@stapel/workspaces-react 0.6.0 → 0.8.0

package/dist/i18n/ru.js

@@ -54,6 +54,36 @@ export const workspacesI18nBundleRu = {
     "workspaces.members.role.admin": "Администратор",
     "workspaces.members.role.member": "Участник",
     "workspaces.members.role.viewer": "Наблюдатель",
+    // Role registry labels (builtin four; clients merge their own roles)
+    "workspaces.role.owner": "Владелец",
+    "workspaces.role.admin": "Администратор",
+    "workspaces.role.member": "Участник",
+    "workspaces.role.viewer": "Наблюдатель",
+    // Invite accept flow (org-program §B4)
+    "workspaces.invite.loading": "Загрузка приглашения…",
+    "workspaces.invite.acceptTitle": "Присоединиться к {workspace}",
+    "workspaces.invite.roleLine": "Вас пригласили с ролью {role}.",
+    "workspaces.invite.emailLine": "Приглашение для {email}",
+    "workspaces.invite.joinCta": "Присоединиться",
+    "workspaces.invite.declineCta": "Отклонить",
+    "workspaces.invite.accepted": "Вы присоединились к {workspace}.",
+    "workspaces.invite.declined": "Приглашение отклонено.",
+    "workspaces.invite.unavailable.expired": "Срок приглашения истёк. Попросите новое.",
+    "workspaces.invite.unavailable.revoked": "Приглашение было отозвано.",
+    "workspaces.invite.unavailable.accepted": "Приглашение уже использовано.",
+    "workspaces.invite.unavailable.declined": "Приглашение было отклонено.",
+    "workspaces.invite.wrongAccount": "Приглашение для другого аккаунта",
+    "workspaces.invite.wrongAccountHint": "Вы вошли как {email}, а приглашение отправлено на {invited}. Смените аккаунт, чтобы продолжить.",
+    "workspaces.invite.switchAccountCta": "Сменить аккаунт",
+    "workspaces.invite.loginTitle": "Войдите, чтобы принять приглашение",
+    "workspaces.invite.newUserHint": "Мы создадим подтверждённый аккаунт для {email} — без пароля и подтверждения почты.",
+    "workspaces.invite.createAccountCta": "Создать аккаунт и продолжить",
+    "workspaces.invite.claiming": "Создаём ваш аккаунт…",
+    "workspaces.invite.exchanging": "Выполняем вход…",
+    "workspaces.invite.exchangeFailed": "Не удалось завершить вход.",
+    "workspaces.invite.retryCta": "Попробовать ещё раз",
+    "workspaces.invite.basicDataTitle": "Настройте профиль",
+    "workspaces.invite.basicDataContinueCta": "Продолжить",
 };
 /**
  * Register the pair's `ru` locale into a core i18n engine (call once at

