@stapel/workspaces-react 0.6.0 → 0.8.0

package/src/api/generated/schema.ts

@@ -89,6 +89,113 @@ export interface paths {
         patch: operations["workspaces_api_v1_partial_update"];
         trace?: never;
     };
+    "/workspaces/api/v1/{workspace_id}/invitations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * @description Who was invited and has not accepted (#109).
+         *
+         *     Before this endpoint an admin could send invitations and never see
+         *     them again: acceptance produced a member row, and everything else —
+         *     the unopened mail, the wrong address, the person who declined — was
+         *     invisible from the product. The roster answered "who is in"; nothing
+         *     answered "who is still out, and since when".
+         *
+         *     Gated on ``members.invite``: the mandate that creates invitations is
+         *     the mandate that sees and manages them. Reading the list is strictly
+         *     less than sending one, so no separate capability is minted — a role
+         *     that may invite but may not audit its own invitations would be a
+         *     distinction without a use.
+         *
+         *     The invite token is never in the response. It is a bearer credential;
+         *     a list endpoint that carried it would hand every admin a working login
+         *     link for every invited address.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        get: operations["workspaces_api_v1_invitations_list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/api/v1/{workspace_id}/invitations/{invitation_id}/resend": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Send the invitation email again (#109).
+         *
+         *     Accepts an **expired** invitation on purpose — a dead TTL is the most
+         *     common reason to resend — and refuses the three stored terminal states,
+         *     which are decisions rather than delivery failures. The token is
+         *     rotated and the TTL restarts, so the fresh letter carries a fresh link
+         *     and any stale copy of the old one stops working.
+         *
+         *     Reviving an expired invitation re-reserves a seat, so the plan ceiling
+         *     is re-checked here exactly as it is on invite: capability first ("may
+         *     YOU", 403), then the org's plan ("may the ORG", 402). An invitation
+         *     that is already pending costs no additional seat and is never blocked
+         *     by that check.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        post: operations["workspaces_api_v1_invitations_resend_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/api/v1/{workspace_id}/invitations/{invitation_id}/revoke": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Withdraw a live invitation (#109).
+         *
+         *     The workspace's terminal "no", the mirror of the invitee's decline —
+         *     the two stay distinguishable in ``status`` forever. The seat the
+         *     invitation reserved is freed on commit.
+         *
+         *     Only a **pending** invitation is revocable: an accepted one produced a
+         *     membership (remove the member instead), a declined or already-revoked
+         *     one is terminal, and an expired one is already harmless. Each of those
+         *     gets its own error key rather than a shrug.
+         *
+         *     The transition is a compare-and-set under a row lock, not a blind
+         *     write: an accept committing between this view's state check and the
+         *     lock wins, and the revocation then fails honestly with
+         *     ``error.400.invitation_already_used``. The reverse — a revocation
+         *     committing between an accept's check and its lock — is the race fixed
+         *     in 0.10.0, and it is the same predicate holding both ends.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        post: operations["workspaces_api_v1_invitations_revoke_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/api/v1/{workspace_id}/members": {
         parameters: {
             query?: never;
@@ -154,6 +261,78 @@ export interface paths {
         patch: operations["workspaces_api_v1_members_partial_update"];
         trace?: never;
     };
+    "/workspaces/api/v1/{workspace_id}/members/{user_id}/password/reset": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Reset a member's password on the organization's order (#110).
+         *
+         *     Five questions this endpoint has to answer out loud, because a
+         *     password reset is an account takeover performed on purpose and every
+         *     one of them is a way to get it wrong.
+         *
+         *     **Who may do it.** A mandate, not a session: capability
+         *     ``members.password.reset`` (builtin ``admin`` and ``owner``), declared
+         *     ``high``, so ``@requires_verification(scope="sensitive")`` demands a
+         *     fresh step-up on top — an ambient cookie is not enough to hand
+         *     somebody else's account over. Only an owner may reset an OWNER's
+         *     password, the same hardcoded owner protection role changes and
+         *     removals carry: otherwise an admin resets the owner and inherits the
+         *     organization. And auth refuses a staff/superuser target outright
+         *     (``error.403.privileged_account``) — org admin is a role inside one
+         *     workspace, deployment staff is a role above every workspace, and the
+         *     first must never be a route to the second.
