@stapel/workspaces-react 0.6.0 → 0.7.0

package/dist/flows/inviteAcceptFlow.js

@@ -0,0 +1,126 @@
+import { createFlowMachine } from "@stapel/core";
+import { emailMatchesMask } from "../model/emailMask.js";
+import { toFlowError } from "./errors.js";
+/**
+ * Flow id: stapel-workspaces annotates no `@flow_step` yet (its
+ * `docs/flows.json` is empty — the pair's flow registry is the zero-flow
+ * shim), so this id is pair-local until the backend documents the flow;
+ * switch to the generated registry id when it lands.
+ */
+const FLOW_ID = "workspaces.invite_accept";
+function routeSignedIn(preview, email) {
+    return emailMatchesMask(email, preview.email_masked)
+        ? { step: "acceptPrompt", preview }
+        : { step: "wrongAccount", preview };
+}
+function routePreview(preview, sessionEmail) {
+    if (preview.status !== "pending") {
+        return { step: "unavailable", preview, status: preview.status };
+    }
+    if (sessionEmail !== null && sessionEmail !== "") {
+        return routeSignedIn(preview, sessionEmail);
+    }
+    return preview.email_registered
+        ? { step: "loginRequired", preview }
+        : { step: "newUser", preview };
+}
+export function createInviteAcceptFlow(deps) {
+    const machine = createFlowMachine({
+        id: FLOW_ID,
+        initial: { step: "idle" },
+        analytics: deps.analytics ?? null,
+    });
+    async function load(sessionEmail) {
+        await machine.run({ step: "loadingPreview" }, () => deps.api.getInvitationPreview(deps.token), {
+            resolve: (preview) => routePreview(preview, sessionEmail),
+            reject: (error) => ({
+                step: "previewError",
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function claim() {
+        const s = machine.getState();
+        if (s.step !== "newUser" && s.step !== "claimError")
+            return;
+        const { preview } = s;
+        await machine.run({ step: "claiming", preview }, () => deps.api.claimInvitation(deps.token), {
+            resolve: (r) => {
+                deps.onLoginGrant?.(r.grant_token);
+                return { step: "grantIssued", preview, grantToken: r.grant_token };
+            },
+            reject: (error) => ({
+                step: "claimError",
+                preview,
+                error: toFlowError(error),
+            }),
+        });
+    }
+    function sessionEstablished(email) {
+        const s = machine.getState();
+        if (s.step !== "loginRequired" && s.step !== "wrongAccount")
+            return;
+        machine.to(routeSignedIn(s.preview, email));
+    }
+    function grantExchanged() {
+        const s = machine.getState();
+        if (s.step !== "grantIssued")
+            return;
+        machine.to({ step: "basicData", preview: s.preview });
+    }
+    function completeBasicData() {
+        const s = machine.getState();
+        if (s.step !== "basicData")
+            return;
+        machine.to({ step: "acceptPrompt", preview: s.preview });
+    }
+    async function accept() {
+        const s = machine.getState();
+        if (s.step !== "acceptPrompt" && s.step !== "acceptError")
+            return;
+        const { preview } = s;
+        await machine.run({ step: "accepting", preview }, () => deps.api.acceptInvitation({ token: deps.token }), {
+            resolve: (member) => {
+                deps.onAccepted?.(member);
+                return { step: "accepted", member, preview };
+            },
+            reject: (error) => ({
+                step: "acceptError",
+                preview,
+                error: toFlowError(error),
+            }),
+        });
+    }
+    async function decline() {
+        const s = machine.getState();
+        if (s.step !== "acceptPrompt" && s.step !== "acceptError")
+            return;
+        const { preview } = s;
+        await machine.run({ step: "declining", preview }, () => deps.api.declineInvitation(deps.token), {
+            resolve: () => {
+                deps.onDeclined?.();
+                return { step: "declined", preview };
+            },
+            reject: (error) => ({
+                step: "acceptError",
+                preview,
+                error: toFlowError(error),
+            }),
+        });
+    }
+    function reset() {
+        machine.to({ step: "idle" });
+    }
+    return {
+        machine,
+        load,
+        claim,
+        sessionEstablished,
+        grantExchanged,
+        completeBasicData,
+        accept,
+        decline,
+        reset,
+    };
+}
+//# sourceMappingURL=inviteAcceptFlow.js.map