package/dist/i18n/ru.js.map

@@ -1 +1 @@
-{"version":3,"file":"ru.js","sourceRoot":"","sources":["../../src/i18n/ru.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,uEAAuE;IACvE,GAAG,uBAAuB;IAE1B,yEAAyE;IACzE,0BAA0B,EAAE,0CAA0C;IACtE,yBAAyB,EAAE,+BAA+B;IAC1D,uBAAuB,EAAE,+BAA+B;IACxD,wBAAwB,EAAE,8BAA8B;IACxD,0BAA0B,EAAE,WAAW;IACvC,4BAA4B,EAAE,sBAAsB;IACpD,2BAA2B,EAAE,YAAY;IACzC,6BAA6B,EAAE,cAAc;IAC7C,gCAAgC,EAAE,eAAe;IACjD,2BAA2B,EAAE,SAAS;IACtC,0BAA0B,EAAE,qBAAqB;IACjD,6BAA6B,EAAE,WAAW;IAC1C,4BAA4B,EAAE,4CAA4C;IAC1E,2BAA2B,EAAE,sBAAsB;IACnD,8BAA8B,EAAE,6BAA6B;IAC7D,gCAAgC,EAAE,gCAAgC;IAClE,gCAAgC,EAAE,mBAAmB;IACrD,gCAAgC,EAAE,KAAK;IACvC,0BAA0B,EAAE,qBAAqB;IACjD,4BAA4B,EAAE,aAAa;IAC3C,uCAAuC,EAAE,cAAc;IACvD,wCAAwC,EAAE,8BAA8B;IACxE,gDAAgD,EAAE,wDAAwD;IAC1G,0BAA0B,EAAE,WAAW;IACvC,6BAA6B,EAAE,8CAA8C;IAC7E,wCAAwC,EAAE,uBAAuB;IACjE,+CAA+C,EAAE,cAAc;IAC/D,qDAAqD,EAAE,+BAA+B;IACtF,6CAA6C,EAAE,MAAM;IACrD,mCAAmC,EAAE,0BAA0B;IAC/D,+BAA+B,EAAE,UAAU;IAC3C,+BAA+B,EAAE,eAAe;IAChD,gCAAgC,EAAE,UAAU;IAC5C,gCAAgC,EAAE,aAAa;CAChD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAkB;IACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IACpD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"ru.js","sourceRoot":"","sources":["../../src/i18n/ru.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,uEAAuE;IACvE,GAAG,uBAAuB;IAE1B,yEAAyE;IACzE,0BAA0B,EAAE,0CAA0C;IACtE,yBAAyB,EAAE,+BAA+B;IAC1D,uBAAuB,EAAE,+BAA+B;IACxD,wBAAwB,EAAE,8BAA8B;IACxD,0BAA0B,EAAE,WAAW;IACvC,4BAA4B,EAAE,sBAAsB;IACpD,2BAA2B,EAAE,YAAY;IACzC,6BAA6B,EAAE,cAAc;IAC7C,gCAAgC,EAAE,eAAe;IACjD,2BAA2B,EAAE,SAAS;IACtC,0BAA0B,EAAE,qBAAqB;IACjD,6BAA6B,EAAE,WAAW;IAC1C,4BAA4B,EAAE,4CAA4C;IAC1E,2BAA2B,EAAE,sBAAsB;IACnD,8BAA8B,EAAE,6BAA6B;IAC7D,gCAAgC,EAAE,gCAAgC;IAClE,gCAAgC,EAAE,mBAAmB;IACrD,gCAAgC,EAAE,KAAK;IACvC,0BAA0B,EAAE,qBAAqB;IACjD,4BAA4B,EAAE,aAAa;IAC3C,uCAAuC,EAAE,cAAc;IACvD,wCAAwC,EAAE,8BAA8B;IACxE,gDAAgD,EAAE,wDAAwD;IAC1G,0BAA0B,EAAE,WAAW;IACvC,6BAA6B,EAAE,8CAA8C;IAC7E,wCAAwC,EAAE,uBAAuB;IACjE,+CAA+C,EAAE,cAAc;IAC/D,qDAAqD,EAAE,+BAA+B;IACtF,6CAA6C,EAAE,MAAM;IACrD,mCAAmC,EAAE,0BAA0B;IAC/D,+BAA+B,EAAE,UAAU;IAC3C,+BAA+B,EAAE,eAAe;IAChD,gCAAgC,EAAE,UAAU;IAC5C,gCAAgC,EAAE,aAAa;IAE/C,qEAAqE;IACrE,uBAAuB,EAAE,UAAU;IACnC,uBAAuB,EAAE,eAAe;IACxC,wBAAwB,EAAE,UAAU;IACpC,wBAAwB,EAAE,aAAa;IAEvC,uCAAuC;IACvC,2BAA2B,EAAE,uBAAuB;IACpD,+BAA+B,EAAE,8BAA8B;IAC/D,4BAA4B,EAAE,gCAAgC;IAC9D,6BAA6B,EAAE,yBAAyB;IACxD,2BAA2B,EAAE,gBAAgB;IAC7C,8BAA8B,EAAE,WAAW;IAC3C,4BAA4B,EAAE,kCAAkC;IAChE,4BAA4B,EAAE,wBAAwB;IACtD,uCAAuC,EAAE,0CAA0C;IACnF,uCAAuC,EAAE,4BAA4B;IACrE,wCAAwC,EAAE,+BAA+B;IACzE,wCAAwC,EAAE,6BAA6B;IACvE,gCAAgC,EAAE,kCAAkC;IACpE,oCAAoC,EAClC,iGAAiG;IACnG,oCAAoC,EAAE,iBAAiB;IACvD,8BAA8B,EAAE,oCAAoC;IACpE,+BAA+B,EAC7B,oFAAoF;IACtF,oCAAoC,EAAE,8BAA8B;IACpE,4BAA4B,EAAE,sBAAsB;IACpD,8BAA8B,EAAE,iBAAiB;IACjD,kCAAkC,EAAE,4BAA4B;IAChE,4BAA4B,EAAE,qBAAqB;IACnD,kCAAkC,EAAE,mBAAmB;IACvD,wCAAwC,EAAE,YAAY;CACvD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAkB;IACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IACpD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;AACtD,CAAC"}