+         *
+         *     **Whether the user finds out.** Always. A
+         *     ``workspace.member_password_reset`` letter names the workspace and the
+         *     admin who did it — a reset is indistinguishable from a takeover
+         *     unless the account holder is told which one it was. ``notified`` in
+         *     the response says honestly whether a channel existed; the letter
+         *     never carries the new password (see
+         *     :func:`~stapel_workspaces.services.reset_member_password`).
+         *
+         *     **Whether the new password is temporary.** Yes — auth raises the
+         *     workspace's ``provisioned_user_policies`` (#90), defaulting to
+         *     ``password_change``. A password the admin knows must stop working the
+         *     first time it is used, and since auth 0.15.0 that demand holds on all
+         *     19 session-issuance paths rather than only the password form. An org
+         *     may pass an explicit ``[]`` to suppress it, and that lands in auth's
+         *     audit row.
+         *
+         *     **Whether it is an existence oracle.** No: a target that is not a
+         *     resettable member of THIS workspace — an unknown UUID, a real account
+         *     that is not a member, a member of a different workspace, or the
+         *     caller's own id — all get one byte-identical 404. And the capability
+         *     check runs before any target lookup, so a caller without the mandate
+         *     learns nothing at all about anybody. ``tests/
+         *     test_api_member_password_reset.py`` compares those responses byte for
+         *     byte.
+         *
+         *     **Whether it is logged with the actor.** Twice, on purpose:
+         *     ``workspace.member_password_reset`` through the transactional outbox
+         *     (the org's activity log) and auth's own ``AuthAuditLog`` row carrying
+         *     ``actor_id`` and ``via=admin_reset`` (the deployment's security
+         *     journal). Neither carries credential material.
+         *
+         *     Own password: use auth's ``POST /password/change/``. This endpoint is
+         *     for acting on somebody else, and answers about yourself with the same
+         *     404 as about a stranger.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        post: operations["workspaces_api_v1_members_password_reset_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/api/v1/{workspace_id}/members/invite": {
         parameters: {
             query?: never;
@@ -181,6 +360,49 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/api/v1/{workspace_id}/members/provision": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Provision an org-created (synthetic) member (org-program spec §C1).
+         *
+         *     The org mints its own login/password account: full username is
+         *     ``{workspace_slug}/{username_local}`` (namespaced — the slug is
+         *     globally unique, so orgs cannot collide), the account is created by
+         *     ``auth.provision_user`` with the workspace's first-login policy
+         *     (``settings.security.provisioned_user_policy``: forced password change
+         *     or mandatory MFA enrollment) and joins immediately
+         *     (``accepted_at=now``, ``provisioned=True``).
+         *
+         *     Gate stack, in order: HIGH step-up (``@requires_verification``, scope
+         *     ``sensitive`` — the same store as admin step-up) → capability
+         *     ``members.provision`` (403) → entitlement ``workspaces.provision_user``
+         *     (402; degrades to allow without billing) → optional per-user debit
+         *     (``STAPEL_WORKSPACES["PROVISION_USER_CREDITS"]`` > 0).
+         *
+         *     Credentials: a synthetic account normally has no email — when the
+         *     request omits ``email``, the server-generated password comes back in
+         *     the response (``generated_password``) exactly once and no letter is
+         *     sent. With ``email``, the ``workspace.provisioned_account`` letter
+         *     carries the credentials as well. Auth's structured failures pass
+         *     through keyed (``error.409.username_taken`` / auth's 400s); auth not
+         *     wired → honest 503, this seam never degrades to allow.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        post: operations["workspaces_api_v1_members_provision_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/api/v1/internal/{workspace_id}/members/{user_id}": {
         parameters: {
             query?: never;
@@ -223,6 +445,90 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/api/v1/invitations/{token}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * @description Public invitation preview — what the /invite/{token} page renders.
