@stapel/workspaces-react 0.8.0 → 0.10.0

package/src/api/generated/schema.ts

@@ -126,6 +126,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/api/v1/{workspace_id}/invitations/{invitation_id}/name": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * @description ``PATCH <ws>/invitations/<id>/name`` — fix a pending invite's name hint.
+         *
+         *     The same correction as :class:`MemberNameView`, one step earlier: the
+         *     invitee has not accepted, so there is no profile of theirs to write and
+         *     the name lives on the invitation as ``display_name_hint`` — the invite
+         *     modal's "Name" field, which ``accept_invitation`` copies onto the
+         *     membership at acceptance. Editing it after the fact is why this endpoint
+         *     exists: before #109's invitation surface the only fix for a typo in an
+         *     invitee's name was to revoke and re-invite, which re-mails the person.
+         *
+         *     Only a **pending** invitation is editable, with the same keyed refusals
+         *     revoke gives for each terminal state (``invitation_revoked`` /
+         *     ``already_used`` / ``declined`` / ``expired``): an accepted invitation's
+         *     name is the member's name now — use the member endpoint — and a dead
+         *     invitation is not a thing to relabel. Unknown and cross-workspace ids
+         *     collapse into one identical 404 (inherited resolution).
+         *
+         *     The value is still held to stapel-profiles' name canon even though the
+         *     column being written is local: this hint becomes a displayed name, and
+         *     the two endpoints must not disagree about what a name may contain.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        patch: operations["workspaces_api_v1_invitations_name_partial_update"];
+        trace?: never;
+    };
     "/workspaces/api/v1/{workspace_id}/invitations/{invitation_id}/resend": {
         parameters: {
             query?: never;
@@ -261,6 +301,50 @@ export interface paths {
         patch: operations["workspaces_api_v1_members_partial_update"];
         trace?: never;
     };
+    "/workspaces/api/v1/{workspace_id}/members/{user_id}/name": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * @description ``PATCH <ws>/members/<user_id>/name`` — correct a member's display name.
+         *
+         *     Writes the CANONICAL name: stapel-profiles' ``Profile.display_name``,
+         *     reached through this module's existing in-process profiles seam
+         *     (``services.set_profile_display_name``), which also publishes
+         *     ``profile.changed`` so every consumer of that name follows.
+         *
+         *     NOT ``WorkspaceMember.display_name_hint``: the hint is a pre-profile
+         *     placeholder, copied once at creation and dark from the moment a real
+         *     profile exists (see its docstring in ``models.py``). Writing it would
+         *     produce a correction the roster shows and nothing else in the product
+         *     ever does — including, eventually, the roster.
+         *
+         *     Where stapel-profiles does not run in this process there is nothing to
+         *     write and no remote operation to call for it (that module publishes no
+         *     write-somebody-else's-name endpoint and no comm Function), so the answer
+         *     is an honest ``error.503.profiles_unavailable`` — never a 200 over a
+         *     write that did not happen.
+         *
+         *     Only an owner may rename an owner — the same hardcoded owner protection
+         *     that role changes, removals and password resets carry. Renaming is not
+         *     escalation, but an admin relabelling the owner of the organization on
+         *     every screen in the product is close enough to the same act to answer
+         *     the same way.
+         *
+         *     **Permissions:** `IsAuthenticated`
+         */
+        patch: operations["workspaces_api_v1_members_name_partial_update"];
+        trace?: never;
+    };
     "/workspaces/api/v1/{workspace_id}/members/{user_id}/password/reset": {
         parameters: {
             query?: never;
@@ -403,6 +487,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/workspaces/api/v1/instance": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * @description Instance shape: how a street signup lands (personal | none) and whether self-serve registration is open. Public, unauthenticated — the screen a kicked/left member sees depends on it.
+         *
+         *     **Permissions:** `AllowAny`
+         */
+        get: operations["workspaces_api_v1_instance_retrieve"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/workspaces/api/v1/internal/{workspace_id}/members/{user_id}": {
         parameters: {
             query?: never;
