@stapel/workspaces-react 0.16.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,199 @@
 # @stapel/workspaces-react
 
+## 0.19.0
+
+### Minor Changes
+
+- 57bd738: Visual pass 3: delete the legacy harness stories, and stop the screens saying
+  the same thing twice.
+
+  **The seven harness demos are gone** (`workspace-list`, `members--default`,
+  `accept-invitation`, `capability-gate`, `invite-accept-flow`,
+  `role-select--registry`, `workspaces-provider`). They shipped a debug card —
+  `state.step` chips, `1 workspace(s)`, "Grant exchanged", `members.invite
+allowed` — beside the real skins that replaced them, so half of what this
+  package showed was the harness. The headless primitives they stood for are now
+  covered by the skin demo that renders each one (`covers:`), and `demo/_harness`
+  is the provider frame and nothing else. **Breaking for anyone who deep-links a
+  viewer story id.**
+
+  Screen fixes, each one a repetition or a contradiction:
+
+  - **Invitations.** A terminal row printed its refusal once per control — the
+    same sentence six times on one phone screen. `RowActions` states it once per
+    row, as a footnote spanning the row, with every switched-off control's
+    `aria-describedby` pointing at it.
+  - **Workspaces page.** A failed read said so twice, in two wordings, with two
+    recoveries (the create button's gate carried its own copy plus `HTTP 503`
+    above the alert that already had the retry). One alert now, the control
+    points at it, and the retry sits under the alert instead of squeezing its
+    text into ~110px at 390px. The empty state no longer repeats the restriction
+    the disabled control states.
+  - **Workspace settings.** "Require two-factor authentication" read ON while the
+    line under it said two-factor was not required here — the note derived from
+    the absence of an enforcement status instead of from the policy. Both now
+    read the same value, and "no check has run yet" is its own sentence.
+  - **Invitation page.** A dead expired link was drawn in antd's _info_ blue with
+    nothing to do next; it is the warning tone, names the next step, and takes an
+    optional `onExit` for the host's way out.
+  - **Members.** The refusals on the viewer's own row widened the action column
+    until that row wrapped to the phone layout in the middle of a desktop table.
+    One row geometry per breakpoint now. The empty roster has one "Invite", not
+    two, and no search field over nobody.
+  - **Roles.** "It is not a workspace without roles." was not English. An empty
+    registry no longer borrows the "we could not load" sentence.
+  - **Membership history.** `Role: admin` was the raw slug; it goes through the
+    same registry labels as the picker. Events are grouped under their day, so a
+    burst of three no longer prints one timestamp three times.
+
+  Additive API: `InviteAcceptPageProps.onExit`, `WorkspaceFormat.time()`,
+  `useRoleLabel()` (a role label with no `GET /roles` behind it — the public
+  invitation page cannot make that call).
+
+## 0.18.0
+
+### Minor Changes
+
+- 80617e9: The pair becomes the product: the delete button stops lying, the MFA policy gets a screen, and the invitation console exists
+
+  **The refusal a screen used to promise.** `<WorkspaceSettings/>` drew "Delete
+  workspace" from `my_role === "owner"` — the exact derivation stapel-workspaces
+  0.26.0 added `WorkspaceResponse.can_delete` + `delete_blocked_reason` to
+  replace, because an owner of the instance's default workspace or of a personal
+  one gets a 409. The control now reads the server's verdict through
+  `GatedControl`, and prints the server's own refusal CODE as a sentence beside
+  it — translatable at last, because the generated error bundle was five codes
+  behind the backend (`error.409.workspace_is_instance_default`,
+  `workspace_is_personal`, `error.429.invitation_grant_pending`,
+  `error.503.billing_unavailable`, `error.503.mandate_unavailable`). The test
+  that cemented the old rule now asserts the new one. Name and security editing
+  are gated on the CAPABILITIES the server granted (`workspace.update`,
+  `workspace.security.manage`), falling back to the pre-0.6 owner rule only when
+  a backend sends no `my_capabilities` at all.
