, one page of `(permission, node_id)` rows: every permission the identity holds, paired with each hierarchy node its grants were made at — the nodes themselves, **not** expanded through their descendants. Rows are ordered by permission, then node; a caller building the whole map walks every page. A grant already means "this node and everything beneath it", so a caller answers a node-scoped question by walking up from the node in question and looking for one of these roots, using a copy of the parent edges fetched once from `GET /api/v1/nodes/parents` and shared across identities. Answers both scopes without a further call: the permission appearing at all is the Application-wide answer, and the walk is the node-scoped one. Scheduled assignments outside their effective window are excluded. Returns `404` when the identity has no membership in this Environment.
+         * @description Returns, for the current Environment, one page of `(permission, node_id)` rows: every permission the identity holds, paired with each hierarchy node its grants were made at — the nodes themselves, **not** expanded through their descendants. Rows are ordered by permission, then node; a caller building the whole map walks every page. A grant already means "this node and everything beneath it", so a caller answers a node-scoped question by walking up from the node in question and looking for one of these roots, using a copy of the parent edges fetched once from `GET /api/v1/nodes/parents` and shared across identities. Answers both scopes without a further call: the permission appearing at all is the Application-wide answer, and the walk is the node-scoped one. By default, assignments outside their effective window are excluded. With `include=windows`, every assignment is a row carrying `effective_from` and `effective_to` (null for an unbounded side), in effect or not, so a caller applies the window itself: it can say why a check fails (the grant has ended, or has not begun) and drop a grant at its boundary without reading again. Returns `404` when the identity has no membership in this Environment.
          */
         get: operations["ApiIdentitiesController_getIdentityGrants"];
         put?: never;
@@ -1075,6 +1095,170 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/organizations/{id}/me": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * What the caller administers in an organization
+         * @description The authority read a customer's admin screen renders from: whether the caller holds `canopy:organization.manage` at the organization node (`administers_organization`), the topmost nodes where they hold `canopy:access.manage` inside it (`access_roots`, each with its name, type and the path of names from the organization down to it; the organization node itself when they administer the organization), the same for the structure and roles keys (empty until those ship), and whether the Environment's schema allows nodes beneath an organization (`has_hierarchy`). Computed from assignments at or beneath the organization node only, so a role held above every organization does not count. The developer's key answers as administering the whole organization. Refused with `403` for a caller holding nothing inside the organization.
+         */
+        get: operations["ApiOrganizationAccessController_me"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/tree": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the organization's tree as the caller sees it
+         * @description The organization's subtree pruned to the caller: every node beneath a node they administer is `accessible`, the ancestors between the organization node and such a node are `context_only`, and nothing else is returned. A paged flat list, each row carrying its parent, in the shape of the developer's node listing. Admitted to whoever the authority read admits.
+         */
+        get: operations["ApiOrganizationAccessController_tree"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/nodes/{nodeId}/access": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List who holds a role at a node in the organization
+         * @description Who holds a role at the node, directly or inherited from a node above it inside the organization: one row per assignment with the identity, the role, where it was granted and its window. Paginated; filtered and sorted as the developer's node identities listing is. Requires `hierarchy.view` at the node, or `canopy:organization.manage` at the organization, or `canopy:access.manage` at the node or above it.
+         */
+        get: operations["ApiOrganizationAccessController_listAccess"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/nodes/{nodeId}/access/summary": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Summarize who holds a role at a node in the organization
+         * @description The counts over the node's assignments: direct and inherited people, by status, roles in use and the most recent arrivals, with `can_manage_assignments` saying whether the caller may change them. Requires the same as the node access listing.
+         */
+        get: operations["ApiOrganizationAccessController_accessSummary"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/nodes/{nodeId}/grantable-roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the roles the caller may grant at a node
+         * @description The active, assignable roles of the Environment kept to the ones the caller may grant at the node under the grant ceiling: for an identity, those whose every permission it holds at the node or above; every assignable role for the developer's key and Console users. The list a picker offers, so nothing it shows is refused on write. Requires `canopy:access.manage` at the node or above it, `canopy:organization.manage` at the organization, or `hierarchy.manage` at the node. The response is an unpaginated `{ items }` array.
+         */
+        get: operations["ApiOrganizationAccessController_grantableRoles"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/nodes/{nodeId}/members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the organization's members, for granting a role at a node
+         * @description The organization's members as candidates for a role at the node: each row names the identity only. Paginated; `q` searches name and email. Requires the same as the grantable-roles read at the node, so an administrator of one office may choose from the whole organization's roster without reading what anyone else holds.
+         */
+        get: operations["ApiOrganizationAccessController_listMembersAt"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/assignments": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Grant a role at a node beneath the organization
+         * @description Grants `role_id` to `identity_id` at `node_id`, the organization node or one beneath it. The identity must be a member of the organization (`409 organization.membership_required` otherwise). Requires `rbac.manage_assignments` at the node, `canopy:organization.manage` at the organization, or `canopy:access.manage` at the node or above it, within the grant ceiling. Emits `assignment.created`.
+         */
+        post: operations["ApiOrganizationAccessController_createAssignment"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/organizations/{id}/assignments/{assignmentId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /**
+         * Take a grant in the organization away
+         * @description Removes an assignment at the organization node or beneath it; the membership stays. Never bounded by the grant ceiling, but the last administrator's role at the organization node cannot be removed (`409 organization.last_admin`). Requires the same as creating one.
+         */
+        delete: operations["ApiOrganizationAccessController_removeAssignment"];
+        options?: never;
+        head?: never;
+        /**
+         * Change a grant in the organization
+         * @description Changes the role or the window of an assignment at the organization node or beneath it. A new role meets the grant ceiling; dates alone do not. The last administrator's role at the organization node cannot be changed away (`409 organization.last_admin`). Requires the same as creating one.
+         */
+        patch: operations["ApiOrganizationAccessController_updateAssignment"];
+        trace?: never;
+    };
     "/api/v1/organizations": {
         parameters: {
             query?: never;
@@ -1332,13 +1516,13 @@ interface paths {
         };
         /**
          * List an organization's members
-         * @description Lists the organization's members: each row is the member's identity, their single role in this organization, effective dates, when they joined, and `node_assignments`, the grants the member also holds at nodes beneath the organization (empty in a flat Environment). Paginated; `q` searches name and email. Requires the `rbac.view_assignments` permission at the organization.
+         * @description Lists the organization's members: each row is the membership (its `status`, `source` and `joined_at`), the member's identity, and `roles`, every role assignment the member holds in the organization, at its node and beneath, with the node and the effective window. Active members by default; `status=deactivated` lists those who left and `status=all` both. Paginated; `q` searches name and email, `role_id` keeps members holding that role anywhere in the organization. Requires the `rbac.view_assignments` permission at the organization.
          */
         get: operations["ApiOrganizationsController_listMembers"];
         put?: never;
         /**
          * Add a member to an organization
-         * @description Adds a member: assigns `role_id` to `identity_id` at the organization. The identity must already hold an active membership in this Environment (invite by email instead for someone who does not). A member holds exactly one role per organization, so an identity that is already a member returns `409` — use the change-role operation. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.added`. An organization's own administrator, signed in with an identity token and admitted by `canopy:organization.manage` alone, is refused with `403` (`organization.member_add_requires_invite`): the person never agreed to join, so the administrator invites them instead.