@@ -585,6 +690,46 @@ export interface paths {
 export type webhooks = Record<string, never>;
 export interface components {
     schemas: {
+        /** @description What the name is after the write — the stored value, not the request. */
+        DisplayNameResponse: {
+            /**
+             * @description The stored name, trimmed and canon-checked. Empty string when the name was cleared
+             * @example Ada Lovelace
+             */
+            display_name: string;
+        };
+        /**
+         * @description How THIS instance is deployed — what the client needs to know before
+         *     deciding what to show a person with no workspace.
+         *
+         *     The ``landing`` axis (``STREET_LANDING_MODE``) has existed since
+         *     2026-08-03 but lived only in backend config, with nothing exposing it —
+         *     a client had no way to tell a closed deployment from a public cloud one.
+         *
+         *     This matters because the screen shown to someone who is no longer (or
+         *     never was) a workspace member differs by deployment:
+         *
+         *     * ``none`` — closed deployment: the person has no workspace and none is
+         *     obtainable. An honest screen says "you're not a member, ask for an
+         *     invite" and offers no path forward;
+         *     * ``personal`` — public cloud: they have their own workspace, and the
+         *     client can route them there.
+         *
+         *     Offering "create a workspace" to someone the instance will never let
+         *     create one is a dead end drawn as a button.
+         */
+        InstanceShapeResponse: {
+            /**
+             * @description What a "street" (no-invite) arrival lands on
+             * @example personal
+             */
+            landing: string;
+            /**
+             * @description Whether self-registration is available
+             * @example True
+             */
+            registration_open: boolean;
+        };
         /** @description Get-or-create result for a user's personal workspace (service-to-service). */
         InternalPersonalWorkspaceResponse: {
             /**
@@ -692,9 +837,19 @@ export interface components {
              * @example 0192a...
              */
             invited_by_id?: string | null;
+            /**
+             * @description Name hint typed for this invitee at invite time, if any; null otherwise
+             * @example Ada Lovelace
+             */
+            display_name?: string | null;
         };
         /** @description Invite payload. */
         MemberInviteRequest: {
+            /**
+             * @description Name hint for the invitee (this invite's "Name" field), applied to every email in this request. Optional — an invite without one behaves exactly as before. NOT written into stapel-profiles directly (that store is the invitee's own): held on the invitation, copied onto the member at accept time, and shown only until stapel-profiles has a real name for the person
+             * @example Ada Lovelace
+             */
+            display_name?: string | null;
             /**
              * @description One or more emails to invite
              * @example [
@@ -793,6 +948,11 @@ export interface components {
             suspended_at?: string | null;
             /** @description Why the membership is suspended (canonical value no_mfa); null while active */
             suspension_reason?: string | null;
+            /**
+             * @description Best-effort display name — a live lookup in stapel-profiles when it is installed and has one, else the name typed at invite/provision time (never both, never invented when neither exists). Null when nobody has one yet
+             * @example Ada Lovelace
+             */
+            display_name?: string | null;
         };
         PaginatedInvitationResponseList: {
             items: components["schemas"]["InvitationResponse"][];
@@ -820,6 +980,14 @@ export interface components {
             /** @description Number of items in current page */
             count: number;
         };
+        /** @description Roster-side name correction (one field, both name-edit endpoints). */
+        PatchedDisplayNameUpdateRequest: {
+            /**
+             * @description The name to show for this person. Held to stapel-profiles' display-name canon (validate_display_name) — this module never adds a second, differently-strict rule. Blank, whitespace-only, null and a missing key all mean the same thing: clear the name
+             * @example Ada Lovelace
+             */
+            display_name?: string | null;
+        };
         /** @description MemberUpdateRequest(role: str) */
         PatchedMemberUpdateRequest: {
             role?: string;
@@ -874,9 +1042,19 @@ export interface components {