+
+  **Four screens that were hooks with no pixels.** `<WorkspacesPage/>` (the §54
+  default skin `WorkspaceList` never had: roster, create gated on
+  `can_create_workspace`, preferred-workspace choice, guest and closed-instance
+  copy), `<InvitationsPane/>` (list / revoke / resend / rename — four API methods
+  and zero pixels until now, each control gated on the invitation state the
+  endpoint would refuse), `<AuditTrailPane/>` (the membership history, action
+  vocabulary as sentences, timestamps as "3 days ago (23 Sept 2026, 09:00)"), and
+  `<RoleSelectField/>` (a real `<Select>` with an accessible name and the rank as
+  a caption, where the story used to show five bullet points).
+
+  **MFA enforcement, visible.** `mfa_enforcement` (state, coverage, unverified
+  members, last error) is drawn beside the `require_mfa` switch that
+  `useUpdateSecuritySettings` now actually has a consumer for, and
+  `MemberResponse.mfa_compliant` is a per-member tag with three states — true,
+  false, and "nobody has asked yet".
+
+  **Members reach page two.** `<Members>` takes `params` and exposes `page`
+  (anchor cursors + `has_next`/`has_prev`); the roster ships a pager and a
+  search box. `rosterComplete` now also requires `has_prev === false`, so the
+  last-owner claim is not made from the last page of a longer roster.
+
+  **Substrate migration.** Local `src/default/ErrorAlert.tsx` deleted; every
+  screen self-themes through `<SkinTheme>`, confirms are `SkinConfirm` (no
+  `Popconfirm`), load arms are `LoadList`/`LoadBoundary`, blocked controls are
+  `GatedButton`/`GatedControl`, and the unfilled `renderLoginPanel` slot renders
+  a `SlotPlaceholder` instead of a hole. Doctrine lint: 99 warnings → 0.
+
+  **i18n.** `es` went from 1 translated UI key to complete; `ru` stays complete
+  over a bundle that roughly tripled. Counts render through CLDR plurals
+  (`useTPlural`) instead of `1 workspace(s)`, and dates through a new
+  `useWorkspaceFormat()` in the model layer instead of raw ISO.
+
+  BREAKING (pre-1.0, hence minor): `MembersBag` gained `page`/`rename`/
+  `isRenaming`, `RoleSelect`'s `labelFor` now title-cases an unlabelled registry
+  role (`secretary` → `Secretary`) instead of returning the raw token, and
+  `src/default/ErrorAlert.tsx` is gone — import `ErrorAlert` from
+  `@stapel/tokens-antd/skin`.
+
+- 308e3d6: `is_self` closes two lying controls, the four admin screens get doors, and every default-skin screen is finally photographed
+
+  **The row the roster could not identify.** stapel-workspaces 0.30.0 derives
+  `MemberResponse.is_self` server-side, and the pair now reads it off the
+  generated schema instead of a defensive cast. It gates TWO controls, not one.
+  "Remove" was already asking. "Reset password" was not — and it is the worse
+  case: `MemberPasswordResetView` refuses the caller's own row with the
+  byte-identical 404 it gives for a stranger ("Yourself is not in the set this
+  endpoint acts on"), so an ungated button reads the backend's correct refusal
+  as "this member has been removed". Both are switched off through `GatedButton`
+  with the reason beside them, in en/ru/es. A backend that sends no `is_self`
+  still claims nothing: the absence reads as "the server did not say".
+
+  **The administrative password reset now exists on the glass.**
+  `useResetMemberPassword` had no consumer at all — the endpoint (#110) was
+  unreachable from any shipped screen. `<MembersManager/>` grows the control and
+  the dialog around it, and the dialog states the three things this operation is:
+  the step-up is ANNOUNCED before the click (the capability is declared `high`,
+  so `requires_verification(scope="sensitive")` will demand one), the generated
+  password is labelled as the one-shot credential it is and leaves the screen
+  when the dialog closes (the mutation is reset), and `notified: false` is said
+  out loud — it means the account had no channel to be told on, which makes the
+  admin the only person who can tell them.
+
+  **Four finished screens stop being undeclared.** `<WorkspaceSettings/>`,
+  `<MembersManager/>`, `<InvitationsPane/>` and `<AuditTrailPane/>` are in the
+  nav manifest, on paths relative to the account section, and their `workspaceId`
+  prop became OPTIONAL. The architecture answer the pair was waiting for: the
+  active workspace is RUNTIME state — the same state the container writes when a
+  person switches — not a path param of a settings URL. So a nav-mounted screen
+  reads it from the selection seam (`useOptionalWorkspaceSelection`, new export)
+  and a screen with no active workspace renders a designed "choose a workspace"
+  (and "you are not in a workspace yet" for a person who belongs to none) rather
+  than a blank page or a throw from a provider a shell forgot to wire.