package/dist/flows/inviteAcceptFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inviteAcceptFlow.js","sourceRoot":"","sources":["../../src/flows/inviteAcceptFlow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmI1C;;;;;GAKG;AACH,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAE3C,SAAS,aAAa,CACpB,OAA0B,EAC1B,KAAa;IAEb,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC;QAClD,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE;QACnC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CACnB,OAA0B,EAC1B,YAA2B;IAE3B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC,gBAAgB;QAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE;QACpC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAA0B;IAE1B,MAAM,OAAO,GAAG,iBAAiB,CAAoB;QACnD,EAAE,EAAE,OAAO;QACX,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;KAClC,CAAC,CAAC;IAEH,KAAK,UAAU,IAAI,CAAC,YAA2B;QAC7C,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC1B,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/C;YACE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC;YACzD,MAAM,EAAE,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;gBACrC,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACtB,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1C;YACE,OAAO,EAAE,CAAC,CAAC,EAAqB,EAAE;gBAChC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACrE,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;gBACrC,IAAI,EAAE,YAAY;gBAClB,OAAO;gBACP,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,SAAS,kBAAkB,CAAC,KAAa;QACvC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO;QACpE,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,SAAS,cAAc;QACrB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO;QACrC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,SAAS,iBAAiB;QACxB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO;QACnC,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO;QAClE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACtB,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAC9B,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EACtD;YACE,OAAO,EAAE,CAAC,MAAM,EAAqB,EAAE;gBACrC,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC1B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC/C,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;gBACrC,IAAI,EAAE,aAAa;gBACnB,OAAO;gBACP,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,OAAO;QACpB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO;QAClE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACtB,MAAM,OAAO,CAAC,GAAG,CACf,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAC9B,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC5C;YACE,OAAO,EAAE,GAAsB,EAAE;gBAC/B,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBACpB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YACvC,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAqB,EAAE,CAAC,CAAC;gBACrC,IAAI,EAAE,aAAa;gBACnB,OAAO;gBACP,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;aAC1B,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED,SAAS,KAAK;QACZ,OAAO,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,OAAO;QACP,IAAI;QACJ,KAAK;QACL,kBAAkB;QAClB,cAAc;QACd,iBAAiB;QACjB,MAAM;QACN,OAAO;QACP,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/headless/Can.d.ts

@@ -0,0 +1,40 @@
+import type { ReactNode } from "react";
+/** Render-prop bag for {@link Can}'s function-children variant. */
+export interface CanBag {
+    /** The wildcard-aware verdict for `capability` in `workspaceId`. */
+    readonly allowed: boolean;
+    /** The underlying read is still in flight (verdict is `false` meanwhile —
+     * deny-by-default; render a skeleton off this if flicker matters). */
+    readonly isLoading: boolean;
+}
+/**
+ * Capability gate (org-program §A2) — the mandate model's UI affordance:
+ *
+ * ```tsx
+ * <Can capability="meetings.spotlight" workspaceId={wsId}>
+ *   <SpotlightButton />
+ * </Can>
+ * // or the render-prop variant, when "disabled" beats "hidden":
+ * <Can capability="members.invite" workspaceId={wsId}>
+ *   {({ allowed }) => <Button disabled={!allowed}>…</Button>}
+ * </Can>
+ * ```
+ *
+ * Reads the caller's `my_capabilities` from the workspace detail
+ * ({@link useCapabilities}) and matches with the backend's ported wildcard
+ * matcher (`*` / `prefix.*`). Deny-by-default: nothing renders (or
+ * `allowed: false`) while loading, on error, for a non-member, or against a
+ * pre-0.6 backend. UI convenience ONLY — the backend re-checks every
+ * capability on every operation; hiding a button is not access control.
+ */
+export declare function Can(props: {
+    /** Namespaced capability string, e.g. `"meetings.spotlight"`. */
+    capability: string;
+    workspaceId: string;
+    /** Static children render when allowed; function children always render,
+     * receiving the {@link CanBag}. */
+    children: ReactNode | ((bag: CanBag) => ReactNode);
+    /** Rendered when the verdict is a definite "no" (static children only). */
+    fallback?: ReactNode;
+}): ReactNode;
+//# sourceMappingURL=Can.d.ts.map

package/dist/headless/Can.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Can.d.ts","sourceRoot":"","sources":["../../src/headless/Can.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAGvC,mEAAmE;AACnE,MAAM,WAAW,MAAM;IACrB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;0EACsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE;IACzB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;uCACmC;IACnC,QAAQ,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC;IACnD,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB,GAAG,SAAS,CAOZ"}