package/dist/index.d.ts

@@ -14,16 +14,23 @@ export type { Schemas } from "./api/types.js";
 export { createFlowMachine, useFlow, isErrorCode } from "@stapel/core";
 export type { FlowMachine, FlowMachineOptions, FlowStateBase, FlowError, } from "@stapel/core";
 export { toFlowError } from "./flows/errors.js";
+export { createInviteAcceptFlow } from "./flows/inviteAcceptFlow.js";
+export type { InviteAcceptFlow as InviteAcceptFlowController, InviteAcceptFlowDeps, InviteAcceptState, } from "./flows/inviteAcceptFlow.js";
 export { WORKSPACES_FLOWS, flowEndpoints } from "./flows/registry.js";
 export type { WorkspacesFlowId, WorkspacesFlowSpec, FlowEndpoint, } from "./flows/registry.js";
 export { createWorkspacesRuntime } from "./model/runtime.js";
 export type { WorkspacesRuntime, CreateWorkspacesRuntimeOptions, } from "./model/runtime.js";
 export { WorkspacesRuntimeContext, useWorkspacesRuntime, useWorkspacesApi, useWorkspacesAnalytics, } from "./model/context.js";
 export { workspacesQueryKeys } from "./model/queryKeys.js";
-export { useWorkspaces, useWorkspace, useMembers, } from "./model/queries.js";
-export { useCreateWorkspace, useUpdateWorkspace, useDeleteWorkspace, useInviteMembers, useUpdateMemberRole, useRemoveMember, useAcceptInvitation, } from "./model/mutations.js";
-export type { MemberRoleChange } from "./model/mutations.js";
-export type { Workspace as WorkspaceData, WorkspaceList as WorkspaceListData, WorkspaceCreate, WorkspaceUpdate, Member as MemberData, MemberPage as MemberListData, MembersParams, MemberInvite, MemberInviteResult, MemberRoleUpdate, Invitation, InvitationAccept, WorkspaceRole, WorkspaceKind, } from "./api/types.js";
+export { useWorkspaces, useWorkspace, useMembers, useInvitations, useInfiniteInvitations, useRoles, useInvitationPreview, useCapabilities, useCapabilityGate, } from "./model/queries.js";
+export type { CapabilitiesResult, CapabilityGate } from "./model/queries.js";
+export { capabilityMatches, hasCapability } from "./model/capabilities.js";
+export { BUILTIN_CAPABILITY_LEVELS, SENSITIVE_SCOPE, capabilityLevel, readVerificationEnrollment, } from "./model/stepUp.js";
+export type { CapabilityLevel, VerificationEnrollment, } from "./model/stepUp.js";
+export { maskEmail, emailMatchesMask } from "./model/emailMask.js";
+export { useCreateWorkspace, useUpdateWorkspace, useDeleteWorkspace, useInviteMembers, useUpdateMemberRole, useRemoveMember, useAcceptInvitation, useClaimInvitation, useDeclineInvitation, useRevokeInvitation, useResendInvitation, useResetMemberPassword, useUpdateSecuritySettings, } from "./model/mutations.js";
+export type { MemberRoleChange, MemberPasswordResetVars, } from "./model/mutations.js";
+export type { Workspace as WorkspaceData, WorkspaceList as WorkspaceListData, WorkspaceCreate, WorkspaceUpdate, Member as MemberData, MemberPage as MemberListData, MembersParams, MemberInvite, MemberInviteResult, MemberRoleUpdate, Invitation, InvitationPage as InvitationListData, InvitationsParams, InvitationStatusFilter, InvitationAccept, InvitationPreview, InvitationClaim, MemberPasswordReset, MemberPasswordResetResult, ProvisionedUserPolicy, WorkspaceSecuritySettings, RoleInfo, RoleList, WorkspaceRole, WorkspaceKind, } from "./api/types.js";
 export { WorkspacesProvider } from "./headless/WorkspacesProvider.js";
 export { WorkspaceList } from "./headless/WorkspaceList.js";
 export type { WorkspaceListBag } from "./headless/WorkspaceList.js";
@@ -31,6 +38,12 @@ export { Members } from "./headless/Members.js";
 export type { MembersBag } from "./headless/Members.js";
 export { AcceptInvitation } from "./headless/AcceptInvitation.js";
 export type { AcceptInvitationBag } from "./headless/AcceptInvitation.js";
+export { Can } from "./headless/Can.js";
+export type { CanBag } from "./headless/Can.js";
+export { RoleSelect } from "./headless/RoleSelect.js";
+export type { RoleSelectBag } from "./headless/RoleSelect.js";
+export { InviteAcceptFlow } from "./headless/InviteAcceptFlow.js";
+export type { InviteAcceptFlowBag } from "./headless/InviteAcceptFlow.js";
 export { WORKSPACES_I18N_KEYS, workspacesI18nBundleEn, registerWorkspacesI18n, } from "./i18n/keys.js";