+
+  **The showcase stops showing the test bench.** Seven default-skin demos, one
+  per `/default` export, each with a phone variant and variants seeded at
+  distinct steps — the roster with the viewer's own row refused, the settings
+  screen an owner may not delete, the terminal invitations, the audit line
+  nobody performed, the role field with no registry to read, the invitation page
+  on the wrong account. `gen:demos` goes 0/7 → 7/7 skin covered. A render test
+  per new surface at 390 and 1024, in light and dark, plus the `is_self` and
+  chooser cases: 164 → 187 tests.
+
+  Peer floors raised to the substrate the pair actually imports:
+  `@stapel/core >=0.18.0 <1.0.0` (`useTPlural`, `STAPEL_UI_KEYS`) and
+  `@stapel/tokens-antd >=0.6.0` (the skin surface).
+
+- 95e8eec: The invite dialog is a bottom sheet on a phone, and the members table stops
+  offering removals the backend will refuse.
+
+  `MembersManager`'s `Modal` renders through `@stapel/tokens-antd/skin`'s
+  `SkinDialog` — this package now declares `@stapel/tokens-antd` as an optional
+  peer, like every other antd-skinned pair. The table gained
+  `scroll={{ x: true }}`.
+
+  Remove was rendered identically on every row, including the last owner's, which
+  the backend enforces against. When the roster is COMPLETE (`has_next` is false
+  — now surfaced on the bag as `rosterComplete`) "exactly one row holds owner" is
+  a fact, so that row's Remove is disabled with the reason printed beside it. On a
+  paginated roster nothing is claimed: a count of a page is not a count of the
+  roster, and gating on it would refuse a removal the backend would allow.
+
+  The caller's OWN row is still not gated, and deliberately: `MemberResponse`
+  carries no `is_self`, and the pair has no caller identity to compare `user_id`
+  against (core's session exposes a status, the mandate axis a role — neither is
+  "who am I"). Guessing would grey out somebody else's row. The backend needs one
+  additive field: `is_self` on `MemberResponse`, or the caller's `user_id` on the
+  members page envelope.
+
+  When the role registry read fails, the per-row role `Select` no longer renders
+  enabled over an empty option list; the role still reads as text and the invite
+  dialog states the outage instead of offering a picker with nothing in it.
+
+## 0.17.0
+
+### Minor Changes
+
+- ace82db: `useMandateSource()` — this module's derivation in the shape core's
+  `<MandateProvider>` takes. A screen reads the axis with `useMandate()` from
+  `@stapel/core` and no longer imports this package to do it, which is what
+  lets the same screen work on a public surface that has no workspace list at
+  all. `useMandateState()` and its behaviour are unchanged; the `@stapel/core`
+  floor rises to the release that carries the seam.
+
 ## 0.16.0
 
 ### Minor Changes

package/README.md

@@ -51,6 +51,38 @@ per-module override — `clients={{ workspaces: runtime.client }}` — and nest
 providers (`StapelConfigProvider` + `QueryClientProvider` + `I18nProvider`)
 remain exported for bespoke composition.
 
+## The default skin (`/default`)
+
+The pair ships the screens, not only the hooks (§83): seven antd surfaces
+behind a separate entry point, so a host that brings its own visuals never
+pulls `antd` into its bundle.
+
+```tsx
+import {
+  WorkspacesPage, WorkspaceSettings, MembersManager,
+  InvitationsPane, AuditTrailPane, RoleSelectField, InviteAcceptPage,
+} from "@stapel/workspaces-react/default";
+```
+
+Each one self-themes (light/dark from the live document), is a bottom sheet on
+a phone and a modal above it, and states every refusal the backend would give
+instead of offering a control that leads to one.
