@stapel/workspaces-react 0.13.0 → 0.15.0

package/src/api/generated/schema.ts

@@ -89,6 +89,43 @@ export interface paths {
         patch: operations["workspaces_api_v1_partial_update"];
         trace?: never;
     };
+    "/workspaces/api/v1/{workspace_id}/audit": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * @description ``GET <workspace_id>/audit`` — the workspace's membership history.
+         *
+         *     THE QUESTION THIS ANSWERS is "who let this person in, who took them out,
+         *     and when" — which nothing in this module could answer before. Half the
+         *     transitions the owner listed emit no comm event at all (an invitation
+         *     created, an invitation accepted, an account born from one), and the ones
+         *     that do emit are fire-and-forget notifications to other services: nothing
+         *     keeps them, so there was no record to ask.
+         *
+         *     GATED ON ``members.view``, not on a new capability of its own. An audit of
+         *     who is in the workspace is the same class of fact as the member list —
+         *     every role that may see who is in the room may see how they got there. A
+         *     separate mandate would mean a deployment could grant one without the
+         *     other, which describes no real product.
+         *
+         *     Read-only by construction: this view has no write method, and the model
+         *     has no update or delete path.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        get: operations["workspaces_api_v1_audit_list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/api/v1/{workspace_id}/invitations": {
         parameters: {
             query?: never;
@@ -180,9 +217,9 @@ export interface paths {
          *
          *     Accepts an **expired** invitation on purpose — a dead TTL is the most
          *     common reason to resend — and refuses the three stored terminal states,
-         *     which are decisions rather than delivery failures. The token is
-         *     rotated and the TTL restarts, so the fresh letter carries a fresh link
-         *     and any stale copy of the old one stops working.
+         *     which are decisions rather than delivery failures. The TTL restarts, so
+         *     the invitee has the full window again from the letter that just went
+         *     out.
          *
          *     Reviving an expired invitation re-reserves a seat, so the plan ceiling
          *     is re-checked here exactly as it is on invite: capability first ("may
@@ -190,6 +227,17 @@ export interface paths {
          *     that is already pending costs no additional seat and is never blocked
          *     by that check.
          *
+         *     Then the cooldown ("may we mail this PERSON again yet", 429). It is
+         *     read here and enforced again inside the service's row lock, the same
+         *     two-level shape the state check already has: the view answers a number
+         *     the admin can read, the lock is what actually makes two simultaneous
+         *     presses send one letter.
+         *
+         *     The token is NOT rotated by default from 0.23 — the invitee's existing
+         *     link keeps working, because the resend goes to the same mailbox that
+         *     link is already sitting in. See
+         *     ``STAPEL_WORKSPACES["INVITATION_ROTATE_TOKEN_ON_RESEND"]``.
+         *
          *     **Permissions:** `IsAuthenticated`
          */
         post: operations["workspaces_api_v1_invitations_resend_create"];
@@ -739,6 +787,54 @@ export interface paths {
 export type webhooks = Record<string, never>;
 export interface components {
     schemas: {
+        /** @description One line of a workspace's membership history. */
+        AuditEventResponse: {
+            /**
+             * Format: uuid
+             * @description Audit event UUID
+             */
+            id: string;
+            /**
+             * @description What happened — a CLOSED vocabulary (models.AuditAction): invitation_created, invitation_accepted, invitation_revoked, invitation_declined, account_created_by_invitation, member_joined, member_provisioned, member_removed, member_role_changed, member_suspended, member_unsuspended
+             * @example member_removed
+             */
+            action: string;
+            /**
+             * Format: uuid
+             * @description Who performed it; null for a transition nobody performed (a policy sweep)
+             * @example 0192a...
+             */
+            actor_id: string | null;
+            /** @description Best-effort name of the actor, resolved like every other name in this module (stapel-profiles first); "" when unknown */
+            actor_display_name: string;
+            /**
+             * Format: uuid
+             * @description Whom it happened to; null for an invitation to an address with no account yet
+             * @example 0192b...
+             */
+            subject_id: string | null;
+            /** @description Best-effort name of the subject; "" when unknown */
+            subject_display_name: string;
+            /**
+             * @description The invited address, when the row is about an invitation
+             * @example new@acme.test