+         * @description Adds a member. Membership is admission, not authority: with `role_id` the member also holds that role at the organization node from the start; without it they belong and hold nothing until a role is assigned. The identity must already hold an active membership in this Environment (invite by email instead for someone who does not). An identity that is already a member returns `409`; roles are added through the assignment routes. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.added`. An organization's own administrator, signed in with an identity token and admitted by `canopy:organization.manage` alone, is refused with `403` (`organization.member_add_requires_invite`): the person never agreed to join, so the administrator invites them instead.
          */
         post: operations["ApiOrganizationsController_addMember"];
         delete?: never;
@@ -1359,16 +1543,12 @@ interface paths {
         post?: never;
         /**
          * Remove a member from an organization
-         * @description Removes the member from this organization, revoking their role here and nothing else — the identity and its memberships in other organizations are untouched. Returns `404` when the identity is not a member. Responds `204 No Content`, requires the `rbac.manage_assignments` permission at the organization, and emits `organization.member.removed`.
+         * @description Removes the member from this organization: the membership is deactivated and every role assignment they hold at the organization's nodes goes with it, and nothing else; the identity and its memberships in other organizations are untouched. Returns `404` when the identity is not an active member and `409` when they are the last administrator. Responds `204 No Content`, requires the `rbac.manage_assignments` permission at the organization, and emits `organization.member.removed`.
          */
         delete: operations["ApiOrganizationsController_removeMember"];
         options?: never;
         head?: never;
-        /**
-         * Change a member's role
-         * @description Replaces the member's role in this organization with `role_id`. A member holds exactly one role per organization, so this updates the existing membership in place; changing to the role already held is a no-op. Returns `404` when the identity is not a member. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.role_changed`.
-         */
-        patch: operations["ApiOrganizationsController_changeMemberRole"];
+        patch?: never;
         trace?: never;
     };
     "/api/v1/organizations/{id}/members/{identityId}/mfa/reset": {
@@ -1424,7 +1604,7 @@ interface paths {
         };
         /**
          * List the roles an organization may assign
-         * @description The active, assignable roles of the organization's Environment, for choosing a member's role or an invitation's. System roles are left out, since they cannot be assigned. Requires `hierarchy.view` or `canopy:organization.manage` at the organization. The response is an unpaginated `{ items }` array.
+         * @description The active, assignable roles of the organization's Environment, for choosing a member's role or an invitation's, each with `grantable`: whether the caller may grant it at the organization node under the grant ceiling (always true for the developer's key). System roles are left out, since they cannot be assigned. Requires `hierarchy.view`, `canopy:organization.manage` at the organization, or `canopy:access.manage` at the organization node. The response is an unpaginated `{ items }` array.
          */
         get: operations["ApiOrganizationsController_listRoles"];
         put?: never;
@@ -2484,6 +2664,7 @@ interface components {
             effective_node_id?: string | null;
             /** @description Ids of the roles whose assignments produced a node-scoped allow. Always empty for `scope_evaluated: "app_wide"`, whose answer is not tied to a node, and for a deny. */
             granting_roles: string[];
+            /** @description Why the check was refused: `NO_ROLE_ASSIGNMENT`, `PERMISSION_NOT_GRANTED`, `NODE_SCOPE_VIOLATION`, `ROLE_EXPIRED`, `IDENTITY_INACTIVE`, `IDENTITY_NOT_ENV_MEMBER`, or `ORGANIZATION_MEMBERSHIP_INACTIVE` (assignments sit on the lineage inside an organization the identity's membership in is deactivated, so none count). Null on an allow. */
             denial_reason?: string | null;
         };
         EvaluatePermissionDto: {
@@ -2518,7 +2699,7 @@ interface components {
             assignment_id: string;
             role_id: string;
             role_name: string;
-            /** @description Whether the assignment counts right now: within its effective_from/effective_to window, and its role is active. An inactive role's assignments are kept but grant nothing. */
+            /** @description Whether the assignment counts right now: within its effective_from/effective_to window, its role active, and, inside an organization, the holder's membership there active. An assignment that fails any of these is listed but grants nothing. */
             active: boolean;
             effective_from?: string | null;
             effective_to?: string | null;
@@ -2592,6 +2773,8 @@ interface components {
             effective_from: string | null;
             /** @description When this assignment expires; null means it never does */
             effective_to: string | null;
+            /** @description Optimistic-lock version; send it back as `If-Match` */
+            version: number;
         };
         IdentityRowDto: {
             id: string;
@@ -2738,6 +2921,20 @@ interface components {
             created_at: string;
             /** Format: date-time */
             updated_at: string;
+            /** @description Optimistic-lock version; send it back as `If-Match` */
+            version: number;
+        };
+        IdentityAccessibleNodesResponseDto: {
+            /** @example reports.view */
+            permission: string;
+            /** @description True when a root is the Environment's own root, so every node qualifies and a list needs no filter. `nodes` is null then. */
+            env_wide: boolean;
+            /** @description The nodes the permission is granted at, in effect now, that no other such node already covers. Each reaches everything beneath it. */
+            roots: string[];
+            /** @description Every node beneath the roots, the roots included, for an `IN (...)` filter. Null when `env_wide`, or when there are more than `max_nodes` (then `complete` is false and the caller filters by `roots` instead). */
+            nodes: string[] | null;
+            /** @description False when the set beneath the roots was larger than `max_nodes` and was not sent. */
+            complete: boolean;
         };
         IdentityGrantResponseDto: {
             /** @example reports.view */
@@ -2747,6 +2944,16 @@ interface components {
              * @description The hierarchy node the permission was granted at. Not expanded through descendants.
              */
             node_id: string;
+            /**
+             * Format: date-time
+             * @description When the assignment behind this root begins, or null for no start. Present only with `include=windows`.
+             */
+            effective_from?: string | null;
+            /**
+             * Format: date-time
+             * @description When the assignment behind this root ends, or null for no end. Present only with `include=windows`.