+         *
+         *     AllowAny by design (org-program spec §B2): the invitee has no session
+         *     yet; the token in the URL is the bearer secret. The response leaks
+         *     nothing harvestable — the email is masked, and ``status`` /
+         *     ``email_registered`` are exactly what the frontend flow machine needs
+         *     to route (login vs claim vs terminal-state screen). Throttled as an
+         *     enumeration backstop. The token is never logged.
+         *
+         *     **Permissions:** `AllowAny`
+         */
+        get: operations["workspaces_api_v1_invitations_retrieve"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/api/v1/invitations/{token}/claim": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Mint a login grant for a not-yet-registered invitee (spec §B2-B3).
+         *
+         *     AllowAny — the whole point is that no account exists yet. Only valid
+         *     for ``email_registered == false``: an existing account gets 409 and the
+         *     frontend switches to login. The grant comes from auth's
+         *     ``auth.issue_login_grant`` comm Function (``create_if_missing`` — the
+         *     verified account materializes on exchange); if that Function is not
+         *     wired, the answer is an honest 503 — an invite flow without auth is
+         *     meaningless, so this seam never degrades to allow. The invitation is
+         *     NOT consumed here: accept stays a separate, deliberate step after
+         *     setup. Neither the invite token nor the grant token is ever logged.
+         *
+         *     **Permissions:** `AllowAny`
+         */
+        post: operations["workspaces_api_v1_invitations_claim_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/workspaces/api/v1/invitations/{token}/decline": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * @description Decline an invitation — the invitee's terminal "no" (spec §B2).
+         *
+         *     Authenticated + email-match, exactly like accept: only the invited
+         *     account may resolve the invitation, in either direction. Decline ≠
+         *     revoke — both states stay distinguishable in the preview ``status``.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        post: operations["workspaces_api_v1_invitations_decline_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/api/v1/invitations/accept": {
         parameters: {
             query?: never;
@@ -250,6 +556,31 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/api/v1/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * @description The effective role registry — metadata for frontends (spec §A2).
+         *
+         *     Lets a RoleSelect stop hardcoding the builtin four: builtin roles plus
+         *     the deployment's ``STAPEL_WORKSPACES["ROLES"]`` overlay, capability
+         *     strings verbatim (wildcards included), ordered by descending rank.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        get: operations["workspaces_api_v1_roles_retrieve"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -267,18 +598,100 @@ export interface components {
             /** @description Invite token from the email link */
             token: string;
         };
-        /** @description InvitationResponse(id: uuid.UUID, workspace_id: uuid.UUID, email: str, role: str, expires_at: str, accepted_at: Optional[str], revoked_at: Optional[str], created_at: str) */
+        /** @description Login-grant mint for an unregistered invitee (claim step). */
+        InvitationClaimResponse: {
+            /** @description Single-use, short-lived login grant token — exchange it at auth's POST /grant/exchange/ for a session (creates the verified account). A credential: never log it */
+            grant_token: string;
+        };
+        /** @description Public (AllowAny) invitation preview — what the /invite/{token} page renders before any auth decision. */
+        InvitationPreviewResponse: {
+            /**
+             * @description Display name of the inviting workspace
+             * @example Acme Engineering
+             */
+            workspace_name: string;
+            /**
+             * @description Role granted on acceptance
+             * @example member
+             */
+            role: string;
+            /**
+             * @description Invited email, masked for the public page
+             * @example m***@e***.com
+             */
+            email_masked: string;
+            /**
+             * @description Invitation state. One of pending / expired / revoked / accepted / declined
+             * @example pending
+             */
+            status: string;
+            /** @description Whether an account already exists for the invited email — steers the frontend to login vs claim */
+            email_registered: boolean;
+            /**
+             * @description ISO 8601 expiry time
+             * @example 2026-07-31T10:00:00Z
+             */
+            expires_at: string;
+        };
+        /**
+         * @description One invitation row — the admin's "who has not accepted yet" table (#109).