+             */
+            subject_email: string;
+            /**
+             * @description Role involved, when the action carries one
+             * @example member
+             */
+            role: string;
+            /** @description Action-specific extras — old_role/new_role for a role change, reason for a suspension */
+            metadata: {
+                [key: string]: unknown;
+            };
+            /**
+             * @description ISO 8601 timestamp
+             * @example 2026-08-13T10:00:00Z
+             */
+            created_at: string;
+        };
         /** @description What the name is after the write — the stored value, not the request. */
         DisplayNameResponse: {
             /**
@@ -891,6 +987,17 @@ export interface components {
              * @example Ada Lovelace
              */
             display_name?: string | null;
+            /**
+             * Format: uuid
+             * @description UUID of the admin who withdrew it; null unless revoked, or when that account is gone
+             * @example 0192a...
+             */
+            revoked_by_id?: string | null;
+            /**
+             * @description ISO 8601 time the invitation was last emailed; null if no letter was ever sent
+             * @example 2026-07-24T10:00:00Z
+             */
+            last_sent_at?: string | null;
         };
         /** @description Invite payload. */
         MemberInviteRequest: {
@@ -1003,6 +1110,19 @@ export interface components {
              */
             display_name?: string | null;
         };
+        PaginatedAuditEventResponseList: {
+            items: components["schemas"]["AuditEventResponse"][];
+            /** @description Anchor value for next page */
+            next_anchor?: string | null;
+            /** @description Anchor value for previous page */
+            prev_anchor?: string | null;
+            /** @description Whether there are more items after this page */
+            has_next: boolean;
+            /** @description Whether there are items before this page */
+            has_prev: boolean;
+            /** @description Number of items in current page */
+            count: number;
+        };
         PaginatedInvitationResponseList: {
             items: components["schemas"]["InvitationResponse"][];
             /** @description Anchor value for next page */
@@ -1203,6 +1323,11 @@ export interface components {
              * @example a8bba7ae-5d2e-43e5-9911-0553e7df50b3
              */
             preferred_workspace_id?: string;
+            /**
+             * @description Whether THIS caller may found a new workspace on this instance (WORKSPACE_CREATE_POLICY, evaluated by services.can_create_workspace). The ANSWER, not the policy name: resolving "instance_owner" client-side would mean re-implementing the instance-owner lookup in every client, and a client that got it wrong would draw a button that 403s — or hide one that should be there. Rides the list because the workspace switcher is the surface that draws "+ New space", and it already fetches this
+             * @example true
+             */
+            can_create_workspace?: boolean;
         };
         /** @description Workspace details. */
         WorkspaceResponse: {
@@ -1266,6 +1391,11 @@ export interface components {
              *     ]
              */
             my_capabilities?: string[];
+            /**
+             * @description The owner's display name, best-effort from stapel-profiles (empty when it has none, is not installed, or is unreachable — never invented). Exists because a workspace NAME stopped identifying one: a person can belong to several spaces all called "Personal" — one per company that made them one — and ownership can be handed over, so "Personal" answers nothing on its own. Pickers draw it as the second line under the name. Resolved here rather than in each client, which would otherwise each need a profiles batch of its own for a caption
+             * @example Victor P.
+             */
+            owner_display_name?: string;
         };
     };
     responses: never;
@@ -1388,6 +1518,38 @@ export interface operations {
             };
         };
     };
+    workspaces_api_v1_audit_list: {
+        parameters: {
+            query?: {
+                /** @description Narrow to one action (models.AuditAction). An unknown value matches nothing rather than being ignored — a filter that silently does not apply is worse than an empty page. */
+                action?: string;
+                /** @description Anchor value to paginate from (exclusive) */
+                anchor?: string;
+                /** @description Pagination direction */
+                direction?: "next" | "prev" | "center";
+                /** @description Number of items (default 100, max 500) */
+                limit?: number;
+                /** @description Narrow to one person's history (as the SUBJECT). */
+                user_id?: string;
+            };
+            header?: never;
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PaginatedAuditEventResponseList"];
+                };
+            };
+        };
+    };
     workspaces_api_v1_invitations_list: {
         parameters: {
             query?: {

