@canopy-io/node 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @canopy-io/node
 
+## 0.13.0
+
+### Minor Changes
+
+- 51fd41e: Organization invitations name a place and a window. `organizations.createInvite()` takes an optional `role_id` (none admits a member holding nothing, only at the organization node), a `node_id` for an office or team beneath the organization, and `effective_from` / `effective_to`, copied onto the assignment the invitation grants on acceptance. `organizations.addMember()` takes the same `node_id` and dates. Someone already in the Environment, invited into an organization they don't belong to, receives a request to join (`intent: "grant"`) and accepts it with their own sign-in or password. Invitation responses gain `node_name`, `organization_node_id`, `effective_from`, `effective_to` and `invited_by_identity_id`. Types regenerated from the API spec.
+
 ## 0.12.0
 
 ### Minor Changes

package/README.md

@@ -186,6 +186,15 @@ await canopy.organizations.addMember(acme.id, {
   role_id: ownerRoleId,
 });
 
+// Invite by email straight to an office, for a fixed window. Someone already
+// in the Environment receives a request to join, and accepting is their consent.
+await canopy.organizations.createInvite(acme.id, {
+  email: "lee@acme.example",
+  role_id: agentRoleId,
+  node_id: euOfficeId,
+  effective_to: "2026-12-31T23:59:59.999Z",
+});
+
 // An organization only tightens the Environment: a second factor where the
 // Environment leaves it optional, and only some of the Environment's ways in.
 await canopy.organizations.updatePolicy(acme.id, {

package/dist/index.d.cts

@@ -1522,7 +1522,7 @@ interface paths {
         put?: never;
         /**
          * Add a member to an organization
-         * @description Adds a member. Membership is admission, not authority: with `role_id` the member also holds that role at the organization node from the start; without it they belong and hold nothing until a role is assigned. The identity must already hold an active membership in this Environment (invite by email instead for someone who does not). An identity that is already a member returns `409`; roles are added through the assignment routes. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.added`. An organization's own administrator, signed in with an identity token and admitted by `canopy:organization.manage` alone, is refused with `403` (`organization.member_add_requires_invite`): the person never agreed to join, so the administrator invites them instead.
+         * @description Adds a member. Membership is admission, not authority: with `role_id` the member also holds that role from the start, at the organization node or at the office or team `node_id` names, for the `effective_from` to `effective_to` window when given; without it they belong and hold nothing until a role is assigned (a place or dates need a role, `400 invite.window_requires_role`). The identity must already hold an active membership in this Environment (invite by email instead for someone who does not). An identity that is already a member returns `409`; roles are added through the assignment routes. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.added`. An organization's own administrator, signed in with an identity token and admitted by `canopy:organization.manage` alone, is refused with `403` (`organization.member_add_requires_invite`): the person never agreed to join, so the administrator invites them instead.
          */
         post: operations["ApiOrganizationsController_addMember"];
         delete?: never;
@@ -1586,7 +1586,7 @@ interface paths {
         put?: never;
         /**
          * Invite a member into an organization
-         * @description Invites an email into the organization with the role bound to the invitation; acceptance creates the Environment membership and the organization membership in one step. Works for emails with no identity in the Environment — one is created on acceptance. Requires the `identity.manage` permission and emits `invite.created`.
+         * @description Invites an email into the organization. `role_id` is held on acceptance at `node_id`, the organization node (the default) or an office or team beneath it, for the `effective_from` to `effective_to` window when given; with no `role_id` the invitation admits a member holding nothing, which only the organization node allows (`400 invite.malformed_assignment` beneath it). Acceptance creates what is missing in one transaction: the identity, its Environment membership, the organization membership and the role. For someone who already holds an active membership in this Environment the invitation is a request to join (`intent: grant`): accepting is their consent, proven by their password or their own sign-in. Requires the `identity.manage` permission, or `canopy:organization.manage` at the organization or `canopy:access.manage` at the place for the organization's own administrators, and emits `invite.created`.