 export type { WorkspacesI18nKey } from "./i18n/keys.js";
 export { WORKSPACES_ERRORS, WORKSPACES_ERROR_CODES, workspacesErrorBundleEn, explainWorkspacesError, } from "./i18n/errorsMap.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAK9C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtE,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,YAAY,EACV,SAAS,IAAI,aAAa,EAC1B,aAAa,IAAI,iBAAiB,EAClC,eAAe,EACf,eAAe,EACf,MAAM,IAAI,UAAU,EACpB,UAAU,IAAI,cAAc,EAC5B,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,GACZ,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAK9C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,gBAAgB,IAAI,0BAA0B,EAC9C,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtE,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,cAAc,EACd,sBAAsB,EACtB,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAG7E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,eAAe,EACf,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EACV,SAAS,IAAI,aAAa,EAC1B,aAAa,IAAI,iBAAiB,EAClC,eAAe,EACf,eAAe,EACf,MAAM,IAAI,UAAU,EACpB,UAAU,IAAI,cAAc,EAC5B,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,cAAc,IAAI,kBAAkB,EACpC,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,GACd,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,YAAY,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,GACZ,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -15,20 +15,28 @@ export { createWorkspacesApi } from "./api/workspacesApi.js";
 // every pair — frontend-core-architecture §4b). Re-exported for ergonomics.
 export { createFlowMachine, useFlow, isErrorCode } from "@stapel/core";
 export { toFlowError } from "./flows/errors.js";
+export { createInviteAcceptFlow } from "./flows/inviteAcceptFlow.js";
 export { WORKSPACES_FLOWS, flowEndpoints } from "./flows/registry.js";
 // ── model (runtime wiring, query keys, context) ──────────────────────────────
 export { createWorkspacesRuntime } from "./model/runtime.js";
 export { WorkspacesRuntimeContext, useWorkspacesRuntime, useWorkspacesApi, useWorkspacesAnalytics, } from "./model/context.js";
 export { workspacesQueryKeys } from "./model/queryKeys.js";
 // ── model (read hooks) ───────────────────────────────────────────────────────
-export { useWorkspaces, useWorkspace, useMembers, } from "./model/queries.js";
+export { useWorkspaces, useWorkspace, useMembers, useInvitations, useInfiniteInvitations, useRoles, useInvitationPreview, useCapabilities, useCapabilityGate, } from "./model/queries.js";
+// ── model (capability matcher + email-mask ports — backend-synced utils) ─────
+export { capabilityMatches, hasCapability } from "./model/capabilities.js";
+export { BUILTIN_CAPABILITY_LEVELS, SENSITIVE_SCOPE, capabilityLevel, readVerificationEnrollment, } from "./model/stepUp.js";
+export { maskEmail, emailMatchesMask } from "./model/emailMask.js";
 // ── model (write hooks) ──────────────────────────────────────────────────────
-export { useCreateWorkspace, useUpdateWorkspace, useDeleteWorkspace, useInviteMembers, useUpdateMemberRole, useRemoveMember, useAcceptInvitation, } from "./model/mutations.js";
+export { useCreateWorkspace, useUpdateWorkspace, useDeleteWorkspace, useInviteMembers, useUpdateMemberRole, useRemoveMember, useAcceptInvitation, useClaimInvitation, useDeclineInvitation, useRevokeInvitation, useResendInvitation, useResetMemberPassword, useUpdateSecuritySettings, } from "./model/mutations.js";
 // ── headless (renderless components) ─────────────────────────────────────────
 export { WorkspacesProvider } from "./headless/WorkspacesProvider.js";
 export { WorkspaceList } from "./headless/WorkspaceList.js";
 export { Members } from "./headless/Members.js";
 export { AcceptInvitation } from "./headless/AcceptInvitation.js";
+export { Can } from "./headless/Can.js";
+export { RoleSelect } from "./headless/RoleSelect.js";
+export { InviteAcceptFlow } from "./headless/InviteAcceptFlow.js";
 // ── i18n ─────────────────────────────────────────────────────────────────────
 export { WORKSPACES_I18N_KEYS, workspacesI18nBundleEn, registerWorkspacesI18n, } from "./i18n/keys.js";
 // ── errors map (code → status/params/remediation/en; generated) ──────────────