package/src/api/types.ts

@@ -33,6 +33,29 @@ export type PreferredWorkspace = Schemas["PreferredWorkspaceRequest"];
 /** PUT/DELETE /me/preferred-workspace 200 body — the choice after the write
  * (`""` after a DELETE cleared it). */
 export type PreferredWorkspaceResult = Schemas["PreferredWorkspaceResponse"];
+/** One line of a workspace's membership history (`GET {id}/audit`).
+ *
+ * The vocabulary of `action` is CLOSED on the server (stapel-workspaces
+ * `models.AuditAction`) — an audit whose action is a free string is a log:
+ * nobody can filter it, translate it, or notice that a new lifecycle
+ * transition shipped without a line.
+ */
+export type AuditEvent = Schemas["AuditEventResponse"];
+/** `GET {id}/audit` 200 body — one anchor-paginated page of history. */
+export type AuditPage = Schemas["PaginatedAuditEventResponseList"];
+/** Query parameters for the audit list (narrow by action or by subject). */
+export interface AuditParams {
+  /** One `AuditEvent["action"]`. An unknown value matches nothing rather than
+   * being ignored — a filter that silently does not apply is worse than an
+   * empty page. */
+  readonly action?: string;
+  /** One person's history, as the SUBJECT of the events. */
+  readonly user_id?: string;
+  readonly anchor?: string;
+  readonly direction?: "next" | "prev";
+  readonly limit?: number;
+}
+
 /** POST / request body — create a workspace (slug auto-generated when omitted). */
 export type WorkspaceCreate = Schemas["WorkspaceCreateRequest"];
 /** PATCH /{id} request body — a partial name / slug / settings update. */

package/src/api/workspacesApi.ts

@@ -12,6 +12,8 @@ import type {
   MemberPasswordReset,
   MemberPasswordResetResult,
   MemberRoleUpdate,
+  AuditParams,
+  AuditPage,
   MembersParams,
   PreferredWorkspace,
   PreferredWorkspaceResult,
@@ -88,6 +90,14 @@ export interface WorkspacesApi {
   clearPreferredWorkspace(): Promise<PreferredWorkspaceResult>;
 
   /** A workspace's members (viewer+), an anchor-paginated page. */
+  /** The workspace's membership history, newest first — who let this person
+   * in, who took them out, and when (stapel-workspaces 0.24). Anchor-paginated
+   * like the member and invitation lists. */
+  listAudit(
+    workspaceId: string,
+    params?: AuditParams
+  ): Promise<AuditPage>;
+
   listMembers(
     workspaceId: string,
     params?: MembersParams
@@ -259,6 +269,18 @@ export function createWorkspacesApi(client: StapelClient): WorkspacesApi {
     clearPreferredWorkspace: () =>
       client.delete("/me/preferred-workspace", mutating()),
 
+    listAudit: (workspaceId, params) => {
+      const query: Record<string, string | number> = {};
+      if (params?.action !== undefined) query.action = params.action;
+      if (params?.user_id !== undefined) query.user_id = params.user_id;
+      if (params?.anchor !== undefined) query.anchor = params.anchor;
+      if (params?.direction !== undefined) query.direction = params.direction;
+      if (params?.limit !== undefined) query.limit = params.limit;
+      return client.get(`/${encodeURIComponent(workspaceId)}/audit`, {
+        query,
+      });
+    },
+
     listMembers: (workspaceId, params) => {
       const query: Record<string, string | number> = {};
       if (params?.anchor !== undefined) query.anchor = params.anchor;