+         *
+         *     ``status`` is the derived label (``WorkspaceInvitation.status``), not a
+         *     stored column: it is what the table renders and what the frontend
+         *     routes the revoke/resend affordances on. The raw timestamps travel
+         *     alongside it because "expires in 2 days" and "declined last Tuesday"
+         *     are different rows on the same screen; the label alone cannot say
+         *     when.
+         *
+         *     The invite token is deliberately absent — it is a bearer secret that
+         *     only ever leaves this service inside the invitation email.
+         */
         InvitationResponse: {
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Invitation UUID
+             * @example 0192f...
+             */
             id: string;
-            /** Format: uuid */
+            /**
+             * Format: uuid
+             * @description Workspace UUID
+             */
             workspace_id: string;
+            /**
+             * @description Invited email address (normalized lowercase)
+             * @example alice@example.com
+             */
             email: string;
+            /**
+             * @description Role granted on acceptance
+             * @example member
+             */
             role: string;
+            /**
+             * @description Derived state. One of pending / accepted / declined / revoked / expired
+             * @example pending
+             */
+            status: string;
+            /**
+             * @description ISO 8601 expiry time
+             * @example 2026-07-31T10:00:00Z
+             */
             expires_at: string;
+            /** @description ISO 8601 acceptance time; null unless accepted */
             accepted_at: string | null;
+            /** @description ISO 8601 decline time (the invitee said no); null unless declined */
+            declined_at: string | null;
+            /** @description ISO 8601 revocation time (the workspace withdrew it); null unless revoked */
             revoked_at: string | null;
+            /** @description ISO 8601 creation time */
             created_at: string;
+            /**
+             * Format: uuid
+             * @description UUID of the admin who sent it; null when that account is gone
+             * @example 0192a...
+             */
+            invited_by_id?: string | null;
         };
         /** @description Invite payload. */
         MemberInviteRequest: {
@@ -299,6 +712,50 @@ export interface components {
         MemberInviteResponse: {
             invitations?: components["schemas"]["InvitationResponse"][];
         };
+        /** @description Reset a member's password on the organization's order (#110). */
+        MemberPasswordResetRequest: {
+            /** @description New password chosen by the admin. Omitted: the server generates a crypto-strong one, returned once as generated_password */
+            password?: string | null;
+            /**
+             * @description First-login steps to demand of the member afterwards — any subset of password_change / mfa_enroll. Omitted: the workspace's own security policies, falling back to password_change. A password somebody else chose has to stop working at its first use, so an EMPTY list is a deliberate, auditable choice, not a shortcut
+             * @example [
+             *       "password_change"
+             *     ]
+             */
+            first_login_policies?: string[] | null;
+            /**
+             * @description Free-text note recorded on auth's audit row (e.g. the ticket the request came in on)
+             * @example SUP-42
+             */
+            reason?: string | null;
+        };
+        /** @description Result of an administrative password reset (#110). */
+        MemberPasswordResetResponse: {
+            /**
+             * Format: uuid
+             * @description UUID of the member whose password was reset
+             */
+            user_id: string;
+            /**
+             * @description How many live sessions the reset ended. A reset that left them standing would not recover the account
+             * @example 2
+             */
+            sessions_revoked?: number;
+            /** @description Server-generated password — returned exactly ONCE, only when the request omitted password. Hand it to the member out of band; it cannot be re-fetched. A credential: never log it */
+            generated_password?: string | null;
+            /**
+             * @description The steps now demanded of the member before their next session
+             * @example [
+             *       "password_change"
+             *     ]
+             */
+            first_login_policies_applied?: string[];
+            /**
+             * @description Whether the member was told their password was reset. False means the account has no contact channel — the admin is the only one who can tell them
+             * @example true
+             */
+            notified?: boolean;
+        };
         /** @description Workspace member. */
         MemberResponse: {
             /**
@@ -330,6 +787,25 @@ export interface components {