             /** @description Server-generated initial password — returned exactly ONCE, only when the request omitted password. Store it or hand it to the user now; it cannot be re-fetched. A credential: never log it */
             generated_password?: string | null;
         };
-        /** @description RoleListResponse(roles: List[stapel_workspaces.dto.RoleResponse] = <factory>) */
+        /** @description The effective role registry (builtin four + STAPEL_WORKSPACES overlay). */
         RoleListResponse: {
+            /** @description One entry per effective role, descending rank */
             roles?: components["schemas"]["RoleResponse"][];
+            /**
+             * @description Step-up level per namespaced capability string, builtin ``members.provision`` / ``members.password.reset`` / ``workspace.security.manage`` plus the deployment's ``STAPEL_WORKSPACES["CAPABILITY_LEVELS"]`` overlay. A capability absent from this map is ``"standard"`` — the client-side default. Lets a frontend stop hardcoding its own copy of this registry
+             * @example {
+             *       "members.provision": "high"
+             *     }
+             */
+            capability_levels?: {
+                [key: string]: string;
+            };
         };
         /** @description One role of the effective registry (builtin + STAPEL_WORKSPACES overlay). */
         RoleResponse: {
@@ -943,9 +1121,17 @@ export interface components {
              */
             type?: string;
         };
-        /** @description WorkspaceListResponse(workspaces: List[stapel_workspaces.dto.WorkspaceResponse] = <factory>) */
+        /** @description The caller's own workspace list. */
         WorkspaceListResponse: {
+            /** @description The caller's active memberships (empty for a guest — see is_guest) */
             workspaces?: components["schemas"]["WorkspaceResponse"][];
+            /** @description True when the caller holds NO active mandate anywhere (permissions.is_guest) — the wire form of the mandate-model vardict's guest predicate (2026-08-03), so a frontend can render the "incomplete dashboard" without re-deriving it from workspaces == [] */
+            is_guest?: boolean;
+            /**
+             * @description Which workspace a client should open when the person has expressed no choice — the instance's STAPEL_WORKSPACES["DEFAULT_WORKSPACE_ID"], echoed back ONLY when the caller actually holds an active membership in it, else "". Exists because clients that had to guess guessed badly: meettoday took `workspaces[0]` off a list ordered by last access, so a person in two spaces landed wherever they happened to have been last (measured 2026-08-06 as "the owner cannot see his own invitations" — they were in the OTHER space). A default, not a cage: an explicit choice still wins
+             * @example a8bba7ae-5d2e-43e5-9911-0553e7df50b3
+             */
+            default_workspace_id?: string;
         };
         /** @description Workspace details. */
         WorkspaceResponse: {
@@ -1163,6 +1349,34 @@ export interface operations {
             };
         };
     };
+    workspaces_api_v1_invitations_name_partial_update: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                invitation_id: string;
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["PatchedDisplayNameUpdateRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["PatchedDisplayNameUpdateRequest"];
+                "multipart/form-data": components["schemas"]["PatchedDisplayNameUpdateRequest"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DisplayNameResponse"];
+                };
+            };
+        };
+    };
     workspaces_api_v1_invitations_resend_create: {
         parameters: {
             query?: never;
@@ -1286,6 +1500,34 @@ export interface operations {
             };
         };
     };
+    workspaces_api_v1_members_name_partial_update: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                user_id: string;
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["PatchedDisplayNameUpdateRequest"];
+                "application/x-www-form-urlencoded": components["schemas"]["PatchedDisplayNameUpdateRequest"];
+                "multipart/form-data": components["schemas"]["PatchedDisplayNameUpdateRequest"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["DisplayNameResponse"];
+                };
+            };
+        };
+    };
     workspaces_api_v1_members_password_reset_create: {
         parameters: {
             query?: never;
@@ -1368,6 +1610,25 @@ export interface operations {
             };
         };
     };
+    workspaces_api_v1_instance_retrieve: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InstanceShapeResponse"];
+                };
+            };
+        };
+    };
     workspaces_api_v1_internal_members_retrieve: {
         parameters: {
             query?: never;