+
+**Which workspace a screen is about.** `WorkspaceSettings`, `MembersManager`,
+`InvitationsPane` and `AuditTrailPane` take an OPTIONAL `workspaceId`. Pass it
+and they use it. Omit it — which is how the nav manifest mounts them, because
+the nav contract routes a screen and does not hand it an ambient scope — and
+they read the ACTIVE workspace from the runtime selection
+(`<WorkspaceSelectionProvider>`, the same seam `switchTo` writes). With no
+active workspace they render a designed "choose a workspace" state; they never
+render blank and never throw at a host that has not wired the provider.
+
+```tsx
+<WorkspaceSelectionProvider urlWorkspaceId={params.get("workspace")}>
+  <MembersManager />          {/* the workspace comes from the selection */}
+</WorkspaceSelectionProvider>
+```
+
 ## Layers
 
 ```
@@ -100,13 +132,13 @@ Backend error texts are generated from stapel-workspaces's
 pair's UI keys carry hand-written ru copy. Register your own bundle AFTER the
 pair's to override any key — registration order is override priority.
 
-### Spanish locale (opt-in subpath — backend errors today, UI copy later)
+### Spanish locale (opt-in subpath)
 
-The `es` bundle ships as its own subpath on the same terms as `ru`, with one
-difference stated up front: **it translates the 67 backend error codes, not
-the pair's own UI copy.** `registerWorkspacesI18nEs` registers the en floor UNDER the
-Spanish texts, so a Spanish-speaking user reads Spanish error messages and
-English UI copy — never a raw key.
+The `es` bundle ships as its own subpath on the same terms as `ru`, and it is
+complete on both halves: the generated backend error texts AND hand-written
+Spanish for every UI key the pair owns. `registerWorkspacesI18nEs` registers
+the en floor UNDER the Spanish texts, so a key added tomorrow degrades to
+English rather than to a raw key.
 
 ```tsx
 import { registerWorkspacesI18nEs } from "@stapel/workspaces-react/i18n/es";
@@ -119,8 +151,7 @@ await i18n.setLocale("es");    // live switch; untranslated UI keys read English
 Error texts are generated from stapel-workspaces's `translations/errors.es.json`
 catalog (`pnpm gen:errors`, drift-gated) and are complete over the error
 registry by construction. The coverage boundary is asserted in
-`test/i18nEs.test.ts`; when hand-written Spanish UI copy lands, it lands
-additively — this subpath and `workspacesI18nBundleEs` keep their names.
+`test/i18nEs.test.ts`, which asserts parity with the en bundle key for key.
 
 ## Guardrails
 

package/dist/api/generated/schema.d.ts

@@ -7,26 +7,26 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * @description Overridable serializer seams for API views.
+         * @description Turns an unaskable plan ceiling into 503 for the whole view.
          *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
-         *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *     Mixed in rather than written as an ``except`` at each call site because
+         *     the seam is consulted from views AND from inside ``services`` under the
+         *     workspace lock, and the set of call sites grows: a view that gains a
+         *     method later inherits the mapping instead of re-deriving it. The 402
+         *     denials stay per-call-site — those carry a limit the screen renders.
          *
          *     **Permissions:** `IsAuthenticated`
          */
         get: operations["workspaces_api_v1_retrieve"];
         put?: never;
         /**
-         * @description Overridable serializer seams for API views.
-         *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
+         * @description Turns an unaskable plan ceiling into 503 for the whole view.
          *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *     Mixed in rather than written as an ``except`` at each call site because
+         *     the seam is consulted from views AND from inside ``services`` under the
+         *     workspace lock, and the set of call sites grows: a view that gains a
+         *     method later inherits the mapping instead of re-deriving it. The 402
+         *     denials stay per-call-site — those carry a limit the screen renders.
          *
          *     **Permissions:** `IsAuthenticated`
          */
@@ -45,13 +45,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * @description Overridable serializer seams for API views.
+         * @description Overridable request/response serializer seam for an API view.
+         *
+         *     Declare the classes as attributes, read them through the getters::
          *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
+         *         class WalletView(SerializerSeamMixin, APIView):
+         *             response_serializer_class = WalletResponseSerializer
          *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *             def get(self, request):
+         *                 response_cls = self.get_response_serializer_class()
+         *                 return StapelResponse(response_cls(wallet_to_dto(...)))
+         *
+         *     A host project swaps either direction by subclassing and setting the
+         *     attribute, or overrides the getter for a per-request decision — no HTTP
+         *     method body is ever copied. ``None`` means the direction carries no
+         *     serializer (raw ``request.FILES``, an empty 204 body).