+             */
+            effective_to?: string | null;
         };
         IdentityInviteResponseDto: {
             id: string;
@@ -2957,6 +3164,8 @@ interface components {
             status: "active" | "scheduled" | "expired";
             /** Format: date-time */
             created_at: string;
+            /** @description Optimistic-lock version; send it back as `If-Match` */
+            version: number;
         };
         IdentityAssignmentRowDto: {
             identity: components["schemas"]["AssignmentIdentityDto"];
@@ -2981,6 +3190,65 @@ interface components {
             distinct_role_count: number;
             recent_identities: components["schemas"]["RecentIdentityDto"][];
         };
+        OrganizationAuthorityRootDto: {
+            node_id: string;
+            name: string;
+            /** @description The node's type, as the schema names it */
+            node_type: string;
+            /** @description The names from the organization node down to this node's parent, so the node can be named in context; empty for the organization node itself */
+            path: string[];
+        };
+        OrganizationMeResponseDto: {
+            /** @description Holds `canopy:organization.manage` at the organization node, or is the developer's key */
+            administers_organization: boolean;
+            /** @description The topmost nodes where `canopy:access.manage` is held inside the organization; the organization node when `administers_organization` */
+            access_roots: components["schemas"]["OrganizationAuthorityRootDto"][];
+            /** @description The same for `canopy:structure.manage`, a key no role carries yet; always empty */
+            structure_roots: components["schemas"]["OrganizationAuthorityRootDto"][];
+            /** @description The same for `canopy:roles.manage`, a key no role carries yet; always empty */
+            roles_roots: components["schemas"]["OrganizationAuthorityRootDto"][];
+            /** @description Whether the Environment's schema allows nodes beneath an organization; false in a flat Environment, where the organization is its only node */
+            has_hierarchy: boolean;
+        };
+        RoleResponseDto: {
+            id: string;
+            application_id: string;
+            name: string;
+            description?: string | null;
+            is_system_role: boolean;
+            system_key?: string | null;
+            is_active: boolean;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: date-time */
+            updated_at: string;
+            /** @description Optimistic-lock version. Send back as the `If-Match` header when updating to detect concurrent edits. */
+            version: number;
+            /** @description Number of permissions currently assigned to this role. Populated on list responses; omitted on single-role responses where the join isn't computed. */
+            permission_count?: number;
+            /** @description Number of distinct identities assigned this role. Populated on list responses; omitted on single-role responses where the join isn't computed. */
+            member_count?: number;
+        };
+        OrganizationMemberCandidateResponseDto: {
+            identity: components["schemas"]["AssignmentIdentityDto"];
+        };
+        CreateOrganizationAssignmentDto: {
+            /** @description A member of the organization */
+            identity_id: string;
+            /** @description The organization node, or a node beneath it; the identity must be an active member of the organization */
+            node_id: string;
+            /** @description An active, assignable role of the Environment */
+            role_id: string;
+            /** @description When the grant starts (ISO 8601); now when omitted */
+            effective_from?: Record<string, unknown>;
+            /** @description When the grant ends (ISO 8601); never when omitted */
+            effective_to?: Record<string, unknown>;
+        };
+        UpdateAssignmentDto: {
+            role_id: string;
+            effective_from?: string | null;
+            effective_to?: string | null;
+        };
         OrganizationResponseDto: {
             id: string;
             name: string;
@@ -2990,7 +3258,7 @@ interface components {
             metadata: Record<string, unknown>;
             /** @description Your own id for this organization, unique per Environment. */
             external_id?: string | null;
-            /** @description Members (one role each) in this organization. */
+            /** @description Active members of this organization, whatever roles they hold. */
             member_count: number;
             /** @description Unexpired, unaccepted, unrevoked invitations. */
             pending_invite_count: number;
@@ -3181,38 +3449,52 @@ interface components {
             name: string;
             node_type: string;
         };
-        OrganizationMemberNodeAssignmentDto: {
+        OrganizationMemberAssignmentDto: {
             /** @description The assignment id. */
             id: string;
-            application_node: components["schemas"]["OrganizationMemberNodeDto"];
-            role: components["schemas"]["OrganizationMemberRoleDto"];
-        };
-        OrganizationMemberResponseDto: {
-            /** @description The membership (role assignment) id. */
-            id: string;
-            identity: components["schemas"]["OrganizationMemberIdentityDto"];
             role: components["schemas"]["OrganizationMemberRoleDto"];
+            node: components["schemas"]["OrganizationMemberNodeDto"];
             /** Format: date-time */
             effective_from?: string | null;
             /** Format: date-time */
             effective_to?: string | null;
+            /** @description The assignment's version, for `If-Match` on a change. */
+            version: number;
+        };
+        OrganizationMemberResponseDto: {
+            /** @description The membership id. */
+            id: string;
+            identity: components["schemas"]["OrganizationMemberIdentityDto"];
+            /**
+             * @description `active` while the identity belongs; `deactivated` once removed, kept for the organization's history.
+             * @enum {string}
+             */
+            status: "active" | "deactivated";
+            /**
+             * @description How the membership began: added by an administrator, an accepted invitation, single sign-on, directory sync, or the organization's own creation on sign-up.
+             * @enum {string}
+             */
+            source: "added" | "invitation" | "sso" | "directory_sync" | "signup";
             /**
              * Format: date-time
-             * @description When the membership was created.
+             * @description When the current membership began.
              */
-            created_at: string;
-            /** @description Assignments the member also holds at nodes beneath the organization. Empty in a flat Environment. */
-            node_assignments: components["schemas"]["OrganizationMemberNodeAssignmentDto"][];
+            joined_at: string;
+            /**
+             * Format: date-time
+             * @description When the member was removed; null while active.
+             */
+            deactivated_at?: string | null;
+            /** @description Every role assignment the member holds in the organization, the organization node first, then beneath it. Empty for a member who holds none. */
+            roles: components["schemas"]["OrganizationMemberAssignmentDto"][];
+            /** @description The membership's version. */
+            version: number;
         };
         AddOrganizationMemberDto: {
             /** @description Identity to add. Must already hold an active membership in this Environment; invite by email instead for someone who does not. */
             identity_id: string;
-            /** @description The single role the member holds in this organization, from the Environment's roles. */
-            role_id: string;
-        };
-        ChangeOrganizationMemberRoleDto: {
-            /** @description The replacement role. A member holds exactly one role per organization, so this updates the existing membership in place. */
-            role_id: string;
+            /** @description A role to hold at the organization node from the start, from the Environment's roles. Left out, the member belongs and holds nothing until a role is assigned. */
+            role_id?: string;
         };
         CreateOrganizationInviteDto: {
             /** @description Email to invite. Works for people with no identity in this Environment — one is created when they accept. */
@@ -3227,7 +3509,7 @@ interface components {
              */
             send_email: boolean;
         };
-        RoleResponseDto: {
+        OrganizationRoleResponseDto: {
             id: string;
             application_id: string;
             name: string;
@@ -3245,6 +3527,8 @@ interface components {
             permission_count?: number;
             /** @description Number of distinct identities assigned this role. Populated on list responses; omitted on single-role responses where the join isn't computed. */
             member_count?: number;
+            /** @description Whether the caller may grant this role at the organization node under the grant ceiling: for an identity, it holds every permission the role carries there; always true for the developer's key and Console users */
+            grantable: boolean;
         };
         SsoConnectionTestSummaryDto: {
             test_id: string;
@@ -3554,11 +3838,6 @@ interface components {
             effective_from?: string;
             effective_to?: string;
         };
-        UpdateAssignmentDto: {
-            role_id: string;
-            effective_from?: string | null;
-            effective_to?: string | null;
-        };
         BulkRemoveAssignmentsDto: {
             assignment_ids: string[];
         };
@@ -4999,16 +5278,21 @@ interface components {
                      * @description The identity that joined.