package/src/default/MembersManager.tsx

@@ -15,9 +15,9 @@
  */
 import { useState } from "react";
 import type { ReactElement } from "react";
-import { Button, Card, Input, Modal, Popconfirm, Select, Table, Typography } from "antd";
+import { Button, Card, Empty, Input, Modal, Popconfirm, Select, Table, Typography } from "antd";
 import type { TableProps } from "antd";
-import { useErrorDisplay, useT } from "@stapel/core";
+import { loadedRowsOrEmpty, matchList, useErrorDisplay, useT } from "@stapel/core";
 import { Members } from "../headless/Members.js";
 import { RoleSelect } from "../headless/RoleSelect.js";
 import type { RoleSelectBag } from "../headless/RoleSelect.js";
@@ -54,9 +54,15 @@ export function MembersManager(props: MembersManagerProps): ReactElement {
     <RoleSelect>
       {(rolesBag: RoleSelectBag) => (
         <Members workspaceId={props.workspaceId}>
-          {({ members, isLoading, isError, error, invite, isInviting, updateRole, remove }) => {
+          {({ state, writeError, invite, isInviting, updateRole, remove, refetch }) => {
             const { labelFor } = rolesBag;
-            const roleOptions = rolesBag.roles.map((r) => ({
+            // The registry read is a SEPARATE load from the roster's, and it
+            // gets its own sentence below rather than silently producing an
+            // empty picker — a role menu with nothing in it and a role menu
+            // that could not be fetched look identical to a person.
+            const rolesFailed = rolesBag.state.status === "failed";
+            const rolesLoading = rolesBag.state.status === "loading";
+            const roleOptions = loadedRowsOrEmpty(rolesBag.state).map((r) => ({
               value: r.role,
               label: labelFor(r.role),
             }));
@@ -95,7 +101,7 @@ export function MembersManager(props: MembersManagerProps): ReactElement {
                     <Select<string>
                       value={member.role}
                       style={{ width: 160 }}
-                      loading={rolesBag.isLoading}
+                      loading={rolesLoading}
                       onChange={(next) => updateRole({ userId: member.user_id, role: next })}
                       // A member's CURRENT role may be missing from the
                       // registry options (a deployment removed an overlay
@@ -148,17 +154,64 @@ export function MembersManager(props: MembersManagerProps): ReactElement {
                   )}
                 </div>
 
-                {isError && <ErrorAlert error={errorDisplay(error)} style={{ marginTop: 12 }} />}
+                {/* A write that failed — the roster read has its own arm below. */}
+                {writeError !== null && (
+                  <ErrorAlert error={errorDisplay(writeError)} style={{ marginTop: 12 }} />
+                )}
+                {rolesFailed && (
+                  <ErrorAlert
+                    testId="members-roles-error"
+                    error={{ message: t(WORKSPACES_I18N_KEYS.rolesLoadFailed), detail: undefined }}
+                    style={{ marginTop: 12 }}
+                  />
+                )}
 
-                <Table<Member>
-                  style={{ marginTop: 16 }}
-                  size="small"
-                  loading={isLoading}
-                  rowKey={(member) => member.id}
-                  dataSource={members as Member[]}
-                  columns={columns}
-                  pagination={false}
-                />
+                {matchList(state, {
+                  loading: () => (
+                    <Table<Member>
+                      style={{ marginTop: 16 }}
+                      size="small"
+                      loading
+                      rowKey={(member) => member.id}
+                      dataSource={[]}
+                      columns={columns}
+                      pagination={false}
+                    />
+                  ),
+                  // An antd Table with no rows renders "No data". On a failed
+                  // read that is the empty-state lie with a built-in
+                  // illustration, so the table does not get rendered at all.
+                  failed: (error) => (
+                    <div style={{ marginTop: 16 }} data-testid="members-list-error">
+                      <ErrorAlert error={errorDisplay(error)} />
+                      <Button
+                        style={{ marginTop: 12 }}
+                        onClick={refetch}
+                        data-analytics="none"
+                        data-analytics-reason="local-ui-refetch-after-a-stated-read-failure"
+                      >
+                        {t(WORKSPACES_I18N_KEYS.retry)}
+                      </Button>
+                    </div>
+                  ),
+                  empty: () => (
+                    <Empty
+                      style={{ marginTop: 16 }}
+                      data-testid="members-list-empty"
+                      description={t(WORKSPACES_I18N_KEYS.membersEmpty)}
+                    />
+                  ),
+                  ready: (members) => (
+                    <Table<Member>
+                      style={{ marginTop: 16 }}
+                      size="small"
+                      rowKey={(member) => member.id}
+                      dataSource={[...members]}
+                      columns={columns}
+                      pagination={false}
+                    />
+                  ),
+                })}
 