          */
         post: operations["ApiOrganizationsController_createInvite"];
         delete?: never;
@@ -2968,12 +2968,28 @@ interface components {
             name: string;
             role_id?: string | null;
             node_id?: string | null;
+            /** @description The name of the node at `node_id`, when it has one. */
+            node_name?: string | null;
+            /** @description The organization the invitation joins, when `node_id` is an organization node or sits beneath one. */
+            organization_node_id?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants starts to count.
+             */
+            effective_from?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants stops counting.
+             */
+            effective_to?: string | null;
             has_initial_assignment: boolean;
             /** @enum {string} */
             status: "pending" | "accepted" | "revoked" | "expired";
             /** Format: date-time */
             expires_at: string;
             invited_by: string;
+            /** @description The customer's own administrator who sent it with their identity token; `invited_by` names a platform user instead. */
+            invited_by_identity_id?: string | null;
             /** Format: date-time */
             created_at: string;
         };
@@ -2999,12 +3015,28 @@ interface components {
             name: string;
             role_id?: string | null;
             node_id?: string | null;
+            /** @description The name of the node at `node_id`, when it has one. */
+            node_name?: string | null;
+            /** @description The organization the invitation joins, when `node_id` is an organization node or sits beneath one. */
+            organization_node_id?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants starts to count.
+             */
+            effective_from?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants stops counting.
+             */
+            effective_to?: string | null;
             has_initial_assignment: boolean;
             /** @enum {string} */
             status: "pending" | "accepted" | "revoked" | "expired";
             /** Format: date-time */
             expires_at: string;
             invited_by: string;
+            /** @description The customer's own administrator who sent it with their identity token; `invited_by` names a platform user instead. */
+            invited_by_identity_id?: string | null;
             /** Format: date-time */
             created_at: string;
             /** @description Tokenized URL the invitee would land on. Returned so callers that pass send_email=false can deliver it themselves. */
@@ -3023,7 +3055,7 @@ interface components {
             first_name?: string;
             /** @description Required for `activate`. Ignored for `add_to_app` and `password_reset`. */
             last_name?: string;
-            /** @description Role ID — required if node_id is provided */
+            /** @description The role the invitation grants at `node_id`. Required with a `node_id`, except an organization node, where an invitation may admit a member with no role. */
             role_id?: string;
             /** @description Node ID — required if role_id is provided */
             node_id?: string;
@@ -3032,6 +3064,16 @@ interface components {
              * @default true
              */
             send_email: boolean;
+            /**
+             * Format: date-time
+             * @description When the role starts to count (ISO 8601). Copied onto the assignment the invitation grants; needs a role.
+             */
+            effective_from?: string;
+            /**
+             * Format: date-time
+             * @description When the role stops counting (ISO 8601), after `effective_from`. Copied onto the assignment; an invitation whose window has ended by acceptance is refused with `400 invite.window_ended`.
+             */
+            effective_to?: string;
         };
         BulkCreateIdentityInvitesDto: {
             invites: components["schemas"]["CreateIdentityInviteDto"][];
@@ -3495,12 +3537,36 @@ interface components {
             identity_id: string;
             /** @description A role to hold at the organization node from the start, from the Environment's roles. Left out, the member belongs and holds nothing until a role is assigned. */
             role_id?: string;
+            /** @description Where the role is held: the organization node (the default) or an office or team beneath it. Needs a role. */
+            node_id?: string;
+            /**
+             * Format: date-time
+             * @description When the role starts to count (ISO 8601). Needs a role.
+             */
+            effective_from?: string;
+            /**
+             * Format: date-time
+             * @description When the role stops counting (ISO 8601), after `effective_from`. Needs a role.
+             */
+            effective_to?: string;
         };
         CreateOrganizationInviteDto: {
             /** @description Email to invite. Works for people with no identity in this Environment — one is created when they accept. */
             email: string;
-            /** @description The role the member will hold in this organization on acceptance. */
-            role_id: string;
+            /** @description The role the person holds on acceptance, at `node_id`. Optional at the organization node, where accepting admits a member with no role; required for a place beneath it. */
+            role_id?: string;
+            /** @description Where the role is held: the organization node (the default) or an office or team beneath it. Accepting admits the person to the organization either way. */
+            node_id?: string;
+            /**
+             * Format: date-time
+             * @description When the role starts to count (ISO 8601). Copied onto the assignment the invitation grants; needs a role.
