@stapel/workspaces-react 0.6.0 → 0.8.0

package/src/headless/Can.tsx

@@ -0,0 +1,49 @@
+import type { ReactNode } from "react";
+import { useCapabilities } from "../model/queries.js";
+
+/** Render-prop bag for {@link Can}'s function-children variant. */
+export interface CanBag {
+  /** The wildcard-aware verdict for `capability` in `workspaceId`. */
+  readonly allowed: boolean;
+  /** The underlying read is still in flight (verdict is `false` meanwhile —
+   * deny-by-default; render a skeleton off this if flicker matters). */
+  readonly isLoading: boolean;
+}
+
+/**
+ * Capability gate (org-program §A2) — the mandate model's UI affordance:
+ *
+ * ```tsx
+ * <Can capability="meetings.spotlight" workspaceId={wsId}>
+ *   <SpotlightButton />
+ * </Can>
+ * // or the render-prop variant, when "disabled" beats "hidden":
+ * <Can capability="members.invite" workspaceId={wsId}>
+ *   {({ allowed }) => <Button disabled={!allowed}>…</Button>}
+ * </Can>
+ * ```
+ *
+ * Reads the caller's `my_capabilities` from the workspace detail
+ * ({@link useCapabilities}) and matches with the backend's ported wildcard
+ * matcher (`*` / `prefix.*`). Deny-by-default: nothing renders (or
+ * `allowed: false`) while loading, on error, for a non-member, or against a
+ * pre-0.6 backend. UI convenience ONLY — the backend re-checks every
+ * capability on every operation; hiding a button is not access control.
+ */
+export function Can(props: {
+  /** Namespaced capability string, e.g. `"meetings.spotlight"`. */
+  capability: string;
+  workspaceId: string;
+  /** Static children render when allowed; function children always render,
+   * receiving the {@link CanBag}. */
+  children: ReactNode | ((bag: CanBag) => ReactNode);
+  /** Rendered when the verdict is a definite "no" (static children only). */
+  fallback?: ReactNode;
+}): ReactNode {
+  const caps = useCapabilities(props.workspaceId);
+  const allowed = caps.can(props.capability);
+  if (typeof props.children === "function") {
+    return props.children({ allowed, isLoading: caps.isLoading });
+  }
+  return allowed ? props.children : (props.fallback ?? null);
+}

