@hanzo/rooms 0.1.0

package/dist/lib/home.d.ts

@@ -0,0 +1,61 @@
+/**
+ * What the home reads, and the two reads `@hanzo/ai` publishes no hook for.
+ *
+ * Sessions, agents, threads and people all have hooks — the home uses those and
+ * adds nothing. Projects and connected apps do not, so they go through the
+ * client's own transport (`client.http`, which the SDK exposes for exactly
+ * this) rather than a second fetch stack with a second answer about who the
+ * bearer is.
+ *
+ * EVERY READER ANSWERS `null` FOR UNKNOWN. An empty array is a fact — the org
+ * has none — and a failed or unmade request is not that fact. Collapsing the
+ * two is how a card comes to say "0 projects" about a question nobody asked.
+ */
+import type { AiClient } from '@hanzo/ai';
+/** A site the org has deployed. */
+export interface Project {
+    slug: string;
+    name?: string;
+    /** Where it serves, when it is serving. */
+    liveUrl?: string;
+    /** Unix seconds. */
+    updatedAt?: number;
+}
+/** A service the org can connect, and whether it has. */
+export interface App {
+    id: string;
+    name: string;
+    connected?: boolean;
+}
+/**
+ * Where a teammate is invited.
+ *
+ * IAM owns invitations and `@hanzo/iam` publishes no method that sends one, so
+ * the invite LEAVES this surface for hanzo.id's own org members page rather
+ * than this site growing an invite backend of its own. `Shell.tsx` states the
+ * same address privately; it should read this one.
+ */
+/**
+ * WHERE A TEAMMATE IS ACTUALLY ADDED.
+ *
+ * It pointed at the account settings of the identity service, which is a
+ * different question with a similar name: that page is where a person edits
+ * THEMSELVES, so pressing Invite people took you off this site and showed you
+ * your own settings. This page issues the invitation — it mints the single-use
+ * code, files it against the org, and hands back the link to send — so the
+ * control and its verb are the same thing again.
+ *
+ * A PATH, not a URL. It is a page of this app, so it is reached the way every
+ * other page of this app is, and the three doors that offer it (the empty
+ * room's tile, the Create menu, the sidebar's row) all read this one line.
+ */
+export declare const invite: () => string;
+/** The org's projects, newest first. */
+export declare function projects(client: AiClient, signal?: AbortSignal): Promise<Project[]>;
+/**
+ * Every app the platform can connect, carrying whether this org has.
+ *
+ * The route answers the whole catalogue — connected and not — so the caller
+ * counts rather than being told a number.
+ */
+export declare function apps(client: AiClient, signal?: AbortSignal): Promise<App[]>;

package/dist/lib/home.js

@@ -0,0 +1,54 @@
+/**
+ * What the home reads, and the two reads `@hanzo/ai` publishes no hook for.
+ *
+ * Sessions, agents, threads and people all have hooks — the home uses those and
+ * adds nothing. Projects and connected apps do not, so they go through the
+ * client's own transport (`client.http`, which the SDK exposes for exactly
+ * this) rather than a second fetch stack with a second answer about who the
+ * bearer is.
+ *
+ * EVERY READER ANSWERS `null` FOR UNKNOWN. An empty array is a fact — the org
+ * has none — and a failed or unmade request is not that fact. Collapsing the
+ * two is how a card comes to say "0 projects" about a question nobody asked.
+ */
+import { site } from '../where.js';
+/**
+ * Where a teammate is invited.
+ *
+ * IAM owns invitations and `@hanzo/iam` publishes no method that sends one, so
+ * the invite LEAVES this surface for hanzo.id's own org members page rather
+ * than this site growing an invite backend of its own. `Shell.tsx` states the
+ * same address privately; it should read this one.
+ */
+/**
+ * WHERE A TEAMMATE IS ACTUALLY ADDED.
+ *
+ * It pointed at the account settings of the identity service, which is a
+ * different question with a similar name: that page is where a person edits
+ * THEMSELVES, so pressing Invite people took you off this site and showed you
+ * your own settings. This page issues the invitation — it mints the single-use
+ * code, files it against the org, and hands back the link to send — so the
+ * control and its verb are the same thing again.
+ *
+ * A PATH, not a URL. It is a page of this app, so it is reached the way every
+ * other page of this app is, and the three doors that offer it (the empty
+ * room's tile, the Create menu, the sidebar's row) all read this one line.
+ */
+export const invite = () => site('/account/organization');
+/** The org's projects, newest first. */
+export async function projects(client, signal) {
+    const rows = await client.http.json({ path: '/v1/projects', signal });
+    if (!Array.isArray(rows))
+        return [];
+    return [...rows].sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0));
+}
+/**
+ * Every app the platform can connect, carrying whether this org has.
+ *
+ * The route answers the whole catalogue — connected and not — so the caller
+ * counts rather than being told a number.
+ */
+export async function apps(client, signal) {
+    const out = await client.http.json({ path: '/v1/integrations', signal });
+    return out?.providers ?? [];
+}