                 <Modal
                   title={t(WORKSPACES_I18N_KEYS.membersInviteDialogTitle)}
@@ -182,7 +235,7 @@ export function MembersManager(props: MembersManagerProps): ReactElement {
                         value={inviteRole}
                         onChange={setInviteRole}
                         style={{ width: "100%" }}
-                        loading={rolesBag.isLoading}
+                        loading={rolesLoading}
                         options={inviteRoleOptions}
                       />
                     </div>

package/src/default/WorkspaceSettings.tsx

@@ -9,7 +9,14 @@
 import { useEffect, useState } from "react";
 import type { ReactElement } from "react";
 import { Badge, Button, Card, Input, Popconfirm, Spin, Typography } from "antd";
-import { useErrorDisplay, useT } from "@stapel/core";
+import {
+  actionAvailable,
+  actionBlocked,
+  firstBlock,
+  useActionGate,
+  useErrorDisplay,
+  useT,
+} from "@stapel/core";
 import { useWorkspace } from "../model/queries.js";
 import { useUpdateWorkspace, useDeleteWorkspace } from "../model/mutations.js";
 import { WORKSPACES_I18N_KEYS } from "../i18n/keys.js";
@@ -35,6 +42,17 @@ export function WorkspaceSettings(props: WorkspaceSettingsProps): ReactElement {
   const workspace = query.data;
   const [name, setName] = useState("");
 
+  // Two unrelated situations used to share one `disabled={!isOwner ||
+  // !name.trim()}` bit, and a person facing either of them saw the same dead
+  // button. `firstBlock` keeps them two, in the order you would explain them.
+  const isOwner = workspace?.my_role === "owner";
+  const saveGate = useActionGate(
+    firstBlock(
+      isOwner ? actionAvailable() : actionBlocked(WORKSPACES_I18N_KEYS.blockedNotOwner),
+      name.trim() ? actionAvailable() : actionBlocked(WORKSPACES_I18N_KEYS.blockedNameRequired)
+    )
+  );
+
   useEffect(() => {
     if (workspace) setName(workspace.name);
   }, [workspace]);
@@ -66,8 +84,6 @@ export function WorkspaceSettings(props: WorkspaceSettingsProps): ReactElement {
     );
   }
 
-  const isOwner = workspace.my_role === "owner";
-
   return (
     <div data-testid="workspace-settings" style={{ display: "grid", gap: 16 }}>
       <Card>
@@ -79,7 +95,18 @@ export function WorkspaceSettings(props: WorkspaceSettingsProps): ReactElement {
         <div style={{ display: "grid", gap: 12, maxWidth: 480, marginTop: 16 }}>
           <div>
             <Typography.Text>{t(WORKSPACES_I18N_KEYS.fieldName)}</Typography.Text>
-            <Input value={name} onChange={(e) => setName(e.target.value)} disabled={!isOwner} />
+            <Input
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              disabled={!isOwner}
+            />
+            {!isOwner && (
+              <div>
+                <Typography.Text type="secondary" data-testid="workspace-name-blocked">
+                  {t(WORKSPACES_I18N_KEYS.blockedNotOwner)}
+                </Typography.Text>
+              </div>
+            )}
           </div>
           <div>
             <Typography.Text>{t(WORKSPACES_I18N_KEYS.fieldSlug)}</Typography.Text>
@@ -101,13 +128,22 @@ export function WorkspaceSettings(props: WorkspaceSettingsProps): ReactElement {
           type="primary"
           style={{ marginTop: 16 }}
           loading={updateMutation.isPending}
-          disabled={!isOwner || !name.trim()}
+          disabled={saveGate.disabled}
           onClick={handleSave}
           data-analytics="none"
           data-analytics-reason="business action — host app wraps with its own tracked(); pairs carry no @stapel/analytics runtime dependency by architecture"
         >
           {updateMutation.isPending ? t(WORKSPACES_I18N_KEYS.saving) : t(WORKSPACES_I18N_KEYS.save)}
         </Button>
+        {/* Beside the control, as TEXT: a disabled button receives no pointer
+            events, so a tooltip on it is a reason nobody can read. */}
+        {saveGate.reason !== undefined && (
+          <div style={{ marginTop: 8 }}>
+            <Typography.Text type="secondary" data-testid="workspace-save-blocked">
+              {saveGate.reason}
+            </Typography.Text>
+          </div>
+        )}
       </Card>
 