                      */
                     identity_id: string;
+                    /** @description Your own identifier for the organization, when you set one. */
+                    external_id?: string | null;
                     /**
                      * Format: uuid
-                     * @description The role it holds in the organization.
+                     * @description The membership record.
                      */
-                    role_id: string;
-                    /** @description Your own identifier for the organization, when you set one. */
-                    external_id?: string | null;
+                    membership_id?: string;
+                    /**
+                     * Format: uuid
+                     * @description The role given at the organization node on joining, when one was.
+                     */
+                    role_id?: string;
                     /**
                      * Format: uuid
-                     * @description The role assignment that is the membership.
+                     * @description That role's assignment, when a role was given.
                      */
                     assignment_id?: string;
                     /**
@@ -5030,7 +5314,7 @@ interface components {
                      * @description How the member joined, when it was not added directly.
                      * @enum {string}
                      */
-                    source?: "sso_jit" | "invite" | "scim";
+                    source?: "sso_jit" | "invite" | "scim" | "self_signup";
                 };
             };
         };
@@ -5087,13 +5371,13 @@ interface components {
                      * @description The identity removed.
                      */
                     identity_id: string;
+                    /** @description Role assignments it held at the organization's nodes, removed with the membership. */
+                    assignments_removed: number;
                     /**
                      * Format: uuid
-                     * @description The role it held.
+                     * @description The membership record, now deactivated.
                      */
-                    role_id: string;
-                    /** @description Grants it held beneath the organization, removed with the membership. */
-                    scoped_assignments_removed: number;
+                    membership_id?: string;
                     /**
                      * @description Set when directory sync made the change rather than somebody directly.
                      * @enum {string}
@@ -5541,8 +5825,7 @@ interface operations {
     ApiPermissionsController_deletePermission: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -5670,8 +5953,7 @@ interface operations {
     ApiPermissionsController_updatePermission: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -8358,7 +8640,10 @@ interface operations {
     };
     ApiIdentitiesController_getIdentityPermissions: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Answer at this node: the permissions granted by assignments on its lineage. Omit for the Application-wide answer. */
+                node_id?: string;
+            };
             header?: never;
             path: {
                 id: string;
@@ -8464,13 +8749,13 @@ interface operations {
             };
         };
     };
-    ApiIdentitiesController_getIdentityGrants: {
+    ApiIdentitiesController_getIdentityAccessibleNodes: {
         parameters: {
-            query?: {
-                /** @description Page number (1-based) */
-                page?: number;
-                /** @description Items per page (1-100, default 20) */
-                take?: number;
+            query: {
+                /** @description The permission to answer for, by key. */
+                permission: string;
+                /** @description The largest `nodes` set to return. Past it, `nodes` is null and `complete` false. */
+                max_nodes?: number;
             };
             header?: never;
             path: {
@@ -8480,15 +8765,130 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description One page of grant roots, one row per permission and node, ordered by permission then node */
+            /** @description The minimal grant roots for the permission, and the nodes beneath them up to the cap */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /** @description The version of the authorization model these rows describe. A client that evaluates from them refuses a version it does not know rather than guessing. */
-                        model_version: number;
+                        data: components["schemas"]["IdentityAccessibleNodesResponseDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities/{id}/accessible-nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No identity with that id has a membership in this Environment */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "No identity with that id has a membership in this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/identities/{id}/accessible-nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiIdentitiesController_getIdentityGrants: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description `windows` adds `effective_from` and `effective_to` to every row and includes assignments outside their window, so the caller applies the window itself. */
+                include?: "windows";
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description One page of grant roots, one row per permission and node, ordered by permission then node */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description The version of the authorization model these rows describe. A client that evaluates from them refuses a version it does not know rather than guessing. */
+                        model_version: number;
                         items: components["schemas"]["IdentityGrantResponseDto"][];
                         pagination: components["schemas"]["PageMetaDto"];
                     };
@@ -9683,8 +10083,7 @@ interface operations {
     ApiNodesController_deleteNode: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -9812,8 +10211,7 @@ interface operations {
     ApiNodesController_updateNode: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -10234,8 +10632,7 @@ interface operations {
     ApiNodesController_moveNode: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -10539,8 +10936,1100 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Invalid or expired token */
-            401: {
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Node not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Node not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/nodes/{id}/identities/summary",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_me: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The caller's authority in the organization */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["OrganizationMeResponseDto"];
+                    };
+                };
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller holds no delegated key inside the organization and no developer key over it, or the token is not an admin, API key or identity token */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The caller holds no delegated key inside the organization and no developer key over it, or the token is not an admin, API key or identity token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_tree: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search node names and slugs */
+                q?: string;
+                /** @description Sort column. Defaults to `created`, oldest first. */
+                sort_by?: "name" | "created";
+                /** @description Sort direction */
+                order?: "asc" | "desc";
+            };
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Nodes returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["ScopedNodeResponseDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/tree",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller holds no delegated key inside the organization and no developer key over it, or the token is not an admin, API key or identity token */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The caller holds no delegated key inside the organization and no developer key over it, or the token is not an admin, API key or identity token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/tree",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Organization not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "Organization not found",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/tree",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_listAccess: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search term */
+                q?: string;
+                /** @description Sort field */
+                sort_by?: "name" | "role" | "access_type" | "created_at";
+                /** @description Sort order */
+                order?: "asc" | "desc";
+                /** @description Filter by role ID */
+                role_id?: string;
+                /** @description Filter by access type */
+                access_type?: "direct" | "inherited";
+                /** @description Filter by assignment status */
+                status?: "active" | "scheduled" | "expired";
+                /** @description Filter by source node ID */
+                source_node_id?: string;
+            };
+            header?: never;
+            path: {
+                id: string;
+                nodeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Assignments returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["IdentityAssignmentRowDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_accessSummary: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                nodeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Summary returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["NodeIdentitiesSummaryDto"];
+                    };
+                };
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access/summary",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_grantableRoles: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                nodeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Roles returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["RoleResponseDto"][];
+                    };
+                };
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/grantable-roles",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_listMembersAt: {
+        parameters: {
+            query?: {
+                /** @description Page number (1-based) */
+                page?: number;
+                /** @description Items per page (1-100, default 20) */
+                take?: number;
+                /** @description Search member names and emails */
+                q?: string;
+                /** @description Sort column. Defaults to `joined`, longest-standing member first. */
+                sort_by?: "name" | "email" | "joined";
+                /** @description Sort direction */
+                order?: "asc" | "desc";
+            };
+            header?: never;
+            path: {
+                id: string;
+                nodeId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Members returned */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["OrganizationMemberCandidateResponseDto"][];
+                        pagination: components["schemas"]["PageMetaDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/members",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/access",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/nodes/{nodeId}/members",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_createAssignment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateOrganizationAssignmentDto"];
