@stapel/workspaces-react 0.7.0 → 0.9.0

package/dist/model/queryKeys.js

@@ -1,5 +1,5 @@
 /**
- * Namespaced TanStack Query keys (frontend-standard §2 — "ключи неймспейснуты").
+ * Namespaced TanStack Query keys (frontend-standard §2 — namespaced keys).
  * Everything under the `"workspaces"` root so a host can invalidate the whole
  * module or match a single resource. Persist scope is per-user via core's query
  * runtime (`setPersistUser`). Explicit tuple return types satisfy
@@ -14,7 +14,27 @@ export const workspacesQueryKeys = {
     // invalidating `members(workspaceId)` (mutations.ts) drops every page.
     members: (workspaceId) => [ROOT, "members", workspaceId],
     membersPage: (workspaceId, params) => [ROOT, "members", workspaceId, params],
+    // Same prefix trick as `members`: the bare 3-tuple invalidates every page
+    // (and the infinite list, which keys on it) after a revoke / resend.
+    invitations: (workspaceId) => [ROOT, "invitations", workspaceId],
+    invitationsPage: (workspaceId, params) => [
+        ROOT,
+        "invitations",
+        workspaceId,
+        params,
+    ],
+    // The infinite list carries its own marker segment: its cached value is an
+    // `InfiniteData` envelope, not a page, so it must never collide with a
+    // single-page key that happens to hold the same filters.
+    invitationsInfinite: (workspaceId, filters) => [
+        ROOT,
+        "invitations",
+        workspaceId,
+        "infinite",
+        filters,
+    ],
     roles: () => [ROOT, "roles"],
+    instance: () => [ROOT, "instance"],
     // NOTE: the key carries the invite TOKEN (a secret). Core's query persist
     // scope is per-user and the preview response is already public-by-design
     // (masked email only) — but hosts logging query keys should treat this one

package/dist/model/queryKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"queryKeys.js","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,YAAqB,CAAC;AAEnC,MAAM,CAAC,MAAM,mBAAmB,GAa5B;IACF,GAAG,EAAE,CAAC,IAAI,CAAC;IACX,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;IACtD,kEAAkE;IAClE,uEAAuE;IACvE,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC;IACxD,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;IAC5E,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC;IAC5B,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,gBAAgB;IAChB,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,KAAK,CAAC;CAClE,CAAC"}
+{"version":3,"file":"queryKeys.js","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,YAAqB,CAAC;AAEnC,MAAM,CAAC,MAAM,mBAAmB,GA6B5B;IACF,GAAG,EAAE,CAAC,IAAI,CAAC;IACX,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;IACtD,kEAAkE;IAClE,uEAAuE;IACvE,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC;IACxD,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;IAC5E,0EAA0E;IAC1E,qEAAqE;IACrE,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC;IAChE,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI;QACJ,aAAa;QACb,WAAW;QACX,MAAM;KACP;IACD,2EAA2E;IAC3E,uEAAuE;IACvE,yDAAyD;IACzD,mBAAmB,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI;QACJ,aAAa;QACb,WAAW;QACX,UAAU;QACV,OAAO;KACR;IACD,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC;IAC5B,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;IAClC,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,gBAAgB;IAChB,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,KAAK,CAAC;CAClE,CAAC"}

package/dist/model/stepUp.d.ts

@@ -0,0 +1,25 @@
+/** The verification scope every `high` workspace capability is gated under. */
+export declare const SENSITIVE_SCOPE = "sensitive";
+/** Step-up level of a capability. */
+export type CapabilityLevel = "standard" | "high";
+/** PORT of `BUILTIN_CAPABILITY_LEVELS` — everything unlisted is `standard`. */
+export declare const BUILTIN_CAPABILITY_LEVELS: Readonly<Record<string, "high">>;
+/** The declared step-up level of one capability string. */
+export declare function capabilityLevel(capability: string): CapabilityLevel;
+/**
+ * The 403 ENROLLMENT envelope: the caller must first enroll one of `factors`
+ * — there is no challenge to complete, so core cannot drive it.
+ */
+export interface VerificationEnrollment {
+    /** What the demand protects — `"sensitive"` for every `high` capability. */
+    readonly scope: string;
+    /** Interchangeable factors, any ONE of which unblocks the operation. */
+    readonly factors: readonly string[];
+}
+/**
+ * Read the enrollment demand out of a rejected request, or `null` when the
+ * error is anything else (including a step-up CHALLENGE, which carries a
+ * `challenge_id` and is core's business, not the consumer's).
+ */
+export declare function readVerificationEnrollment(error: unknown): VerificationEnrollment | null;
+//# sourceMappingURL=stepUp.d.ts.map