package/dist/lib/host.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Which host this export is read on, and what that host keeps.
+ *
+ * hanzo.ai is the site for a stranger and the app for a member: the web app is
+ * `/` once signed in (app/page.tsx), beside /chat. hanzo.team is the
+ * workspace, its own app (hanzo-apps/team) with Home at its root. This export
+ * still carries the rooms, so a room asked for on the apex is sent to the same
+ * room on hanzo.team, and `output: 'export'` has no server to do that, so it is
+ * decided in the browser off the hostname, here.
+ *
+ * Two predicates, one per product: `apex()` for the app, `team()` for the
+ * workspace. Every host that is neither (localhost, a preview) draws the whole
+ * workspace and admits the way the apex does.
+ */
+/** The workspace's own address. */
+export declare const WORKSPACE = "https://hanzo.team";
+/**
+ * The workspace, signed in. hanzo.team keeps its own session (its own origin's
+ * storage), so a reader signed in here arrives there signed out and is shown the
+ * landing. `?signin` asks it to start the sign-in on arrival instead; hanzo.id
+ * answers at once for a browser already signed in there, so the reader lands in
+ * the workspace with nothing to press.
+ */
+export declare const ENTRY = "https://hanzo.team/?signin";
+/**
+ * Where a business signs up for Hanzo Team: hanzo.team's /start. Email or a
+ * provider at hanzo.id, then the team's name, invitations and seats, then the
+ * Team plan's checkout — on the workspace's own origin, which is where the new
+ * team's session has to live.
+ */
+export declare const START = "https://hanzo.team/start";
+/**
+ * The web app, at `/` for a signed-in reader, in two modes. Chat is the default.
+ * Dev is @hanzo/build's `<Builder>`, and what it shows rides ONE query, `?at=`,
+ * in the builder's own grammar (`route` in @hanzo/build): '' New, `sess_<id>` a
+ * run, `-/<screen>`, `-/settings[/<section>]`, `-/customize[/<tab>]`,
+ * `-/plans`, `<slug>` a project. A query and not a path, because a static
+ * export has no server to answer a path under `/`.
+ */
+export declare const AT = "at";
+/** `/` in Dev at an app address; '' is Dev's New, `/?at=`. The key is the mode. */
+export declare const app: (path: string) => string;
+/**
+ * Chat, the app's default mode: `/` is a new conversation and `?chat=<id>` one
+ * of the reader's. So the address says which mode the app is in — `at` for Dev,
+ * anything else Chat — and a reload keeps it.
+ */
+export declare const TALK = "chat";
+/** `/` in Chat, on a conversation, or `/` itself for a new one. */
+export declare const talk: (id?: string | null) => string;
+/**
+ * The door opened on one run or project: `?run=` or `?project=`, the query the
+ * door turns into `?at=` — and the one the console and shared links already
+ * carry. Only a value that is exactly a session id or a project slug is
+ * carried; anything else opens /dev itself, so no caller can make this name
+ * another address.
+ */
+export declare const dev: (ref?: string | null) => string;
+/**
+ * The workspace's rooms: every route under app/(app) the apex does not keep.
+ *
+ * Derived from the tree `scripts/sync-rooms.mjs` walks, so a room added under
+ * app/(app) lives on hanzo.team unless the apex names it above.
+ */
+export declare const ROOMS: readonly string[];
+/** The apex's hosts, where the app is served and the rooms are not. */
+export declare const APEX: readonly string[];
+/** Whether a host is the apex. */
+export declare const apex: (hostname: string) => boolean;
+/** Whether a host is the workspace's own, where every room asks for a paid plan. */
+export declare const team: (hostname: string) => boolean;
+/** Whether an address on this export, query and all, opens one of the workspace's rooms. */
+export declare function room(address: string): boolean;
+/**
+ * Where an address belongs when it is asked for on `hostname`: on a `guest`
+ * alias, the same address on hanzo.ai, because every room signs in and a guest
+ * host cannot; on the apex, the same room and query on the workspace; otherwise
+ * null. Home is the workspace's root, so /home?room=x lands on /?room=x.
+ */
+export declare const away: (hostname: string, address: string) => string | null;
+/** Where a sign-in started on a `guest` host is finished. */
+export declare const SIGNIN = "https://hanzo.ai";
+/**
+ * The Hanzo App, to get: the page with Download, Install CLI and Open in web.
+ * It is this export's /app, served as the root of hanzo.app (universe
+ * static-sites `hanzo-app`), so it is linked by that address and hanzo.ai/app
+ * forwards there.
+ */
+export declare const GET = "https://hanzo.app";
+/**
+ * The app, opened from another host: the chat at hanzo.ai/chat. A reader who
+ * is signed out is asked to sign in there, on hanzo.ai's own page, and lands
+ * back in the chat.
+ */
+export declare const WEB = "https://hanzo.ai/chat";
+/**
+ * Whether a host serves this export and signs nobody in: hanzo.app, whose root
+ * is the page above; every `<slug>.hanzo.app` alias the Sites plane serves it
+ * at; and hanzo.chat, whose root is /forward. hanzo.app is a namespace
+ * customers publish into and hanzo.chat is only an address for the chat, so no
+ * sign-in runs under either: every address that needs one is the same address
+ * on hanzo.ai.
+ */
+export declare const guest: (hostname: string) => boolean;