+            };
+        };
+        responses: {
+            /** @description Assignment created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["AssignmentResponseDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node, or is an identity outside the grant ceiling for the role (`assignment.grant_ceiling`) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node, or is an identity outside the grant ceiling for the role (`assignment.grant_ceiling`)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the node is not inside it */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the node is not inside it",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The identity already holds this role at this node, or is not a member of the organization (`organization.membership_required`) */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The identity already holds this role at this node, or is not a member of the organization (`organization.membership_required`)",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_removeAssignment: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: string;
+                assignmentId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Assignment removed */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The request sent both an `X-API-Key` and an `Authorization` header; send one */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request sent both an `X-API-Key` and an `Authorization` header; send one",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 403,
+                     *         "code": null,
+                     *         "message": "The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The organization is not in this Environment, or the assignment is not at one of its nodes */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 404,
+                     *         "code": null,
+                     *         "message": "The organization is not in this Environment, or the assignment is not at one of its nodes",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The member is the organization's last administrator (`organization.last_admin`); make someone else one first */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The member is the organization's last administrator (`organization.last_admin`); make someone else one first",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    ApiOrganizationAccessController_updateAssignment: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
+                "If-Match"?: string;
+            };
+            path: {
+                id: string;
+                assignmentId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateAssignmentDto"];
+            };
+        };
+        responses: {
+            /** @description Assignment updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["AssignmentResponseDto"];
+                    };
+                };
+            };
+            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 400,
+                     *         "code": null,
+                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "PATCH"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Invalid or expired token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 401,
+                     *         "code": null,
+                     *         "message": "Invalid or expired token",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/organizations/{id}/me",
+                     *         "method": "GET"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node, or is an identity outside the grant ceiling for the role (`assignment.grant_ceiling`) */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -10548,20 +12037,20 @@ interface operations {
                     /**
                      * @example {
                      *       "error": {
-                     *         "statusCode": 401,
+                     *         "statusCode": 403,
                      *         "code": null,
-                     *         "message": "Invalid or expired token",
+                     *         "message": "The token is not an admin, API key or identity token, or the caller holds none of the keys the operation needs at the node, or is an identity outside the grant ceiling for the role (`assignment.grant_ceiling`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "PATCH"
                      *       }
                      *     }
                      */
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment */
-            403: {
+            /** @description The organization is not in this Environment, or the assignment is not at one of its nodes */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -10569,20 +12058,20 @@ interface operations {
                     /**
                      * @example {
                      *       "error": {
-                     *         "statusCode": 403,
+                     *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "The bearer token is not an admin or platform token, or the caller lacks the permission this operation checks: a scoped API key without that scope, an admin without the Account capability that covers it, or, for a node-scoped check, a node outside this Environment",
+                     *         "message": "The organization is not in this Environment, or the assignment is not at one of its nodes",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "PATCH"
                      *       }
                      *     }
                      */
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Node not found */
-            404: {
+            /** @description The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or it is the last administrator's role at the organization node (`organization.last_admin`) */
+            409: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -10590,12 +12079,12 @@ interface operations {
                     /**
                      * @example {
                      *       "error": {
-                     *         "statusCode": 404,
+                     *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "Node not found",
+                     *         "message": "The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or it is the last administrator's role at the organization node (`organization.last_admin`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/nodes/{id}/identities/summary",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/assignments/{assignmentId}",
+                     *         "method": "PATCH"
                      *       }
                      *     }
                      */
@@ -11005,8 +12494,7 @@ interface operations {
     ApiOrganizationsController_deleteOrganization: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -11134,8 +12622,7 @@ interface operations {
     ApiOrganizationsController_updateOrganization: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -11379,8 +12866,7 @@ interface operations {
     ApiOrganizationsController_updatePolicy: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -12690,14 +14176,14 @@ interface operations {
                 take?: number;
                 /** @description Search member names and emails */
                 q?: string;
-                /** @description Sort column. Defaults to `created`, oldest membership first. */
-                sort_by?: "name" | "email" | "role" | "created";
+                /** @description Sort column. Defaults to `joined`, longest-standing member first. */
+                sort_by?: "name" | "email" | "joined";
                 /** @description Sort direction */
                 order?: "asc" | "desc";
-                /** @description Only members holding this role */
+                /** @description Only members holding this role anywhere in the organization, at its node or beneath */
                 role_id?: string;
-                /** @description Filter by the membership's effective window: active now, scheduled to start, or already expired */
-                status?: "active" | "scheduled" | "expired";
+                /** @description Which memberships to list: `active` (the default), `deactivated` for members who left, or `all` */
+                status?: "active" | "deactivated" | "all";
             };
             header?: never;
             path: {
@@ -12915,7 +14401,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The identity is already a member of this organization */
+            /** @description The identity is already a member of this organization (`organization.member_exists`); give them a role through the assignment routes */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -12926,7 +14412,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "The identity is already a member of this organization",
+                     *         "message": "The identity is already a member of this organization (`organization.member_exists`); give them a role through the assignment routes",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/members",
                      *         "method": "POST"
@@ -13064,140 +14550,6 @@ interface operations {
             };
         };
     };
-    ApiOrganizationsController_changeMemberRole: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                id: string;
-                identityId: string;
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["ChangeOrganizationMemberRoleDto"];
-            };
-        };
-        responses: {
-            /** @description Member role changed */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        data: components["schemas"]["OrganizationMemberResponseDto"];
-                    };
-                };
-            };
-            /** @description The request failed validation, or the role is inactive or a system role; or the request sent both an `X-API-Key` and an `Authorization` header */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 400,
-                     *         "code": null,
-                     *         "message": "The request failed validation, or the role is inactive or a system role; or the request sent both an `X-API-Key` and an `Authorization` header",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations/{id}/members/{identityId}",
-                     *         "method": "PATCH"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description Invalid or expired token */
-            401: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 401,
-                     *         "code": null,
-                     *         "message": "Invalid or expired token",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
-            403: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 403,
-                     *         "code": null,
-                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations",
-                     *         "method": "GET"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description The organization or the role does not exist, or the identity is not a member of this organization */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 404,
-                     *         "code": null,
-                     *         "message": "The organization or the role does not exist, or the identity is not a member of this organization",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations/{id}/members/{identityId}",