package/src/api/types.ts

@@ -53,6 +53,20 @@ export type MemberPasswordReset = Schemas["MemberPasswordResetRequest"];
  * — see {@link "../model/mutations.js".useResetMemberPassword}, which keeps it
  * out of the query cache. */
 export type MemberPasswordResetResult = Schemas["MemberPasswordResetResponse"];
+/**
+ * PATCH /{id}/members/{userId}/name and PATCH
+ * /{id}/invitations/{invitationId}/name request body — the ONE field both
+ * name-edit endpoints take (stapel-workspaces ≥0.19.0). Blank,
+ * whitespace-only, `null` and a missing key all mean the same thing to the
+ * backend: clear the name. The value is held to stapel-profiles'
+ * `validate_display_name` canon (35-char ceiling as the serializer's
+ * `max_length`) — this module declares no second, differently-strict rule.
+ */
+export type DisplayNameUpdate = Schemas["PatchedDisplayNameUpdateRequest"];
+/** PATCH …/name 200 body — what the name IS after the write (the stored,
+ * trimmed, canon-checked value; empty string when the name was cleared), not
+ * an echo of the request. */
+export type DisplayNameResult = Schemas["DisplayNameResponse"];
 /** POST /invitations/accept request body — the token from the email link. */
 export type InvitationAccept = Schemas["InvitationAcceptRequest"];
 /** GET /invitations/{token} 200 body — the public (AllowAny) preview the
@@ -68,6 +82,14 @@ export type RoleInfo = Schemas["RoleResponse"];
 /** GET /roles 200 body — the effective role registry, rank-descending. */
 export type RoleList = Schemas["RoleListResponse"];
 
+/**
+ * Deployment shape: what a person landing "off the street" gets, and
+ * whether self-serve signup is open. A property of the INSTANCE, not of a
+ * workspace — and not a setting the customer can toggle: it's fixed at
+ * deployment time.
+ */
+export type InstanceShape = Schemas["InstanceShapeResponse"];
+
 // ── documented corrections (drf-spectacular under-describes) ──────────────────
 
 /**

package/src/api/workspacesApi.ts

@@ -1,5 +1,7 @@
 import type { StapelClient, StapelRequestOptions } from "@stapel/core";
 import type {
+  DisplayNameResult,
+  DisplayNameUpdate,
   Invitation,
   InvitationPage,
   InvitationsParams,
@@ -14,6 +16,7 @@ import type {
   InvitationAccept,
   InvitationClaim,
   InvitationPreview,
+  InstanceShape,
   RoleList,
   Workspace,
   WorkspaceCreate,
@@ -92,6 +95,24 @@ export interface WorkspacesApi {
   /** Remove a member from a workspace (admin+; the last owner is protected). */
   removeMember(workspaceId: string, userId: string): Promise<void>;
 
+  /**
+   * Correct a member's display name (stapel-workspaces ≥0.19.0, capability
+   * `members.role.change`). Writes the CANONICAL name — stapel-profiles'
+   * `Profile.display_name` through this module's in-process profiles seam,
+   * which also publishes `profile.changed` — NOT the membership's
+   * `display_name_hint`, which is a pre-profile placeholder that goes dark the
+   * moment a real profile exists.
+   *
+   * Only an owner may rename an owner. Where stapel-profiles does not run in
+   * the deployment's process the answer is `error.503.profiles_unavailable`,
+   * never a 200 over a write that did not happen.
+   */
+  renameMember(
+    workspaceId: string,
+    userId: string,
+    body: DisplayNameUpdate
+  ): Promise<DisplayNameResult>;
+
   /**
    * Reset a member's password on the organization's order (stapel-workspaces
    * ≥0.14.0, #110). Capability `members.password.reset`, declared **high** —
@@ -140,6 +161,25 @@ export interface WorkspacesApi {
     workspaceId: string,
     invitationId: string
   ): Promise<Invitation>;
+  /**
+   * Fix a still-PENDING invitation's name hint (stapel-workspaces ≥0.19.0,
+   * capability `members.role.change` — the same one as {@link renameMember},
+   * because this hint IS the member's name after acceptance and splitting the
+   * two would let a role fix a name that reverts).
+   *
+   * The same correction as {@link renameMember}, one step earlier: the invitee
+   * has not accepted, so there is no profile of theirs to write and the name
+   * lives on the invitation. Before it, the only fix for a typo in an
+   * invitee's name was revoke-and-re-invite, which re-mails the person. A
+   * terminal invitation refuses with the keyed answers revoke gives
+   * (`error.400.invitation_already_used` / `_revoked` / `_declined` /
+   * `_expired`).
+   */
+  renameInvitation(
+    workspaceId: string,
+    invitationId: string,
+    body: DisplayNameUpdate
+  ): Promise<DisplayNameResult>;
 