package/dist/headless/Can.js

@@ -0,0 +1,30 @@
+import { useCapabilities } from "../model/queries.js";
+/**
+ * Capability gate (org-program §A2) — the mandate model's UI affordance:
+ *
+ * ```tsx
+ * <Can capability="meetings.spotlight" workspaceId={wsId}>
+ *   <SpotlightButton />
+ * </Can>
+ * // or the render-prop variant, when "disabled" beats "hidden":
+ * <Can capability="members.invite" workspaceId={wsId}>
+ *   {({ allowed }) => <Button disabled={!allowed}>…</Button>}
+ * </Can>
+ * ```
+ *
+ * Reads the caller's `my_capabilities` from the workspace detail
+ * ({@link useCapabilities}) and matches with the backend's ported wildcard
+ * matcher (`*` / `prefix.*`). Deny-by-default: nothing renders (or
+ * `allowed: false`) while loading, on error, for a non-member, or against a
+ * pre-0.6 backend. UI convenience ONLY — the backend re-checks every
+ * capability on every operation; hiding a button is not access control.
+ */
+export function Can(props) {
+    const caps = useCapabilities(props.workspaceId);
+    const allowed = caps.can(props.capability);
+    if (typeof props.children === "function") {
+        return props.children({ allowed, isLoading: caps.isLoading });
+    }
+    return allowed ? props.children : (props.fallback ?? null);
+}
+//# sourceMappingURL=Can.js.map

package/dist/headless/Can.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Can.js","sourceRoot":"","sources":["../../src/headless/Can.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAWtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,GAAG,CAAC,KASnB;IACC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/dist/headless/InviteAcceptFlow.d.ts

@@ -0,0 +1,44 @@
+import type { ReactNode } from "react";
+import type { InviteAcceptState } from "../flows/inviteAcceptFlow.js";
+import type { Member } from "../api/types.js";
+/** Render-prop bag for {@link InviteAcceptFlow}. */
+export interface InviteAcceptFlowBag {
+    readonly state: InviteAcceptState;
+    /** From `newUser`/`claimError`: mint the login grant. */
+    claim(): void;
+    /** From `loginRequired`/`wrongAccount`: a session now exists — re-route on
+     * its email. (Also fired automatically when the `sessionEmail` prop
+     * becomes non-null while parked in either step.) */
+    sessionEstablished(email: string): void;
+    /** From `grantIssued`: the host exchanged the grant at auth. */
+    grantExchanged(): void;
+    /** From `basicData`: the initial-setup slot finished. */
+    completeBasicData(): void;
+    accept(): void;
+    decline(): void;
+    /** Re-fetch the preview and re-route (e.g. after a logout on wrongAccount). */
+    reload(): void;
+}
+/**
+ * Headless `/invite/{token}` journey (org-program §B4) — the flow machine
+ * (`flows/inviteAcceptFlow.ts`, see ITS doc for the full state graph and the
+ * grant_token hand-off seam) wired to this pair's runtime. Renderless: every
+ * screen (accept modal, wrong-account, the login and initial-setup SLOTS) is
+ * the host's; the default `InviteAcceptPage` is the reference skin.
+ *
+ * The pair knows nothing about auth: pass the signed-in email (or null) as
+ * `sessionEmail`, and connect `onLoginGrant` to auth-react's
+ * `exchangeLoginGrant` yourself — then call `grantExchanged()`.
+ */
+export declare function InviteAcceptFlow(props: {
+    /** The invite token from the URL — a bearer secret, never log it. */
+    token: string;
+    /** The signed-in account's email, or null/undefined when no session. */
+    sessionEmail?: string | null;
+    children: (bag: InviteAcceptFlowBag) => ReactNode;
+    /** The grant_token hand-off (a credential — exchange, never log). */
+    onLoginGrant?: (grantToken: string) => void;
+    onAccepted?: (member: Member) => void;
+    onDeclined?: () => void;
+}): ReactNode;
+//# sourceMappingURL=InviteAcceptFlow.d.ts.map