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAI7D,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAOvE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOtE,gFAAgF;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,gFAAgF;AAChF,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAqB9B,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,gFAAgF;AAChF,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAI7D,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAOvE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAMrE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOtE,gFAAgF;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,gFAAgF;AAChF,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,cAAc,EACd,sBAAsB,EACtB,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAG5B,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAmC9B,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,gFAAgF;AAChF,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC"}

package/dist/model/capabilities.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Client-side capability matcher (org-program §A1/§A2) — a PORT of
+ * stapel-workspaces' `capabilities.capability_matches` (which is itself
+ * mirrored by the consumer helper in `stapel_core.django.workspaces`).
+ * KEEP SEMANTICS IN SYNC with the backend: capability strings are namespaced
+ * `"<domain>.<action>"`, free-form for the client (`meetings.spotlight`,
+ * `records.view`, …); a granted string may be the exact capability, the
+ * global wildcard `"*"`, or a prefix wildcard like `"members.*"` (which
+ * matches `members.remove` AND deeper `members.role.change`).
+ *
+ * The client-side check is a UI convenience (hide/disable affordances) —
+ * NEVER an access decision: the backend re-checks every capability on every
+ * operation (`has_capability` in-service, `workspaces.check_capability`
+ * cross-service).
+ */
+/** Match one granted capability string against the requested one. */
+export declare function capabilityMatches(capability: string, granted: string): boolean;
+/** True if any of `granted` (verbatim registry strings, wildcards included)
+ * matches `capability`. Empty/absent grants deny — deny-by-default. */
+export declare function hasCapability(granted: readonly string[] | null | undefined, capability: string): boolean;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/model/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/model/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qEAAqE;AACrE,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAMT;AAED;uEACuE;AACvE,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EAC7C,UAAU,EAAE,MAAM,GACjB,OAAO,CAGT"}

package/dist/model/capabilities.js

@@ -0,0 +1,32 @@
+/**
+ * Client-side capability matcher (org-program §A1/§A2) — a PORT of
+ * stapel-workspaces' `capabilities.capability_matches` (which is itself
+ * mirrored by the consumer helper in `stapel_core.django.workspaces`).
+ * KEEP SEMANTICS IN SYNC with the backend: capability strings are namespaced
+ * `"<domain>.<action>"`, free-form for the client (`meetings.spotlight`,
+ * `records.view`, …); a granted string may be the exact capability, the
+ * global wildcard `"*"`, or a prefix wildcard like `"members.*"` (which
+ * matches `members.remove` AND deeper `members.role.change`).
+ *
+ * The client-side check is a UI convenience (hide/disable affordances) —
+ * NEVER an access decision: the backend re-checks every capability on every
+ * operation (`has_capability` in-service, `workspaces.check_capability`
+ * cross-service).
+ */
+/** Match one granted capability string against the requested one. */
+export function capabilityMatches(capability, granted) {
+    if (granted === "*" || granted === capability)
+        return true;
+    if (granted.endsWith(".*")) {
+        return capability.startsWith(granted.slice(0, -1));
+    }
+    return false;
+}
+/** True if any of `granted` (verbatim registry strings, wildcards included)
+ * matches `capability`. Empty/absent grants deny — deny-by-default. */
+export function hasCapability(granted, capability) {
+    if (!granted)
+        return false;
+    return granted.some((g) => capabilityMatches(capability, g));
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/model/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/model/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,OAAe;IAEf,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,aAAa,CAC3B,OAA6C,EAC7C,UAAkB;IAElB,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/model/emailMask.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Email masking — a PORT of stapel-workspaces' `views._mask_email` (the
+ * function that produces `InvitationPreviewResponse.email_masked`). KEEP IN
+ * SYNC with the backend: first character of the local part and of the domain
+ * name survive, the TLD stays readable — `m***@e***.com`.
+ *
+ * Why the client re-implements it: the public invitation preview deliberately
+ * carries only the MASKED email (harvest-proof, org-program §B2), yet the
+ * §B4 flow must route "session & email match" vs "wrong account" BEFORE
+ * attempting the accept. Masking the signed-in account's own (fully known)
+ * email with the same algorithm and comparing the two masks is the exact
+ * decision the backend would make — without ever exposing the invitee's
+ * address. A mask collision (two addresses masking identically) merely shows
+ * the accept prompt; the backend's real email-match on accept remains the
+ * enforcement point.
+ */
+/** Mask an email exactly like the backend's invitation preview does. */
+export declare function maskEmail(email: string): string;
+/** Whether `email`, masked by the backend's algorithm, equals `emailMasked`
+ * (case-insensitive on the email, as the backend matches `iexact`). */
+export declare function emailMatchesMask(email: string, emailMasked: string): boolean;
+//# sourceMappingURL=emailMask.d.ts.map