package/dist/model/stepUp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stepUp.d.ts","sourceRoot":"","sources":["../../src/model/stepUp.ts"],"names":[],"mappings":"AAiCA,+EAA+E;AAC/E,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,qCAAqC;AACrC,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,CAAC;AAElD,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAItE,CAAC;AAEF,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAEnE;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAQD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,IAAI,CAoB/B"}

package/dist/model/stepUp.js

@@ -0,0 +1,79 @@
+/**
+ * Step-up ahead of the button, not behind it (org-program §A3).
+ *
+ * Some workspace operations are declared **high**: the backend gates them
+ * with `stapel_core`'s `@requires_verification(scope="sensitive")` on top of
+ * the capability check, so an ambient cookie is never enough. A client that
+ * only learns this from the 403 shows the admin a button, a spinner and a
+ * refusal; this module lets it know BEFORE the click.
+ *
+ * Two things travel from the backend, and they are not the same thing:
+ *
+ * 1. **A step-up CHALLENGE** — `verification.challenge_id` is present. This
+ *    one nobody has to handle here: `@stapel/core`'s client intercepts it,
+ *    hands it to the app's verification controller (auth-react's factor
+ *    machines) and replays the original request with
+ *    `X-Verification-Token`. It is a detour, not a failure.
+ * 2. **An ENROLLMENT demand** — `verification.enroll === true` and there is
+ *    NO challenge id, because the user holds no factor that could be
+ *    challenged. Core deliberately does not intercept this one (there is
+ *    nothing to drive), so it surfaces as a plain 403 and the app must send
+ *    the user to factor enrollment first. {@link readVerificationEnrollment}
+ *    is how a hook says "this is that, and these are the factors".
+ *
+ * KEEP IN SYNC with stapel-workspaces `capabilities.BUILTIN_CAPABILITY_LEVELS`
+ * — a PORT for the same reason `capabilityMatches` is one: `GET /roles`
+ * publishes each role's capabilities but not their levels, so the level map
+ * cannot be read off the wire. A deployment may raise further capabilities via
+ * `STAPEL_WORKSPACES["CAPABILITY_LEVELS"]`; those are additive, so treating an
+ * unlisted capability as `standard` can only ever under-promise (the backend
+ * still challenges, and core still drives it).
+ */
+import { isStapelApiError } from "@stapel/core";
+/** The verification scope every `high` workspace capability is gated under. */
+export const SENSITIVE_SCOPE = "sensitive";
+/** PORT of `BUILTIN_CAPABILITY_LEVELS` — everything unlisted is `standard`. */
+export const BUILTIN_CAPABILITY_LEVELS = {
+    "members.provision": "high",
+    "members.password.reset": "high",
+    "workspace.security.manage": "high",
+};
+/** The declared step-up level of one capability string. */
+export function capabilityLevel(capability) {
+    return BUILTIN_CAPABILITY_LEVELS[capability] ?? "standard";
+}
+function asRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : null;
+}
+/**
+ * Read the enrollment demand out of a rejected request, or `null` when the
+ * error is anything else (including a step-up CHALLENGE, which carries a
+ * `challenge_id` and is core's business, not the consumer's).
+ */
+export function readVerificationEnrollment(error) {
+    // Both dialects, narrowed through the imported predicate (never through a
+    // shape this call site invented): the typed error carries the parsed body,
+    // a rethrown raw envelope IS the body.
+    const body = asRecord(isStapelApiError(error) ? error.body : error);
+    if (body === null)
+        return null;
+    const verification = asRecord(body["verification"]);
+    if (verification === null)
+        return null;
+    if (verification["enroll"] !== true)
+        return null;
+    if (typeof verification["challenge_id"] === "string")
+        return null;
+    const factors = verification["factors"];
+    return {
+        scope: typeof verification["scope"] === "string"
+            ? verification["scope"]
+            : SENSITIVE_SCOPE,
+        factors: Array.isArray(factors)
+            ? factors.filter((f) => typeof f === "string")
+            : [],
+    };
+}
+//# sourceMappingURL=stepUp.js.map