package/dist/headless/InviteAcceptFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InviteAcceptFlow.d.ts","sourceRoot":"","sources":["../../src/headless/InviteAcceptFlow.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAGvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAG9C,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,yDAAyD;IACzD,KAAK,IAAI,IAAI,CAAC;IACd;;wDAEoD;IACpD,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,gEAAgE;IAChE,cAAc,IAAI,IAAI,CAAC;IACvB,yDAAyD;IACzD,iBAAiB,IAAI,IAAI,CAAC;IAC1B,MAAM,IAAI,IAAI,CAAC;IACf,OAAO,IAAI,IAAI,CAAC;IAChB,+EAA+E;IAC/E,MAAM,IAAI,IAAI,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,SAAS,CAAC;IAClD,qEAAqE;IACrE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;CACzB,GAAG,SAAS,CAwDZ"}

package/dist/headless/InviteAcceptFlow.js

@@ -0,0 +1,67 @@
+import { useEffect, useMemo } from "react";
+import { useFlow } from "@stapel/core";
+import { createInviteAcceptFlow } from "../flows/inviteAcceptFlow.js";
+import { useWorkspacesAnalytics, useWorkspacesApi } from "../model/context.js";
+/**
+ * Headless `/invite/{token}` journey (org-program §B4) — the flow machine
+ * (`flows/inviteAcceptFlow.ts`, see ITS doc for the full state graph and the
+ * grant_token hand-off seam) wired to this pair's runtime. Renderless: every
+ * screen (accept modal, wrong-account, the login and initial-setup SLOTS) is
+ * the host's; the default `InviteAcceptPage` is the reference skin.
+ *
+ * The pair knows nothing about auth: pass the signed-in email (or null) as
+ * `sessionEmail`, and connect `onLoginGrant` to auth-react's
+ * `exchangeLoginGrant` yourself — then call `grantExchanged()`.
+ */
+export function InviteAcceptFlow(props) {
+    const api = useWorkspacesApi();
+    const analytics = useWorkspacesAnalytics();
+    const sessionEmail = props.sessionEmail ?? null;
+    const { token, onLoginGrant, onAccepted, onDeclined } = props;
+    const flow = useMemo(() => createInviteAcceptFlow({
+        api,
+        analytics,
+        token,
+        ...(onLoginGrant !== undefined ? { onLoginGrant } : {}),
+        ...(onAccepted !== undefined ? { onAccepted } : {}),
+        ...(onDeclined !== undefined ? { onDeclined } : {}),
+    }), [api, analytics, token, onLoginGrant, onAccepted, onDeclined]);
+    const state = useFlow(flow.machine);
+    // Initial load — once per flow instance (a new token remounts the memo).
+    useEffect(() => {
+        if (flow.machine.getState().step === "idle") {
+            void flow.load(sessionEmail);
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps -- sessionEmail is read once at load time by design; later session changes re-route via the dedicated effect below, not a re-load
+    }, [flow]);
+    // Auto hand-off: the host's login slot signed the user in while we were
+    // parked in `loginRequired`/`wrongAccount` — re-route without requiring the
+    // host to call `sessionEstablished` manually.
+    useEffect(() => {
+        if (sessionEmail === null || sessionEmail === "")
+            return;
+        const step = flow.machine.getState().step;
+        if (step === "loginRequired" || step === "wrongAccount") {
+            flow.sessionEstablished(sessionEmail);
+        }
+    }, [flow, sessionEmail, state.step]);
+    return props.children({
+        state,
+        claim: () => {
+            void flow.claim();
+        },
+        sessionEstablished: flow.sessionEstablished,
+        grantExchanged: flow.grantExchanged,
+        completeBasicData: flow.completeBasicData,
+        accept: () => {
+            void flow.accept();
+        },
+        decline: () => {
+            void flow.decline();
+        },
+        reload: () => {
+            void flow.load(sessionEmail);
+        },
+    });
+}
+//# sourceMappingURL=InviteAcceptFlow.js.map

package/dist/headless/InviteAcceptFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InviteAcceptFlow.js","sourceRoot":"","sources":["../../src/headless/InviteAcceptFlow.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAE3C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAGtE,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAqB/E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAUhC;IACC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC;IAChD,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,EAAE,CACH,sBAAsB,CAAC;QACrB,GAAG;QACH,SAAS;QACT,KAAK;QACL,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,EACJ,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAC9D,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEpC,yEAAyE;IACzE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5C,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;QACD,yLAAyL;IAC3L,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,wEAAwE;IACxE,4EAA4E;IAC5E,8CAA8C;IAC9C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAErC,OAAO,KAAK,CAAC,QAAQ,CAAC;QACpB,KAAK;QACL,KAAK,EAAE,GAAG,EAAE;YACV,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;QACD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,MAAM,EAAE,GAAG,EAAE;YACX,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACZ,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE;YACX,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/headless/RoleSelect.d.ts