package/dist/model/emailMask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailMask.d.ts","sourceRoot":"","sources":["../../src/model/emailMask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAY/C;AAED;uEACuE;AACvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAE5E"}

package/dist/model/emailMask.js

@@ -0,0 +1,36 @@
+/**
+ * Email masking — a PORT of stapel-workspaces' `views._mask_email` (the
+ * function that produces `InvitationPreviewResponse.email_masked`). KEEP IN
+ * SYNC with the backend: first character of the local part and of the domain
+ * name survive, the TLD stays readable — `m***@e***.com`.
+ *
+ * Why the client re-implements it: the public invitation preview deliberately
+ * carries only the MASKED email (harvest-proof, org-program §B2), yet the
+ * §B4 flow must route "session & email match" vs "wrong account" BEFORE
+ * attempting the accept. Masking the signed-in account's own (fully known)
+ * email with the same algorithm and comparing the two masks is the exact
+ * decision the backend would make — without ever exposing the invitee's
+ * address. A mask collision (two addresses masking identically) merely shows
+ * the accept prompt; the backend's real email-match on accept remains the
+ * enforcement point.
+ */
+/** Mask an email exactly like the backend's invitation preview does. */
+export function maskEmail(email) {
+    const at = email.indexOf("@");
+    const local = at === -1 ? email : email.slice(0, at);
+    const domain = at === -1 ? "" : email.slice(at + 1);
+    const dot = domain.lastIndexOf(".");
+    const maskedLocal = `${local.slice(0, 1) || "*"}***`;
+    if (dot !== -1) {
+        const domainName = domain.slice(0, dot);
+        const tld = domain.slice(dot + 1);
+        return `${maskedLocal}@${domainName.slice(0, 1) || "*"}***.${tld}`;
+    }
+    return `${maskedLocal}@${domain.slice(0, 1) || "*"}***`;
+}
+/** Whether `email`, masked by the backend's algorithm, equals `emailMasked`
+ * (case-insensitive on the email, as the backend matches `iexact`). */
+export function emailMatchesMask(email, emailMasked) {
+    return maskEmail(email.trim().toLowerCase()) === emailMasked.toLowerCase();
+}
+//# sourceMappingURL=emailMask.js.map

package/dist/model/emailMask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailMask.js","sourceRoot":"","sources":["../../src/model/emailMask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAClC,OAAO,GAAG,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,OAAO,GAAG,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;AAC1D,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,WAAmB;IACjE,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;AAC7E,CAAC"}