package/dist/model/stepUp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stepUp.js","sourceRoot":"","sources":["../../src/model/stepUp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAK3C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,yBAAyB,GAAqC;IACzE,mBAAmB,EAAE,MAAM;IAC3B,wBAAwB,EAAE,MAAM;IAChC,2BAA2B,EAAE,MAAM;CACpC,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,yBAAyB,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;AAC7D,CAAC;AAaD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACpD,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,OAAO,YAAY,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,KAAK,EACH,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,QAAQ;YACvC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;YACvB,CAAC,CAAC,eAAe;QACrB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC3D,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC"}

package/llms.txt

@@ -1,6 +1,6 @@
-# @stapel/workspaces-react 0.7.0
+# @stapel/workspaces-react 0.9.0
 
-Headless React flow pair for stapel-workspaces (contract >=0.8 <0.9) — business + state, zero visual opinion.
+Headless React flow pair for stapel-workspaces (contract >=0.18 <0.19) — business + state, zero visual opinion.
 Built on @stapel/core: typed client + StapelApiError envelope, auth token refresh,
 verification-403 interception, i18n engine, analytics facade, TanStack Query layer.
 
@@ -26,16 +26,21 @@ Request/response schema names are in manifest.json + the generated types.
 Paths are relative to `/workspaces/api/v1/`.
 - workspaces_api_v1_create: POST /
 - workspaces_api_v1_destroy: DELETE /{workspace_id}
+- workspaces_api_v1_instance_retrieve: GET /instance
 - workspaces_api_v1_internal_members_retrieve: GET /internal/{workspace_id}/members/{user_id}
 - workspaces_api_v1_internal_users_personal_create: POST /internal/users/{user_id}/personal
 - workspaces_api_v1_invitations_accept_create: POST /invitations/accept
 - workspaces_api_v1_invitations_claim_create: POST /invitations/{token}/claim
 - workspaces_api_v1_invitations_decline_create: POST /invitations/{token}/decline
+- workspaces_api_v1_invitations_list: GET /{workspace_id}/invitations
+- workspaces_api_v1_invitations_resend_create: POST /{workspace_id}/invitations/{invitation_id}/resend
 - workspaces_api_v1_invitations_retrieve: GET /invitations/{token}
+- workspaces_api_v1_invitations_revoke_create: POST /{workspace_id}/invitations/{invitation_id}/revoke
 - workspaces_api_v1_members_destroy: DELETE /{workspace_id}/members/{user_id}
 - workspaces_api_v1_members_invite_create: POST /{workspace_id}/members/invite
 - workspaces_api_v1_members_list: GET /{workspace_id}/members
 - workspaces_api_v1_members_partial_update: PATCH /{workspace_id}/members/{user_id}
+- workspaces_api_v1_members_password_reset_create: POST /{workspace_id}/members/{user_id}/password/reset
 - workspaces_api_v1_members_provision_create: POST /{workspace_id}/members/provision
 - workspaces_api_v1_partial_update: PATCH /{workspace_id}
 - workspaces_api_v1_retrieve: GET /
@@ -48,18 +53,24 @@ Paths are relative to `/workspaces/api/v1/`.
 - useCreateWorkspace (mutation) → createWorkspace
 - useDeclineInvitation (mutation) → declineInvitation
 - useDeleteWorkspace (mutation) → deleteWorkspace
+- useInstanceShape (query) → getInstanceShape
 - useInvitationPreview (query) → getInvitationPreview
+- useInvitations (query) → listInvitations
 - useInviteMembers (mutation) → inviteMembers
 - useMembers (query) → listMembers
 - useRemoveMember (mutation) → removeMember
+- useResendInvitation (mutation) → resendInvitation
+- useResetMemberPassword (mutation) → resetMemberPassword
+- useRevokeInvitation (mutation) → revokeInvitation
 - useRoles (query) → listRoles
 - useUpdateMemberRole (mutation) → updateMemberRole
+- useUpdateSecuritySettings (mutation) → getWorkspace+updateWorkspace
 - useUpdateWorkspace (mutation) → updateWorkspace
 - useWorkspace (query) → getWorkspace
 - useWorkspaces (query) → listWorkspaces
 