          *
          *     **Permissions:** `IsAuthenticated`
          */
@@ -59,13 +67,13 @@ export interface paths {
         put?: never;
         post?: never;
         /**
-         * @description Overridable serializer seams for API views.
-         *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
+         * @description End a workspace — the transition itself lives in the service.
          *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *     The view's whole job here is authority (owner, and only owner) and
+         *     turning the service's typed refusal back into the keyed 409 the
+         *     frontend routes on. The write, the event and the audit line are one
+         *     indivisible act in ``services.delete_workspace``, because a second
+         *     door into this transition is a second chance to forget the record.
          *
          *     **Permissions:** `IsAuthenticated`
          */
@@ -73,13 +81,21 @@ export interface paths {
         options?: never;
         head?: never;
         /**
-         * @description Overridable serializer seams for API views.
+         * @description Overridable request/response serializer seam for an API view.
          *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
+         *     Declare the classes as attributes, read them through the getters::
          *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *         class WalletView(SerializerSeamMixin, APIView):
+         *             response_serializer_class = WalletResponseSerializer
+         *
+         *             def get(self, request):
+         *                 response_cls = self.get_response_serializer_class()
+         *                 return StapelResponse(response_cls(wallet_to_dto(...)))
+         *
+         *     A host project swaps either direction by subclassing and setting the
+         *     attribute, or overrides the getter for a per-request decision — no HTTP
+         *     method body is ever copied. ``None`` means the direction carries no
+         *     serializer (raw ``request.FILES``, an empty 204 body).
          *
          *     **Permissions:** `IsAuthenticated`
          */
@@ -289,13 +305,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * @description Overridable serializer seams for API views.
+         * @description Overridable request/response serializer seam for an API view.
+         *
+         *     Declare the classes as attributes, read them through the getters::
          *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
+         *         class WalletView(SerializerSeamMixin, APIView):
+         *             response_serializer_class = WalletResponseSerializer
          *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *             def get(self, request):
+         *                 response_cls = self.get_response_serializer_class()
+         *                 return StapelResponse(response_cls(wallet_to_dto(...)))
+         *
+         *     A host project swaps either direction by subclassing and setting the
+         *     attribute, or overrides the getter for a per-request decision — no HTTP
+         *     method body is ever copied. ``None`` means the direction carries no
+         *     serializer (raw ``request.FILES``, an empty 204 body).
          *
          *     **Permissions:** `IsAuthenticated`
          */
@@ -319,13 +343,21 @@ export interface paths {
         put?: never;
         post?: never;
         /**
-         * @description Overridable serializer seams for API views.
+         * @description Overridable request/response serializer seam for an API view.
+         *
+         *     Declare the classes as attributes, read them through the getters::
          *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
+         *         class WalletView(SerializerSeamMixin, APIView):
+         *             response_serializer_class = WalletResponseSerializer
          *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *             def get(self, request):
+         *                 response_cls = self.get_response_serializer_class()
+         *                 return StapelResponse(response_cls(wallet_to_dto(...)))
+         *
+         *     A host project swaps either direction by subclassing and setting the
+         *     attribute, or overrides the getter for a per-request decision — no HTTP
+         *     method body is ever copied. ``None`` means the direction carries no
+         *     serializer (raw ``request.FILES``, an empty 204 body).
          *
          *     **Permissions:** `IsAuthenticated`
          */
@@ -333,13 +365,21 @@ export interface paths {
         options?: never;
         head?: never;
         /**
-         * @description Overridable serializer seams for API views.
+         * @description Overridable request/response serializer seam for an API view.
+         *
+         *     Declare the classes as attributes, read them through the getters::
+         *
+         *         class WalletView(SerializerSeamMixin, APIView):
+         *             response_serializer_class = WalletResponseSerializer
          *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
+         *             def get(self, request):
+         *                 response_cls = self.get_response_serializer_class()
+         *                 return StapelResponse(response_cls(wallet_to_dto(...)))
          *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *     A host project swaps either direction by subclassing and setting the
+         *     attribute, or overrides the getter for a per-request decision — no HTTP
+         *     method body is ever copied. ``None`` means the direction carries no
+         *     serializer (raw ``request.FILES``, an empty 204 body).