@@ -0,0 +1,41 @@
+import type { ReactNode } from "react";
+import type { StapelApiError } from "@stapel/core";
+import type { RoleInfo } from "../api/types.js";
+/** Render-prop bag for {@link RoleSelect}. */
+export interface RoleSelectBag {
+    /** The effective registry (GET /roles): builtin four + the deployment's
+     * overlay, rank-descending. Empty while loading. */
+    readonly roles: readonly RoleInfo[];
+    /**
+     * Display label for a role key: the i18n key `workspaces.role.<key>` when
+     * the current locale's merged bundle carries it (the pair ships the builtin
+     * four; a client bundle merges its own — e.g. `workspaces.role.secretary`),
+     * else the RAW role key. The raw-name fallback is deliberate: a
+     * deployment-defined role without a translation must still be pickable,
+     * never render as a dotted i18n key.
+     */
+    labelFor(role: string): string;
+    readonly isLoading: boolean;
+    readonly isError: boolean;
+    readonly error: StapelApiError | null;
+}
+/**
+ * Headless role picker over the effective role registry (org-program §A2) —
+ * the component that lets role UI stop hardcoding the builtin four. Bring
+ * your own `<Select>`:
+ *
+ * ```tsx
+ * <RoleSelect>
+ *   {({ roles, labelFor }) => (
+ *     <Select options={roles.map((r) => ({ value: r.role, label: labelFor(r.role) }))} />
+ *   )}
+ * </RoleSelect>
+ * ```
+ *
+ * `owner` is in the registry too — filter it out where "only an owner grants
+ * owner" applies (the backend enforces regardless).
+ */
+export declare function RoleSelect(props: {
+    children: (bag: RoleSelectBag) => ReactNode;
+}): ReactNode;
+//# sourceMappingURL=RoleSelect.d.ts.map

package/dist/headless/RoleSelect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleSelect.d.ts","sourceRoot":"","sources":["../../src/headless/RoleSelect.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGhD,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAChC,QAAQ,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,SAAS,CAAC;CAC7C,GAAG,SAAS,CAcZ"}

package/dist/headless/RoleSelect.js

@@ -0,0 +1,34 @@
+import { useI18n } from "@stapel/core";
+import { useRoles } from "../model/queries.js";
+/**
+ * Headless role picker over the effective role registry (org-program §A2) —
+ * the component that lets role UI stop hardcoding the builtin four. Bring
+ * your own `<Select>`:
+ *
+ * ```tsx
+ * <RoleSelect>
+ *   {({ roles, labelFor }) => (
+ *     <Select options={roles.map((r) => ({ value: r.role, label: labelFor(r.role) }))} />
+ *   )}
+ * </RoleSelect>
+ * ```
+ *
+ * `owner` is in the registry too — filter it out where "only an owner grants
+ * owner" applies (the backend enforces regardless).
+ */
+export function RoleSelect(props) {
+    const query = useRoles();
+    const i18n = useI18n();
+    // Raw bundle lookup, NOT `t()`: `t` falls back to the key itself, which is
+    // exactly the wrong fallback here (a deployment role without a translation
+    // must show its raw name, not `workspaces.role.secretary`).
+    const bundle = i18n.getBundle();
+    return props.children({
+        roles: query.data ?? [],
+        labelFor: (role) => bundle[`workspaces.role.${role}`] ?? role,
+        isLoading: query.isLoading,
+        isError: query.isError,
+        error: query.error ?? null,
+    });
+}
+//# sourceMappingURL=RoleSelect.js.map

package/dist/headless/RoleSelect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleSelect.js","sourceRoot":"","sources":["../../src/headless/RoleSelect.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAqB/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAAC,KAE1B;IACC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,2EAA2E;IAC3E,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,QAAQ,CAAC;QACpB,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;QACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,IAAI,IAAI;QAC7D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;KAC3B,CAAC,CAAC;AACL,CAAC"}