 ## Errors (render t(code, params); UX from remediation)
-60 keys (full catalog: manifest.json §errors). By remediation: fix_input 28 · retry 12 · contact_support 7 · wait_and_retry 6 · verify 5 · reauthenticate 2.
+61 keys (full catalog: manifest.json §errors). By remediation: fix_input 29 · retry 12 · contact_support 7 · wait_and_retry 6 · verify 5 · reauthenticate 2.
 Param-bearing keys (interpolation slots matter):
 - error.400.field.blank [400] → fix_input {field}
 - error.400.field.does_not_exist [400] → fix_input {field}
@@ -75,6 +86,7 @@ Param-bearing keys (interpolation slots matter):
 - error.402.member_limit_reached [402] → fix_input {limit}
 - error.403.membership_suspended [403] → fix_input {reason}
 - error.403.missing_capability [403] → contact_support {capability}
+- error.403.role_exceeds_inviter_rank [403] → fix_input {role}
 - error.429.rate_limit [429] → wait_and_retry {retry_after_minutes}
 
 ## Analytics events (typed; defineEvent → events.json, drift-gated)

package/manifest.json

@@ -1,10 +1,10 @@
 {
   "$generated": "by scripts/gen-manifest.mjs — do not edit; drift-gated (pnpm gen:manifest:check)",
   "package": "@stapel/workspaces-react",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "backend": {
     "module": "stapel-workspaces",
-    "contract": ">=0.8 <0.9"
+    "contract": ">=0.18 <0.19"
   },
   "layers": [
     "api",
@@ -32,6 +32,13 @@
       "request": null,
       "response": null
     },
+    "workspaces_api_v1_instance_retrieve": {
+      "method": "GET",
+      "path": "/workspaces/api/v1/instance",
+      "tag": "Workspaces",
+      "request": null,
+      "response": "InstanceShapeResponse"
+    },
     "workspaces_api_v1_internal_members_retrieve": {
       "method": "GET",
       "path": "/workspaces/api/v1/internal/{workspace_id}/members/{user_id}",
@@ -67,6 +74,20 @@
       "request": null,
       "response": null
     },
+    "workspaces_api_v1_invitations_list": {
+      "method": "GET",
+      "path": "/workspaces/api/v1/{workspace_id}/invitations",
+      "tag": "Members",
+      "request": null,
+      "response": "PaginatedInvitationResponseList"
+    },
+    "workspaces_api_v1_invitations_resend_create": {
+      "method": "POST",
+      "path": "/workspaces/api/v1/{workspace_id}/invitations/{invitation_id}/resend",
+      "tag": "Members",
+      "request": null,
+      "response": "InvitationResponse"
+    },
     "workspaces_api_v1_invitations_retrieve": {
       "method": "GET",
       "path": "/workspaces/api/v1/invitations/{token}",
@@ -74,6 +95,13 @@
       "request": null,
       "response": "InvitationPreviewResponse"
     },
+    "workspaces_api_v1_invitations_revoke_create": {
+      "method": "POST",
+      "path": "/workspaces/api/v1/{workspace_id}/invitations/{invitation_id}/revoke",
+      "tag": "Members",
+      "request": null,
+      "response": "InvitationResponse"
+    },
     "workspaces_api_v1_members_destroy": {
       "method": "DELETE",
       "path": "/workspaces/api/v1/{workspace_id}/members/{user_id}",
@@ -102,6 +130,13 @@
       "request": "PatchedMemberUpdateRequest",
       "response": "MemberResponse"
     },
+    "workspaces_api_v1_members_password_reset_create": {
+      "method": "POST",
+      "path": "/workspaces/api/v1/{workspace_id}/members/{user_id}/password/reset",
+      "tag": "Members",