   /** Accept an invitation by its token — returns the caller's new membership. */
   acceptInvitation(body: InvitationAccept): Promise<Member>;
@@ -171,6 +211,9 @@ export interface WorkspacesApi {
   /** The effective role registry (builtin + deployment overlay), for
    * RoleSelect-class UI — capability strings verbatim, rank-descending. */
   listRoles(): Promise<RoleList>;
+
+  /** Instance shape (GET /instance, unauthenticated). */
+  getInstanceShape(): Promise<InstanceShape>;
 }
 
 export function createWorkspacesApi(client: StapelClient): WorkspacesApi {
@@ -226,6 +269,20 @@ export function createWorkspacesApi(client: StapelClient): WorkspacesApi {
         mutating()
       ),
 
+    renameMember: (workspaceId, userId, body) =>
+      client.patch(
+        `/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(userId)}/name`,
+        body satisfies DisplayNameUpdate,
+        mutating()
+      ),
+
+    renameInvitation: (workspaceId, invitationId, body) =>
+      client.patch(
+        `/${encodeURIComponent(workspaceId)}/invitations/${encodeURIComponent(invitationId)}/name`,
+        body satisfies DisplayNameUpdate,
+        mutating()
+      ),
+
     resetMemberPassword: (workspaceId, userId, body) =>
       client.post(
         `/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(userId)}/password/reset`,
@@ -284,5 +341,7 @@ export function createWorkspacesApi(client: StapelClient): WorkspacesApi {
       ),
 
     listRoles: () => client.get("/roles"),
+
+    getInstanceShape: () => client.get("/instance"),
   };
 }

package/src/default/MembersManager.tsx

@@ -1,7 +1,7 @@
 /**
  * `<MembersManager/>` — default skin for the "members & roles" settings
- * screen (owner directive: "настройки воркспейса (имя/участники/роли/
- * инвайты)"). Built entirely on this pair's EXISTING `Members` headless
+ * screen (owner directive: workspace settings — name/members/roles/
+ * invites). Built entirely on this pair's EXISTING `Members` headless
  * wrapper (`useMembers`/`useInviteMembers`/`useUpdateMemberRole`/
  * `useRemoveMember`) — no new backend surface.
  *

package/src/i18n/generated/errors.gen.ts

@@ -39,6 +39,10 @@ export const WORKSPACES_ERRORS = {
   "error.400.bad_request": { status: 400, params: [], remediation: "fix_input", en: "Bad request" },
   "error.400.captcha_invalid": { status: 400, params: [], remediation: "retry", en: "Captcha verification failed. Please try again." },
   "error.400.captcha_required": { status: 400, params: [], remediation: "retry", en: "Captcha token is required." },
+  "error.400.display_name_emoji": { status: 400, params: [], remediation: "fix_input", en: "Display name cannot contain emoji" },
+  "error.400.display_name_forbidden_chars": { status: 400, params: [], remediation: "fix_input", en: "Display name contains forbidden characters" },
+  "error.400.display_name_invisible_chars": { status: 400, params: [], remediation: "fix_input", en: "Display name contains invisible characters" },
+  "error.400.display_name_too_short": { status: 400, params: [], remediation: "fix_input", en: "Display name must be at least 2 characters" },
   "error.400.expected_list": { status: 400, params: [], remediation: "fix_input", en: "Expected a list of items" },
   "error.400.field.blank": { status: 400, params: ["field"], remediation: "fix_input", en: "{field} may not be blank" },
   "error.400.field.does_not_exist": { status: 400, params: ["field"], remediation: "fix_input", en: "{field} does not exist" },
@@ -72,6 +76,7 @@ export const WORKSPACES_ERRORS = {
   "error.403.membership_suspended": { status: 403, params: ["reason"], remediation: "fix_input", en: "Your membership in this workspace is suspended ({reason})" },
   "error.403.missing_capability": { status: 403, params: ["capability"], remediation: "contact_support", en: "Your role does not include the {capability} capability in this workspace" },
   "error.403.network_blocked": { status: 403, params: [], remediation: "contact_support", en: "Requests from this network are not allowed" },
+  "error.403.role_exceeds_inviter_rank": { status: 403, params: ["role"], remediation: "fix_input", en: "You cannot grant a role that outranks your own ({role})" },
   "error.403.verification_enrollment_required": { status: 403, params: [], remediation: "verify", en: "Verification factor enrollment required" },
   "error.403.verification_required": { status: 403, params: [], remediation: "verify", en: "Additional verification required" },
   "error.404.ad_not_found": { status: 404, params: [], remediation: "retry", en: "Listing not found" },
@@ -95,6 +100,7 @@ export const WORKSPACES_ERRORS = {
   "error.429.too_many_requests": { status: 429, params: [], remediation: "wait_and_retry", en: "Too many requests. Please try again later." },
   "error.500.internal": { status: 500, params: [], remediation: "contact_support", en: "Something went wrong" },
   "error.503.auth_unavailable": { status: 503, params: [], remediation: "wait_and_retry", en: "The authentication service is unavailable; try again later" },
+  "error.503.profiles_unavailable": { status: 503, params: [], remediation: "wait_and_retry", en: "The profiles service is unavailable; try again later" },
 } as const;
 