package/src/headless/InviteAcceptFlow.tsx

@@ -0,0 +1,105 @@
+import { useEffect, useMemo } from "react";
+import type { ReactNode } from "react";
+import { useFlow } from "@stapel/core";
+import { createInviteAcceptFlow } from "../flows/inviteAcceptFlow.js";
+import type { InviteAcceptState } from "../flows/inviteAcceptFlow.js";
+import type { Member } from "../api/types.js";
+import { useWorkspacesAnalytics, useWorkspacesApi } from "../model/context.js";
+
+/** Render-prop bag for {@link InviteAcceptFlow}. */
+export interface InviteAcceptFlowBag {
+  readonly state: InviteAcceptState;
+  /** From `newUser`/`claimError`: mint the login grant. */
+  claim(): void;
+  /** From `loginRequired`/`wrongAccount`: a session now exists — re-route on
+   * its email. (Also fired automatically when the `sessionEmail` prop
+   * becomes non-null while parked in either step.) */
+  sessionEstablished(email: string): void;
+  /** From `grantIssued`: the host exchanged the grant at auth. */
+  grantExchanged(): void;
+  /** From `basicData`: the initial-setup slot finished. */
+  completeBasicData(): void;
+  accept(): void;
+  decline(): void;
+  /** Re-fetch the preview and re-route (e.g. after a logout on wrongAccount). */
+  reload(): void;
+}
+
+/**
+ * Headless `/invite/{token}` journey (org-program §B4) — the flow machine
+ * (`flows/inviteAcceptFlow.ts`, see ITS doc for the full state graph and the
+ * grant_token hand-off seam) wired to this pair's runtime. Renderless: every
+ * screen (accept modal, wrong-account, the login and initial-setup SLOTS) is
+ * the host's; the default `InviteAcceptPage` is the reference skin.
+ *
+ * The pair knows nothing about auth: pass the signed-in email (or null) as
+ * `sessionEmail`, and connect `onLoginGrant` to auth-react's
+ * `exchangeLoginGrant` yourself — then call `grantExchanged()`.
+ */
+export function InviteAcceptFlow(props: {
+  /** The invite token from the URL — a bearer secret, never log it. */
+  token: string;
+  /** The signed-in account's email, or null/undefined when no session. */
+  sessionEmail?: string | null;
+  children: (bag: InviteAcceptFlowBag) => ReactNode;
+  /** The grant_token hand-off (a credential — exchange, never log). */
+  onLoginGrant?: (grantToken: string) => void;
+  onAccepted?: (member: Member) => void;
+  onDeclined?: () => void;
+}): ReactNode {
+  const api = useWorkspacesApi();
+  const analytics = useWorkspacesAnalytics();
+  const sessionEmail = props.sessionEmail ?? null;
+  const { token, onLoginGrant, onAccepted, onDeclined } = props;
+  const flow = useMemo(
+    () =>
+      createInviteAcceptFlow({
+        api,
+        analytics,
+        token,
+        ...(onLoginGrant !== undefined ? { onLoginGrant } : {}),
+        ...(onAccepted !== undefined ? { onAccepted } : {}),
+        ...(onDeclined !== undefined ? { onDeclined } : {}),
+      }),
+    [api, analytics, token, onLoginGrant, onAccepted, onDeclined]
+  );
+  const state = useFlow(flow.machine);
+
+  // Initial load — once per flow instance (a new token remounts the memo).
+  useEffect(() => {
+    if (flow.machine.getState().step === "idle") {
+      void flow.load(sessionEmail);
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- sessionEmail is read once at load time by design; later session changes re-route via the dedicated effect below, not a re-load
+  }, [flow]);
+
+  // Auto hand-off: the host's login slot signed the user in while we were
+  // parked in `loginRequired`/`wrongAccount` — re-route without requiring the
+  // host to call `sessionEstablished` manually.
+  useEffect(() => {
+    if (sessionEmail === null || sessionEmail === "") return;
+    const step = flow.machine.getState().step;
+    if (step === "loginRequired" || step === "wrongAccount") {
+      flow.sessionEstablished(sessionEmail);
+    }
+  }, [flow, sessionEmail, state.step]);
+
+  return props.children({
+    state,
+    claim: () => {
+      void flow.claim();
+    },
+    sessionEstablished: flow.sessionEstablished,
+    grantExchanged: flow.grantExchanged,
+    completeBasicData: flow.completeBasicData,
+    accept: () => {
+      void flow.accept();
+    },
+    decline: () => {
+      void flow.decline();
+    },
+    reload: () => {
+      void flow.load(sessionEmail);
+    },
+  });
+}

package/src/headless/RoleSelect.tsx

@@ -0,0 +1,58 @@
+import type { ReactNode } from "react";
+import { useI18n } from "@stapel/core";
+import type { StapelApiError } from "@stapel/core";
+import type { RoleInfo } from "../api/types.js";
+import { useRoles } from "../model/queries.js";
+
+/** Render-prop bag for {@link RoleSelect}. */
+export interface RoleSelectBag {
+  /** The effective registry (GET /roles): builtin four + the deployment's
+   * overlay, rank-descending. Empty while loading. */
+  readonly roles: readonly RoleInfo[];
+  /**
+   * Display label for a role key: the i18n key `workspaces.role.<key>` when
+   * the current locale's merged bundle carries it (the pair ships the builtin
+   * four; a client bundle merges its own — e.g. `workspaces.role.secretary`),
+   * else the RAW role key. The raw-name fallback is deliberate: a
+   * deployment-defined role without a translation must still be pickable,
+   * never render as a dotted i18n key.
+   */
+  labelFor(role: string): string;
+  readonly isLoading: boolean;
+  readonly isError: boolean;
+  readonly error: StapelApiError | null;
+}
+
+/**
+ * Headless role picker over the effective role registry (org-program §A2) —
+ * the component that lets role UI stop hardcoding the builtin four. Bring
+ * your own `<Select>`:
+ *
+ * ```tsx
+ * <RoleSelect>
+ *   {({ roles, labelFor }) => (
+ *     <Select options={roles.map((r) => ({ value: r.role, label: labelFor(r.role) }))} />
+ *   )}
+ * </RoleSelect>
+ * ```
+ *
+ * `owner` is in the registry too — filter it out where "only an owner grants
+ * owner" applies (the backend enforces regardless).
+ */
+export function RoleSelect(props: {
+  children: (bag: RoleSelectBag) => ReactNode;
+}): ReactNode {
+  const query = useRoles();
+  const i18n = useI18n();
+  // Raw bundle lookup, NOT `t()`: `t` falls back to the key itself, which is
+  // exactly the wrong fallback here (a deployment role without a translation
+  // must show its raw name, not `workspaces.role.secretary`).
+  const bundle = i18n.getBundle();
+  return props.children({
+    roles: query.data ?? [],
+    labelFor: (role) => bundle[`workspaces.role.${role}`] ?? role,
+    isLoading: query.isLoading,
+    isError: query.isError,
+    error: query.error ?? null,
+  });
+}