package/dist/i18n/generated/errors.gen.d.ts

@@ -124,6 +124,12 @@ export declare const WORKSPACES_ERRORS: {
         readonly remediation: "fix_input";
         readonly en: "Invalid advertisement ID";
     };
+    readonly "error.400.invalid_provision_username": {
+        readonly status: 400;
+        readonly params: readonly [];
+        readonly remediation: "fix_input";
+        readonly en: "Invalid username for a provisioned account";
+    };
     readonly "error.400.invalid_role": {
         readonly status: 400;
         readonly params: readonly [];
@@ -136,6 +142,12 @@ export declare const WORKSPACES_ERRORS: {
         readonly remediation: "fix_input";
         readonly en: "Invitation has already been used";
     };
+    readonly "error.400.invitation_declined": {
+        readonly status: 400;
+        readonly params: readonly [];
+        readonly remediation: "contact_support";
+        readonly en: "Invitation has been declined";
+    };
     readonly "error.400.invitation_expired": {
         readonly status: 400;
         readonly params: readonly [];
@@ -178,6 +190,18 @@ export declare const WORKSPACES_ERRORS: {
         readonly remediation: "reauthenticate";
         readonly en: "Authentication required";
     };
+    readonly "error.402.entitlement_required": {
+        readonly status: 402;
+        readonly params: readonly [];
+        readonly remediation: "fix_input";
+        readonly en: "The workspace owner's plan does not include this feature";
+    };
+    readonly "error.402.member_limit_reached": {
+        readonly status: 402;
+        readonly params: readonly ["limit"];
+        readonly remediation: "fix_input";
+        readonly en: "The workspace member limit ({limit}) has been reached";
+    };
     readonly "error.402.payment_required": {
         readonly status: 402;
         readonly params: readonly [];
@@ -202,6 +226,18 @@ export declare const WORKSPACES_ERRORS: {
         readonly remediation: "fix_input";
         readonly en: "The last owner cannot be removed; transfer ownership first";
     };
+    readonly "error.403.membership_suspended": {
+        readonly status: 403;
+        readonly params: readonly ["reason"];
+        readonly remediation: "fix_input";
+        readonly en: "Your membership in this workspace is suspended ({reason})";
+    };
+    readonly "error.403.missing_capability": {
+        readonly status: 403;
+        readonly params: readonly ["capability"];
+        readonly remediation: "contact_support";
+        readonly en: "Your role does not include the {capability} capability in this workspace";
+    };
     readonly "error.403.network_blocked": {
         readonly status: 403;
         readonly params: readonly [];
@@ -280,6 +316,12 @@ export declare const WORKSPACES_ERRORS: {
         readonly remediation: "fix_input";
         readonly en: "Resource already exists";
     };
+    readonly "error.409.email_already_registered": {
+        readonly status: 409;
+        readonly params: readonly [];
+        readonly remediation: "reauthenticate";
+        readonly en: "An account with this email already exists — log in instead";
+    };
     readonly "error.410.gone": {
         readonly status: 410;
         readonly params: readonly [];
@@ -334,6 +376,12 @@ export declare const WORKSPACES_ERRORS: {
         readonly remediation: "contact_support";
         readonly en: "Something went wrong";
     };
+    readonly "error.503.auth_unavailable": {
+        readonly status: 503;
+        readonly params: readonly [];
+        readonly remediation: "wait_and_retry";
+        readonly en: "The authentication service is unavailable; try again later";
+    };
 };
 export type WorkspacesErrorCode = keyof typeof WORKSPACES_ERRORS;
 /** Every backend error code this module can surface, sorted. */

package/dist/i18n/generated/errors.gen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.gen.d.ts","sourceRoot":"","sources":["../../../src/i18n/generated/errors.gen.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,QAAQ,GACR,WAAW,GACX,iBAAiB,GACjB,KAAK,CAAC;AAEV,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDpB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAEjE,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EAqDhE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAqDvE,CAAC"}
+{"version":3,"file":"errors.gen.d.ts","sourceRoot":"","sources":["../../../src/i18n/generated/errors.gen.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB,OAAO,GACP,gBAAgB,GAChB,gBAAgB,GAChB,QAAQ,GACR,WAAW,GACX,iBAAiB,GACjB,KAAK,CAAC;AAEV,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DpB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAEjE,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,EAAE,SAAS,mBAAmB,EA6DhE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CA6DvE,CAAC"}