package/dist/lib/host.js

@@ -0,0 +1,132 @@
+/**
+ * Which host this export is read on, and what that host keeps.
+ *
+ * hanzo.ai is the site for a stranger and the app for a member: the web app is
+ * `/` once signed in (app/page.tsx), beside /chat. hanzo.team is the
+ * workspace, its own app (hanzo-apps/team) with Home at its root. This export
+ * still carries the rooms, so a room asked for on the apex is sent to the same
+ * room on hanzo.team, and `output: 'export'` has no server to do that, so it is
+ * decided in the browser off the hostname, here.
+ *
+ * Two predicates, one per product: `apex()` for the app, `team()` for the
+ * workspace. Every host that is neither (localhost, a preview) draws the whole
+ * workspace and admits the way the apex does.
+ */
+import APP from './rooms.json' with { type: 'json' };
+import { site } from '../where.js';
+/** The workspace's own address. */
+export const WORKSPACE = 'https://hanzo.team';
+/**
+ * The workspace, signed in. hanzo.team keeps its own session (its own origin's
+ * storage), so a reader signed in here arrives there signed out and is shown the
+ * landing. `?signin` asks it to start the sign-in on arrival instead; hanzo.id
+ * answers at once for a browser already signed in there, so the reader lands in
+ * the workspace with nothing to press.
+ */
+export const ENTRY = `${WORKSPACE}/?signin`;
+/**
+ * Where a business signs up for Hanzo Team: hanzo.team's /start. Email or a
+ * provider at hanzo.id, then the team's name, invitations and seats, then the
+ * Team plan's checkout — on the workspace's own origin, which is where the new
+ * team's session has to live.
+ */
+export const START = `${WORKSPACE}/start`;
+/**
+ * The web app, at `/` for a signed-in reader, in two modes. Chat is the default.
+ * Dev is @hanzo/build's `<Builder>`, and what it shows rides ONE query, `?at=`,
+ * in the builder's own grammar (`route` in @hanzo/build): '' New, `sess_<id>` a
+ * run, `-/<screen>`, `-/settings[/<section>]`, `-/customize[/<tab>]`,
+ * `-/plans`, `<slug>` a project. A query and not a path, because a static
+ * export has no server to answer a path under `/`.
+ */
+export const AT = 'at';
+/** `/` in Dev at an app address; '' is Dev's New, `/?at=`. The key is the mode. */
+export const app = (path) => `/?${AT}=${path}`;
+/**
+ * Chat, the app's default mode: `/` is a new conversation and `?chat=<id>` one
+ * of the reader's. So the address says which mode the app is in — `at` for Dev,
+ * anything else Chat — and a reload keeps it.
+ */
+export const TALK = 'chat';
+/** `/` in Chat, on a conversation, or `/` itself for a new one. */
+export const talk = (id) => (id ? `/?${TALK}=${encodeURIComponent(id)}` : '/');
+/**
+ * The door into the app: every "Try Hanzo Dev" link, the rail's Dev, the
+ * console's "open in the builder", dev.hanzo.ai. It signs a stranger in and
+ * forwards a member to Dev in the app, `/?at=` (app/(app)/dev/_door.tsx). It is
+ * the app's page, so it is reached through `site()`: here on hanzo.ai, across
+ * to hanzo.ai from hanzo.team.
+ */
+const DEV = '/dev';
+/** A run, as the platform mints its id. */
+const SESSION = /^sess_[0-9a-f]{32}$/;
+/** A project, as the Sites plane slugs it. */
+const SLUG = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
+/**
+ * The door opened on one run or project: `?run=` or `?project=`, the query the
+ * door turns into `?at=` — and the one the console and shared links already