package/src/i18n/generated/errors.gen.ts

@@ -52,8 +52,10 @@ export const WORKSPACES_ERRORS = {
   "error.400.field.required": { status: 400, params: ["field"], remediation: "fix_input", en: "{field} is required" },
   "error.400.field.unique": { status: 400, params: ["field"], remediation: "fix_input", en: "{field} must be unique" },
   "error.400.invalid_ad_id": { status: 400, params: [], remediation: "fix_input", en: "Invalid advertisement ID" },
+  "error.400.invalid_provision_username": { status: 400, params: [], remediation: "fix_input", en: "Invalid username for a provisioned account" },
   "error.400.invalid_role": { status: 400, params: [], remediation: "fix_input", en: "Invalid role" },
   "error.400.invitation_already_used": { status: 400, params: [], remediation: "fix_input", en: "Invitation has already been used" },
+  "error.400.invitation_declined": { status: 400, params: [], remediation: "contact_support", en: "Invitation has been declined" },
   "error.400.invitation_expired": { status: 400, params: [], remediation: "contact_support", en: "Invitation has expired" },
   "error.400.invitation_revoked": { status: 400, params: [], remediation: "contact_support", en: "Invitation has been revoked" },
   "error.400.validation_error": { status: 400, params: [], remediation: "fix_input", en: "Validation error" },
@@ -61,10 +63,14 @@ export const WORKSPACES_ERRORS = {
   "error.400.verification_invalid_factor": { status: 400, params: [], remediation: "verify", en: "This verification factor is not available" },
   "error.400.workspace_slug_taken": { status: 400, params: [], remediation: "fix_input", en: "Workspace slug is already taken" },
   "error.401.unauthorized": { status: 401, params: [], remediation: "reauthenticate", en: "Authentication required" },
+  "error.402.entitlement_required": { status: 402, params: [], remediation: "fix_input", en: "The workspace owner's plan does not include this feature" },
+  "error.402.member_limit_reached": { status: 402, params: ["limit"], remediation: "fix_input", en: "The workspace member limit ({limit}) has been reached" },
   "error.402.payment_required": { status: 402, params: [], remediation: "retry", en: "Payment required" },
   "error.403.forbidden": { status: 403, params: [], remediation: "retry", en: "You do not have permission to perform this action" },
   "error.403.forbidden_workspace": { status: 403, params: [], remediation: "contact_support", en: "You do not have access to this workspace" },
   "error.403.last_owner_cannot_be_removed": { status: 403, params: [], remediation: "fix_input", en: "The last owner cannot be removed; transfer ownership first" },
+  "error.403.membership_suspended": { status: 403, params: ["reason"], remediation: "fix_input", en: "Your membership in this workspace is suspended ({reason})" },
+  "error.403.missing_capability": { status: 403, params: ["capability"], remediation: "contact_support", en: "Your role does not include the {capability} capability in this workspace" },
   "error.403.network_blocked": { status: 403, params: [], remediation: "contact_support", en: "Requests from this network are not allowed" },
   "error.403.verification_enrollment_required": { status: 403, params: [], remediation: "verify", en: "Verification factor enrollment required" },
   "error.403.verification_required": { status: 403, params: [], remediation: "verify", en: "Additional verification required" },
@@ -78,6 +84,7 @@ export const WORKSPACES_ERRORS = {
   "error.406.not_acceptable": { status: 406, params: [], remediation: "retry", en: "Not acceptable" },
   "error.408.request_timeout": { status: 408, params: [], remediation: "retry", en: "Request timeout" },
   "error.409.conflict": { status: 409, params: [], remediation: "fix_input", en: "Resource already exists" },
+  "error.409.email_already_registered": { status: 409, params: [], remediation: "reauthenticate", en: "An account with this email already exists — log in instead" },
   "error.410.gone": { status: 410, params: [], remediation: "retry", en: "Resource has been permanently removed" },
   "error.413.payload_too_large": { status: 413, params: [], remediation: "retry", en: "Request body is too large" },
   "error.415.unsupported_media_type": { status: 415, params: [], remediation: "retry", en: "Unsupported media type" },
@@ -87,6 +94,7 @@ export const WORKSPACES_ERRORS = {
   "error.429.rate_limit": { status: 429, params: ["retry_after_minutes"], remediation: "wait_and_retry", en: "Too many attempts. Try again in {retry_after_minutes} minutes." },
   "error.429.too_many_requests": { status: 429, params: [], remediation: "wait_and_retry", en: "Too many requests. Please try again later." },
   "error.500.internal": { status: 500, params: [], remediation: "contact_support", en: "Something went wrong" },
+  "error.503.auth_unavailable": { status: 503, params: [], remediation: "wait_and_retry", en: "The authentication service is unavailable; try again later" },
 } as const;
 