       {isOwner && (

package/src/headless/Can.tsx

@@ -8,6 +8,14 @@ export interface CanBag {
   /** The underlying read is still in flight (verdict is `false` meanwhile —
    * deny-by-default; render a skeleton off this if flicker matters). */
   readonly isLoading: boolean;
+  /**
+   * The read FAILED, so `allowed: false` means "we could not find out",
+   * not "you may not". Deny-by-default still holds — a capability check that
+   * opened up on an outage would be a security hole — but a skin with
+   * somewhere to put a sentence should say which of the two it is rather than
+   * silently withholding the control.
+   */
+  readonly isUnknown: boolean;
 }
 
 /**
@@ -43,7 +51,11 @@ export function Can(props: {
   const caps = useCapabilities(props.workspaceId);
   const allowed = caps.can(props.capability);
   if (typeof props.children === "function") {
-    return props.children({ allowed, isLoading: caps.isLoading });
+    return props.children({
+      allowed,
+      isLoading: caps.state.status === "loading",
+      isUnknown: caps.state.status === "failed",
+    });
   }
   return allowed ? props.children : (props.fallback ?? null);
 }

package/src/headless/Members.tsx

@@ -1,5 +1,6 @@
 import type { ReactNode } from "react";
-import type { StapelApiError } from "@stapel/core";
+import { loadStateFromQuery, mapLoad } from "@stapel/core";
+import type { LoadState, StapelApiError } from "@stapel/core";
 import type { Member, MemberInvite } from "../api/types.js";
 import { useMembers } from "../model/queries.js";
 import {
@@ -12,18 +13,19 @@ import type { MemberRoleChange } from "../model/mutations.js";
 /** Render-prop bag for {@link Members}. */
 export interface MembersBag {
   /**
-   * The workspace's members once loaded (empty before load). This is one page
-   * (default 100) — the roster's own {@link Member.email}/`search` narrows
-   * further; a full pager is out of scope for this renderless view (bring
-   * your own via `useMembers`' `params` for anchor pagination).
+   * The roster read, as a state a skin cannot flatten — render it with core's
+   * `matchList`. This is one page (default 100); a full pager is out of scope
+   * for this renderless view (bring your own via `useMembers`' `params` for
+   * anchor pagination).
+   *
+   * Separate from {@link writeError} on purpose: "the roster could not be
+   * loaded" and "your invite was rejected" are different sentences, and the
+   * old merged `isError` could only produce one of them.
    */
-  readonly members: readonly Member[];
-  /** The initial member-list load is in flight. */
-  readonly isLoading: boolean;
-  /** The read, an invite, a role change, or a removal failed. */
-  readonly isError: boolean;
-  /** The error, when `isError` (a localizable `StapelApiError`), else null. */
-  readonly error: StapelApiError | null;
+  readonly state: LoadState<readonly Member[]>;
+  /** An invite, a role change, or a removal failed. Never the read — that is
+   * {@link state}. */
+  readonly writeError: StapelApiError | null;
   /** Invite one or more emails at a role. */
   invite(body: MemberInvite): void;
   /** An invite call is in flight. */
@@ -49,7 +51,7 @@ export interface MembersBag {
  *
  * ```tsx
  * <Members workspaceId={id}>
- *   {({ members, invite, updateRole, remove }) => ( ... )}
+ *   {({ state, invite, updateRole, remove }) => ( ... )}
  * </Members>
  * ```
  */
@@ -62,19 +64,9 @@ export function Members(props: {
   const roleMutation = useUpdateMemberRole(props.workspaceId);
   const removeMutation = useRemoveMember(props.workspaceId);
   return props.children({
-    members: query.data?.items ?? [],
-    isLoading: query.isLoading,
-    isError:
-      query.isError ||
-      inviteMutation.isError ||
-      roleMutation.isError ||
-      removeMutation.isError,
-    error:
-      query.error ??
-      inviteMutation.error ??
-      roleMutation.error ??
-      removeMutation.error ??
-      null,
+    state: mapLoad(loadStateFromQuery(query), (page) => page.items),
+    writeError:
+      inviteMutation.error ?? roleMutation.error ?? removeMutation.error ?? null,
     invite: (body) => {
       inviteMutation.mutate(body);
     },