 export type WorkspacesErrorCode = keyof typeof WORKSPACES_ERRORS;
@@ -105,6 +111,10 @@ export const WORKSPACES_ERROR_CODES: readonly WorkspacesErrorCode[] = [
   "error.400.bad_request",
   "error.400.captcha_invalid",
   "error.400.captcha_required",
+  "error.400.display_name_emoji",
+  "error.400.display_name_forbidden_chars",
+  "error.400.display_name_invisible_chars",
+  "error.400.display_name_too_short",
   "error.400.expected_list",
   "error.400.field.blank",
   "error.400.field.does_not_exist",
@@ -138,6 +148,7 @@ export const WORKSPACES_ERROR_CODES: readonly WorkspacesErrorCode[] = [
   "error.403.membership_suspended",
   "error.403.missing_capability",
   "error.403.network_blocked",
+  "error.403.role_exceeds_inviter_rank",
   "error.403.verification_enrollment_required",
   "error.403.verification_required",
   "error.404.ad_not_found",
@@ -161,6 +172,7 @@ export const WORKSPACES_ERROR_CODES: readonly WorkspacesErrorCode[] = [
   "error.429.too_many_requests",
   "error.500.internal",
   "error.503.auth_unavailable",
+  "error.503.profiles_unavailable",
 ];
 
 /**
@@ -173,6 +185,10 @@ export const workspacesErrorBundleEn: Record<WorkspacesErrorCode, string> = {
   "error.400.bad_request": "Bad request",
   "error.400.captcha_invalid": "Captcha verification failed. Please try again.",
   "error.400.captcha_required": "Captcha token is required.",
+  "error.400.display_name_emoji": "Display name cannot contain emoji",
+  "error.400.display_name_forbidden_chars": "Display name contains forbidden characters",
+  "error.400.display_name_invisible_chars": "Display name contains invisible characters",
+  "error.400.display_name_too_short": "Display name must be at least 2 characters",
   "error.400.expected_list": "Expected a list of items",
   "error.400.field.blank": "{field} may not be blank",
   "error.400.field.does_not_exist": "{field} does not exist",
@@ -206,6 +222,7 @@ export const workspacesErrorBundleEn: Record<WorkspacesErrorCode, string> = {
   "error.403.membership_suspended": "Your membership in this workspace is suspended ({reason})",
   "error.403.missing_capability": "Your role does not include the {capability} capability in this workspace",
   "error.403.network_blocked": "Requests from this network are not allowed",
+  "error.403.role_exceeds_inviter_rank": "You cannot grant a role that outranks your own ({role})",
   "error.403.verification_enrollment_required": "Verification factor enrollment required",
   "error.403.verification_required": "Additional verification required",
   "error.404.ad_not_found": "Listing not found",
@@ -229,4 +246,5 @@ export const workspacesErrorBundleEn: Record<WorkspacesErrorCode, string> = {
   "error.429.too_many_requests": "Too many requests. Please try again later.",
   "error.500.internal": "Something went wrong",
   "error.503.auth_unavailable": "The authentication service is unavailable; try again later",
+  "error.503.profiles_unavailable": "The profiles service is unavailable; try again later",
 };