 export type WorkspacesErrorCode = keyof typeof WORKSPACES_ERRORS;
@@ -110,8 +118,10 @@ export const WORKSPACES_ERROR_CODES: readonly WorkspacesErrorCode[] = [
   "error.400.field.required",
   "error.400.field.unique",
   "error.400.invalid_ad_id",
+  "error.400.invalid_provision_username",
   "error.400.invalid_role",
   "error.400.invitation_already_used",
+  "error.400.invitation_declined",
   "error.400.invitation_expired",
   "error.400.invitation_revoked",
   "error.400.validation_error",
@@ -119,10 +129,14 @@ export const WORKSPACES_ERROR_CODES: readonly WorkspacesErrorCode[] = [
   "error.400.verification_invalid_factor",
   "error.400.workspace_slug_taken",
   "error.401.unauthorized",
+  "error.402.entitlement_required",
+  "error.402.member_limit_reached",
   "error.402.payment_required",
   "error.403.forbidden",
   "error.403.forbidden_workspace",
   "error.403.last_owner_cannot_be_removed",
+  "error.403.membership_suspended",
+  "error.403.missing_capability",
   "error.403.network_blocked",
   "error.403.verification_enrollment_required",
   "error.403.verification_required",
@@ -136,6 +150,7 @@ export const WORKSPACES_ERROR_CODES: readonly WorkspacesErrorCode[] = [
   "error.406.not_acceptable",
   "error.408.request_timeout",
   "error.409.conflict",
+  "error.409.email_already_registered",
   "error.410.gone",
   "error.413.payload_too_large",
   "error.415.unsupported_media_type",
@@ -145,6 +160,7 @@ export const WORKSPACES_ERROR_CODES: readonly WorkspacesErrorCode[] = [
   "error.429.rate_limit",
   "error.429.too_many_requests",
   "error.500.internal",
+  "error.503.auth_unavailable",
 ];
 