+ * carry. Only a value that is exactly a session id or a project slug is
+ * carried; anything else opens /dev itself, so no caller can make this name
+ * another address.
+ */
+export const dev = (ref) => site(!ref ? DEV : SESSION.test(ref) ? `${DEV}?run=${ref}` : SLUG.test(ref) ? `${DEV}?project=${ref}` : DEV);
+/** The routes under app/(app) the apex keeps: the app — /chat, a chat shared by link, and /dev — and three surfaces that are not the workspace's. */
+const KEPT = new Set(['/chat', '/chat/shared', '/dev', '/vibe', '/beluga', '/dashboard']);
+/** Settings, and every page under it: the person's and the organization's, served wherever the app is. */
+const SETTINGS = '/settings';
+/**
+ * The workspace's rooms: every route under app/(app) the apex does not keep.
+ *
+ * Derived from the tree `scripts/sync-rooms.mjs` walks, so a room added under
+ * app/(app) lives on hanzo.team unless the apex names it above.
+ */
+export const ROOMS = APP.filter((path) => !KEPT.has(path) && path !== SETTINGS && !path.startsWith(`${SETTINGS}/`));
+/** The apex's hosts, where the app is served and the rooms are not. */
+export const APEX = ['hanzo.ai', 'www.hanzo.ai'];
+/** Whether a host is the apex. */
+export const apex = (hostname) => APEX.includes(hostname);
+/** Whether a host is the workspace's own, where every room asks for a paid plan. */
+export const team = (hostname) => hostname === 'hanzo.team' || hostname === 'www.hanzo.team';
+/** Whether an address on this export, query and all, opens one of the workspace's rooms. */
+export function room(address) {
+    const path = address.split(/[?#]/)[0].replace(/\/+$/, '') || '/';
+    return ROOMS.includes(path);
+}
+/**
+ * Where an address belongs when it is asked for on `hostname`: on a `guest`
+ * alias, the same address on hanzo.ai, because every room signs in and a guest
+ * host cannot; on the apex, the same room and query on the workspace; otherwise
+ * null. Home is the workspace's root, so /home?room=x lands on /?room=x.
+ */
+export const away = (hostname, address) => {
+    if (guest(hostname))
+        return SIGNIN + address;
+    if (!apex(hostname) || !room(address))
+        return null;
+    const home = address.match(/^\/home\/?(?=[?#]|$)/);
+    return home ? `${WORKSPACE}/${address.slice(home[0].length)}` : `${WORKSPACE}${address}`;
+};
+/** Where a sign-in started on a `guest` host is finished. */
+export const SIGNIN = 'https://hanzo.ai';
+/**
+ * The Hanzo App, to get: the page with Download, Install CLI and Open in web.
+ * It is this export's /app, served as the root of hanzo.app (universe
+ * static-sites `hanzo-app`), so it is linked by that address and hanzo.ai/app
+ * forwards there.
+ */
+export const GET = 'https://hanzo.app';
+/**
+ * The app, opened from another host: the chat at hanzo.ai/chat. A reader who
+ * is signed out is asked to sign in there, on hanzo.ai's own page, and lands
+ * back in the chat.
+ */
+export const WEB = `${SIGNIN}/chat`;
+/**
+ * Whether a host serves this export and signs nobody in: hanzo.app, whose root
+ * is the page above; every `<slug>.hanzo.app` alias the Sites plane serves it
+ * at; and hanzo.chat, whose root is /forward. hanzo.app is a namespace
+ * customers publish into and hanzo.chat is only an address for the chat, so no
+ * sign-in runs under either: every address that needs one is the same address
+ * on hanzo.ai.
+ */
+export const guest = (hostname) => hostname === 'hanzo.app' || hostname.endsWith('.hanzo.app') || hostname === 'hanzo.chat';