+      "request": "MemberPasswordResetRequest",
+      "response": "MemberPasswordResetResponse"
+    },
     "workspaces_api_v1_members_provision_create": {
       "method": "POST",
       "path": "/workspaces/api/v1/{workspace_id}/members/provision",
@@ -194,6 +229,14 @@
         ]
       ]
     },
+    "useInstanceShape": {
+      "kind": "query",
+      "operation": "getInstanceShape",
+      "queryKey": [
+        "workspaces",
+        "instance"
+      ]
+    },
     "useInvitationPreview": {
       "kind": "query",
       "operation": "getInvitationPreview",
@@ -203,6 +246,16 @@
         "{token}"
       ]
     },
+    "useInvitations": {
+      "kind": "query",
+      "operation": "listInvitations",
+      "queryKey": [
+        "workspaces",
+        "invitations",
+        "{workspaceId}",
+        "{params}"
+      ]
+    },
     "useInviteMembers": {
       "kind": "mutation",
       "operation": "inviteMembers",
@@ -235,6 +288,44 @@
         ]
       ]
     },
+    "useResendInvitation": {
+      "kind": "mutation",
+      "operation": "resendInvitation",
+      "invalidates": [
+        [
+          "workspaces",
+          "invitations",
+          "{workspaceId}"
+        ]
+      ]
+    },
+    "useResetMemberPassword": {
+      "kind": "mutation",
+      "operation": "resetMemberPassword",
+      "invalidates": [
+        [
+          "workspaces",
+          "members",
+          "{workspaceId}"
+        ]
+      ]
+    },
+    "useRevokeInvitation": {
+      "kind": "mutation",
+      "operation": "revokeInvitation",
+      "invalidates": [
+        [
+          "workspaces",
+          "invitations",
+          "{workspaceId}"
+        ],
+        [
+          "workspaces",
+          "members",
+          "{workspaceId}"
+        ]
+      ]
+    },
     "useRoles": {
       "kind": "query",
       "operation": "listRoles",
@@ -254,6 +345,29 @@
         ]
       ]
     },
+    "useUpdateSecuritySettings": {
+      "kind": "mutation",
+      "operations": [
+        "getWorkspace",
+        "updateWorkspace"
+      ],
+      "invalidates": [
+        [
+          "workspaces",
+          "detail",
+          "{workspaceId}"
+        ],
+        [
+          "workspaces",
+          "list"
+        ],
+        [
+          "workspaces",
+          "members",
+          "{workspaceId}"
+        ]
+      ]
+    },
     "useUpdateWorkspace": {
       "kind": "mutation",
       "operation": "updateWorkspace",
@@ -505,6 +619,13 @@
       "params": [],
       "remediation": "contact_support"
     },
+    "error.403.role_exceeds_inviter_rank": {
+      "status": 403,
+      "params": [
+        "role"
+      ],
+      "remediation": "fix_input"
+    },
     "error.403.verification_enrollment_required": {
       "status": 403,
       "params": [],
@@ -764,6 +885,7 @@
     "error.403.membership_suspended",
     "error.403.missing_capability",
     "error.403.network_blocked",
+    "error.403.role_exceeds_inviter_rank",
     "error.403.verification_enrollment_required",
     "error.403.verification_required",
     "error.404.ad_not_found",
@@ -853,10 +975,12 @@
   "exports": {
     "runtime": [
       "AcceptInvitation",
+      "BUILTIN_CAPABILITY_LEVELS",
       "Can",
       "InviteAcceptFlow",
       "Members",
       "RoleSelect",
+      "SENSITIVE_SCOPE",
       "WORKSPACES_ERRORS",