 /**
@@ -170,8 +186,10 @@ export const workspacesErrorBundleEn: Record<WorkspacesErrorCode, string> = {
   "error.400.field.required": "{field} is required",
   "error.400.field.unique": "{field} must be unique",
   "error.400.invalid_ad_id": "Invalid advertisement ID",
+  "error.400.invalid_provision_username": "Invalid username for a provisioned account",
   "error.400.invalid_role": "Invalid role",
   "error.400.invitation_already_used": "Invitation has already been used",
+  "error.400.invitation_declined": "Invitation has been declined",
   "error.400.invitation_expired": "Invitation has expired",
   "error.400.invitation_revoked": "Invitation has been revoked",
   "error.400.validation_error": "Validation error",
@@ -179,10 +197,14 @@ export const workspacesErrorBundleEn: Record<WorkspacesErrorCode, string> = {
   "error.400.verification_invalid_factor": "This verification factor is not available",
   "error.400.workspace_slug_taken": "Workspace slug is already taken",
   "error.401.unauthorized": "Authentication required",
+  "error.402.entitlement_required": "The workspace owner's plan does not include this feature",
+  "error.402.member_limit_reached": "The workspace member limit ({limit}) has been reached",
   "error.402.payment_required": "Payment required",
   "error.403.forbidden": "You do not have permission to perform this action",
   "error.403.forbidden_workspace": "You do not have access to this workspace",
   "error.403.last_owner_cannot_be_removed": "The last owner cannot be removed; transfer ownership first",
+  "error.403.membership_suspended": "Your membership in this workspace is suspended ({reason})",
+  "error.403.missing_capability": "Your role does not include the {capability} capability in this workspace",
   "error.403.network_blocked": "Requests from this network are not allowed",
   "error.403.verification_enrollment_required": "Verification factor enrollment required",
   "error.403.verification_required": "Additional verification required",
@@ -196,6 +218,7 @@ export const workspacesErrorBundleEn: Record<WorkspacesErrorCode, string> = {
   "error.406.not_acceptable": "Not acceptable",
   "error.408.request_timeout": "Request timeout",
   "error.409.conflict": "Resource already exists",
+  "error.409.email_already_registered": "An account with this email already exists — log in instead",
   "error.410.gone": "Resource has been permanently removed",
   "error.413.payload_too_large": "Request body is too large",
   "error.415.unsupported_media_type": "Unsupported media type",
@@ -205,4 +228,5 @@ export const workspacesErrorBundleEn: Record<WorkspacesErrorCode, string> = {
   "error.429.rate_limit": "Too many attempts. Try again in {retry_after_minutes} minutes.",
   "error.429.too_many_requests": "Too many requests. Please try again later.",
   "error.500.internal": "Something went wrong",
+  "error.503.auth_unavailable": "The authentication service is unavailable; try again later",
 };

package/src/i18n/generated/errors.json

@@ -144,6 +144,13 @@
     "remediation": "fix_input",
     "en": "Invalid advertisement ID"
   },
+  {
+    "code": "error.400.invalid_provision_username",
+    "status": 400,
+    "params": [],
+    "remediation": "fix_input",
+    "en": "Invalid username for a provisioned account"
+  },
   {
     "code": "error.400.invalid_role",
     "status": 400,
@@ -158,6 +165,13 @@
     "remediation": "fix_input",
     "en": "Invitation has already been used"
   },
+  {
+    "code": "error.400.invitation_declined",
+    "status": 400,
+    "params": [],
+    "remediation": "contact_support",
+    "en": "Invitation has been declined"
+  },
   {
     "code": "error.400.invitation_expired",
     "status": 400,
@@ -207,6 +221,22 @@
     "remediation": "reauthenticate",
     "en": "Authentication required"
   },
+  {
+    "code": "error.402.entitlement_required",
+    "status": 402,
+    "params": [],
+    "remediation": "fix_input",
+    "en": "The workspace owner's plan does not include this feature"
+  },
+  {
+    "code": "error.402.member_limit_reached",
+    "status": 402,
+    "params": [
+      "limit"
+    ],
+    "remediation": "fix_input",
+    "en": "The workspace member limit ({limit}) has been reached"
+  },
   {
     "code": "error.402.payment_required",
     "status": 402,
@@ -235,6 +265,24 @@
     "remediation": "fix_input",
     "en": "The last owner cannot be removed; transfer ownership first"
   },
+  {
+    "code": "error.403.membership_suspended",
+    "status": 403,
+    "params": [
+      "reason"
+    ],
+    "remediation": "fix_input",
+    "en": "Your membership in this workspace is suspended ({reason})"
+  },
+  {
+    "code": "error.403.missing_capability",
+    "status": 403,
+    "params": [
+      "capability"
+    ],
+    "remediation": "contact_support",
+    "en": "Your role does not include the {capability} capability in this workspace"
+  },
   {
     "code": "error.403.network_blocked",
     "status": 403,
@@ -326,6 +374,13 @@
     "remediation": "fix_input",
     "en": "Resource already exists"
   },
+  {
+    "code": "error.409.email_already_registered",
+    "status": 409,
+    "params": [],
+    "remediation": "reauthenticate",
+    "en": "An account with this email already exists — log in instead"
+  },
   {
     "code": "error.410.gone",
     "status": 410,
@@ -390,5 +445,12 @@
     "params": [],
     "remediation": "contact_support",
     "en": "Something went wrong"
+  },
+  {
+    "code": "error.503.auth_unavailable",
+    "status": 503,
+    "params": [],
+    "remediation": "wait_and_retry",
+    "en": "The authentication service is unavailable; try again later"
   }
 ]