-                     *         "method": "PATCH"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-            /** @description The member is the organization's last administrator (`organization.last_admin`); make someone else one first */
-            409: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    /**
-                     * @example {
-                     *       "error": {
-                     *         "statusCode": 409,
-                     *         "code": null,
-                     *         "message": "The member is the organization's last administrator (`organization.last_admin`); make someone else one first",
-                     *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations/{id}/members/{identityId}",
-                     *         "method": "PATCH"
-                     *       }
-                     *     }
-                     */
-                    "application/json": components["schemas"]["ErrorResponseDto"];
-                };
-            };
-        };
-    };
     ApiOrganizationsController_resetMemberMfa: {
         parameters: {
             query?: never;
@@ -13514,7 +14866,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa) */
+            /** @description The token is not an admin, API key or identity token, or the caller is an identity that does not hold, at the organization node or above, every permission the role carries (`assignment.grant_ceiling`); Console users and API keys are not bounded */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -13525,10 +14877,10 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 403,
                      *         "code": null,
-                     *         "message": "This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)",
+                     *         "message": "The token is not an admin, API key or identity token, or the caller is an identity that does not hold, at the organization node or above, every permission the role carries (`assignment.grant_ceiling`); Console users and API keys are not bounded",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
-                     *         "path": "/api/v1/organizations",
-                     *         "method": "GET"
+                     *         "path": "/api/v1/organizations/{id}/invites",
+                     *         "method": "POST"
                      *       }
                      *     }
                      */
@@ -13597,7 +14949,7 @@ interface operations {
                 };
                 content: {
                     "application/json": {
-                        items: components["schemas"]["RoleResponseDto"][];
+                        items: components["schemas"]["OrganizationRoleResponseDto"][];
                     };
                 };
             };
@@ -16871,8 +18223,7 @@ interface operations {
     ApiRolesController_deleteRole: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -17000,8 +18351,7 @@ interface operations {
     ApiRolesController_updateRole: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
                 "If-Match"?: string;
             };
@@ -17650,7 +19000,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The identity already has this role at this node, already holds its one role at this organization, or the node sits beneath an organization the identity has no membership in effect at */
+            /** @description The identity already has this role at this node, or the node sits beneath an organization the identity is not an active member of (`organization.membership_required`) */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -17661,7 +19011,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "The identity already has this role at this node, already holds its one role at this organization, or the node sits beneath an organization the identity has no membership in effect at",
+                     *         "message": "The identity already has this role at this node, or the node sits beneath an organization the identity is not an active member of (`organization.membership_required`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/assignments",
                      *         "method": "POST"
@@ -17775,12 +19125,36 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The member is the organization's last administrator (`organization.last_admin`); make someone else one first */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The member is the organization's last administrator (`organization.last_admin`); make someone else one first",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/assignments/{id}",
+                     *         "method": "DELETE"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     ApiAssignmentsController_updateAssignment: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description Optimistic-lock version of the resource. Send the `version` field returned on read; the server rejects with 409 if the row has changed since. */
+                "If-Match"?: string;
+            };
             path: {
                 id: string;
             };
@@ -17887,7 +19261,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Identity already has this role at this node */
+            /** @description The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or the role is the last administrator's at an organization node (`organization.last_admin`) */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -17898,7 +19272,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "Identity already has this role at this node",
+                     *         "message": "The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or the role is the last administrator's at an organization node (`organization.last_admin`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/assignments/{id}",
                      *         "method": "PATCH"
@@ -18014,6 +19388,27 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
+            /** @description The member is the organization's last administrator (`organization.last_admin`); make someone else one first */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": {
+                     *         "statusCode": 409,
+                     *         "code": null,
+                     *         "message": "The member is the organization's last administrator (`organization.last_admin`); make someone else one first",
+                     *         "timestamp": "2026-04-20T12:00:00.000Z",
+                     *         "path": "/api/v1/assignments/bulk-remove",
+                     *         "method": "POST"
+                     *       }
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     ApiAssignmentsController_bulkChangeRole: {
@@ -18124,7 +19519,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Identity already has this role at this node */
+            /** @description The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or the role is the last administrator's at an organization node (`organization.last_admin`) */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -18135,7 +19530,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "Identity already has this role at this node",
+                     *         "message": "The identity already holds this role at this node, the assignment has been modified since the version named in If-Match was read (`assignment.version_mismatch`), or the role is the last administrator's at an organization node (`organization.last_admin`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/assignments/bulk-change-role",
                      *         "method": "POST"
@@ -19081,8 +20476,7 @@ interface operations {
     ApiHierarchySchemaController_updateSchema: {
         parameters: {
             query?: never;
-            header: {
-                "if-match": string;
+            header?: {
                 /** @description Optimistic-lock token. Pass the `version` you read from the Environment — request fails 409 when the row has moved on. */
                 "If-Match"?: string;
             };
@@ -21486,7 +22880,12 @@ declare class Assignments {
      * answer, read the current assignments before retrying.
      */
     create(input: RequestBody<"ApiAssignmentsController_assignRole">): Promise<ResponseBody<"ApiAssignmentsController_assignRole">>;
-    update(id: string, input: RequestBody<"ApiAssignmentsController_updateAssignment">): Promise<ResponseBody<"ApiAssignmentsController_updateAssignment">>;
+    /**
+     * Change the role or the window of a grant. Pass the `version` the
+     * assignment was read with as `ifMatch`; a stale one answers 409
+     * `assignment.version_mismatch` rather than overwriting a newer change.
+     */
+    update(id: string, input: RequestBody<"ApiAssignmentsController_updateAssignment">, options?: ConcurrencyOptions): Promise<ResponseBody<"ApiAssignmentsController_updateAssignment">>;
     delete(id: string): Promise<void>;
     /**
      * Grant many at once. Answers 207 with a per-item result rather than failing
@@ -21539,7 +22938,18 @@ declare class Identities {
      * question at the node that matters. This is for showing a person what
      * someone can do.
      */
-    permissions(id: string): Promise<ResponseBody<"ApiIdentitiesController_getIdentityPermissions">>;
+    permissions(id: string, query?: QueryParams<"ApiIdentitiesController_getIdentityPermissions">): Promise<ResponseBody<"ApiIdentitiesController_getIdentityPermissions">>;
+    /**
+     * Where the identity may act with one permission, answered by Canopy for a
+     * list query: the minimal grant roots, and every node beneath them up to
+     * `max_nodes` (null past it, with `complete: false`), or `env_wide` when a
+     * root is the Environment's own root and no filter is needed.
+     *
+     * `LocalAuthorizer.accessibleNodes` answers the same question from its
+     * cache without a call; this is the fresh answer, and the one for a process
+     * that does not run the authorizer.
+     */
+    accessibleNodes(id: string, query: QueryParams<"ApiIdentitiesController_getIdentityAccessibleNodes">): Promise<ResponseBody<"ApiIdentitiesController_getIdentityAccessibleNodes">>;
     /**
      * Every session the identity holds that is neither revoked nor expired,
      * newest first: when and where it was signed in, when it expires, and the
@@ -21579,8 +22989,8 @@ type ItemOf$3<T> = T extends {
 } ? Item : never;
 
 /**
- * Tenant organizations: one per business customer, a role per membership,
- * each with its own authentication policy and identity provider. Every
+ * Tenant organizations: one per business customer, membership apart from
+ * the roles held inside it, each with its own authentication policy and identity provider. Every
  * call here needs the Environment's organizations container switched on.
  */
 declare class Organizations {
@@ -21605,8 +23015,12 @@ declare class Organizations {
     deleteAll(): Promise<void>;
     listMembers(id: string, query?: QueryParams<"ApiOrganizationsController_listMembers">): Paginator<OrganizationMemberItem>;
     addMember(id: string, input: RequestBody<"ApiOrganizationsController_addMember">): Promise<ResponseBody<"ApiOrganizationsController_addMember">>;
-    changeMemberRole(id: string, identityId: string, input: RequestBody<"ApiOrganizationsController_changeMemberRole">): Promise<ResponseBody<"ApiOrganizationsController_changeMemberRole">>;
-    /** Revokes that organization's one role; the identity and its other memberships are untouched. */
+    /**
+     * Deactivates the membership and revokes every role the member holds at
+     * the organization's nodes; the identity and its other memberships are
+     * untouched. A role in the organization is changed through the
+     * organization's assignment routes, not here.