package/dist/model/mutations.d.ts

@@ -1,6 +1,6 @@
 import type { UseMutationResult } from "@tanstack/react-query";
 import type { StapelApiError } from "@stapel/core";
-import type { Member, MemberInvite, MemberInviteResult, InvitationAccept, Workspace, WorkspaceCreate, WorkspaceRole, WorkspaceUpdate } from "../api/types.js";
+import type { Invitation, Member, MemberInvite, MemberInviteResult, MemberPasswordReset, MemberPasswordResetResult, InvitationAccept, InvitationClaim, Workspace, WorkspaceCreate, WorkspaceSecuritySettings, WorkspaceUpdate } from "../api/types.js";
 /**
  * Write hooks (frontend-standard §2 — "мутации с инвалидацией"). Each mutation
  * invalidates exactly the server state it can move. Membership and ownership are
@@ -29,10 +29,14 @@ export declare function useDeleteWorkspace(): UseMutationResult<void, StapelApiE
  * there).
  */
 export declare function useInviteMembers(workspaceId: string): UseMutationResult<MemberInviteResult, StapelApiError, MemberInvite>;
-/** The variable for {@link useUpdateMemberRole}: which member, which new role. */
+/** The variable for {@link useUpdateMemberRole}: which member, which new role.
+ * `role` is an open string since stapel-workspaces 0.6.0 (org-program §A1):
+ * the effective registry is settings-extensible, so any key of GET /roles is
+ * valid — the backend validates against the registry. {@link WorkspaceRole}
+ * still names the builtin four for literals. */
 export interface MemberRoleChange {
     readonly userId: string;
-    readonly role: WorkspaceRole;
+    readonly role: string;
 }
 /**
  * Change a member's role (admin+; the backend guards owner grants and the
@@ -45,6 +49,90 @@ export declare function useUpdateMemberRole(workspaceId: string): UseMutationRes
  * variable is the member's `userId`. Refreshes the member list.
  */
 export declare function useRemoveMember(workspaceId: string): UseMutationResult<void, StapelApiError, string>;
+/**
+ * Withdraw a live invitation (POST /{id}/invitations/{invitationId}/revoke,
+ * #109). The variable is the invitation id; the reply is the UPDATED row, so
+ * it is written straight into the page cache the table reads — a revoke is
+ * the mirror of the invitee's decline and both must stay distinguishable in
+ * `status`, which a blind refetch-and-hope would blur. Only a `pending`
+ * invitation is revocable: the backend answers
+ * `error.400.invitation_already_used` / `_revoked` / `_expired` otherwise
+ * (each its own key, not a shrug). Also refreshes the member list — the seat
+ * the invitation reserved is freed on commit.
+ */
+export declare function useRevokeInvitation(workspaceId: string): UseMutationResult<Invitation, StapelApiError, string>;
+/**
+ * Send the invitation email again (POST /{id}/invitations/{invitationId}/resend,
+ * #109). The variable is the invitation id.
+ *
+ * This is NOT an idempotent "poke": the backend rotates the token and
+ * restarts the TTL, so every earlier link — including the one already in the
+ * invitee's inbox — stops working, and the row's `expires_at` moves. Hence
+ * the invalidation: a table still showing the old expiry would be lying about
+ * a live credential. An EXPIRED invitation is accepted on purpose (a dead TTL
+ * is the commonest reason to resend); reviving it re-reserves a seat, so a
+ * plan ceiling can answer 402 here.
+ */
+export declare function useResendInvitation(workspaceId: string): UseMutationResult<Invitation, StapelApiError, string>;
+/** The variable for {@link useResetMemberPassword}: whose password, and the
+ * (optional) body — omit `password` to have the server generate one. */
+export interface MemberPasswordResetVars {
+    readonly userId: string;
+    readonly body?: MemberPasswordReset;
+}
+/**
+ * Reset a member's password on the organization's order
+ * (POST /{id}/members/{userId}/password/reset, #110).
+ *
+ * **Step-up before the button.** Capability `members.password.reset` is
+ * declared `high`, so the backend wraps the endpoint in
+ * `requires_verification(scope="sensitive")`. Ask
+ * {@link "./queries.js".useCapabilityGate}(workspaceId,
+ * "members.password.reset") BEFORE offering the affordance: it answers both
+ * "may this caller" and "will a step-up be demanded". A step-up CHALLENGE is
+ * then driven by core's client and replayed transparently; the one case that
+ * is not transparent is the ENROLLMENT demand (the caller holds no factor to
+ * challenge) — read it off `error` with
+ * {@link "./stepUp.js".readVerificationEnrollment} and route to enrollment.
+ *
+ * **The one-shot credential.** `generated_password` comes back exactly once,
+ * only when the request omitted `password`, and can never be re-fetched. It
+ * is therefore deliberately kept OUT of the query cache: nothing here writes
+ * the response with `setQueryData`, and `gcTime: 0` drops the mutation result
+ * the moment the screen showing it unmounts. Writing it to a query would
+ * mean writing a live credential into every devtools panel AND into
+ * `localStorage`, because core's query runtime persists the whole per-user
+ * query cache (`createStapelQueryClient`). Hand it to the member out of band.
+ *
+ * Refreshes the member list (the reset moves the member's first-login state);
+ * a target that is not a resettable member of THIS workspace answers one
+ * byte-identical 404, never an existence oracle.
+ */
+export declare function useResetMemberPassword(workspaceId: string): UseMutationResult<MemberPasswordResetResult, StapelApiError, MemberPasswordResetVars>;
+/**
+ * Update a workspace's SECURITY settings (the `security` block of
+ * `PATCH /{id}`, org-program §C3) — `require_mfa` and the first-login
+ * `provisioned_user_policies`.
+ *
+ * Separate from {@link useUpdateWorkspace} because the backend treats this
+ * block as a different endpoint in all but the URL: an extra capability
+ * (`workspace.security.manage`, declared `high`) plus a step-up on the same
+ * `sensitive` scope as the password reset, and turning `require_mfa` on
+ * sweeps the current members. See {@link useResetMemberPassword} for how to
+ * wire that in front of the control.
+ *
+ * `provisioned_user_policies` is a LIST since stapel-workspaces 0.13.0 (#90)
+ * — independent checkboxes, not alternatives. An explicit `[]` is a
+ * deliberate, auditable choice ("demand nothing"), so it is sent as such and
+ * never dropped as "empty means unset".
+ *
+ * MERGES, because the backend does not: `PATCH` assigns `settings` wholesale
+ * (`ws.settings = data.settings`), so sending a bare `{security: …}` would
+ * silently drop every other key the workspace holds. The merge reads the
+ * workspace fresh rather than trusting the detail cache — a stale snapshot
+ * here would resurrect settings somebody else has since removed.
+ */
+export declare function useUpdateSecuritySettings(workspaceId: string): UseMutationResult<Workspace, StapelApiError, WorkspaceSecuritySettings>;
 /**
  * Accept an invitation by its token — the caller joins the workspace. A dead
  * token surfaces a localizable `StapelApiError` (`error.400.invitation_expired`
@@ -52,4 +140,20 @@ export declare function useRemoveMember(workspaceId: string): UseMutationResult<
  * Refreshes the workspace list (the new membership appears there).
  */
 export declare function useAcceptInvitation(): UseMutationResult<Member, StapelApiError, InvitationAccept>;
+/**
+ * Mint a login grant for a NOT-yet-registered invitee (POST
+ * /invitations/{token}/claim, AllowAny — org-program §B2/§B3). The variable
+ * is the invite token; the result carries the single-use `grant_token` to
+ * exchange at AUTH's `POST /grant/exchange/` (the auth-react api — this pair
+ * deliberately does not call it; see `InviteAcceptFlow`'s `onLoginGrant`
+ * seam). 409 `email_already_registered` → switch to login. The invitation is
+ * NOT consumed here. The grant token is a credential: never log it.
+ */
+export declare function useClaimInvitation(): UseMutationResult<InvitationClaim, StapelApiError, string>;
+/**
+ * Decline an invitation (POST /invitations/{token}/decline, authenticated +
+ * email-match — org-program §B2). The variable is the invite token. Decline ≠
+ * revoke — the preview's `status` becomes `declined`.
+ */
+export declare function useDeclineInvitation(): UseMutationResult<void, StapelApiError, string>;
 //# sourceMappingURL=mutations.d.ts.map