package/dist/lib/hostname.d.ts

@@ -0,0 +1 @@
+export declare function useHost(): string;

package/dist/lib/hostname.js

@@ -0,0 +1,14 @@
+'use client';
+import { useSyncExternalStore } from 'react';
+/**
+ * This page's hostname once React owns it, and '' in the render that hydrates.
+ *
+ * The export is prerendered with no host at all, so the server's answer is the
+ * empty string and hydration's first client render agrees with it; the next
+ * render has the real one. `useHydrated`'s shape, for the same reason: nothing
+ * subscribes, because a page's host never changes under it.
+ */
+const NEVER = () => () => { };
+export function useHost() {
+    return useSyncExternalStore(NEVER, () => window.location.hostname, () => '');
+}

package/dist/lib/hydrated.d.ts

@@ -0,0 +1 @@
+export declare function useHydrated(): boolean;

package/dist/lib/hydrated.js

@@ -0,0 +1,20 @@
+'use client';
+import { useSyncExternalStore } from 'react';
+/**
+ * False while the server's markup is on screen, true once React owns it.
+ *
+ * Three places needed this and each wrote it as `useState(false)` plus
+ * `useEffect(() => setReady(true), [])` — the shape
+ * `react-hooks/set-state-in-effect` names, and a second render on every mount.
+ *
+ * `useSyncExternalStore` says it without the copy: the server snapshot is
+ * `false`, so the SSR'd markup and the first client paint agree and hydration
+ * matches; the client snapshot is `true`, so the very next render — the one
+ * hydration already performs — has the real answer. Nothing subscribes, because
+ * nothing changes after that, which is why `subscribe` returns an unsubscribe
+ * that does nothing and is defined at module scope so its identity never moves.
+ */
+const NEVER = () => () => { };
+export function useHydrated() {
+    return useSyncExternalStore(NEVER, () => true, () => false);
+}

package/dist/lib/integrations.d.ts

@@ -0,0 +1,21 @@
+/**
+ * An SDK, framework or platform the host publishes a guide for. The catalogue
+ * is the host's content (hanzo.ai's /integrations) and arrives through
+ * `configure({ integrations })`; Directory lists it as the apps a team connects.
+ */
+export interface Integration {
+    slug: string;
+    name: string;
+    description: string;
+    category: 'sdk' | 'framework' | 'platform' | 'infra' | 'language';
+    icon: string;
+    examples: {
+        lang: string;
+        label: string;
+        code: string;
+    }[];
+    upstream: string;
+    creator: string;
+    creatorUrl: string;
+    license: string;
+}

package/dist/lib/integrations.js

@@ -0,0 +1 @@
+export {};

package/dist/lib/intent.d.ts

@@ -0,0 +1,6 @@
+export declare function markSignupIntent(): void;
+export declare function markMethod(method: string): void;
+export declare function signinMethod(): string;
+/** Read-once: returns true when this callback completes a signup, and clears. */
+export declare function takeSignupIntent(): boolean;
+export declare function countSignup(method?: string): void;