package/src/i18n/generated/errors.ru.gen.ts

@@ -29,8 +29,10 @@ export const workspacesErrorBundleRu: Record<WorkspacesErrorCode, string> = {
   "error.400.field.required": "Поле «{field}» обязательно",
   "error.400.field.unique": "Значение поля «{field}» должно быть уникальным",
   "error.400.invalid_ad_id": "Недопустимый идентификатор объявления",
+  "error.400.invalid_provision_username": "Недопустимое имя пользователя для создаваемого аккаунта",
   "error.400.invalid_role": "Недопустимая роль",
   "error.400.invitation_already_used": "Приглашение уже было использовано",
+  "error.400.invitation_declined": "Приглашение было отклонено",
   "error.400.invitation_expired": "Срок действия приглашения истёк",
   "error.400.invitation_revoked": "Приглашение было отозвано",
   "error.400.validation_error": "Ошибка валидации",
@@ -38,10 +40,14 @@ export const workspacesErrorBundleRu: Record<WorkspacesErrorCode, string> = {
   "error.400.verification_invalid_factor": "Этот способ подтверждения недоступен",
   "error.400.workspace_slug_taken": "Slug рабочего пространства уже занят",
   "error.401.unauthorized": "Требуется аутентификация",
+  "error.402.entitlement_required": "Тариф владельца рабочего пространства не включает эту возможность",
+  "error.402.member_limit_reached": "Достигнут лимит участников рабочего пространства ({limit})",
   "error.402.payment_required": "Требуется оплата",
   "error.403.forbidden": "У вас нет прав для выполнения этого действия",
   "error.403.forbidden_workspace": "У вас нет доступа к этому рабочему пространству",
   "error.403.last_owner_cannot_be_removed": "Нельзя удалить последнего владельца; сначала передайте права владения",
+  "error.403.membership_suspended": "Ваше членство в этом рабочем пространстве приостановлено ({reason})",
+  "error.403.missing_capability": "Ваша роль не включает право {capability} в этом рабочем пространстве",
   "error.403.network_blocked": "Запросы из этой сети не разрешены.",
   "error.403.verification_enrollment_required": "Требуется регистрация фактора подтверждения.",
   "error.403.verification_required": "Требуется дополнительная проверка",
@@ -55,6 +61,7 @@ export const workspacesErrorBundleRu: Record<WorkspacesErrorCode, string> = {
   "error.406.not_acceptable": "Недопустимый формат ответа",
   "error.408.request_timeout": "Время ожидания запроса истекло",
   "error.409.conflict": "Ресурс уже существует",
+  "error.409.email_already_registered": "Аккаунт с этим email уже существует — войдите в него",
   "error.410.gone": "Ресурс был безвозвратно удалён",
   "error.413.payload_too_large": "Тело запроса слишком большое",
   "error.415.unsupported_media_type": "Неподдерживаемый тип данных",
@@ -64,4 +71,5 @@ export const workspacesErrorBundleRu: Record<WorkspacesErrorCode, string> = {
   "error.429.rate_limit": "Слишком много попыток. Повторите попытку через {retry_after_minutes} мин.",
   "error.429.too_many_requests": "Слишком много запросов. Пожалуйста, повторите попытку позже.",
   "error.500.internal": "Что-то пошло не так",
+  "error.503.auth_unavailable": "Сервис аутентификации недоступен; повторите попытку позже",
 };