          *
          *     **Permissions:** `IsAuthenticated`
          */
@@ -477,13 +517,13 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * @description Overridable serializer seams for API views.
+         * @description Turns an unaskable plan ceiling into 503 for the whole view.
          *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
-         *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *     Mixed in rather than written as an ``except`` at each call site because
+         *     the seam is consulted from views AND from inside ``services`` under the
+         *     workspace lock, and the set of call sites grows: a view that gains a
+         *     method later inherits the mapping instead of re-deriving it. The 402
+         *     denials stay per-call-site — those carry a limit the screen renders.
          *
          *     **Permissions:** `IsAuthenticated`
          */
@@ -517,7 +557,8 @@ export interface paths {
          *     Gate stack, in order: HIGH step-up (``@requires_verification``, scope
          *     ``sensitive`` — the same store as admin step-up) → capability
          *     ``members.provision`` (403) → entitlement ``workspaces.provision_user``
-         *     (402; degrades to allow without billing) → optional per-user debit
+         *     (402; an unreachable billing answers 503, not allow) → optional
+         *     per-user debit
          *     (``STAPEL_WORKSPACES["PROVISION_USER_CREDITS"]`` > 0).
          *
          *     Credentials: a synthetic account normally has no email — when the
@@ -650,6 +691,11 @@ export interface paths {
          *     NOT consumed here: accept stays a separate, deliberate step after
          *     setup. Neither the invite token nor the grant token is ever logged.
          *
+         *     ONE live grant at a time (WORK-03): while the previous grant is inside
+         *     its TTL this answers 429 ``error.429.invitation_grant_pending`` with a
+         *     ``Retry-After``, so a leaked invite link cannot be replayed into an
+         *     endless supply of sign-in credentials for the invited mailbox.
+         *
          *     **Permissions:** `AllowAny`
          */
         post: operations["workspaces_api_v1_invitations_claim_create"];
@@ -671,11 +717,36 @@ export interface paths {
         /**
          * @description Decline an invitation — the invitee's terminal "no" (spec §B2).
          *
-         *     Authenticated + email-match, exactly like accept: only the invited
-         *     account may resolve the invitation, in either direction. Decline ≠
-         *     revoke — both states stay distinguishable in the preview ``status``.
+         *     AllowAny, on the token, exactly like preview and claim — and this is a
+         *     CHANGE from the original authenticated-only rule, made because that rule
+         *     made the common "no" impossible to say.
+         *
+         *     Saying no used to require an account. The invitee who has none is the
+         *     majority case on this path (that is why ``claim`` exists at all), so
+         *     declining meant first creating the very account the person was declining
+         *     to create: the flow asked for the commitment before the decision, and
+         *     the refusal left a live, empty account behind it. Verified on the stand.
+         *
+         *     The token is the proof, and it is the same proof the module already
+         *     accepts elsewhere for strictly more: ``claim`` takes this token from an
+         *     anonymous caller and mints a LOGIN GRANT for the invited mailbox.
+         *     Anything a token holder could do by declining, they could already do —
+         *     and more — by claiming. What the token cannot do is act as somebody
+         *     else: a request that arrives WITH a session naming an address must still
+         *     be the invited address, so a signed-in person cannot resolve an
+         *     invitation belonging to someone else. That check is unchanged.
+         *
+         *     A session with no address at all (a guest session — this product mints
+         *     them at meeting doors) is treated as the anonymous case rather than as a
+         *     mismatched account: it names nobody, so it can neither prove nor
+         *     disprove ownership, and the token stands on its own. Before this it was
+         *     refused outright by ``ANONYMOUS_DENIED``, which is how a guest who was
+         *     also an invitee could not decline at all.
+         *
+         *     Decline ≠ revoke — both states stay distinguishable in the preview
+         *     ``status``. Throttled and token-never-logged like its AllowAny siblings.
          *
-         *     **Permissions:** `IsAuthenticated`
+         *     **Permissions:** `AllowAny`
          */
         post: operations["workspaces_api_v1_invitations_decline_create"];
         delete?: never;
@@ -694,13 +765,13 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * @description Overridable serializer seams for API views.
-         *
-         *     Subclasses (or downstream projects) can swap the request/response
-         *     serializers without copying method bodies:
+         * @description Turns an unaskable plan ceiling into 503 for the whole view.