             accepted_at: string | null;
             /** @description ISO 8601 last access; null if never accessed */
             last_accessed_at: string | null;
+            /** @description Whether this is an org-created (synthetic) member joined via members/provision */
+            provisioned?: boolean;
+            /** @description ISO 8601 suspension timestamp; null while active. Suspension is not removal — the role stays but access is closed */
+            suspended_at?: string | null;
+            /** @description Why the membership is suspended (canonical value no_mfa); null while active */
+            suspension_reason?: string | null;
+        };
+        PaginatedInvitationResponseList: {
+            items: components["schemas"]["InvitationResponse"][];
+            /** @description Anchor value for next page */
+            next_anchor?: string | null;
+            /** @description Anchor value for previous page */
+            prev_anchor?: string | null;
+            /** @description Whether there are more items after this page */
+            has_next: boolean;
+            /** @description Whether there are items before this page */
+            has_prev: boolean;
+            /** @description Number of items in current page */
+            count: number;
         };
         PaginatedMemberResponseList: {
             items: components["schemas"]["MemberResponse"][];
@@ -356,6 +832,78 @@ export interface components {
                 [key: string]: unknown;
             } | null;
         };
+        /** @description Provision an org-created (synthetic) member (org-program spec §C1). */
+        ProvisionMemberRequest: {
+            /**
+             * @description Local part of the login; the full username becomes "{workspace_slug}/{username_local}". Stock username alphabet, no slash
+             * @example jdoe
+             */
+            username_local: string;
+            /**
+             * @description Role to grant (effective registry; owner is not provisionable)
+             * @example member
+             */
+            role?: string;
+            /** @description Initial password chosen by the admin. Omitted: the server generates a crypto-strong one, returned once as generated_password */
+            password?: string | null;
+            /**
+             * @description Display-name hint forwarded to auth/profiles
+             * @example Jane Doe
+             */
+            display_name?: string | null;
+            /** @description Optional email anchor (stored UNVERIFIED by auth). When present, the provisioned-account email with the credentials is sent there. Normally omitted — synthetic accounts have no email */
+            email?: string | null;
+        };
+        /** @description Result of provisioning an org member. */
+        ProvisionMemberResponse: {
+            /**
+             * Format: uuid
+             * @description UUID of the created account
+             */
+            user_id: string;
+            /**
+             * @description Full namespaced login
+             * @example acme-eng/jdoe
+             */
+            username: string;
+            /**
+             * @description Granted role
+             * @example member
+             */
+            role: string;
+            /** @description Server-generated initial password — returned exactly ONCE, only when the request omitted password. Store it or hand it to the user now; it cannot be re-fetched. A credential: never log it */
+            generated_password?: string | null;
+        };
+        /** @description RoleListResponse(roles: List[stapel_workspaces.dto.RoleResponse] = <factory>) */
+        RoleListResponse: {
+            roles?: components["schemas"]["RoleResponse"][];
+        };
+        /** @description One role of the effective registry (builtin + STAPEL_WORKSPACES overlay). */
+        RoleResponse: {
+            /**
+             * @description Role key
+             * @example admin
+             */
+            role: string;
+            /**
+             * @description Ordering weight; higher = more powerful
+             * @example 300
+             */
+            rank: number;
+            /**
+             * @description Granted capability strings, verbatim (wildcards like * included)
+             * @example [
+             *       "workspace.view",
+             *       "members.invite"
+             *     ]
+             */
+            capabilities: string[];
+            /**
+             * @description Whether the role key is one of the builtin four
+             * @example true
+             */
+            builtin: boolean;
+        };
         /** @description Structured error returned by all Stapel API endpoints. */
         StapelError: {
             /**
@@ -363,10 +911,7 @@ export interface components {
              * @example error.404.not_found
              */
             localizable_error: string;
-            /**
-             * @description Human-readable message in English
-             * @example Requested resource not found
-             */
+            /** @description Human-readable fallback/debug message — not reliably English, */