package/src/i18n/keys.ts

@@ -50,6 +50,40 @@ export const WORKSPACES_I18N_KEYS = {
   roleAdmin: "workspaces.members.role.admin",
   roleMember: "workspaces.members.role.member",
   roleViewer: "workspaces.members.role.viewer",
+  // Role registry labels (org-program §A2) — the `workspaces.role.<key>`
+  // namespace RoleSelect resolves labels in: the pair ships the builtin four;
+  // a client bundle merges its own (`workspaces.role.secretary`, …) and
+  // RoleSelect falls back to the RAW role key when a label is missing.
+  roleLabelOwner: "workspaces.role.owner",
+  roleLabelAdmin: "workspaces.role.admin",
+  roleLabelMember: "workspaces.role.member",
+  roleLabelViewer: "workspaces.role.viewer",
+  // Invite accept flow (org-program §B4 — InviteAcceptFlow headless +
+  // InviteAcceptPage default skin), one key per flow screen.
+  inviteLoading: "workspaces.invite.loading",
+  inviteAcceptTitle: "workspaces.invite.acceptTitle",
+  inviteRoleLine: "workspaces.invite.roleLine",
+  inviteEmailLine: "workspaces.invite.emailLine",
+  inviteJoinCta: "workspaces.invite.joinCta",
+  inviteDeclineCta: "workspaces.invite.declineCta",
+  inviteAccepted: "workspaces.invite.accepted",
+  inviteDeclined: "workspaces.invite.declined",
+  inviteUnavailableExpired: "workspaces.invite.unavailable.expired",
+  inviteUnavailableRevoked: "workspaces.invite.unavailable.revoked",
+  inviteUnavailableAccepted: "workspaces.invite.unavailable.accepted",
+  inviteUnavailableDeclined: "workspaces.invite.unavailable.declined",
+  inviteWrongAccount: "workspaces.invite.wrongAccount",
+  inviteWrongAccountHint: "workspaces.invite.wrongAccountHint",
+  inviteSwitchAccountCta: "workspaces.invite.switchAccountCta",
+  inviteLoginTitle: "workspaces.invite.loginTitle",
+  inviteNewUserHint: "workspaces.invite.newUserHint",
+  inviteCreateAccountCta: "workspaces.invite.createAccountCta",
+  inviteClaiming: "workspaces.invite.claiming",
+  inviteExchanging: "workspaces.invite.exchanging",
+  inviteExchangeFailed: "workspaces.invite.exchangeFailed",
+  inviteRetryCta: "workspaces.invite.retryCta",
+  inviteBasicDataTitle: "workspaces.invite.basicDataTitle",
+  inviteBasicDataContinueCta: "workspaces.invite.basicDataContinueCta",
 } as const;
 