+     */
     removeMember(id: string, identityId: string): Promise<void>;
     /**
      * Clears a member's second factor, for one who lost their authenticator:
@@ -21839,6 +23253,39 @@ declare class Canopy {
  * delay is short, so a longer value is refused rather than honoured.
  */
 declare const MAX_TTL_MS = 300000;
+/**
+ * The largest node set `accessibleNodes` builds unless told otherwise. Past
+ * it the answer carries the roots alone, and the caller filters against its
+ * own closure table or materialised path instead of an `IN (...)` list.
+ */
+declare const DEFAULT_MAX_NODES = 10000;
+/**
+ * Why a check was denied, as far as the grant roots and the tree can say.
+ *
+ * - `permission_not_held`: no assignment grants the permission anywhere, in
+ *   effect or not.
+ * - `outside_grants`: it is granted, but at no node on the lineage of the
+ *   node asked about.
+ * - `expired`: a grant that would answer has ended, and none is in effect.
+ * - `not_yet_effective`: a grant that would answer has not begun, and none
+ *   is in effect.
+ * - `node_missing`: a `node` check named no node, which is a denial rather
+ *   than an error, because a request whose subject cannot be established
+ *   must not pass.
+ */
+type LocalDenialReason = "permission_not_held" | "outside_grants" | "expired" | "not_yet_effective" | "node_missing";
+/** The answer to a check: the verdict, and why when it is no. */
+interface LocalDecision {
+    allowed: boolean;
+    reason: LocalDenialReason | null;
+}
+/** What a decision hook receives, after the verdict is in. */
+interface LocalDecisionEvent {
+    query: LocalAuthorizationQuery;
+    decision: LocalDecision;
+    /** How long the check took, reads included. */
+    durationMs: number;
+}
 interface LocalAuthorizerOptions {
     /**
      * How long grant roots and the hierarchy are reused, in milliseconds.
@@ -21871,6 +23318,19 @@ interface LocalAuthorizerOptions {
     timeoutMs?: number;
     /** Retries for those reads. */
     maxRetries?: number;
+    /**
+     * The largest node set {@link LocalAuthorizer.accessibleNodes} builds
+     * unless a call says otherwise. Defaults to {@link DEFAULT_MAX_NODES}.
+     */
+    maxNodes?: number;
+    /**
+     * Called after every decision, allowed or not, with the question and the
+     * answer. Never awaited and never allowed to fail the check: a hook that
+     * throws is ignored. For audit trails and metrics.
+     */
+    onDecision?: (event: LocalDecisionEvent) => void;
+    /** Called after every denial, the same way. For alerting on refusals. */
+    onDenied?: (event: LocalDecisionEvent) => void;
     /** Injectable clock, for tests. */
     now?: () => number;
 }
@@ -21881,6 +23341,26 @@ interface LocalAuthorizationQuery {
     scope?: "node" | "app_wide";
     node_id?: string;
 }
+/** Where an identity may act with one permission, shaped for a list query. */
+interface AccessibleNodes {
+    /**
+     * The nodes the permission is granted at, in effect now, that no other
+     * such node already covers. Each reaches everything beneath it.
+     */
+    roots: string[];
+    /**
+     * Every node beneath the roots, the roots included, for an `IN (...)`
+     * filter. Null when `envWide`, or when the set would exceed the cap.
+     */
+    nodes: Set<string> | null;
+    /** False when the set exceeded the cap and `nodes` was not built. */
+    complete: boolean;
+    /**
+     * True when a root is the Environment's own root: every node qualifies, so
+     * a list needs no filter at all.
+     */
+    envWide: boolean;
+}
 interface LocalAuthorizerStats {
     /** Reads of an identity's grant roots, one per refresh however many pages it took. */
     grantFetches: number;
@@ -21900,8 +23380,11 @@ interface LocalAuthorizerStats {
 declare class LocalAuthorizer {
     private readonly client;
     private readonly ttlMs;
+    private readonly maxNodes;
     private readonly now;
     private readonly readOptions;
+    private readonly onDecision;
+    private readonly onDenied;
     private readonly grants;
     private tree;
     /**
@@ -21917,7 +23400,7 @@ declare class LocalAuthorizer {
     private stats;
     constructor(client: CanopyClient, options?: LocalAuthorizerOptions);
     /**
-     * Whether the identity holds the permission.
+     * Whether the identity holds the permission, and why not when it does not.
      *
      * Shaped like the API's own evaluate so a caller can swap one for the other.
      * A `node` check with no node is a denial rather than an error: a request
@@ -21925,9 +23408,51 @@ declare class LocalAuthorizer {
      */
     evaluate(query: LocalAuthorizationQuery, options?: {
         signal?: AbortSignal;
-    }): Promise<{
-        allowed: boolean;
+    }): Promise<LocalDecision>;
+    /**
+     * The nodes the identity holds the permission at, in effect now, reduced to
+     * the ones no other such node already covers, and whether one of them is
+     * the Environment's root. The roots alone are enough for an application
+     * that keeps a closure table or a materialised path: it filters by "beneath
+     * one of these" without an expanded set.
+     *
+     * Reads the tree, since minimality and `envWide` are questions about it; a
+     * root the readable hierarchy does not contain raises
+     * `authorizer.hierarchy_incomplete`, as a check at such a node does.
+     */
+    grantRoots(identityId: string, permission: string): Promise<{
+        roots: string[];
+        envWide: boolean;
     }>;
+    /**
+     * Where the identity may act with the permission, as the set a list query
+     * filters by: {@link grantRoots} expanded through their descendants, up to
+     * `maxNodes` (the authorizer's default unless given here).
+     *
+     * Past the cap `nodes` is null and `complete` false: the set is too large
+     * to be worth an `IN (...)` list, and the caller filters by `roots`
+     * instead. An `envWide` answer carries no set either, since every node
+     * qualifies and a filter would only slow the query down.
+     *
+     * Computed from the same cached grant roots and tree a check uses, so a
+     * list filtered by it and the check on a write cannot disagree, and it goes
+     * stale on the same `ttlMs`.
+     */
+    accessibleNodes(identityId: string, permission: string, options?: {
+        maxNodes?: number;
+    }): Promise<AccessibleNodes>;
+    /**
+     * Every permission the identity holds at the node, by grant or by
+     * inheritance: the list a screen renders its controls from, answered from
+     * the same cached grant roots and tree a check uses.
+     */
+    permissionsAt(identityId: string, nodeId: string): Promise<string[]>;
+    /**
+     * {@link permissionsAt} for several nodes at once, as node → permissions:
+     * the rows of a list each with their own controls, answered from one read
+     * of the grant roots and one walk per node.
+     */
+    permissionsAtMany(identityId: string, nodeIds: readonly string[]): Promise<Map<string, string[]>>;
     private decide;
     /** Counters for observability — how much traffic the cache is actually saving. */
     snapshot(): LocalAuthorizerStats;
@@ -21954,19 +23479,29 @@ declare class LocalAuthorizer {
      * top of it — size the TTL to the revocation latency you can promise.