package/dist/i18n/generated/errors.gen.js

@@ -24,8 +24,10 @@ export const WORKSPACES_ERRORS = {
     "error.400.field.required": { status: 400, params: ["field"], remediation: "fix_input", en: "{field} is required" },
     "error.400.field.unique": { status: 400, params: ["field"], remediation: "fix_input", en: "{field} must be unique" },
     "error.400.invalid_ad_id": { status: 400, params: [], remediation: "fix_input", en: "Invalid advertisement ID" },
+    "error.400.invalid_provision_username": { status: 400, params: [], remediation: "fix_input", en: "Invalid username for a provisioned account" },
     "error.400.invalid_role": { status: 400, params: [], remediation: "fix_input", en: "Invalid role" },
     "error.400.invitation_already_used": { status: 400, params: [], remediation: "fix_input", en: "Invitation has already been used" },
+    "error.400.invitation_declined": { status: 400, params: [], remediation: "contact_support", en: "Invitation has been declined" },
     "error.400.invitation_expired": { status: 400, params: [], remediation: "contact_support", en: "Invitation has expired" },
     "error.400.invitation_revoked": { status: 400, params: [], remediation: "contact_support", en: "Invitation has been revoked" },
     "error.400.validation_error": { status: 400, params: [], remediation: "fix_input", en: "Validation error" },
@@ -33,10 +35,14 @@ export const WORKSPACES_ERRORS = {
     "error.400.verification_invalid_factor": { status: 400, params: [], remediation: "verify", en: "This verification factor is not available" },
     "error.400.workspace_slug_taken": { status: 400, params: [], remediation: "fix_input", en: "Workspace slug is already taken" },
     "error.401.unauthorized": { status: 401, params: [], remediation: "reauthenticate", en: "Authentication required" },
+    "error.402.entitlement_required": { status: 402, params: [], remediation: "fix_input", en: "The workspace owner's plan does not include this feature" },
+    "error.402.member_limit_reached": { status: 402, params: ["limit"], remediation: "fix_input", en: "The workspace member limit ({limit}) has been reached" },
     "error.402.payment_required": { status: 402, params: [], remediation: "retry", en: "Payment required" },
     "error.403.forbidden": { status: 403, params: [], remediation: "retry", en: "You do not have permission to perform this action" },
     "error.403.forbidden_workspace": { status: 403, params: [], remediation: "contact_support", en: "You do not have access to this workspace" },
     "error.403.last_owner_cannot_be_removed": { status: 403, params: [], remediation: "fix_input", en: "The last owner cannot be removed; transfer ownership first" },
+    "error.403.membership_suspended": { status: 403, params: ["reason"], remediation: "fix_input", en: "Your membership in this workspace is suspended ({reason})" },
+    "error.403.missing_capability": { status: 403, params: ["capability"], remediation: "contact_support", en: "Your role does not include the {capability} capability in this workspace" },
     "error.403.network_blocked": { status: 403, params: [], remediation: "contact_support", en: "Requests from this network are not allowed" },
     "error.403.verification_enrollment_required": { status: 403, params: [], remediation: "verify", en: "Verification factor enrollment required" },
     "error.403.verification_required": { status: 403, params: [], remediation: "verify", en: "Additional verification required" },
@@ -50,6 +56,7 @@ export const WORKSPACES_ERRORS = {
     "error.406.not_acceptable": { status: 406, params: [], remediation: "retry", en: "Not acceptable" },
     "error.408.request_timeout": { status: 408, params: [], remediation: "retry", en: "Request timeout" },
     "error.409.conflict": { status: 409, params: [], remediation: "fix_input", en: "Resource already exists" },
+    "error.409.email_already_registered": { status: 409, params: [], remediation: "reauthenticate", en: "An account with this email already exists — log in instead" },
     "error.410.gone": { status: 410, params: [], remediation: "retry", en: "Resource has been permanently removed" },
     "error.413.payload_too_large": { status: 413, params: [], remediation: "retry", en: "Request body is too large" },
     "error.415.unsupported_media_type": { status: 415, params: [], remediation: "retry", en: "Unsupported media type" },
@@ -59,6 +66,7 @@ export const WORKSPACES_ERRORS = {
     "error.429.rate_limit": { status: 429, params: ["retry_after_minutes"], remediation: "wait_and_retry", en: "Too many attempts. Try again in {retry_after_minutes} minutes." },
     "error.429.too_many_requests": { status: 429, params: [], remediation: "wait_and_retry", en: "Too many requests. Please try again later." },
     "error.500.internal": { status: 500, params: [], remediation: "contact_support", en: "Something went wrong" },