       "WORKSPACES_ERROR_CODES",
       "WORKSPACES_FLOWS",
@@ -864,6 +988,7 @@
       "WorkspaceList",
       "WorkspacesProvider",
       "WorkspacesRuntimeContext",
+      "capabilityLevel",
       "capabilityMatches",
       "createFlowMachine",
       "createInviteAcceptFlow",
@@ -875,21 +1000,30 @@
       "hasCapability",
       "isErrorCode",
       "maskEmail",
+      "readVerificationEnrollment",
       "registerWorkspacesI18n",
       "toFlowError",
       "useAcceptInvitation",
       "useCapabilities",
+      "useCapabilityGate",
       "useClaimInvitation",
       "useCreateWorkspace",
       "useDeclineInvitation",
       "useDeleteWorkspace",
       "useFlow",
+      "useInfiniteInvitations",
+      "useInstanceShape",
       "useInvitationPreview",
+      "useInvitations",
       "useInviteMembers",
       "useMembers",
       "useRemoveMember",
+      "useResendInvitation",
+      "useResetMemberPassword",
+      "useRevokeInvitation",
       "useRoles",
       "useUpdateMemberRole",
+      "useUpdateSecuritySettings",
       "useUpdateWorkspace",
       "useWorkspace",
       "useWorkspaces",
@@ -904,6 +1038,8 @@
       "AcceptInvitationBag",
       "CanBag",
       "CapabilitiesResult",
+      "CapabilityGate",
+      "CapabilityLevel",
       "CreateWorkspacesRuntimeOptions",
       "FlowEndpoint",
       "FlowError",
@@ -913,7 +1049,10 @@
       "Invitation",
       "InvitationAccept",
       "InvitationClaim",
+      "InvitationListData",
       "InvitationPreview",
+      "InvitationStatusFilter",
+      "InvitationsParams",
       "InviteAcceptFlowBag",
       "InviteAcceptFlowController",
       "InviteAcceptFlowDeps",
@@ -922,21 +1061,27 @@
       "MemberInvite",
       "MemberInviteResult",
       "MemberListData",
+      "MemberPasswordReset",
+      "MemberPasswordResetResult",
+      "MemberPasswordResetVars",
       "MemberRoleChange",
       "MemberRoleUpdate",
       "MembersBag",
       "MembersParams",
+      "ProvisionedUserPolicy",
       "Remediation",
       "RoleInfo",
       "RoleList",
       "RoleSelectBag",
       "Schemas",
+      "VerificationEnrollment",
       "WorkspaceCreate",
       "WorkspaceData",
       "WorkspaceKind",
       "WorkspaceListBag",
       "WorkspaceListData",
       "WorkspaceRole",
+      "WorkspaceSecuritySettings",
       "WorkspaceUpdate",
       "WorkspacesApi",
       "WorkspacesErrorCode",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stapel/workspaces-react",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Headless React flow pair for stapel-workspaces: typed API client, TanStack Query hooks, flow machines, headless components, and i18n keys. Zero visual opinion.",
   "license": "MIT",
   "repository": {
@@ -82,9 +82,9 @@
     "size-limit": "^11.2.0",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4",
-    "@stapel/core": "^0.8.0",
-    "@stapel/tokens": "^0.5.0",
-    "@stapel/showcase": "^0.2.0"
+    "@stapel/core": "^0.10.0",
+    "@stapel/showcase": "^0.2.0",
+    "@stapel/tokens": "^0.5.0"
   },
   "engines": {
     "node": ">=22"

package/src/analytics/generated/events.json

@@ -1,7 +1,7 @@
 {
   "$generated": "by scripts/gen-events.mjs — do not edit; drift-gated (pnpm gen:events:check)",
   "package": "@stapel/workspaces-react",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "defined": [],
   "flows": []
 }