      */
     invalidate(identityId?: string): void;
-    /** Climb from `nodeId` and look for a grant root among its ancestors. */
-    private holdsAtNode;
+    /** Fire the decision hooks, after the verdict and without waiting on them. */
+    private announce;
+    /** The node and its ancestors, from the tree this client can read. */
+    private lineageOf;
+    private hierarchyIncomplete;
     private grantRootsFor;
     /**
-     * Every page of the identity's grant roots, folded into permission → nodes.
+     * Every page of the identity's grant roots, with their windows, folded
+     * into permission → roots.
+     *
+     * Each row is one permission at one node for one assignment, so a
+     * permission granted at three nodes arrives as three rows, possibly on
+     * different pages. Stopping after the first page would under-report what
+     * the identity holds: a false deny, the safe direction, but a wrong answer
+     * all the same.
      *
-     * Each row is one permission at one node, so a permission granted at three
-     * nodes arrives as three rows, possibly on different pages. Stopping after
-     * the first page would under-report what the identity holds: a false deny,
-     * the safe direction, but a wrong answer all the same.
+     * Rows outside their window are kept: they are what lets a denial say
+     * `expired` or `not_yet_effective`, and the entry expires at the nearest
+     * window boundary when that comes before the TTL, so a grant takes effect
+     * or ends on time rather than up to `ttlMs` late.
      */
     private fetchGrantRoots;
-    private parents;
+    private treeEntry;
     /**
      * Revalidate rather than re-read. The hierarchy is the expensive half and
      * the one that changes least, so the common case is a `304` and no transfer
@@ -22287,23 +23822,28 @@ interface CanopyTokenClaims {
      * The organization this session is acting in — present only on identity
      * tokens from an Environment with the organizations container on, for an
      * identity that belongs to at least one organization. Always minted
-     * together with `org_role`; read the pair through {@link orgContext}
+     * together with `org_roles`; read the pair through {@link orgContext}
      * rather than separately.
      */
     org_id?: string;
-    /** The name of the single role the identity holds in `org_id`. */
-    org_role?: string;
+    /**
+     * The names of the roles the identity holds at the organization's own node,
+     * sorted; empty for a member who holds none there. Membership is admission,
+     * not a role: a member may hold roles only beneath the organization, or
+     * none at all.
+     */
+    org_roles?: string[];
     [claim: string]: unknown;
 }
 /**
  * The organization context a verified token carries: which organization the
- * session is acting in, and the one role it holds there.
+ * session is acting in, and the roles it holds at that organization's node.
  */
 interface CanopyOrgContext {
     /** The organization's id — also a hierarchy node id, usable as `node_id`. */
     orgId: string;
-    /** The role's name (not its id): what `org_role` carries. */
-    orgRole: string;
+    /** The roles' names (not ids) held at the organization node: what `org_roles` carries. Empty for a member holding none there. */
+    orgRoles: string[];
 }
 /**
  * The organization context of a verified token, or `null` when it has none.
@@ -22311,16 +23851,18 @@ interface CanopyOrgContext {
  * `null` is an ordinary answer, not a failure: it is every token from an
  * Environment without the organizations container on, and every identity
  * that belongs to no organization yet. Branch on it rather than on the raw claims —
- * Canopy mints `org_id` and `org_role` together, and this helper refuses a
+ * Canopy mints `org_id` and `org_roles` together, and this helper refuses a
  * half-present pair instead of letting one claim be read as though the other
- * were there.
+ * were there. An empty `orgRoles` is a member of the organization holding no
+ * role at its node; authorize such a session by evaluating, never by the
+ * list's length.
  *
  * ```ts
  * const claims = await verifier.verify(token);
  * const org = orgContext(claims);
  *
  * if (org) {
- *   // acting inside org.orgId as org.orgRole
+ *   // acting inside org.orgId, holding org.orgRoles at its node
  * }
  * ```
  */
@@ -22432,4 +23974,4 @@ type WebhookEventData<Name extends WebhookEventName> = WebhookEvent<Name>["data"
  */
 declare function isWebhookEvent<Name extends WebhookEventName>(delivery: WebhookDelivery, name: Name): delivery is WebhookEvent<Name>;
 
-export { type AssignmentItem, Assignments, type CallOptions, Canopy, CanopyAuthorizerError, CanopyClient, type CanopyClientOptions, CanopyConnectionError, CanopyError, type CanopyErrorBody, type CanopyOrgContext, type CanopyTokenClaims, CanopyTokenError, type Collection, type ConcurrencyOptions, type ConditionalResult, type CursorPagination, type FailureStatus, Identities, type IdentityAssignmentItem, type IdentityItem, type IdentitySessionItem, type LocalAuthorizationQuery, LocalAuthorizer, type LocalAuthorizerOptions, type LocalAuthorizerStats, MAX_TTL_MS, type OffsetPagination, type OperationId, type OrganizationDirectoryGroupItem, type OrganizationInviteItem, type OrganizationItem, type OrganizationMemberItem, Organizations, type PageFetcher, type PageParams, type PaginateOptions, type Pagination, Paginator, type PartialSuccess, type PermissionItem, Permissions, type QueryParams, type RequestBody, type RequestOptions, type ResponseBody, type RoleItem, Roles, type Schema, TokenVerifier, type TokenVerifierOptions, type WebhookDelivery, type WebhookEvent, type WebhookEventData, type WebhookEventName, authorizationErrorStatus, type components, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, isWebhookEvent, type operations, orgContext, paginate, type paths, tokenErrorStatus, withConcurrency };
+export { type AccessibleNodes, type AssignmentItem, Assignments, type CallOptions, Canopy, CanopyAuthorizerError, CanopyClient, type CanopyClientOptions, CanopyConnectionError, CanopyError, type CanopyErrorBody, type CanopyOrgContext, type CanopyTokenClaims, CanopyTokenError, type Collection, type ConcurrencyOptions, type ConditionalResult, type CursorPagination, DEFAULT_MAX_NODES, type FailureStatus, Identities, type IdentityAssignmentItem, type IdentityItem, type IdentitySessionItem, type LocalAuthorizationQuery, LocalAuthorizer, type LocalAuthorizerOptions, type LocalAuthorizerStats, type LocalDecision, type LocalDecisionEvent, type LocalDenialReason, MAX_TTL_MS, type OffsetPagination, type OperationId, type OrganizationDirectoryGroupItem, type OrganizationInviteItem, type OrganizationItem, type OrganizationMemberItem, Organizations, type PageFetcher, type PageParams, type PaginateOptions, type Pagination, Paginator, type PartialSuccess, type PermissionItem, Permissions, type QueryParams, type RequestBody, type RequestOptions, type ResponseBody, type RoleItem, Roles, type Schema, TokenVerifier, type TokenVerifierOptions, type WebhookDelivery, type WebhookEvent, type WebhookEventData, type WebhookEventName, authorizationErrorStatus, type components, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, isWebhookEvent, type operations, orgContext, paginate, type paths, tokenErrorStatus, withConcurrency };