 export type WorkspacesI18nKey =
@@ -101,6 +135,40 @@ export const workspacesI18nBundleEn: I18nDictionary = {
   "workspaces.members.role.admin": "Admin",
   "workspaces.members.role.member": "Member",
   "workspaces.members.role.viewer": "Viewer",
+
+  // Role registry labels (builtin four; clients merge their own roles)
+  "workspaces.role.owner": "Owner",
+  "workspaces.role.admin": "Admin",
+  "workspaces.role.member": "Member",
+  "workspaces.role.viewer": "Viewer",
+
+  // Invite accept flow (org-program §B4)
+  "workspaces.invite.loading": "Loading invitation…",
+  "workspaces.invite.acceptTitle": "Join {workspace}",
+  "workspaces.invite.roleLine": "You've been invited as {role}.",
+  "workspaces.invite.emailLine": "Invitation for {email}",
+  "workspaces.invite.joinCta": "Join workspace",
+  "workspaces.invite.declineCta": "Decline",
+  "workspaces.invite.accepted": "You've joined {workspace}.",
+  "workspaces.invite.declined": "Invitation declined.",
+  "workspaces.invite.unavailable.expired": "This invitation has expired. Ask for a new one.",
+  "workspaces.invite.unavailable.revoked": "This invitation was revoked.",
+  "workspaces.invite.unavailable.accepted": "This invitation has already been used.",
+  "workspaces.invite.unavailable.declined": "This invitation was declined.",
+  "workspaces.invite.wrongAccount": "This invitation is for a different account",
+  "workspaces.invite.wrongAccountHint":
+    "You're signed in as {email}, but the invitation was sent to {invited}. Switch accounts to continue.",
+  "workspaces.invite.switchAccountCta": "Switch account",
+  "workspaces.invite.loginTitle": "Sign in to accept the invitation",
+  "workspaces.invite.newUserHint":
+    "We'll create a verified account for {email} — no password or email confirmation needed.",
+  "workspaces.invite.createAccountCta": "Create account and continue",
+  "workspaces.invite.claiming": "Creating your account…",
+  "workspaces.invite.exchanging": "Signing you in…",
+  "workspaces.invite.exchangeFailed": "Couldn't finish signing you in.",
+  "workspaces.invite.retryCta": "Try again",
+  "workspaces.invite.basicDataTitle": "Set up your profile",
+  "workspaces.invite.basicDataContinueCta": "Continue",
 };
 
 /**

package/src/i18n/ru.ts

@@ -58,6 +58,40 @@ export const workspacesI18nBundleRu: I18nDictionary = {
   "workspaces.members.role.admin": "Администратор",
   "workspaces.members.role.member": "Участник",
   "workspaces.members.role.viewer": "Наблюдатель",
+
+  // Role registry labels (builtin four; clients merge their own roles)
+  "workspaces.role.owner": "Владелец",
+  "workspaces.role.admin": "Администратор",
+  "workspaces.role.member": "Участник",
+  "workspaces.role.viewer": "Наблюдатель",
+
+  // Invite accept flow (org-program §B4)
+  "workspaces.invite.loading": "Загрузка приглашения…",
+  "workspaces.invite.acceptTitle": "Присоединиться к {workspace}",
+  "workspaces.invite.roleLine": "Вас пригласили с ролью {role}.",
+  "workspaces.invite.emailLine": "Приглашение для {email}",
+  "workspaces.invite.joinCta": "Присоединиться",
+  "workspaces.invite.declineCta": "Отклонить",
+  "workspaces.invite.accepted": "Вы присоединились к {workspace}.",
+  "workspaces.invite.declined": "Приглашение отклонено.",
+  "workspaces.invite.unavailable.expired": "Срок приглашения истёк. Попросите новое.",
+  "workspaces.invite.unavailable.revoked": "Приглашение было отозвано.",
+  "workspaces.invite.unavailable.accepted": "Приглашение уже использовано.",
+  "workspaces.invite.unavailable.declined": "Приглашение было отклонено.",
+  "workspaces.invite.wrongAccount": "Приглашение для другого аккаунта",
+  "workspaces.invite.wrongAccountHint":
+    "Вы вошли как {email}, а приглашение отправлено на {invited}. Смените аккаунт, чтобы продолжить.",
+  "workspaces.invite.switchAccountCta": "Сменить аккаунт",
+  "workspaces.invite.loginTitle": "Войдите, чтобы принять приглашение",
+  "workspaces.invite.newUserHint":
+    "Мы создадим подтверждённый аккаунт для {email} — без пароля и подтверждения почты.",
+  "workspaces.invite.createAccountCta": "Создать аккаунт и продолжить",
+  "workspaces.invite.claiming": "Создаём ваш аккаунт…",
+  "workspaces.invite.exchanging": "Выполняем вход…",
+  "workspaces.invite.exchangeFailed": "Не удалось завершить вход.",
+  "workspaces.invite.retryCta": "Попробовать ещё раз",
+  "workspaces.invite.basicDataTitle": "Настройте профиль",
+  "workspaces.invite.basicDataContinueCta": "Продолжить",
 };
 
 /**