+             */
+            effective_from?: string;
+            /**
+             * Format: date-time
+             * @description When the role stops counting (ISO 8601), after `effective_from`. Copied onto the assignment; an invitation whose window has ended by acceptance is refused with `400 invite.window_ended`.
+             */
+            effective_to?: string;
             first_name?: string;
             last_name?: string;
             /**
@@ -9103,7 +9169,7 @@ interface operations {
                     };
                 };
             };
-            /** @description The request failed validation; `role_id` and `node_id` were not given together; a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation; `role_id` came with no `node_id`, or a `node_id` with no `role_id` outside an organization node (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -9114,7 +9180,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation; `role_id` and `node_id` were not given together; a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation; `role_id` came with no `node_id`, or a `node_id` with no `role_id` outside an organization node (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/identity-invites",
                      *         "method": "POST"
@@ -9166,7 +9232,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description A pending invite already exists for this email at this scope, the identity already has access to this Environment, or the node sits inside an organization the identity is not a member of */
+            /** @description A pending invite already exists for this email at this scope, the identity already has access to this Environment and the invitation joins no organization (`invite.identity_already_in_app`), or the identity is already an active member of the organization it joins (`organization.member_exists`) */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -9177,7 +9243,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "A pending invite already exists for this email at this scope, the identity already has access to this Environment, or the node sits inside an organization the identity is not a member of",
+                     *         "message": "A pending invite already exists for this email at this scope, the identity already has access to this Environment and the invitation joins no organization (`invite.identity_already_in_app`), or the identity is already an active member of the organization it joins (`organization.member_exists`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/identity-invites",
                      *         "method": "POST"
@@ -14317,7 +14383,7 @@ interface operations {
                     };
                 };
             };
-            /** @description The request failed validation, or the role is a system role, which cannot be assigned; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation, the role is a system role, which cannot be assigned, a place or dates came with no role (`invite.window_requires_role`), or the dates end before they start; or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -14328,7 +14394,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation, or the role is a system role, which cannot be assigned; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation, the role is a system role, which cannot be assigned, a place or dates came with no role (`invite.window_requires_role`), or the dates end before they start; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/members",
                      *         "method": "POST"
@@ -14380,7 +14446,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The organization, the identity or the role does not exist in this Environment */
+            /** @description The organization, the identity or the role does not exist in this Environment, or `node_id` is not the organization or a place beneath it */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -14391,7 +14457,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "The organization, the identity or the role does not exist in this Environment",
+                     *         "message": "The organization, the identity or the role does not exist in this Environment, or `node_id` is not the organization or a place beneath it",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/members",
                      *         "method": "POST"
@@ -14824,7 +14890,7 @@ interface operations {
                     };
                 };
             };
-            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation; a place beneath the organization was named with no role (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -14835,7 +14901,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation; a place beneath the organization was named with no role (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/invites",
                      *         "method": "POST"
@@ -14887,7 +14953,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Organization not found */
+            /** @description The organization does not exist, or `node_id` is not the organization or a place beneath it */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -14898,7 +14964,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "Organization not found",
+                     *         "message": "The organization does not exist, or `node_id` is not the organization or a place beneath it",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/invites",
                      *         "method": "POST"
@@ -14908,7 +14974,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description A pending invitation already exists for this email, or the identity already has active access to this Environment */
+            /** @description A pending invitation already exists for this email at this place, or the identity is already an active member of the organization (`organization.member_exists`); give a member a role through the assignment routes */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -14919,7 +14985,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "A pending invitation already exists for this email, or the identity already has active access to this Environment",
+                     *         "message": "A pending invitation already exists for this email at this place, or the identity is already an active member of the organization (`organization.member_exists`); give a member a role through the assignment routes",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/invites",
                      *         "method": "POST"

package/dist/index.d.ts

@@ -1522,7 +1522,7 @@ interface paths {
         put?: never;
         /**
          * Add a member to an organization
-         * @description Adds a member. Membership is admission, not authority: with `role_id` the member also holds that role at the organization node from the start; without it they belong and hold nothing until a role is assigned. The identity must already hold an active membership in this Environment (invite by email instead for someone who does not). An identity that is already a member returns `409`; roles are added through the assignment routes. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.added`. An organization's own administrator, signed in with an identity token and admitted by `canopy:organization.manage` alone, is refused with `403` (`organization.member_add_requires_invite`): the person never agreed to join, so the administrator invites them instead.