package/src/i18n/generated/errors.json

@@ -27,6 +27,34 @@
     "remediation": "retry",
     "en": "Captcha token is required."
   },
+  {
+    "code": "error.400.display_name_emoji",
+    "status": 400,
+    "params": [],
+    "remediation": "fix_input",
+    "en": "Display name cannot contain emoji"
+  },
+  {
+    "code": "error.400.display_name_forbidden_chars",
+    "status": 400,
+    "params": [],
+    "remediation": "fix_input",
+    "en": "Display name contains forbidden characters"
+  },
+  {
+    "code": "error.400.display_name_invisible_chars",
+    "status": 400,
+    "params": [],
+    "remediation": "fix_input",
+    "en": "Display name contains invisible characters"
+  },
+  {
+    "code": "error.400.display_name_too_short",
+    "status": 400,
+    "params": [],
+    "remediation": "fix_input",
+    "en": "Display name must be at least 2 characters"
+  },
   {
     "code": "error.400.expected_list",
     "status": 400,
@@ -290,6 +318,15 @@
     "remediation": "contact_support",
     "en": "Requests from this network are not allowed"
   },
+  {
+    "code": "error.403.role_exceeds_inviter_rank",
+    "status": 403,
+    "params": [
+      "role"
+    ],
+    "remediation": "fix_input",
+    "en": "You cannot grant a role that outranks your own ({role})"
+  },
   {
     "code": "error.403.verification_enrollment_required",
     "status": 403,
@@ -452,5 +489,12 @@
     "params": [],
     "remediation": "wait_and_retry",
     "en": "The authentication service is unavailable; try again later"
+  },
+  {
+    "code": "error.503.profiles_unavailable",
+    "status": 503,
+    "params": [],
+    "remediation": "wait_and_retry",
+    "en": "The profiles service is unavailable; try again later"
   }
 ]

package/src/i18n/generated/errors.ru.gen.ts

@@ -16,6 +16,10 @@ export const workspacesErrorBundleRu: Record<WorkspacesErrorCode, string> = {
   "error.400.bad_request": "Некорректный запрос",
   "error.400.captcha_invalid": "Проверка капчи не пройдена. Пожалуйста, попробуйте ещё раз.",
   "error.400.captcha_required": "Требуется токен капчи.",
+  "error.400.display_name_emoji": "Отображаемое имя не может содержать эмодзи",
+  "error.400.display_name_forbidden_chars": "Отображаемое имя содержит запрещённые символы",
+  "error.400.display_name_invisible_chars": "Отображаемое имя содержит невидимые символы",
+  "error.400.display_name_too_short": "Отображаемое имя должно содержать не менее 2 символов",
   "error.400.expected_list": "Ожидался список элементов",
   "error.400.field.blank": "Поле «{field}» не может быть пустым",
   "error.400.field.does_not_exist": "«{field}» не существует",
@@ -49,6 +53,7 @@ export const workspacesErrorBundleRu: Record<WorkspacesErrorCode, string> = {
   "error.403.membership_suspended": "Ваше членство в этом рабочем пространстве приостановлено ({reason})",
   "error.403.missing_capability": "Ваша роль не включает право {capability} в этом рабочем пространстве",
   "error.403.network_blocked": "Запросы из этой сети не разрешены.",
+  "error.403.role_exceeds_inviter_rank": "Вы не можете выдать роль, которая превышает вашу собственную ({role})",
   "error.403.verification_enrollment_required": "Требуется регистрация фактора подтверждения.",
   "error.403.verification_required": "Требуется дополнительная проверка",
   "error.404.ad_not_found": "Объявление не найдено",
@@ -72,4 +77,5 @@ export const workspacesErrorBundleRu: Record<WorkspacesErrorCode, string> = {
   "error.429.too_many_requests": "Слишком много запросов. Пожалуйста, повторите попытку позже.",
   "error.500.internal": "Что-то пошло не так",
   "error.503.auth_unavailable": "Сервис аутентификации недоступен; повторите попытку позже",
+  "error.503.profiles_unavailable": "Сервис профилей недоступен; повторите попытку позже",
 };