          *
-         *         class MyWorkspaceDetailView(WorkspaceDetailView):
-         *             response_serializer_class = MyWorkspaceResponseSerializer
+         *     Mixed in rather than written as an ``except`` at each call site because
+         *     the seam is consulted from views AND from inside ``services`` under the
+         *     workspace lock, and the set of call sites grows: a view that gains a
+         *     method later inherits the mapping instead of re-deriving it. The 402
+         *     denials stay per-call-site — those carry a limit the screen renders.
          *
          *     **Permissions:** `IsAuthenticated`
          */
@@ -996,6 +1067,46 @@ export interface components {
              */
             last_sent_at?: string | null;
         };
+        /** @description How far the workspace's require_mfa policy has actually got. */
+        MFAEnforcementStatus: {
+            /**
+             * @description pending / enforcing / enforced / failed. Only "enforced" means every active member's second factor has been confirmed — a settings flag saying require_mfa=true says somebody asked for it, not that it holds
+             * @example enforcing
+             */
+            state: string;
+            /**
+             * @description How many sweeps have run since the policy was switched on
+             * @example 3
+             */
+            attempts?: number;
+            /**
+             * @description Members auth answered about in the last sweep
+             * @example 12
+             */
+            checked_members?: number;
+            /**
+             * @description Of those, members with no strong factor — suspended with reason no_mfa
+             * @example 2
+             */
+            noncompliant_members?: number;
+            /**
+             * @description Active members whose factor nobody has confirmed yet. They are NOT admitted while the policy is on; this is the number an administrator has to get to zero
+             * @example 1
+             */
+            unverified_members?: number;
+            /**
+             * @description ISO 8601 time of the last sweep; null before the first
+             * @example 2026-08-11T10:00:00Z
+             */
+            last_attempt_at?: string | null;
+            /** @description ISO 8601 time coverage last became complete; null while it is not */
+            completed_at?: string | null;
+            /**
+             * @description What auth answered when the last sweep failed, verbatim; empty otherwise. Never credential material
+             * @example FunctionCallError: mfa_status timed out
+             */
+            last_error?: string;
+        };
         /** @description Invite payload. */
         MemberInviteRequest: {
             /**
@@ -1106,6 +1217,13 @@ export interface components {
              * @example Ada Lovelace
              */
             display_name?: string | null;
+            /**
+             * @description Whether this member was PROVEN to hold a strong second factor — true, false, or null for "nobody has asked yet". Under a require_mfa policy the null is what an administrator acts on: those members are not admitted until the answer arrives
+             * @example true
+             */
+            mfa_compliant?: boolean | null;
+            /** @description Whether this row IS the caller. Server-derived — the client is never asked to compare ids it may not have. Always false on the service-to-service membership read, where the caller is a service and not a member of anything */
+            is_self?: boolean;
         };
         PaginatedAuditEventResponseList: {
             items: components["schemas"]["AuditEventResponse"][];
@@ -1393,6 +1511,15 @@ export interface components {
              * @example Victor P.
              */
             owner_display_name?: string;
+            /** @description State of the security.require_mfa policy — present on the single-workspace responses (GET/PATCH detail) when the policy is on, null otherwise. The settings block says what was asked for; this says what actually holds, so an administrator who switched MFA on is not told "done" while half the organization was never checked */
+            mfa_enforcement?: components["schemas"]["MFAEnforcementStatus"] | null;
+            /** @description Whether THIS caller may delete THIS workspace right now. The ANSWER, not the inputs: a client deriving it from my_role alone draws a delete button on the instance's default workspace and on a personal workspace the next sign-in re-mints — both of which the endpoint refuses, which is the "button that leads to a refusal" defect. Same shape and same reason as can_create_workspace on the list response */
+            can_delete?: boolean;
+            /**
+             * @description The error code the DELETE would return, or "" when can_delete is true. The CODE rather than a sentence, so the client renders the refusal in the caller's own language through the error map it already ships. Server verdict and screen explanation are ONE evaluation (services.deletion_block_reason), so a screen cannot promise what the endpoint denies
+             * @example error.409.workspace_is_instance_default
+             */
+            delete_blocked_reason?: string;
         };
     };
     responses: never;