+         * @description Adds a member. Membership is admission, not authority: with `role_id` the member also holds that role from the start, at the organization node or at the office or team `node_id` names, for the `effective_from` to `effective_to` window when given; without it they belong and hold nothing until a role is assigned (a place or dates need a role, `400 invite.window_requires_role`). The identity must already hold an active membership in this Environment (invite by email instead for someone who does not). An identity that is already a member returns `409`; roles are added through the assignment routes. Requires the `rbac.manage_assignments` permission at the organization and emits `organization.member.added`. An organization's own administrator, signed in with an identity token and admitted by `canopy:organization.manage` alone, is refused with `403` (`organization.member_add_requires_invite`): the person never agreed to join, so the administrator invites them instead.
          */
         post: operations["ApiOrganizationsController_addMember"];
         delete?: never;
@@ -1586,7 +1586,7 @@ interface paths {
         put?: never;
         /**
          * Invite a member into an organization
-         * @description Invites an email into the organization with the role bound to the invitation; acceptance creates the Environment membership and the organization membership in one step. Works for emails with no identity in the Environment — one is created on acceptance. Requires the `identity.manage` permission and emits `invite.created`.
+         * @description Invites an email into the organization. `role_id` is held on acceptance at `node_id`, the organization node (the default) or an office or team beneath it, for the `effective_from` to `effective_to` window when given; with no `role_id` the invitation admits a member holding nothing, which only the organization node allows (`400 invite.malformed_assignment` beneath it). Acceptance creates what is missing in one transaction: the identity, its Environment membership, the organization membership and the role. For someone who already holds an active membership in this Environment the invitation is a request to join (`intent: grant`): accepting is their consent, proven by their password or their own sign-in. Requires the `identity.manage` permission, or `canopy:organization.manage` at the organization or `canopy:access.manage` at the place for the organization's own administrators, and emits `invite.created`.
          */
         post: operations["ApiOrganizationsController_createInvite"];
         delete?: never;
@@ -2968,12 +2968,28 @@ interface components {
             name: string;
             role_id?: string | null;
             node_id?: string | null;
+            /** @description The name of the node at `node_id`, when it has one. */
+            node_name?: string | null;
+            /** @description The organization the invitation joins, when `node_id` is an organization node or sits beneath one. */
+            organization_node_id?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants starts to count.
+             */
+            effective_from?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants stops counting.
+             */
+            effective_to?: string | null;
             has_initial_assignment: boolean;
             /** @enum {string} */
             status: "pending" | "accepted" | "revoked" | "expired";
             /** Format: date-time */
             expires_at: string;
             invited_by: string;
+            /** @description The customer's own administrator who sent it with their identity token; `invited_by` names a platform user instead. */
+            invited_by_identity_id?: string | null;
             /** Format: date-time */
             created_at: string;
         };
@@ -2999,12 +3015,28 @@ interface components {
             name: string;
             role_id?: string | null;
             node_id?: string | null;
+            /** @description The name of the node at `node_id`, when it has one. */
+            node_name?: string | null;
+            /** @description The organization the invitation joins, when `node_id` is an organization node or sits beneath one. */
+            organization_node_id?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants starts to count.
+             */
+            effective_from?: string | null;
+            /**
+             * Format: date-time
+             * @description When the role it grants stops counting.