package/dist/lib/intent.js

@@ -0,0 +1,71 @@
+import { track } from './tags.js';
+/**
+ * Signup vs login, decided in ONE place.
+ *
+ * IAM hosts the form, so /auth/callback sees the same redirect for a brand-new
+ * account and a returning sign-in — and counting a returning login as a signup
+ * would silently inflate the top-line conversion. /signup marks the intent
+ * before handing off; the callback takes it (read-once) and picks the event.
+ *
+ * sessionStorage, not localStorage: the intent must not survive the tab.
+ */
+const KEY = 'hz_signup_intent';
+export function markSignupIntent() {
+    try {
+        window.sessionStorage.setItem(KEY, '1');
+    }
+    catch {
+        /* private mode — the callback then reports login_completed; never throw */
+    }
+}
+/**
+ * How this tab is signing in, written when the person commits to a way:
+ * `email` (a new account), `password`, `code`, a provider's kind (`google`,
+ * `github`), `hanzo.id` (IAM's own page), or `session` (a hanzo.id session,
+ * asked silently). The callback's login and the first organization's sign-up
+ * carry it as `method`; a sign-in that began nowhere on this site is `hanzo.id`.
+ */
+const METHOD = 'hz_signin_method';
+export function markMethod(method) {
+    try {
+        window.sessionStorage.setItem(METHOD, method);
+    }
+    catch {
+        /* private mode — the method reads as hanzo.id; never throw */
+    }
+}
+export function signinMethod() {
+    try {
+        return window.sessionStorage.getItem(METHOD) || 'hanzo.id';
+    }
+    catch {
+        return 'hanzo.id';
+    }
+}
+/** Read-once: returns true when this callback completes a signup, and clears. */
+export function takeSignupIntent() {
+    try {
+        const had = window.sessionStorage.getItem(KEY) === '1';
+        window.sessionStorage.removeItem(KEY);
+        return had;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The account was created: signup_completed, once per tab however many places
+ * could say so (the terms page's Create account, the first organization).
+ */
+const COUNTED = 'hz_signup_counted';
+export function countSignup(method = signinMethod()) {
+    try {
+        if (window.sessionStorage.getItem(COUNTED))
+            return;
+        window.sessionStorage.setItem(COUNTED, '1');
+    }
+    catch {
+        /* private mode — counted on every call rather than never */
+    }
+    track('signup_completed', { method });
+}