             error: string;
             /**
              * @description Context values for template placeholders
@@ -377,6 +922,8 @@ export interface components {
             params?: {
                 [key: string]: unknown;
             };
+            /** @description Active Django locale `error` was rendered in (e.g */
+            error_language?: string;
         };
         /** @description Create-workspace payload. */
         WorkspaceCreateRequest: {
@@ -454,6 +1001,14 @@ export interface components {
              * @example 2026-05-20T10:00:00Z
              */
             updated_at: string;
+            /**
+             * @description Granted capability strings of the requesting user's role, verbatim from the registry (wildcards like * included)
+             * @example [
+             *       "workspace.view",
+             *       "members.view"
+             *     ]
+             */
+            my_capabilities?: string[];
         };
     };
     responses: never;
@@ -576,6 +1131,82 @@ export interface operations {
             };
         };
     };
+    workspaces_api_v1_invitations_list: {
+        parameters: {
+            query?: {
+                /** @description Anchor value to paginate from (exclusive) */
+                anchor?: string;
+                /** @description Pagination direction */
+                direction?: "next" | "prev" | "center";
+                /** @description Number of items (default 100, max 500) */
+                limit?: number;
+                /** @description Case-insensitive substring filter on the invited email address. */
+                search?: string;
+                /** @description Which invitations to return. `pending` (default) — live, actionable, seat-reserving ones, i.e. who has not accepted yet. `never_accepted` — those plus the declined, revoked and expired ones. `all` — the full history, accepted rows included. */
+                status?: "all" | "never_accepted" | "pending";
+            };
+            header?: never;
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PaginatedInvitationResponseList"];
+                };
+            };
+        };
+    };
+    workspaces_api_v1_invitations_resend_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                invitation_id: string;
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InvitationResponse"];
+                };
+            };
+        };
+    };
+    workspaces_api_v1_invitations_revoke_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                invitation_id: string;
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InvitationResponse"];
+                };
+            };
+        };
+    };
     workspaces_api_v1_members_list: {
         parameters: {
             query?: {
@@ -655,6 +1286,34 @@ export interface operations {
             };
         };
     };
+    workspaces_api_v1_members_password_reset_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["MemberPasswordResetRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["MemberPasswordResetRequest"];
+                "multipart/form-data": components["schemas"]["MemberPasswordResetRequest"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["MemberPasswordResetResponse"];
+                };
+            };
+        };
+    };
     workspaces_api_v1_members_invite_create: {
         parameters: {
             query?: never;
@@ -682,6 +1341,33 @@ export interface operations {
             };
         };
     };
+    workspaces_api_v1_members_provision_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ProvisionMemberRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["ProvisionMemberRequest"];
+                "multipart/form-data": components["schemas"]["ProvisionMemberRequest"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ProvisionMemberResponse"];
+                };
+            };
+        };
+    };
     workspaces_api_v1_internal_members_retrieve: {
         parameters: {
             query?: never;
@@ -733,6 +1419,68 @@ export interface operations {
             };
         };
     };
+    workspaces_api_v1_invitations_retrieve: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                token: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InvitationPreviewResponse"];
+                };
+            };
+        };
+    };
+    workspaces_api_v1_invitations_claim_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                token: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InvitationClaimResponse"];
+                };
+            };
+        };
+    };
+    workspaces_api_v1_invitations_decline_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                token: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No response body */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     workspaces_api_v1_invitations_accept_create: {
         parameters: {
             query?: never;
@@ -758,4 +1506,23 @@ export interface operations {
             };
         };
     };
+    workspaces_api_v1_roles_retrieve: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["RoleListResponse"];
+                };
+            };
+        };
+    };
 }