+             */
+            effective_to?: string | null;
             has_initial_assignment: boolean;
             /** @enum {string} */
             status: "pending" | "accepted" | "revoked" | "expired";
             /** Format: date-time */
             expires_at: string;
             invited_by: string;
+            /** @description The customer's own administrator who sent it with their identity token; `invited_by` names a platform user instead. */
+            invited_by_identity_id?: string | null;
             /** Format: date-time */
             created_at: string;
             /** @description Tokenized URL the invitee would land on. Returned so callers that pass send_email=false can deliver it themselves. */
@@ -3023,7 +3055,7 @@ interface components {
             first_name?: string;
             /** @description Required for `activate`. Ignored for `add_to_app` and `password_reset`. */
             last_name?: string;
-            /** @description Role ID — required if node_id is provided */
+            /** @description The role the invitation grants at `node_id`. Required with a `node_id`, except an organization node, where an invitation may admit a member with no role. */
             role_id?: string;
             /** @description Node ID — required if role_id is provided */
             node_id?: string;
@@ -3032,6 +3064,16 @@ interface components {
              * @default true
              */
             send_email: boolean;
+            /**
+             * Format: date-time
+             * @description When the role starts to count (ISO 8601). Copied onto the assignment the invitation grants; needs a role.
+             */
+            effective_from?: string;
+            /**
+             * Format: date-time
+             * @description When the role stops counting (ISO 8601), after `effective_from`. Copied onto the assignment; an invitation whose window has ended by acceptance is refused with `400 invite.window_ended`.
+             */
+            effective_to?: string;
         };
         BulkCreateIdentityInvitesDto: {
             invites: components["schemas"]["CreateIdentityInviteDto"][];
@@ -3495,12 +3537,36 @@ interface components {
             identity_id: string;
             /** @description A role to hold at the organization node from the start, from the Environment's roles. Left out, the member belongs and holds nothing until a role is assigned. */
             role_id?: string;
+            /** @description Where the role is held: the organization node (the default) or an office or team beneath it. Needs a role. */
+            node_id?: string;
+            /**
+             * Format: date-time
+             * @description When the role starts to count (ISO 8601). Needs a role.
+             */
+            effective_from?: string;
+            /**
+             * Format: date-time
+             * @description When the role stops counting (ISO 8601), after `effective_from`. Needs a role.
+             */
+            effective_to?: string;
         };
         CreateOrganizationInviteDto: {
             /** @description Email to invite. Works for people with no identity in this Environment — one is created when they accept. */
             email: string;
-            /** @description The role the member will hold in this organization on acceptance. */
-            role_id: string;
+            /** @description The role the person holds on acceptance, at `node_id`. Optional at the organization node, where accepting admits a member with no role; required for a place beneath it. */
+            role_id?: string;
+            /** @description Where the role is held: the organization node (the default) or an office or team beneath it. Accepting admits the person to the organization either way. */
+            node_id?: string;
+            /**
+             * Format: date-time
+             * @description When the role starts to count (ISO 8601). Copied onto the assignment the invitation grants; needs a role.
+             */
+            effective_from?: string;
+            /**
+             * Format: date-time
+             * @description When the role stops counting (ISO 8601), after `effective_from`. Copied onto the assignment; an invitation whose window has ended by acceptance is refused with `400 invite.window_ended`.