package/dist/lib/invite.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Organization invitations, on the real IAM surface.
+ *
+ * The contract, source-verified end to end:
+ *  - create   POST   /v1/iam/invitations                (schema iam.invitations.Input)
+ *  - list     GET    /v1/iam/invitations?owner=<org>    → { invitations, total }
+ *  - withdraw DELETE /v1/iam/invitations/<owner>/<name>
+ *  - send     POST   /v1/iam/invitations/<owner>/<name>/send
+ *             {} → { sent, to }: IAM emails the join link to the address the
+ *             invitation is pinned to, from the org of the application the
+ *             caller's access token was issued to (hanzo-app here).
+ *  - redeem   https://hanzo.id/join?client_id=<CLIENT>&invite=<CODE>&org=<owner>
+ *             — the link IAM emails, built here identically. A new person
+ *             creates their account there with the code, and a signed-in one
+ *             accepts it; the server model (iam pkg/schema/invitation.go)
+ *             gates on State "Active", counts UsedCount against Quota, and an
+ *             Email pin constrains who may redeem.
+ *
+ * A refusal states its reason. 401 is the credential, 403 is permission —
+ * neither is "try again", so neither ever says it.
+ */
+export interface Invitation {
+    owner: string;
+    name: string;
+    displayName: string;
+    code: string;
+    quota: number;
+    usedCount: number;
+    email?: string;
+    state: string;
+    createdTime?: string;
+}
+export declare class InviteRefusal extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/** The link a member joins by, on the same IAM the account panel signs into.
+ *  Those two were separately configurable and neither name was set anywhere, so
+ *  pointing the app at another IAM would have moved one and left the other. It is
+ *  the link IAM emails, parameter for parameter, so a copied link and an emailed
+ *  one are the same link: the application the member joins through, the code, and
+ *  the org IAM looks the code up in. */
+export declare function inviteLink(org: string, code: string): string;
+/** How many people one shared invite link admits. */
+export declare const LINK_SEATS = 25;
+/**
+ * Issues one invitation and returns it: pinned to an email and redeemable once,
+ * or open to anyone with the link for `quota` joins. The caller owns telling the
+ * person — `sendInvitation` emails a pinned one, and the link is
+ * `inviteLink(invitation.owner, invitation.code)`.
+ */
+export declare function createInvitation(org: string, email?: string, quota?: number): Promise<Invitation>;
+/**
+ * One organization's invitations, newest first, redeemed ones included.
+ *
+ * The organization is named as `?owner=`, the one input IAM's list reads. A
+ * read that names none is authorized against no organization and refused.
+ */
+export declare function listInvitations(org: string): Promise<Invitation[]>;
+/**
+ * Emails the join link to the address an invitation is pinned to, and returns
+ * the address IAM sent it to. A refusal carries IAM's own reason.
+ */
+export declare function sendInvitation(inv: Pick<Invitation, 'owner' | 'name'>): Promise<string>;
+/**
+ * The organization's shared invite link: an active invitation pinned to nobody
+ * with a seat left. Pinned invitations are one person's and are not it.
+ */
+export declare function shareable(rows: Invitation[]): Invitation | undefined;
+/** Withdraws an invitation so its code stops redeeming. */
+export declare function withdrawInvitation(inv: Pick<Invitation, 'owner' | 'name'>): Promise<void>;
+/**
+ * Sets how the organization APPEARS: an image, or one emoji, or neither.
+ *
+ * `POST /v1/iam/organizations/avatar` writes those two fields onto the stored
+ * row and touches nothing else — which the general update cannot do, because it
+ * replaces the whole record and a record read back arrives MASKED, so a
+ * read-modify-write through it would persist the mask over the organization's
+ * own credential settings. That is IAM's own reason for publishing this route,
+ * and it is why the logo does not go through `updateOrganization`.
+ *
+ * An image is an https link or the bytes inline as a data URL, up to 96 KiB —
+ * the same bound and the same shape `lib/mark.ts` already produces for a
+ * person's photograph, so a logo is not a second kind of picture.
+ */
+export declare function setOrganizationMark(owner: string, name: string, mark: {
+    avatar?: string;
+    emoji?: string;
+}): Promise<void>;
+/**
+ * Changes how an organization READS: its display name and its website.
+ *
+ * `POST /v1/iam/organizations/profile`, the sibling of the avatar route, and it
+ * exists for the same reason. Update REPLACES the record, so sending just a new
+ * name blanks the website and the sign-in rules — and a record read back arrives
+ * MASKED, so the obvious read-modify-write stores "***" as the master password.
+ * One costs the organization its settings, the other its credentials. This
+ * writes the fields it names and touches nothing else.
+ *
+ * A field left `undefined` is not sent and not changed; `''` is sent and clears.
+ */
+export declare function setOrganizationProfile(owner: string, name: string, profile: {
+    displayName?: string;
+    websiteUrl?: string;
+}): Promise<void>;
+/** One person in the organization. */
+export interface Member {
+    /** "<homeOrg>/<username>", the membership's key. */
+    id: string;
+    name: string;
+    email: string;
+    /** The role IAM gives them here: owner | admin | member. */
+    role: string;
+    /**
+     * Their account LIVES in this org, so their access is the account's own and
+     * not a membership row: IAM refuses to revoke it (the account is disabled
+     * instead) and reads their role off the account (store.HomeRole).
+     */
+    home: boolean;
+}
+/**
+ * The organization's people: everyone who may act in it, with their role.
+ *
+ * Two reads, because IAM grants access two ways: a MEMBERSHIP row (someone who
+ * lives in another org and was let into this one) and an account that LIVES in
+ * this org, whose access is the account itself and has no row. A person usually
+ * lives in their own personal organization and acts in a team one, so a team
+ * org's people are mostly rows; an older org's people mostly live in it.
+ *
+ * A membership row carries the account and the role and no name, and IAM lets a
+ * reader open accounts in the org's own directory and no other org's. So each
+ * member is named from what the reader may read: the reader from their own
+ * account (`self`, where the caller holds it), a member who lives in the org
+ * from its directory, and anyone else by the username the row carries. The
+ * directory also marks the org's service accounts, which are left out: the
+ * roster beside the agents is where somebody looks for those. A reader who may
+ * not read the directory sees the rows alone, by username.
+ */
+export declare function members(org: string, self?: {
+    name: string;
+    email: string;
+}): Promise<Member[]>;
+/**
+ * Changes an existing member's role: `POST /v1/iam/memberships {user, org, role}`,
+ * the one role write HIP-0527 names, by an owner or admin of the org. Resolves to
+ * the role IAM holds for them afterwards, read back from the roster, so a caller
+ * reports what IAM stored rather than what it asked for.
+ */
+export declare function setRole(org: string, user: string, next: string): Promise<string | null>;
+/**
+ * Ends someone's access to the org: `POST /v1/iam/delete-membership {user, org}`.
+ * Their account survives. IAM refuses it for a person whose account lives in the
+ * org, and says so in its own words.
+ */
+export declare function removeMember(org: string, user: string): Promise<void>;