+    "error.503.auth_unavailable": { status: 503, params: [], remediation: "wait_and_retry", en: "The authentication service is unavailable; try again later" },
 };
 /** Every backend error code this module can surface, sorted. */
 export const WORKSPACES_ERROR_CODES = [
@@ -79,8 +87,10 @@ export const WORKSPACES_ERROR_CODES = [
     "error.400.field.required",
     "error.400.field.unique",
     "error.400.invalid_ad_id",
+    "error.400.invalid_provision_username",
     "error.400.invalid_role",
     "error.400.invitation_already_used",
+    "error.400.invitation_declined",
     "error.400.invitation_expired",
     "error.400.invitation_revoked",
     "error.400.validation_error",
@@ -88,10 +98,14 @@ export const WORKSPACES_ERROR_CODES = [
     "error.400.verification_invalid_factor",
     "error.400.workspace_slug_taken",
     "error.401.unauthorized",
+    "error.402.entitlement_required",
+    "error.402.member_limit_reached",
     "error.402.payment_required",
     "error.403.forbidden",
     "error.403.forbidden_workspace",
     "error.403.last_owner_cannot_be_removed",
+    "error.403.membership_suspended",
+    "error.403.missing_capability",
     "error.403.network_blocked",
     "error.403.verification_enrollment_required",
     "error.403.verification_required",
@@ -105,6 +119,7 @@ export const WORKSPACES_ERROR_CODES = [
     "error.406.not_acceptable",
     "error.408.request_timeout",
     "error.409.conflict",
+    "error.409.email_already_registered",
     "error.410.gone",
     "error.413.payload_too_large",
     "error.415.unsupported_media_type",
@@ -114,6 +129,7 @@ export const WORKSPACES_ERROR_CODES = [
     "error.429.rate_limit",
     "error.429.too_many_requests",
     "error.500.internal",
+    "error.503.auth_unavailable",
 ];
 /**
  * English fallback bundle — one string per backend key, so a `StapelApiError.code`
@@ -138,8 +154,10 @@ export const workspacesErrorBundleEn = {
     "error.400.field.required": "{field} is required",
     "error.400.field.unique": "{field} must be unique",
     "error.400.invalid_ad_id": "Invalid advertisement ID",
+    "error.400.invalid_provision_username": "Invalid username for a provisioned account",
     "error.400.invalid_role": "Invalid role",
     "error.400.invitation_already_used": "Invitation has already been used",
+    "error.400.invitation_declined": "Invitation has been declined",
     "error.400.invitation_expired": "Invitation has expired",
     "error.400.invitation_revoked": "Invitation has been revoked",
     "error.400.validation_error": "Validation error",
@@ -147,10 +165,14 @@ export const workspacesErrorBundleEn = {
     "error.400.verification_invalid_factor": "This verification factor is not available",
     "error.400.workspace_slug_taken": "Workspace slug is already taken",
     "error.401.unauthorized": "Authentication required",
+    "error.402.entitlement_required": "The workspace owner's plan does not include this feature",
+    "error.402.member_limit_reached": "The workspace member limit ({limit}) has been reached",
     "error.402.payment_required": "Payment required",
     "error.403.forbidden": "You do not have permission to perform this action",
     "error.403.forbidden_workspace": "You do not have access to this workspace",
     "error.403.last_owner_cannot_be_removed": "The last owner cannot be removed; transfer ownership first",
+    "error.403.membership_suspended": "Your membership in this workspace is suspended ({reason})",
+    "error.403.missing_capability": "Your role does not include the {capability} capability in this workspace",
     "error.403.network_blocked": "Requests from this network are not allowed",
     "error.403.verification_enrollment_required": "Verification factor enrollment required",
     "error.403.verification_required": "Additional verification required",
@@ -164,6 +186,7 @@ export const workspacesErrorBundleEn = {
     "error.406.not_acceptable": "Not acceptable",
     "error.408.request_timeout": "Request timeout",
     "error.409.conflict": "Resource already exists",
+    "error.409.email_already_registered": "An account with this email already exists — log in instead",
     "error.410.gone": "Resource has been permanently removed",
     "error.413.payload_too_large": "Request body is too large",
     "error.415.unsupported_media_type": "Unsupported media type",
@@ -173,5 +196,6 @@ export const workspacesErrorBundleEn = {
     "error.429.rate_limit": "Too many attempts. Try again in {retry_after_minutes} minutes.",
     "error.429.too_many_requests": "Too many requests. Please try again later.",
     "error.500.internal": "Something went wrong",
+    "error.503.auth_unavailable": "The authentication service is unavailable; try again later",
 };
 //# sourceMappingURL=errors.gen.js.map