+             */
+            effective_to?: string;
             first_name?: string;
             last_name?: string;
             /**
@@ -9103,7 +9169,7 @@ interface operations {
                     };
                 };
             };
-            /** @description The request failed validation; `role_id` and `node_id` were not given together; a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation; `role_id` came with no `node_id`, or a `node_id` with no `role_id` outside an organization node (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -9114,7 +9180,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation; `role_id` and `node_id` were not given together; a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation; `role_id` came with no `node_id`, or a `node_id` with no `role_id` outside an organization node (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); a `password_reset` invite carries a role assignment or names an email with no identity; or `client_id` names no active OAuth client in this Environment, or one with no invite redirect URL; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/identity-invites",
                      *         "method": "POST"
@@ -9166,7 +9232,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description A pending invite already exists for this email at this scope, the identity already has access to this Environment, or the node sits inside an organization the identity is not a member of */
+            /** @description A pending invite already exists for this email at this scope, the identity already has access to this Environment and the invitation joins no organization (`invite.identity_already_in_app`), or the identity is already an active member of the organization it joins (`organization.member_exists`) */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -9177,7 +9243,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "A pending invite already exists for this email at this scope, the identity already has access to this Environment, or the node sits inside an organization the identity is not a member of",
+                     *         "message": "A pending invite already exists for this email at this scope, the identity already has access to this Environment and the invitation joins no organization (`invite.identity_already_in_app`), or the identity is already an active member of the organization it joins (`organization.member_exists`)",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/identity-invites",
                      *         "method": "POST"
@@ -14317,7 +14383,7 @@ interface operations {
                     };
                 };
             };
-            /** @description The request failed validation, or the role is a system role, which cannot be assigned; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation, the role is a system role, which cannot be assigned, a place or dates came with no role (`invite.window_requires_role`), or the dates end before they start; or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -14328,7 +14394,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation, or the role is a system role, which cannot be assigned; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation, the role is a system role, which cannot be assigned, a place or dates came with no role (`invite.window_requires_role`), or the dates end before they start; or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/members",
                      *         "method": "POST"
@@ -14380,7 +14446,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description The organization, the identity or the role does not exist in this Environment */
+            /** @description The organization, the identity or the role does not exist in this Environment, or `node_id` is not the organization or a place beneath it */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -14391,7 +14457,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "The organization, the identity or the role does not exist in this Environment",
+                     *         "message": "The organization, the identity or the role does not exist in this Environment, or `node_id` is not the organization or a place beneath it",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/members",
                      *         "method": "POST"
@@ -14824,7 +14890,7 @@ interface operations {
                     };
                 };
             };
-            /** @description The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header */
+            /** @description The request failed validation; a place beneath the organization was named with no role (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); or the request sent both an `X-API-Key` and an `Authorization` header */
             400: {
                 headers: {
                     [name: string]: unknown;
@@ -14835,7 +14901,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 400,
                      *         "code": null,
-                     *         "message": "The request failed validation: a body field, a query parameter or an id in the path is missing, malformed or out of range; or the request sent both an `X-API-Key` and an `Authorization` header",
+                     *         "message": "The request failed validation; a place beneath the organization was named with no role (`invite.malformed_assignment`); dates came with no role (`invite.window_requires_role`), end before they start, or have already ended (`invite.window_ended`); or the request sent both an `X-API-Key` and an `Authorization` header",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/invites",
                      *         "method": "POST"
@@ -14887,7 +14953,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Organization not found */
+            /** @description The organization does not exist, or `node_id` is not the organization or a place beneath it */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -14898,7 +14964,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 404,
                      *         "code": null,
-                     *         "message": "Organization not found",
+                     *         "message": "The organization does not exist, or `node_id` is not the organization or a place beneath it",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/invites",
                      *         "method": "POST"
@@ -14908,7 +14974,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description A pending invitation already exists for this email, or the identity already has active access to this Environment */
+            /** @description A pending invitation already exists for this email at this place, or the identity is already an active member of the organization (`organization.member_exists`); give a member a role through the assignment routes */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -14919,7 +14985,7 @@ interface operations {
                      *       "error": {
                      *         "statusCode": 409,
                      *         "code": null,
-                     *         "message": "A pending invitation already exists for this email, or the identity already has active access to this Environment",
+                     *         "message": "A pending invitation already exists for this email at this place, or the identity is already an active member of the organization (`organization.member_exists`); give a member a role through the assignment routes",
                      *         "timestamp": "2026-04-20T12:00:00.000Z",
                      *         "path": "/api/v1/organizations/{id}/invites",
                      *         "method": "POST"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canopy-io/node",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Official TypeScript SDK for Canopy \u2014 hierarchical identity and access management.",
   "license": "MIT",
   "author": "Canopy Identity Inc.",