package/dist/model/mutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mutations.d.ts","sourceRoot":"","sources":["../../src/model/mutations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EAChB,MAAM,iBAAiB,CAAC;AAIzB;;;;;;;;;;;GAWG;AAEH,wEAAwE;AACxE,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,SAAS,EACT,cAAc,EACd,eAAe,CAChB,CAaA;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,eAAe,CAAC,CAiB/D;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,IAAI,EACJ,cAAc,EACd,MAAM,CACP,CAeA;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,EAAE,YAAY,CAAC,CAgBrE;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,MAAM,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAa7D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAYjD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,iBAAiB,CACtD,MAAM,EACN,cAAc,EACd,gBAAgB,CACjB,CAYA"}
+{"version":3,"file":"mutations.d.ts","sourceRoot":"","sources":["../../src/model/mutations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EACV,UAAU,EACV,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,eAAe,EACf,yBAAyB,EACzB,eAAe,EAChB,MAAM,iBAAiB,CAAC;AAIzB;;;;;;;;;;;GAWG;AAEH,wEAAwE;AACxE,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,SAAS,EACT,cAAc,EACd,eAAe,CAChB,CAaA;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,eAAe,CAAC,CAiB/D;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,IAAI,EACJ,cAAc,EACd,MAAM,CACP,CAeA;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,EAAE,YAAY,CAAC,CAgBrE;AAED;;;;gDAIgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,MAAM,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAa7D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAYjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAgBvD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAavD;AAED;wEACwE;AACxE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAClB,yBAAyB,EACzB,cAAc,EACd,uBAAuB,CACxB,CAoBA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAsCzE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,iBAAiB,CACtD,MAAM,EACN,cAAc,EACd,gBAAgB,CACjB,CAgBA;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,eAAe,EACf,cAAc,EACd,MAAM,CACP,CAMA;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,CACvD,IAAI,EACJ,cAAc,EACd,MAAM,CACP,CAYA"}